@atlasauth/angular 0.8.0 → 0.10.0

package/dist/fesm2022/atlasauth-angular.mjs

@@ -1,10 +1,10 @@
 import * as i0 from '@angular/core';
-import { InjectionToken, inject, PLATFORM_ID, computed, Injectable, TemplateRef, ViewContainerRef, Directive, Input, ElementRef, Renderer2, EventEmitter, Output, ChangeDetectionStrategy, Component, signal, makeEnvironmentProviders, ENVIRONMENT_INITIALIZER, NgModule } from '@angular/core';
+import { InjectionToken, signal, inject, PLATFORM_ID, computed, Injectable, TemplateRef, ViewContainerRef, Directive, Input, ElementRef, Renderer2, EventEmitter, Output, ChangeDetectionStrategy, Component, ChangeDetectorRef, effect, untracked, DestroyRef, makeEnvironmentProviders, ENVIRONMENT_INITIALIZER, NgModule } from '@angular/core';
 import { isPlatformBrowser, DOCUMENT } from '@angular/common';
 import { toSignal } from '@angular/core/rxjs-interop';
 import { BehaviorSubject, Subject, combineLatest, firstValueFrom } from 'rxjs';
 import { map, distinctUntilChanged, filter, take } from 'rxjs/operators';
-import { TokenCache, SignOutNotifier, resolveFrontendApi, withDevBrowser, catalogLocale, configureReferralCapture, FapiClient, SignOutGuard, localizedErrorMessage, getTemplateToken, getProviderToken, signOutReasonFromClient, readRedirectResult, completeOAuthPopupLanding, mapOAuthPopupPayload, stripRedirectParams, closeOAuthPopupAfterSignIn, SDK_HEADER, sdkHeaderValue, reportSdkAdvisory, readExpiry, msUntilRefresh, nextStep, createCaptchaController, atlasCaptchaLabels, flowFromPending, initialFlow, fetchInstanceSettings, offeredFirstFactors, prepareFactor, signInCaptchaOptions, flowNeedsCaptcha, planFirstFactor, advanceWithCaptcha, createSignUp, shouldKeepPolling, pollAttempt, signUp } from '@atlasauth/js';
+import { createOrganizationAuditLog, POLICY_STRINGS, TokenCache, SignOutNotifier, resolveFrontendApi, withDevBrowser, catalogLocale, configureReferralCapture, FapiClient, SignOutGuard, localizedErrorMessage, reauthenticate, getTemplateToken, getProviderToken, signOutReasonFromClient, readRedirectResult, completeOAuthPopupLanding, mapOAuthPopupPayload, stripRedirectParams, closeOAuthPopupAfterSignIn, SDK_HEADER, sdkHeaderValue, reportSdkAdvisory, readExpiry, msUntilRefresh, policyTranslator, injectPolicyStyles, mountPolicyClickwrap, mountPolicyConsent, controllerForPending, mountPolicyAcceptStep, joinTitles, formatPolicyDate, PolicyGateController, groupSetupKey, enrollmentSubmitKey, nextStep, awaitingSignUpLink, canDownloadRecoveryCodes, copyRecoveryCodes, downloadRecoveryCodes, createCaptchaController, atlasCaptchaLabels, PolicyAcceptanceController, flowFromPending, initialFlow, createMfaEnrollment, mfaChoicesFrom, fetchInstanceSettings, fetchLastSignInMethod, offeredFirstFactors, prepareFactor, signInCaptchaOptions, flowNeedsCaptcha, planFirstFactor, advanceWithCaptcha, loadPolicies, createSignUp, prepareSecondFactorCode, resendSignUpVerification, createPasskeySignUp, finishPasskeySignUp, pendingRecoveryCodes, acknowledgeRecoveryCodes, shouldKeepPolling, pollAttempt, lastUsedMethodLabel, signUp, confirmPolicies, passkeysSupported, awaitingPasskey, OrganizationProfileController, describeAuditAction, actorFromClaims } from '@atlasauth/js';
 export { FapiClient, SIGN_OUT_EVENT, SignOutError, advance, flowFromPending, getProviderToken, initialFlow, onAtlasSignOut, pollAttempt, prepareFactor, requestForStep, shouldKeepPolling } from '@atlasauth/js';
 import { evaluate } from '@atlasauth/authz';
 export { evaluate, hasFromClaims } from '@atlasauth/authz';
@@ -19,6 +19,43 @@ import { Router } from '@angular/router';
  */
 const ATLAS_OPTIONS = new InjectionToken('ATLAS_OPTIONS');
 
+/**
+ * The active organization's audit trail, for its admins — the engine behind
+ * `<atlas-organization-audit-log>` and `AtlasService.organizationAuditLog()`
+ * (the Angular peer of React's `useOrganizationAuditLog`). `state` is a signal
+ * of `{ entries, loading, forbidden, hasMore }`, one page at a time, newest
+ * first. It follows the active organization until {@link destroy}.
+ */
+class AtlasOrganizationAuditLog {
+    _state;
+    log;
+    unsubscribe;
+    organizationSub;
+    state;
+    constructor(client, organization$, options = {}) {
+        this.log = createOrganizationAuditLog(client, options);
+        this._state = signal(this.log.getState());
+        this.state = this._state.asReadonly();
+        this.unsubscribe = this.log.subscribe((next) => this._state.set(next));
+        this.organizationSub = organization$
+            .pipe(map((membership) => membership?.organization.id ?? null), distinctUntilChanged())
+            .subscribe((id) => void this.log.load(id));
+    }
+    /** Append the next page, when there is one. */
+    loadMore() {
+        return this.log.loadMore();
+    }
+    /** Re-read from the newest entry. */
+    reload() {
+        return this.log.reload();
+    }
+    /** Stop following the active organization. */
+    destroy() {
+        this.organizationSub.unsubscribe();
+        this.unsubscribe();
+    }
+}
+
 /**
  * §10.3 theming.
  *
@@ -163,6 +200,7 @@ const EN_US = {
     'signIn.submit': 'Continue',
     'signIn.forgotPassword': 'Forgot password?',
     'signIn.noAccount': 'No account?',
+    'signIn.lastUsed': 'Last used',
     'signIn.signUpLink': 'Sign up',
     'signIn.orDivider': 'or',
     'signIn.socialButton': 'Continue with {provider}',
@@ -170,6 +208,8 @@ const EN_US = {
     'signIn.useEmailCode': 'Email me a code',
     'signIn.codeSentTo': 'We sent a code to {email}. Enter it below.',
     'signIn.resendCode': 'Resend code',
+    'signIn.sending': 'Sending…',
+    'signIn.emailCodeOption': 'Email me a code instead',
     'signIn.magicLinkSent': 'Check your email for a sign-in link.',
     'signIn.signedIn': 'You\'re signed in.',
     'signIn.sessionNotKept': 'You signed in, but this browser didn\'t keep the session. If it blocks third-party cookies, allow cookies for this site and try again.',
@@ -189,6 +229,13 @@ const EN_US = {
     'signUp.and': 'and',
     // = EMAIL_UNAVAILABLE_MESSAGE from @atlasauth/js.
     'signUp.emailUnavailable': "This app can't send email right now. Try another sign-in method or contact the app owner.",
+    'signUp.passkeyOption': 'Sign up with a passkey instead',
+    'signUp.passwordOption': 'Sign up with a password instead',
+    'signUp.passkeyIntro': "No password needed: you'll sign in with a passkey saved on this device or in your password manager.",
+    'signUp.passkeyPrompt': 'Create a passkey to finish setting up your account.',
+    'signUp.passkeyCreate': 'Create passkey',
+    'signUp.passkeyCancelled': "The passkey wasn't created. Try again when you're ready.",
+    'signUp.linkSentTo': 'We sent a confirmation link to {email}. Open it on any device; this page continues on its own.',
     'captcha.prompt': 'Complete the security check to continue.',
     'captcha.required': 'Please complete the security check, then try again.',
     'captcha.failed': "The security check didn't pass. Please try again.",
@@ -206,6 +253,24 @@ const EN_US = {
     'mfa.usePasskey': 'Use a passkey instead',
     'mfa.useBackupCode': 'Use a recovery code',
     'mfa.submit': 'Verify',
+    'mfa.enrollChoose': 'Set up a second step for signing in.',
+    'mfa.enrollTotpOption': 'Use an authenticator app',
+    'mfa.enrollSmsOption': 'Use text messages',
+    'mfa.enrollScan': 'Scan this QR code with your authenticator app, or enter the setup key.',
+    'mfa.enrollQrAlt': 'QR code for your authenticator app',
+    'mfa.enrollSetupKey': 'Setup key',
+    'mfa.enrollPreparing': 'Setting up…',
+    'mfa.phoneLabel': 'Mobile number',
+    'mfa.phoneHint': 'Include the country code, for example +14155550101.',
+    'mfa.sendCode': 'Text me a code',
+    'mfa.codeTextedTo': 'Enter the code we texted to {phone}.',
+    'mfa.smsCodeOption': 'Text me a code instead',
+    'mfa.recoveryCodesTitle': 'Save your recovery codes',
+    'mfa.recoveryCodesHelp': "Each code works once. If you can't use your second step, sign in with one of these. Keep them somewhere safe: they won't be shown again.",
+    'mfa.recoveryCodesCopy': 'Copy codes',
+    'mfa.recoveryCodesCopied': 'Copied.',
+    'mfa.recoveryCodesDownload': 'Download as .txt',
+    'mfa.recoveryCodesSaved': "I've saved my codes",
     'reset.title': 'Reset your password',
     'reset.submit': 'Send reset code',
     'reset.newPasswordLabel': 'New password',
@@ -233,6 +298,37 @@ const EN_US = {
     'organization.members': 'Members',
     'organization.invite': 'Invite member',
     'organization.roleLabel': 'Role',
+    'organization.invitations': 'Invitations',
+    'organization.settings': 'Settings',
+    'organization.emailLabel': 'Email address',
+    'organization.sendInvite': 'Send invitation',
+    'organization.noInvitations': 'No pending invitations.',
+    'organization.remove': 'Remove',
+    'organization.revoke': 'Revoke',
+    'organization.resend': 'Resend',
+    'organization.you': '(you)',
+    'organization.leave': 'Leave organization',
+    'organization.leaveConfirm': 'Leave {name}? You will lose access until you are invited again.',
+    'organization.delete': 'Delete organization',
+    'organization.deleteConfirm': 'Delete {name} for every member? This cannot be undone.',
+    'organization.confirm': 'Confirm',
+    'organization.cancel': 'Cancel',
+    'organization.unnamedMember': 'Unnamed member',
+    'organization.passwordPrompt': 'Enter your password to confirm.',
+    'organization.roles': 'Roles',
+    'organization.roleName': 'Role name',
+    'organization.roleKey': 'Role key (for example org:auditor)',
+    'organization.rolePermissions': 'Permissions',
+    'organization.createRole': 'Create role',
+    'organization.saveRole': 'Save role',
+    'organization.editRole': 'Edit',
+    'organization.deleteRole': 'Delete',
+    'organization.noCustomRoles': 'This organization has no roles of its own yet.',
+    'impersonation.banner': 'You are signed in as {name} on someone else\'s behalf.',
+    'impersonation.returnToAdmin': 'Return to admin',
+    'impersonation.end': 'End impersonation',
+    // Policy acceptance (terms, privacy, any policy).
+    ...POLICY_STRINGS,
     'error.generic': 'Something went wrong. Please try again.',
     'error.network': 'We could not reach the server. Check your connection.',
     // Server errors, by the stable `reason` the Frontend API sends. Shown instead
@@ -293,7 +389,7 @@ function withFallback(locale) {
 }
 
 /** This package's version, sent as `X-Atlas-SDK` (kept in step with package.json by a test). */
-const ATLAS_ANGULAR_VERSION = '0.8.0';
+const ATLAS_ANGULAR_VERSION = '0.9.0';
 const ATLAS_ANGULAR_SDK = { name: '@atlasauth/angular', version: ATLAS_ANGULAR_VERSION };
 
 /**
@@ -507,6 +603,23 @@ class AtlasService {
             return null;
         }
     }
+    /**
+     * The active organization's audit trail, for its admins: `state` is a signal
+     * of `{ entries, loading, forbidden, hasMore }`, one page at a time with
+     * `loadMore()`. `action` narrows it (exact, or a prefix ending in `.`). It
+     * follows the active organization; call `destroy()` when done. The peer of
+     * React's `useOrganizationAuditLog`.
+     */
+    organizationAuditLog(options = {}) {
+        return new AtlasOrganizationAuditLog(this.createFapiClient(), this.organization$, options);
+    }
+    /**
+     * Re-authenticate the signed-in user with their password (a step-up), for an
+     * action the server answered with STEP_UP_REQUIRED. Rejects when refused.
+     */
+    reauthenticate(password) {
+        return reauthenticate({ strategy: 'password', password }, { api: this.baseUrl, publishableKey: this.publishableKey, fetchImpl: this.doFetch, locale: this.requestLocale });
+    }
     /** A fresh {@link FapiClient} for driving a sign-in/sign-up flow. */
     createFapiClient() {
         return new FapiClient({
@@ -574,6 +687,25 @@ class AtlasService {
             await this.reload();
         return this.guard.settle(attempt, options);
     }
+    /**
+     * End the active impersonation ("return to admin"): the impersonator's own
+     * session on this browser becomes active again with no sign-in
+     * (`resumed: true`); with none, another account signed in here is adopted,
+     * or this browser is signed out.
+     */
+    async endImpersonation() {
+        const outcome = await this.guard.endImpersonation(this.cache.peek()?.sessionId ?? this._session.value?.id ?? null);
+        if (!outcome.ended)
+            return outcome;
+        if (!outcome.activeSessionId) {
+            this.clearLocalState('user');
+            return outcome;
+        }
+        if (outcome.jwt)
+            this.applyToken(outcome.jwt, outcome.activeSessionId);
+        await this.reload();
+        return outcome;
+    }
     /**
      * Switch the active organization (or `null` for the personal account). The
      * new token carries the new org claims, so the app's permission checks update
@@ -674,7 +806,7 @@ class AtlasService {
     readPendingAttempt() {
         const result = readRedirectResult(window.location.search);
         return result?.status && !result.ticket
-            ? { id: result.attemptId, status: result.status }
+            ? { id: result.attemptId, status: result.status, ...(result.policyToken ? { policyToken: result.policyToken } : {}) }
             : null;
     }
     async call(path, init) {
@@ -1069,6 +1201,254 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
                 args: ['atlasCaptchaSlot']
             }] } });
 
+/** The policy UI's translator (the localization bundle, else the English policy strings) for the current Atlas service. */
+function policyUi(atlas) {
+    return {
+        t: policyTranslator((key, vars) => translate(atlas.localization, key, vars)),
+        classes: {
+            link: 'atlas-link',
+            text: 'atlas-text',
+            primaryButton: classFor('formButtonPrimary', atlas.appearance, 'atlas-button'),
+            error: classFor('formFieldError', atlas.appearance, 'atlas-error'),
+        },
+    };
+}
+/**
+ * `[atlasPolicies]="controller"` — draws the instance's policies (terms, privacy,
+ * …) into the host element: `kind="consent"` (default) is the checkbox block with
+ * its in-page viewer, `kind="clickwrap"` the "By continuing you agree to …" line.
+ * The state is the controller's (`AtlasFlowController.policies`); the DOM comes
+ * from `@atlasauth/js`, shared with every SDK.
+ */
+class AtlasPoliciesDirective {
+    host = inject(ElementRef);
+    atlas = inject(AtlasService);
+    mounted = null;
+    ready = false;
+    controller = null;
+    atlasPolicyKind = 'consent';
+    ngOnInit() {
+        this.ready = true;
+        this.draw();
+    }
+    ngOnChanges(changes) {
+        if (this.ready && (changes['controller'] || changes['atlasPolicyKind']))
+            this.draw();
+    }
+    ngOnDestroy() {
+        this.mounted?.destroy();
+    }
+    draw() {
+        this.mounted?.destroy();
+        this.mounted = null;
+        if (!this.controller)
+            return;
+        const el = this.host.nativeElement;
+        injectPolicyStyles(el.ownerDocument);
+        const ui = policyUi(this.atlas);
+        this.mounted =
+            this.atlasPolicyKind === 'clickwrap'
+                ? mountPolicyClickwrap(el, this.controller, ui)
+                : mountPolicyConsent(el, this.controller, ui);
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AtlasPoliciesDirective, deps: [], target: i0.ɵɵFactoryTarget.Directive });
+    static ɵdir = i0.ɵɵngDeclareDirective({ minVersion: "14.0.0", version: "17.3.12", type: AtlasPoliciesDirective, isStandalone: true, selector: "[atlasPolicies]", inputs: { controller: ["atlasPolicies", "controller"], atlasPolicyKind: "atlasPolicyKind" }, usesOnChanges: true, ngImport: i0 });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AtlasPoliciesDirective, decorators: [{
+            type: Directive,
+            args: [{ selector: '[atlasPolicies]', standalone: true }]
+        }], propDecorators: { controller: [{
+                type: Input,
+                args: ['atlasPolicies']
+            }], atlasPolicyKind: [{
+                type: Input
+            }] } });
+/**
+ * `<atlas-policy-accept-step>` — the sign-in step for a `needs_policy_acceptance`
+ * attempt: scroll-mode policies in their unskippable dialog, the rest as
+ * checkboxes, then "Accept and continue". Emits `submitFlow` with the
+ * `policy_acceptances` JSON for the flow, and `declined` with the policy title
+ * when the user declines (cancel the attempt).
+ */
+class PolicyAcceptStepComponent {
+    host = inject(ElementRef);
+    atlas = inject(AtlasService);
+    step = null;
+    alive = true;
+    attempt = null;
+    busy = false;
+    submitFlow = new EventEmitter();
+    declined = new EventEmitter();
+    loading = signal(true);
+    loadingText = policyUi(this.atlas).t('policy.loading');
+    ngOnInit() {
+        const client = this.atlas.createFapiClient();
+        void controllerForPending(client, this.attempt, { locale: this.atlas.locale ?? undefined }).then((controller) => {
+            if (!this.alive)
+                return;
+            this.loading.set(false);
+            const el = this.host.nativeElement.querySelector('.atlas-policy-step-host');
+            if (!el)
+                return;
+            injectPolicyStyles(el.ownerDocument);
+            this.step = mountPolicyAcceptStep(el, controller, {
+                ...policyUi(this.atlas),
+                onSubmit: (acceptances) => this.submitFlow.emit({ policy_acceptances: JSON.stringify(acceptances) }),
+                onDecline: (policy) => this.declined.emit(policy.title),
+            });
+            this.step.setBusy(this.busy);
+        });
+    }
+    ngOnChanges(changes) {
+        if (changes['busy'])
+            this.step?.setBusy(this.busy);
+    }
+    ngOnDestroy() {
+        this.alive = false;
+        this.step?.destroy();
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: PolicyAcceptStepComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: PolicyAcceptStepComponent, isStandalone: true, selector: "atlas-policy-accept-step", inputs: { attempt: "attempt", busy: "busy" }, outputs: { submitFlow: "submitFlow", declined: "declined" }, usesOnChanges: true, ngImport: i0, template: `@if (loading()) {<p class="atlas-text">{{ loadingText }}</p>}<div class="atlas-policy-step-host"></div>`, isInline: true, changeDetection: i0.ChangeDetectionStrategy.OnPush });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: PolicyAcceptStepComponent, decorators: [{
+            type: Component,
+            args: [{
+                    selector: 'atlas-policy-accept-step',
+                    standalone: true,
+                    changeDetection: ChangeDetectionStrategy.OnPush,
+                    template: `@if (loading()) {<p class="atlas-text">{{ loadingText }}</p>}<div class="atlas-policy-step-host"></div>`,
+                }]
+        }], propDecorators: { attempt: [{
+                type: Input
+            }], busy: [{
+                type: Input
+            }], submitFlow: [{
+                type: Output
+            }], declined: [{
+                type: Output
+            }] } });
+/**
+ * `<atlas-policy-gate>` — in-app re-acceptance. For a signed-in user, a banner
+ * when a policy needs re-acceptance; "Review and accept" opens the unskippable
+ * dialog / checkboxes and posts `/v1/client/me/policies/accept`. Projects its
+ * content always.
+ */
+class PolicyGateComponent {
+    host = inject(ElementRef);
+    atlas = inject(AtlasService);
+    ui = policyUi(this.atlas);
+    gate;
+    off = null;
+    step = null;
+    version = signal(0);
+    accepted = new EventEmitter();
+    reviewing = signal(false);
+    error = signal('');
+    title = this.ui.t('policy.bannerTitle');
+    reviewText = this.ui.t('policy.bannerReview');
+    linkClass = this.ui.classes.link ?? '';
+    errorClass = this.ui.classes.error ?? '';
+    bannerClass = 'atlas-policy-banner';
+    cardClass = classFor('card', this.atlas.appearance, 'atlas-card');
+    bannerText() {
+        this.version();
+        if (!this.gate || this.gate.pending.length === 0 || this.reviewing())
+            return null;
+        const t = this.ui.t;
+        const grace = this.gate.graceEndsAt;
+        return (t('policy.bannerBody', { policies: joinTitles(this.gate.pending.map((p) => p.title), t('policy.and')) }) +
+            (grace ? ` ${t('policy.bannerGrace', { date: formatPolicyDate(grace) })}` : ''));
+    }
+    ngOnInit() {
+        this.gate = new PolicyGateController(this.atlas.createFapiClient(), this.atlas.locale ?? undefined);
+        this.off = this.gate.subscribe(() => this.version.update((n) => n + 1));
+        if (this.atlas.status() === 'signed_in')
+            void this.gate.load();
+    }
+    async begin() {
+        const controller = await this.gate.begin();
+        this.reviewing.set(true);
+        await Promise.resolve();
+        const el = this.host.nativeElement.querySelector('.atlas-policy-gate-host');
+        if (!el)
+            return;
+        injectPolicyStyles(el.ownerDocument);
+        this.step = mountPolicyAcceptStep(el, controller, {
+            ...this.ui,
+            onSubmit: async () => {
+                this.step?.setBusy(true);
+                const res = await this.gate.accept(controller);
+                this.step?.setBusy(false);
+                if (!res.ok) {
+                    this.error.set(res.errors[0]?.message ?? this.ui.t('policy.requiredGeneric'));
+                    return;
+                }
+                this.close();
+                this.accepted.emit();
+            },
+            onDecline: () => this.close(),
+        });
+    }
+    close() {
+        this.step?.destroy();
+        this.step = null;
+        this.reviewing.set(false);
+    }
+    ngOnDestroy() {
+        this.off?.();
+        this.step?.destroy();
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: PolicyGateComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: PolicyGateComponent, isStandalone: true, selector: "atlas-policy-gate", outputs: { accepted: "accepted" }, ngImport: i0, template: `
+    @if (bannerText(); as text) {
+      <div [class]="bannerClass" role="status" data-atlas-policy-banner="">
+        <span
+          ><strong>{{ title }}. </strong>{{ text }}</span
+        >
+        <button type="button" [class]="linkClass" (click)="begin()">{{ reviewText }}</button>
+      </div>
+    }
+    @if (reviewing()) {
+      <div [class]="cardClass" data-atlas-policy-gate="">
+        <div class="atlas-policy-gate-host"></div>
+        @if (error()) {
+          <p [class]="errorClass" role="alert">{{ error() }}</p>
+        }
+      </div>
+    }
+    <ng-content></ng-content>
+  `, isInline: true, changeDetection: i0.ChangeDetectionStrategy.OnPush });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: PolicyGateComponent, decorators: [{
+            type: Component,
+            args: [{
+                    selector: 'atlas-policy-gate',
+                    standalone: true,
+                    changeDetection: ChangeDetectionStrategy.OnPush,
+                    template: `
+    @if (bannerText(); as text) {
+      <div [class]="bannerClass" role="status" data-atlas-policy-banner="">
+        <span
+          ><strong>{{ title }}. </strong>{{ text }}</span
+        >
+        <button type="button" [class]="linkClass" (click)="begin()">{{ reviewText }}</button>
+      </div>
+    }
+    @if (reviewing()) {
+      <div [class]="cardClass" data-atlas-policy-gate="">
+        <div class="atlas-policy-gate-host"></div>
+        @if (error()) {
+          <p [class]="errorClass" role="alert">{{ error() }}</p>
+        }
+      </div>
+    }
+    <ng-content></ng-content>
+  `,
+                }]
+        }], propDecorators: { accepted: [{
+                type: Output
+            }] } });
+
 /**
  * The server-driven flow shell, shared by `<atlas-sign-in>` and
  * `<atlas-sign-up>`. The Angular peer of React's internal `AttemptFlow`.
@@ -1105,6 +1485,40 @@ class AttemptFlowComponent {
     submitFlow = new EventEmitter();
     /** Emits when the user picks a first factor the server must send first (an emailed code). */
     chooseFactor = new EventEmitter();
+    /**
+     * Offer "Email me a code instead" at the second factor (the instance's
+     * `account.emailSecondFactor`); `emailSecondFactor` asks for it and
+     * `emailedSecondFactor` reports how it went.
+     */
+    offerEmailSecondFactor = false;
+    /** `AtlasFlowController.emailSecondFactor()`: in flight, where it went, or why not. */
+    emailedSecondFactor = null;
+    emailSecondFactor = new EventEmitter();
+    /**
+     * Offer "Text me a code instead" at the second factor (where the app offers
+     * texted codes, `AtlasFlowController.mfaChoices().sms`); `smsSecondFactor`
+     * asks for it and `textedSecondFactor` reports how it went.
+     */
+    offerSmsSecondFactor = false;
+    /** `AtlasFlowController.smsSecondFactor()`: in flight, where it went, or why not. */
+    textedSecondFactor = null;
+    smsSecondFactor = new EventEmitter();
+    /**
+     * The MFA enrolment step (`AtlasFlowController.enrollment` and
+     * `enrollmentState()`): the authenticator app's QR code and setup key, or a
+     * texted code. Null: the step asks for two authenticator codes only.
+     */
+    enrollment = null;
+    enrollmentState = null;
+    /**
+     * The instance's `account.emailVerification`. On `link` a sign-up's
+     * verification step has nothing to type: it says to open the emailed link
+     * while the flow polls, and offers a resend (`resend`).
+     */
+    emailVerification = 'code';
+    resend = new EventEmitter();
+    /** The user declined a policy the sign-in was waiting on (`needs_policy_acceptance`): cancel the attempt. */
+    policyDeclined = new EventEmitter();
     values = {};
     t(key, vars) {
         return translate(this.atlas.localization, key, vars);
@@ -1123,8 +1537,45 @@ class AttemptFlowComponent {
     }
     onSubmit(event) {
         event.preventDefault();
+        // Enrolment: text the code to the typed number, or confirm the factor.
+        if (this.enrolling() && this.enrollment) {
+            void this.enrollment.submit(this.values).then((next) => {
+                if (next)
+                    this.submitFlow.emit(next);
+            });
+            return;
+        }
         this.submitFlow.emit(this.values);
     }
+    /** The shared enrolment step is drawn (a controller was passed and the flow is enrolling). */
+    enrolling() {
+        return this.step().kind === 'enroll_second_factor' && !!this.enrollment && !!this.enrollmentState;
+    }
+    chooseMethod(method) {
+        this.values = {};
+        void this.enrollment?.choose(method);
+    }
+    resendEnrollment() {
+        void this.enrollment?.resend();
+    }
+    otherMethods(state) {
+        return state.options.filter((m) => m !== state.method);
+    }
+    setupKey(secret) {
+        return groupSetupKey(secret);
+    }
+    /** The submit button's label key (enrolment: "Text me a code" before the number is sent). */
+    submitKey() {
+        return (this.enrolling() && this.enrollmentState && enrollmentSubmitKey(this.enrollmentState)) || 'signIn.submit';
+    }
+    showSmsSecondFactor() {
+        return this.offerSmsSecondFactor && this.step().kind === 'collect_second_factor';
+    }
+    /** Where the texted second-factor code went (masked), once it was sent. */
+    smsSecondFactorSentTo() {
+        const sent = this.textedSecondFactor?.sentTo;
+        return typeof sent === 'string' ? sent || ' ' : null;
+    }
     formErrors() {
         return this.errors.filter((error) => !error.param);
     }
@@ -1145,6 +1596,17 @@ class AttemptFlowComponent {
             return [];
         return this.firstFactors ?? step.strategies;
     }
+    linkOnly() {
+        return awaitingSignUpLink(this.attempt, this.emailVerification);
+    }
+    showEmailSecondFactor() {
+        return this.offerEmailSecondFactor && this.step().kind === 'collect_second_factor';
+    }
+    /** Where the emailed second-factor code went (masked), once it was sent. */
+    emailSecondFactorSentTo() {
+        const sent = this.emailedSecondFactor?.sentTo;
+        return typeof sent === 'string' ? sent || ' ' : null;
+    }
     showEmailCodeOption() {
         // Before the code is sent: the choice (or the retry of a failed automatic
         // send). After: "Resend code".
@@ -1156,13 +1618,22 @@ class AttemptFlowComponent {
             return null;
         return this.t('signIn.codeSentTo', { email: this.attempt?.identifier ?? '' });
     }
+    /** The attempt is `needs_policy_acceptance`. */
+    awaitingPolicies() {
+        return this.step().kind === 'accept_policies';
+    }
     showSubmit() {
         const kind = this.step().kind;
         // Nothing to submit on a first-factor step that only offers an emailed code
         // until that code is sent.
         if (kind === 'collect_first_factor')
             return this.fields().length > 0;
-        return kind !== 'done' && kind !== 'await_oauth';
+        if (this.linkOnly())
+            return false;
+        // Enrolment: nothing to submit while choosing a method or fetching the setup.
+        if (this.enrolling() && this.enrollmentState && !enrollmentSubmitKey(this.enrollmentState))
+            return false;
+        return kind !== 'done' && kind !== 'await_oauth' && kind !== 'accept_policies';
     }
     fields() {
         const step = this.step();
@@ -1183,6 +1654,9 @@ class AttemptFlowComponent {
             case 'collect_second_factor':
                 return [{ kind: 'input', name: 'code', labelKey: 'mfa.codeLabel', type: 'text' }];
             case 'enroll_second_factor':
+                // The shared enrolment step draws its own fields (above).
+                if (this.enrolling())
+                    return [];
                 // Two consecutive codes (§5.6): a phone with a fast clock fails here
                 // rather than on every sign-in afterwards.
                 return [
@@ -1190,9 +1664,12 @@ class AttemptFlowComponent {
                     { kind: 'input', name: 'secondCode', labelKey: 'mfa.enrollSecondCodeLabel', type: 'text' },
                 ];
             case 'collect_email_code':
-                return [{ kind: 'input', name: 'code', labelKey: 'signIn.emailCodeLabel', type: 'text' }];
+                return this.linkOnly() ? [] : [{ kind: 'input', name: 'code', labelKey: 'signIn.emailCodeLabel', type: 'text' }];
             case 'collect_new_password':
                 return [{ kind: 'input', name: 'password', labelKey: 'reset.newPasswordLabel', type: 'password' }];
+            case 'accept_policies':
+                // Drawn by <atlas-policy-accept-step> above.
+                return [];
             case 'collect_captcha':
                 // §5 the server withheld the attempt until a captcha clears. Solving the
                 // widget resubmits the identifier on its own; the button retries.
@@ -1216,7 +1693,7 @@ class AttemptFlowComponent {
         }
     }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AttemptFlowComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: AttemptFlowComponent, isStandalone: true, selector: "atlas-attempt-flow", inputs: { attempt: "attempt", busy: "busy", errors: "errors", sessionKept: "sessionKept", titleKey: "titleKey", captcha: "captcha", firstFactors: "firstFactors", preparedFactor: "preparedFactor" }, outputs: { submitFlow: "submitFlow", chooseFactor: "chooseFactor" }, ngImport: i0, template: `
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: AttemptFlowComponent, isStandalone: true, selector: "atlas-attempt-flow", inputs: { attempt: "attempt", busy: "busy", errors: "errors", sessionKept: "sessionKept", titleKey: "titleKey", captcha: "captcha", firstFactors: "firstFactors", preparedFactor: "preparedFactor", offerEmailSecondFactor: "offerEmailSecondFactor", emailedSecondFactor: "emailedSecondFactor", offerSmsSecondFactor: "offerSmsSecondFactor", textedSecondFactor: "textedSecondFactor", enrollment: "enrollment", enrollmentState: "enrollmentState", emailVerification: "emailVerification" }, outputs: { submitFlow: "submitFlow", chooseFactor: "chooseFactor", emailSecondFactor: "emailSecondFactor", smsSecondFactor: "smsSecondFactor", resend: "resend", policyDeclined: "policyDeclined" }, ngImport: i0, template: `
     <div [class]="cls('card', 'atlas-card')">
       <h1 [class]="cls('headerTitle', 'atlas-title')">{{ t(titleKey) }}</h1>
 
@@ -1228,6 +1705,98 @@ class AttemptFlowComponent {
         @if (codeSentText(); as sentText) {
           <p class="atlas-text" data-atlas-code-sent="">{{ sentText }}</p>
         }
+        @if (linkOnly()) {
+          <!-- Nothing to type: the flow polls until the emailed link is opened (anywhere). -->
+          <p class="atlas-text" data-atlas-link-sent="" aria-live="polite">
+            {{ t('signUp.linkSentTo', { email: attempt?.identifier ?? '' }) }}
+          </p>
+          <button
+            [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+            type="button"
+            data-atlas-resend=""
+            [disabled]="busy"
+            (click)="resend.emit()"
+          >
+            {{ t('signIn.resendLink') }}
+          </button>
+        }
+        @if (enrolling() && enrollmentState; as enrol) {
+          @if (enrol.method === null) {
+            <p class="atlas-text">{{ t('mfa.enrollChoose') }}</p>
+            @for (m of enrol.options; track m) {
+              <button
+                [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+                type="button"
+                [attr.data-atlas-mfa-method]="m"
+                [disabled]="busy || enrol.busy"
+                (click)="chooseMethod(m)"
+              >
+                {{ t(m === 'totp' ? 'mfa.enrollTotpOption' : 'mfa.enrollSmsOption') }}
+              </button>
+            }
+          } @else if (enrol.method === 'totp') {
+            @if (enrol.enrollment; as setup) {
+              <p class="atlas-text">{{ t('mfa.enrollScan') }}</p>
+              @if (setup.qrCode) {
+                <img class="atlas-mfa-qr" data-atlas="mfa-qr" [src]="setup.qrCode" [alt]="t('mfa.enrollQrAlt')" width="180" height="180" />
+              }
+              @if (setup.secret) {
+                <p class="atlas-text" data-atlas="mfa-setup-key">{{ t('mfa.enrollSetupKey') }}: <code>{{ setupKey(setup.secret) }}</code></p>
+              }
+              <label class="atlas-field">
+                <span>{{ t('mfa.enrollFirstCodeLabel') }}</span>
+                <input [class]="cls('formFieldInput', 'atlas-input')" type="text" name="code" autocomplete="one-time-code" inputmode="numeric" [value]="values['code'] ?? ''" (input)="setValue('code', $any($event.target).value)" />
+              </label>
+              @if (enrol.totpCodes >= 2) {
+                <label class="atlas-field">
+                  <span>{{ t('mfa.enrollSecondCodeLabel') }}</span>
+                  <input [class]="cls('formFieldInput', 'atlas-input')" type="text" name="secondCode" autocomplete="one-time-code" inputmode="numeric" [value]="values['secondCode'] ?? ''" (input)="setValue('secondCode', $any($event.target).value)" />
+                </label>
+              }
+            } @else {
+              <p class="atlas-text" aria-live="polite">{{ enrol.busy ? t('mfa.enrollPreparing') : '' }}</p>
+            }
+          } @else {
+            @if (enrol.enrollment; as texted) {
+              <p class="atlas-text" data-atlas="mfa-code-texted" aria-live="polite">{{ t('mfa.codeTextedTo', { phone: texted.phone ?? '' }) }}</p>
+              <label class="atlas-field">
+                <span>{{ t('mfa.codeLabel') }}</span>
+                <input [class]="cls('formFieldInput', 'atlas-input')" type="text" name="code" autocomplete="one-time-code" inputmode="numeric" [value]="values['code'] ?? ''" (input)="setValue('code', $any($event.target).value)" />
+              </label>
+              <button
+                [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+                type="button"
+                data-atlas-resend=""
+                [disabled]="busy || enrol.busy"
+                (click)="resendEnrollment()"
+              >
+                {{ t('signIn.resendCode') }}
+              </button>
+            } @else {
+              <label class="atlas-field">
+                <span>{{ t('mfa.phoneLabel') }}</span>
+                <input [class]="cls('formFieldInput', 'atlas-input')" type="tel" name="phone" autocomplete="tel" [value]="values['phone'] ?? ''" (input)="setValue('phone', $any($event.target).value)" />
+              </label>
+              <p class="atlas-text">{{ t('mfa.phoneHint') }}</p>
+            }
+          }
+          @for (error of enrol.errors; track $index) {
+            <p [class]="cls('formFieldError', 'atlas-error')" role="alert">{{ error.message }}</p>
+          }
+          @if (enrol.method !== null && enrol.options.length > 1) {
+            @for (other of otherMethods(enrol); track other) {
+              <button
+                [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+                type="button"
+                [attr.data-atlas-mfa-method]="other"
+                [disabled]="busy || enrol.busy"
+                (click)="chooseMethod(other)"
+              >
+                {{ t(other === 'totp' ? 'mfa.enrollTotpOption' : 'mfa.enrollSmsOption') }}
+              </button>
+            }
+          }
+        }
         @for (f of fields(); track $index) {
           @if (f.kind === 'input') {
             <label class="atlas-field">
@@ -1250,16 +1819,68 @@ class AttemptFlowComponent {
           }
         }
 
+        @if (awaitingPolicies()) {
+          <!-- A required policy changed: scroll-mode ones in their dialog, the rest as checkboxes. -->
+          <atlas-policy-accept-step
+            [attempt]="attempt"
+            [busy]="busy"
+            (submitFlow)="submitFlow.emit($event)"
+            (declined)="policyDeclined.emit($event)"
+          ></atlas-policy-accept-step>
+        }
+
         @if (showCaptcha()) {
           <div class="atlas-captcha" data-atlas-captcha="" [atlasCaptchaSlot]="captcha"></div>
         }
 
         @if (showSubmit()) {
-          <button [class]="cls('formButtonPrimary', 'atlas-button')" [disabled]="busy" type="submit">
-            {{ t('signIn.submit') }}
+          <button [class]="cls('formButtonPrimary', 'atlas-button')" [disabled]="busy || (enrolling() && !!enrollmentState?.busy)" type="submit">
+            {{ t(submitKey()) }}
           </button>
         }
 
+        @if (showSmsSecondFactor()) {
+          @if (smsSecondFactorSentTo(); as sentTo) {
+            <p class="atlas-text" data-atlas="sms-second-factor-sent" aria-live="polite">
+              {{ t('mfa.codeTextedTo', { phone: sentTo }) }}
+            </p>
+          } @else {
+            <button
+              [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+              type="button"
+              data-atlas="sms-second-factor"
+              [disabled]="busy || !!textedSecondFactor?.busy"
+              (click)="smsSecondFactor.emit()"
+            >
+              {{ textedSecondFactor?.busy ? t('signIn.sending') : t('mfa.smsCodeOption') }}
+            </button>
+            @if (textedSecondFactor?.error; as message) {
+              <p [class]="cls('formFieldError', 'atlas-error')" role="alert">{{ message }}</p>
+            }
+          }
+        }
+
+        @if (showEmailSecondFactor()) {
+          @if (emailSecondFactorSentTo(); as sentTo) {
+            <p class="atlas-text" data-atlas="email-second-factor-sent" aria-live="polite">
+              {{ t('signIn.codeSentTo', { email: sentTo }) }}
+            </p>
+          } @else {
+            <button
+              [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+              type="button"
+              data-atlas="email-second-factor"
+              [disabled]="busy || !!emailedSecondFactor?.busy"
+              (click)="emailSecondFactor.emit()"
+            >
+              {{ emailedSecondFactor?.busy ? t('signIn.sending') : t('signIn.emailCodeOption') }}
+            </button>
+            @if (emailedSecondFactor?.error; as message) {
+              <p [class]="cls('formFieldError', 'atlas-error')" role="alert">{{ message }}</p>
+            }
+          }
+        }
+
         @if (showEmailCodeOption()) {
           <button
             [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
@@ -1274,7 +1895,7 @@ class AttemptFlowComponent {
         }
       </form>
     </div>
-  `, isInline: true, dependencies: [{ kind: "directive", type: AtlasCaptchaSlotDirective, selector: "[atlasCaptchaSlot]", inputs: ["atlasCaptchaSlot"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
+  `, isInline: true, dependencies: [{ kind: "directive", type: AtlasCaptchaSlotDirective, selector: "[atlasCaptchaSlot]", inputs: ["atlasCaptchaSlot"] }, { kind: "component", type: PolicyAcceptStepComponent, selector: "atlas-policy-accept-step", inputs: ["attempt", "busy"], outputs: ["submitFlow", "declined"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AttemptFlowComponent, decorators: [{
             type: Component,
@@ -1282,7 +1903,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
                     selector: 'atlas-attempt-flow',
                     standalone: true,
                     changeDetection: ChangeDetectionStrategy.OnPush,
-                    imports: [AtlasCaptchaSlotDirective],
+                    imports: [AtlasCaptchaSlotDirective, PolicyAcceptStepComponent],
                     template: `
     <div [class]="cls('card', 'atlas-card')">
       <h1 [class]="cls('headerTitle', 'atlas-title')">{{ t(titleKey) }}</h1>
@@ -1295,6 +1916,98 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
         @if (codeSentText(); as sentText) {
           <p class="atlas-text" data-atlas-code-sent="">{{ sentText }}</p>
         }
+        @if (linkOnly()) {
+          <!-- Nothing to type: the flow polls until the emailed link is opened (anywhere). -->
+          <p class="atlas-text" data-atlas-link-sent="" aria-live="polite">
+            {{ t('signUp.linkSentTo', { email: attempt?.identifier ?? '' }) }}
+          </p>
+          <button
+            [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+            type="button"
+            data-atlas-resend=""
+            [disabled]="busy"
+            (click)="resend.emit()"
+          >
+            {{ t('signIn.resendLink') }}
+          </button>
+        }
+        @if (enrolling() && enrollmentState; as enrol) {
+          @if (enrol.method === null) {
+            <p class="atlas-text">{{ t('mfa.enrollChoose') }}</p>
+            @for (m of enrol.options; track m) {
+              <button
+                [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+                type="button"
+                [attr.data-atlas-mfa-method]="m"
+                [disabled]="busy || enrol.busy"
+                (click)="chooseMethod(m)"
+              >
+                {{ t(m === 'totp' ? 'mfa.enrollTotpOption' : 'mfa.enrollSmsOption') }}
+              </button>
+            }
+          } @else if (enrol.method === 'totp') {
+            @if (enrol.enrollment; as setup) {
+              <p class="atlas-text">{{ t('mfa.enrollScan') }}</p>
+              @if (setup.qrCode) {
+                <img class="atlas-mfa-qr" data-atlas="mfa-qr" [src]="setup.qrCode" [alt]="t('mfa.enrollQrAlt')" width="180" height="180" />
+              }
+              @if (setup.secret) {
+                <p class="atlas-text" data-atlas="mfa-setup-key">{{ t('mfa.enrollSetupKey') }}: <code>{{ setupKey(setup.secret) }}</code></p>
+              }
+              <label class="atlas-field">
+                <span>{{ t('mfa.enrollFirstCodeLabel') }}</span>
+                <input [class]="cls('formFieldInput', 'atlas-input')" type="text" name="code" autocomplete="one-time-code" inputmode="numeric" [value]="values['code'] ?? ''" (input)="setValue('code', $any($event.target).value)" />
+              </label>
+              @if (enrol.totpCodes >= 2) {
+                <label class="atlas-field">
+                  <span>{{ t('mfa.enrollSecondCodeLabel') }}</span>
+                  <input [class]="cls('formFieldInput', 'atlas-input')" type="text" name="secondCode" autocomplete="one-time-code" inputmode="numeric" [value]="values['secondCode'] ?? ''" (input)="setValue('secondCode', $any($event.target).value)" />
+                </label>
+              }
+            } @else {
+              <p class="atlas-text" aria-live="polite">{{ enrol.busy ? t('mfa.enrollPreparing') : '' }}</p>
+            }
+          } @else {
+            @if (enrol.enrollment; as texted) {
+              <p class="atlas-text" data-atlas="mfa-code-texted" aria-live="polite">{{ t('mfa.codeTextedTo', { phone: texted.phone ?? '' }) }}</p>
+              <label class="atlas-field">
+                <span>{{ t('mfa.codeLabel') }}</span>
+                <input [class]="cls('formFieldInput', 'atlas-input')" type="text" name="code" autocomplete="one-time-code" inputmode="numeric" [value]="values['code'] ?? ''" (input)="setValue('code', $any($event.target).value)" />
+              </label>
+              <button
+                [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+                type="button"
+                data-atlas-resend=""
+                [disabled]="busy || enrol.busy"
+                (click)="resendEnrollment()"
+              >
+                {{ t('signIn.resendCode') }}
+              </button>
+            } @else {
+              <label class="atlas-field">
+                <span>{{ t('mfa.phoneLabel') }}</span>
+                <input [class]="cls('formFieldInput', 'atlas-input')" type="tel" name="phone" autocomplete="tel" [value]="values['phone'] ?? ''" (input)="setValue('phone', $any($event.target).value)" />
+              </label>
+              <p class="atlas-text">{{ t('mfa.phoneHint') }}</p>
+            }
+          }
+          @for (error of enrol.errors; track $index) {
+            <p [class]="cls('formFieldError', 'atlas-error')" role="alert">{{ error.message }}</p>
+          }
+          @if (enrol.method !== null && enrol.options.length > 1) {
+            @for (other of otherMethods(enrol); track other) {
+              <button
+                [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+                type="button"
+                [attr.data-atlas-mfa-method]="other"
+                [disabled]="busy || enrol.busy"
+                (click)="chooseMethod(other)"
+              >
+                {{ t(other === 'totp' ? 'mfa.enrollTotpOption' : 'mfa.enrollSmsOption') }}
+              </button>
+            }
+          }
+        }
         @for (f of fields(); track $index) {
           @if (f.kind === 'input') {
             <label class="atlas-field">
@@ -1317,16 +2030,68 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
           }
         }
 
+        @if (awaitingPolicies()) {
+          <!-- A required policy changed: scroll-mode ones in their dialog, the rest as checkboxes. -->
+          <atlas-policy-accept-step
+            [attempt]="attempt"
+            [busy]="busy"
+            (submitFlow)="submitFlow.emit($event)"
+            (declined)="policyDeclined.emit($event)"
+          ></atlas-policy-accept-step>
+        }
+
         @if (showCaptcha()) {
           <div class="atlas-captcha" data-atlas-captcha="" [atlasCaptchaSlot]="captcha"></div>
         }
 
         @if (showSubmit()) {
-          <button [class]="cls('formButtonPrimary', 'atlas-button')" [disabled]="busy" type="submit">
-            {{ t('signIn.submit') }}
+          <button [class]="cls('formButtonPrimary', 'atlas-button')" [disabled]="busy || (enrolling() && !!enrollmentState?.busy)" type="submit">
+            {{ t(submitKey()) }}
           </button>
         }
 
+        @if (showSmsSecondFactor()) {
+          @if (smsSecondFactorSentTo(); as sentTo) {
+            <p class="atlas-text" data-atlas="sms-second-factor-sent" aria-live="polite">
+              {{ t('mfa.codeTextedTo', { phone: sentTo }) }}
+            </p>
+          } @else {
+            <button
+              [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+              type="button"
+              data-atlas="sms-second-factor"
+              [disabled]="busy || !!textedSecondFactor?.busy"
+              (click)="smsSecondFactor.emit()"
+            >
+              {{ textedSecondFactor?.busy ? t('signIn.sending') : t('mfa.smsCodeOption') }}
+            </button>
+            @if (textedSecondFactor?.error; as message) {
+              <p [class]="cls('formFieldError', 'atlas-error')" role="alert">{{ message }}</p>
+            }
+          }
+        }
+
+        @if (showEmailSecondFactor()) {
+          @if (emailSecondFactorSentTo(); as sentTo) {
+            <p class="atlas-text" data-atlas="email-second-factor-sent" aria-live="polite">
+              {{ t('signIn.codeSentTo', { email: sentTo }) }}
+            </p>
+          } @else {
+            <button
+              [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+              type="button"
+              data-atlas="email-second-factor"
+              [disabled]="busy || !!emailedSecondFactor?.busy"
+              (click)="emailSecondFactor.emit()"
+            >
+              {{ emailedSecondFactor?.busy ? t('signIn.sending') : t('signIn.emailCodeOption') }}
+            </button>
+            @if (emailedSecondFactor?.error; as message) {
+              <p [class]="cls('formFieldError', 'atlas-error')" role="alert">{{ message }}</p>
+            }
+          }
+        }
+
         @if (showEmailCodeOption()) {
           <button
             [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
@@ -1363,6 +2128,28 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
                 type: Output
             }], chooseFactor: [{
                 type: Output
+            }], offerEmailSecondFactor: [{
+                type: Input
+            }], emailedSecondFactor: [{
+                type: Input
+            }], emailSecondFactor: [{
+                type: Output
+            }], offerSmsSecondFactor: [{
+                type: Input
+            }], textedSecondFactor: [{
+                type: Input
+            }], smsSecondFactor: [{
+                type: Output
+            }], enrollment: [{
+                type: Input
+            }], enrollmentState: [{
+                type: Input
+            }], emailVerification: [{
+                type: Input
+            }], resend: [{
+                type: Output
+            }], policyDeclined: [{
+                type: Output
             }] } });
 /** A read-only message row: `labelKey` holds the i18n key of the text to show. */
 function msg(labelKey) {
@@ -1370,49 +2157,190 @@ function msg(labelKey) {
 }
 
 /**
- * The server-driven sign-in / sign-up engine, shared by `<atlas-sign-in>` and
- * `<atlas-sign-up>` — the Angular counterpart of React's `useFlow` hook.
- *
- * It owns no decision about what comes next: every status comes back from the
- * server via `advance`, and this controller only posts whatever the current step
- * needs and re-renders the returned status. State lives in a signal so templates
- * update whether the app runs zoned or zoneless.
- *
- * `<atlas-sign-up>` starts the attempt with {@link create}
- * (`POST /v1/client/sign_ups`); the emailed-code step then runs through the same
- * {@link submit}. Both flows draw the instance's captcha (from
- * {@link loadSettings}) when it is required.
+ * The recovery codes a mid-sign-in MFA enrolment came with, shown once before
+ * the sign-in finishes: copy them, download them as a .txt file, then
+ * "I've saved my codes" (`saved`) exchanges the ticket. The codes live only in
+ * the flow controller's memory and are forgotten once saved.
  */
-class AtlasFlowController {
-    client;
-    reload;
-    t;
-    state;
-    /**
-     * The instance's public sign-in / sign-up settings (captcha, sign-up fields,
-     * legal consent) from `GET /v1/appearance`; null until {@link loadSettings}
-     * resolves, or when the server could not be reached.
-     */
-    settings = signal(null);
-    /** The sign-in captcha (identifier step / `needs_captcha` challenge). */
-    captcha = createCaptchaController(undefined, {
-        // The Atlas captcha's words follow the form's catalog (read when drawn).
-        atlasLabels: () => atlasCaptchaLabels(this.t),
-    });
-    /** The sign-up captcha (the create-account step). */
-    signUpCaptcha = createCaptchaController(undefined, {
-        atlasLabels: () => atlasCaptchaLabels(this.t),
-    });
-    /** Whether {@link captcha} currently draws a widget (for templates). */
-    captchaDrawn = signal(false);
-    /** Whether {@link signUpCaptcha} currently draws a widget (for templates). */
-    signUpCaptchaDrawn = signal(false);
-    /**
-     * The first factor the server was asked to send ({@link prepare}) on the
-     * current `needs_first_factor` step — the form then collects its code. Null
-     * otherwise.
-     */
-    preparedFactor = signal(null);
+class RecoveryCodesComponent {
+    atlas = inject(AtlasService);
+    cdr = inject(ChangeDetectorRef);
+    codes = [];
+    busy = false;
+    saved = new EventEmitter();
+    canCopy = typeof navigator !== 'undefined' && !!navigator.clipboard?.writeText;
+    canDownload = canDownloadRecoveryCodes();
+    copied = false;
+    ngOnChanges() {
+        this.copied = false;
+    }
+    t(key) {
+        return translate(this.atlas.localization, key);
+    }
+    cls(key, base) {
+        return classFor(key, this.atlas.appearance, base);
+    }
+    copy() {
+        void copyRecoveryCodes(this.codes).then((ok) => {
+            this.copied = ok;
+            this.cdr.markForCheck();
+        });
+    }
+    download() {
+        downloadRecoveryCodes(this.codes);
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: RecoveryCodesComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: RecoveryCodesComponent, isStandalone: true, selector: "atlas-recovery-codes", inputs: { codes: "codes", busy: "busy" }, outputs: { saved: "saved" }, usesOnChanges: true, ngImport: i0, template: `
+    <div [class]="cls('card', 'atlas-card')" data-atlas="recovery-codes">
+      <h1 [class]="cls('headerTitle', 'atlas-title')">{{ t('mfa.recoveryCodesTitle') }}</h1>
+      <p class="atlas-text">{{ t('mfa.recoveryCodesHelp') }}</p>
+      <ul
+        class="atlas-recovery-codes"
+        data-atlas="recovery-codes-list"
+        style="list-style:none;padding:0;margin:8px 0 12px;display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:6px;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;text-align:center"
+      >
+        @for (code of codes; track code) {
+          <li><code>{{ code }}</code></li>
+        }
+      </ul>
+      <div class="atlas-alternatives">
+        @if (canCopy) {
+          <button [class]="cls('formButtonSecondary', 'atlas-button-secondary')" type="button" data-atlas="recovery-codes-copy" (click)="copy()">
+            {{ t('mfa.recoveryCodesCopy') }}
+          </button>
+        }
+        @if (canDownload) {
+          <button [class]="cls('formButtonSecondary', 'atlas-button-secondary')" type="button" data-atlas="recovery-codes-download" (click)="download()">
+            {{ t('mfa.recoveryCodesDownload') }}
+          </button>
+        }
+      </div>
+      @if (copied) {
+        <p class="atlas-text" aria-live="polite" data-atlas="recovery-codes-copied">{{ t('mfa.recoveryCodesCopied') }}</p>
+      }
+      <button [class]="cls('formButtonPrimary', 'atlas-button')" type="button" data-atlas="recovery-codes-saved" [disabled]="busy" (click)="saved.emit()">
+        {{ t('mfa.recoveryCodesSaved') }}
+      </button>
+    </div>
+  `, isInline: true, changeDetection: i0.ChangeDetectionStrategy.OnPush });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: RecoveryCodesComponent, decorators: [{
+            type: Component,
+            args: [{
+                    selector: 'atlas-recovery-codes',
+                    standalone: true,
+                    changeDetection: ChangeDetectionStrategy.OnPush,
+                    template: `
+    <div [class]="cls('card', 'atlas-card')" data-atlas="recovery-codes">
+      <h1 [class]="cls('headerTitle', 'atlas-title')">{{ t('mfa.recoveryCodesTitle') }}</h1>
+      <p class="atlas-text">{{ t('mfa.recoveryCodesHelp') }}</p>
+      <ul
+        class="atlas-recovery-codes"
+        data-atlas="recovery-codes-list"
+        style="list-style:none;padding:0;margin:8px 0 12px;display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:6px;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;text-align:center"
+      >
+        @for (code of codes; track code) {
+          <li><code>{{ code }}</code></li>
+        }
+      </ul>
+      <div class="atlas-alternatives">
+        @if (canCopy) {
+          <button [class]="cls('formButtonSecondary', 'atlas-button-secondary')" type="button" data-atlas="recovery-codes-copy" (click)="copy()">
+            {{ t('mfa.recoveryCodesCopy') }}
+          </button>
+        }
+        @if (canDownload) {
+          <button [class]="cls('formButtonSecondary', 'atlas-button-secondary')" type="button" data-atlas="recovery-codes-download" (click)="download()">
+            {{ t('mfa.recoveryCodesDownload') }}
+          </button>
+        }
+      </div>
+      @if (copied) {
+        <p class="atlas-text" aria-live="polite" data-atlas="recovery-codes-copied">{{ t('mfa.recoveryCodesCopied') }}</p>
+      }
+      <button [class]="cls('formButtonPrimary', 'atlas-button')" type="button" data-atlas="recovery-codes-saved" [disabled]="busy" (click)="saved.emit()">
+        {{ t('mfa.recoveryCodesSaved') }}
+      </button>
+    </div>
+  `,
+                }]
+        }], propDecorators: { codes: [{
+                type: Input
+            }], busy: [{
+                type: Input
+            }], saved: [{
+                type: Output
+            }] } });
+
+/**
+ * The server-driven sign-in / sign-up engine, shared by `<atlas-sign-in>` and
+ * `<atlas-sign-up>` — the Angular counterpart of React's `useFlow` hook.
+ *
+ * It owns no decision about what comes next: every status comes back from the
+ * server via `advance`, and this controller only posts whatever the current step
+ * needs and re-renders the returned status. State lives in a signal so templates
+ * update whether the app runs zoned or zoneless.
+ *
+ * `<atlas-sign-up>` starts the attempt with {@link create}
+ * (`POST /v1/client/sign_ups`); the emailed-code step then runs through the same
+ * {@link submit}. Both flows draw the instance's captcha (from
+ * {@link loadSettings}) when it is required.
+ */
+class AtlasFlowController {
+    client;
+    reload;
+    t;
+    state;
+    /**
+     * The instance's public sign-in / sign-up settings (captcha, sign-up fields,
+     * legal consent) from `GET /v1/appearance`; null until {@link loadSettings}
+     * resolves, or when the server could not be reached.
+     */
+    settings = signal(null);
+    /**
+     * The method this browser last signed in with (`password`, `oauth_github`, …)
+     * for the "Last used" hint; null when none, or the instance turned it off.
+     */
+    lastMethod = signal(null);
+    /** The sign-in captcha (identifier step / `needs_captcha` challenge). */
+    captcha = createCaptchaController(undefined, {
+        // The Atlas captcha's words follow the form's catalog (read when drawn).
+        atlasLabels: () => atlasCaptchaLabels(this.t),
+    });
+    /** The sign-up captcha (the create-account step). */
+    signUpCaptcha = createCaptchaController(undefined, {
+        atlasLabels: () => atlasCaptchaLabels(this.t),
+    });
+    /** Whether {@link captcha} currently draws a widget (for templates). */
+    captchaDrawn = signal(false);
+    /** Whether {@link signUpCaptcha} currently draws a widget (for templates). */
+    signUpCaptchaDrawn = signal(false);
+    /**
+     * The first factor the server was asked to send ({@link prepare}) on the
+     * current `needs_first_factor` step — the form then collects its code. Null
+     * otherwise.
+     */
+    preparedFactor = signal(null);
+    /**
+     * "Email me a code instead" at the second factor ({@link sendEmailSecondFactor}):
+     * in flight, where the code went, or why it was not sent. Null until asked,
+     * and again once the flow leaves that step.
+     */
+    emailSecondFactor = signal(null);
+    /** "Text me a code instead" at the second factor ({@link sendSmsSecondFactor}): as {@link emailSecondFactor}. */
+    smsSecondFactor = signal(null);
+    /**
+     * The MFA enrolment step (`needs_mfa_enrollment`): the authenticator app's
+     * setup (QR code, setup key) or a texted code. Started and reset with the flow.
+     */
+    enrollment;
+    /** {@link enrollment}'s state, for templates. */
+    enrollmentState;
+    /**
+     * The instance's policies (terms, privacy, …) for the create-account form:
+     * {@link create} sends their acceptances and reloads them after a refusal.
+     */
+    policies = new PolicyAcceptanceController([]);
     pollTimer = null;
     identifier = '';
     constructor(client, reload, pending, 
@@ -1424,7 +2352,23 @@ class AtlasFlowController {
         // Seeded from a redirect that came back mid-flow (e.g. OAuth needing a second
         // factor) so the user resumes at the demanded step instead of starting over.
         this.state = signal(pending ? flowFromPending(pending) : initialFlow);
+        this.enrollment = createMfaEnrollment(this.client, () => this.mfaChoices());
+        this.enrollmentState = signal(this.enrollment.state);
+        this.enrollment.subscribe((next) => this.enrollmentState.set(next));
         this.syncCaptcha();
+        this.syncEnrollment();
+    }
+    /** What the app lets the MFA steps offer (from {@link settings}). */
+    mfaChoices() {
+        return mfaChoicesFrom(this.settings()?.account);
+    }
+    /** Start the enrolment step for its attempt, or reset it once the flow leaves. */
+    syncEnrollment() {
+        const attempt = this.state().attempt;
+        if (attempt?.status === 'needs_mfa_enrollment' && attempt.id)
+            this.enrollment.start(attempt.id);
+        else
+            this.enrollment.reset();
     }
     /** Fetch the instance's public settings and draw whatever captcha they require. */
     async loadSettings() {
@@ -1432,6 +2376,8 @@ class AtlasFlowController {
         if (loaded) {
             this.settings.set(loaded);
             this.syncCaptcha();
+            if (loaded.account.lastSignInMethod)
+                this.lastMethod.set(await fetchLastSignInMethod(this.client));
         }
     }
     /**
@@ -1486,11 +2432,18 @@ class AtlasFlowController {
         this.signUpCaptchaDrawn.set(this.signUpCaptcha.needed);
     }
     setState(next) {
+        const previousId = this.state().attempt?.id ?? null;
         this.state.set(next);
         // A prepared factor belongs to the first-factor step it was sent for.
         if (next.attempt?.status !== 'needs_first_factor')
             this.preparedFactor.set(null);
+        // An emailed second-factor code belongs to the second-factor step of this attempt.
+        if (next.attempt?.status !== 'needs_second_factor' || (next.attempt?.id ?? null) !== previousId) {
+            this.emailSecondFactor.set(null);
+            this.smsSecondFactor.set(null);
+        }
         this.syncCaptcha();
+        this.syncEnrollment();
         this.autoSend();
     }
     autoSentFor = null;
@@ -1524,6 +2477,17 @@ class AtlasFlowController {
         this.identifier = out.identifier;
         await this.finish(out.state);
     }
+    /** Load the sign-up's policies into {@link policies} (`<atlas-sign-up>` calls it on init). */
+    async loadPolicies(locale) {
+        this.policies.setPolicies(await loadPolicies(this.client, { locale }));
+    }
+    /** The user declined a policy a sign-in was waiting on: cancel the attempt and say why. */
+    declinePolicy(title) {
+        this.state.set({
+            ...initialFlow,
+            errors: [{ code: 'POLICY_DECLINED', message: this.t('policy.declined').replace('{policy}', title) }],
+        });
+    }
     /**
      * Create an account (`POST /v1/client/sign_ups`) from a create-account form's
      * values — email, password and any configured sign-up fields — carrying the
@@ -1536,10 +2500,76 @@ class AtlasFlowController {
             consent,
             captcha: this.signUpCaptcha,
             t: this.t,
+            policies: this.policies,
         });
         await this.finish(next);
     }
+    /**
+     * "Email me a code instead" at the second factor (the instance's
+     * `account.emailSecondFactor`): mails a code to the account's verified email;
+     * it is then posted with {@link submit} like any 2FA code.
+     */
+    async sendEmailSecondFactor() {
+        await this.sendSecondFactorCode('email_code', this.emailSecondFactor);
+    }
+    /**
+     * "Text me a code instead" at the second factor (where the app offers texted
+     * codes, {@link mfaChoices}`().sms`): texts a code to the account's enrolled
+     * phone; it is then posted with {@link submit} like any 2FA code.
+     */
+    async sendSmsSecondFactor() {
+        await this.sendSecondFactorCode('sms', this.smsSecondFactor);
+    }
+    async sendSecondFactorCode(strategy, out) {
+        const id = this.state().attempt?.id;
+        if (!id)
+            return;
+        out.set({ busy: true });
+        try {
+            const { sentTo } = await prepareSecondFactorCode(this.client, id, strategy);
+            out.set({ sentTo });
+        }
+        catch (error) {
+            out.set({ error: error instanceof Error ? error.message : this.t('error.generic') });
+        }
+    }
+    /** Resend a sign-up's emailed code / link (the earlier one stops working). */
+    async resendSignUp() {
+        this.state.update((current) => ({ ...current, busy: true, errors: [] }));
+        this.state.set(await resendSignUpVerification(this.client, this.state()));
+    }
+    /**
+     * Start a passkey-only sign-up (`POST /v1/client/sign_ups/passkey`) from the
+     * create-account form's values — no password. Offered when the instance's
+     * `account.passkeySignUp` is set.
+     */
+    async createWithPasskey(values, consent = true) {
+        this.state.update((current) => ({ ...current, busy: true, errors: [] }));
+        await this.finish(await createPasskeySignUp(this.client, values, { consent, captcha: this.signUpCaptcha, t: this.t, policies: this.policies }));
+    }
+    /** The passkey-only sign-up's last step: create the passkey, and with it the account. */
+    async createPasskey() {
+        this.state.update((current) => ({ ...current, busy: true, errors: [] }));
+        await this.finish(await finishPasskeySignUp(this.client, this.state(), { t: this.t }));
+    }
+    /**
+     * The recovery codes an MFA enrolment just completed the sign-in with, shown
+     * once before it finishes ({@link saveRecoveryCodes}); null otherwise. They
+     * live only in this controller's memory.
+     */
+    recoveryCodes() {
+        return pendingRecoveryCodes(this.state());
+    }
+    /** "I've saved my codes": forget the recovery codes and finish the sign-in. */
+    async saveRecoveryCodes() {
+        await this.finish(acknowledgeRecoveryCodes(this.state()));
+    }
     async finish(next) {
+        // An enrolment's recovery codes are shown first; `saveRecoveryCodes` finishes.
+        if (pendingRecoveryCodes(next)) {
+            this.setState({ ...next, busy: false });
+            return;
+        }
         if (next.attempt?.status === 'complete') {
             // Stays busy until this browser actually holds the session: the completion
             // alone says nothing about whether the cookie was kept.
@@ -1577,6 +2607,9 @@ class AtlasFlowController {
             void (async () => {
                 const { state: next, ticket } = await pollAttempt(this.client, this.state());
                 this.setState(next);
+                // e.g. a passkey sign-up whose email was just proven: only this tab can go on.
+                if (!ticket && !shouldKeepPolling(next))
+                    this.stopPolling();
                 if (!ticket || !next.attempt)
                     return;
                 // The ticket is exchanged by a normal request, so no session token ever
@@ -1628,6 +2661,12 @@ class SignInComponent {
     t(key) {
         return translate(this.atlas.localization, key);
     }
+    /** "Last used: Password" on the identifier step, when the instance shows the hint. */
+    lastUsedLabel() {
+        if (this.flow.state().attempt)
+            return null;
+        return lastUsedMethodLabel(this.flow.lastMethod(), (key) => this.t(key));
+    }
     signUpHref() {
         if (this.signUpUrl === null)
             return null;
@@ -1661,6 +2700,14 @@ class SignInComponent {
     }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: SignInComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
     static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: SignInComponent, isStandalone: true, selector: "atlas-sign-in", inputs: { afterUrl: "afterUrl", signUpUrl: "signUpUrl" }, ngImport: i0, template: `
+    @if (lastUsedLabel(); as label) {
+      <p class="atlas-text atlas-last-used-hint" data-atlas="last-used" [attr.data-atlas-method]="flow.lastMethod()">
+        {{ t('signIn.lastUsed') }}: {{ label }}
+      </p>
+    }
+    @if (flow.recoveryCodes(); as codes) {
+      <atlas-recovery-codes [codes]="codes" [busy]="flow.state().busy" (saved)="flow.saveRecoveryCodes()"></atlas-recovery-codes>
+    } @else {
     <atlas-attempt-flow
       [attempt]="flow.state().attempt"
       [busy]="flow.state().busy"
@@ -1670,15 +2717,25 @@ class SignInComponent {
       [captcha]="flow.captchaDrawn() ? flow.captcha : null"
       [firstFactors]="flow.firstFactors()"
       [preparedFactor]="flow.preparedFactor()"
+      [offerEmailSecondFactor]="flow.settings()?.account?.emailSecondFactor === true"
+      [emailedSecondFactor]="flow.emailSecondFactor()"
       (submitFlow)="flow.submit($event)"
       (chooseFactor)="flow.prepare($event)"
+      [offerSmsSecondFactor]="flow.settings() !== null && flow.mfaChoices().sms"
+      [textedSecondFactor]="flow.smsSecondFactor()"
+      [enrollment]="flow.enrollment"
+      [enrollmentState]="flow.enrollmentState()"
+      (emailSecondFactor)="flow.sendEmailSecondFactor()"
+      (smsSecondFactor)="flow.sendSmsSecondFactor()"
+      (policyDeclined)="flow.declinePolicy($event)"
     ></atlas-attempt-flow>
+    }
     @if (flow.state().attempt?.status !== 'complete' && signUpHref(); as href) {
       <p class="atlas-footer" data-atlas-sign-up-prompt="">
         {{ t('signIn.noAccount') }} <a class="atlas-link" [href]="href">{{ t('signIn.signUpLink') }}</a>
       </p>
     }
-  `, isInline: true, dependencies: [{ kind: "component", type: AttemptFlowComponent, selector: "atlas-attempt-flow", inputs: ["attempt", "busy", "errors", "sessionKept", "titleKey", "captcha", "firstFactors", "preparedFactor"], outputs: ["submitFlow", "chooseFactor"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
+  `, isInline: true, dependencies: [{ kind: "component", type: AttemptFlowComponent, selector: "atlas-attempt-flow", inputs: ["attempt", "busy", "errors", "sessionKept", "titleKey", "captcha", "firstFactors", "preparedFactor", "offerEmailSecondFactor", "emailedSecondFactor", "offerSmsSecondFactor", "textedSecondFactor", "enrollment", "enrollmentState", "emailVerification"], outputs: ["submitFlow", "chooseFactor", "emailSecondFactor", "smsSecondFactor", "resend", "policyDeclined"] }, { kind: "component", type: RecoveryCodesComponent, selector: "atlas-recovery-codes", inputs: ["codes", "busy"], outputs: ["saved"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: SignInComponent, decorators: [{
             type: Component,
@@ -1686,8 +2743,16 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
                     selector: 'atlas-sign-in',
                     standalone: true,
                     changeDetection: ChangeDetectionStrategy.OnPush,
-                    imports: [AttemptFlowComponent],
+                    imports: [AttemptFlowComponent, RecoveryCodesComponent],
                     template: `
+    @if (lastUsedLabel(); as label) {
+      <p class="atlas-text atlas-last-used-hint" data-atlas="last-used" [attr.data-atlas-method]="flow.lastMethod()">
+        {{ t('signIn.lastUsed') }}: {{ label }}
+      </p>
+    }
+    @if (flow.recoveryCodes(); as codes) {
+      <atlas-recovery-codes [codes]="codes" [busy]="flow.state().busy" (saved)="flow.saveRecoveryCodes()"></atlas-recovery-codes>
+    } @else {
     <atlas-attempt-flow
       [attempt]="flow.state().attempt"
       [busy]="flow.state().busy"
@@ -1697,9 +2762,19 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
       [captcha]="flow.captchaDrawn() ? flow.captcha : null"
       [firstFactors]="flow.firstFactors()"
       [preparedFactor]="flow.preparedFactor()"
+      [offerEmailSecondFactor]="flow.settings()?.account?.emailSecondFactor === true"
+      [emailedSecondFactor]="flow.emailSecondFactor()"
       (submitFlow)="flow.submit($event)"
       (chooseFactor)="flow.prepare($event)"
+      [offerSmsSecondFactor]="flow.settings() !== null && flow.mfaChoices().sms"
+      [textedSecondFactor]="flow.smsSecondFactor()"
+      [enrollment]="flow.enrollment"
+      [enrollmentState]="flow.enrollmentState()"
+      (emailSecondFactor)="flow.sendEmailSecondFactor()"
+      (smsSecondFactor)="flow.sendSmsSecondFactor()"
+      (policyDeclined)="flow.declinePolicy($event)"
     ></atlas-attempt-flow>
+    }
     @if (flow.state().attempt?.status !== 'complete' && signUpHref(); as href) {
       <p class="atlas-footer" data-atlas-sign-up-prompt="">
         {{ t('signIn.noAccount') }} <a class="atlas-link" [href]="href">{{ t('signIn.signUpLink') }}</a>
@@ -1723,14 +2798,37 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
  */
 class SignUpFormComponent {
     atlas = inject(AtlasService);
+    cdr = inject(ChangeDetectorRef);
+    unwatch = null;
     settings = null;
     busy = false;
     errors = [];
     captcha = null;
+    /** Passkey-only sign-up: no password field; the email per the instance's mode. */
+    passkey = null;
+    /** Whether the password / passkey toggle is shown (both are offered). */
+    switchable = false;
+    /** The instance's policies (terms, privacy, …); they replace the legacy consent row. */
+    policies = null;
+    /** The user asked for the other sign-up method. */
+    switchMode = new EventEmitter();
     /** Emits the typed values and the consent tick when the form is submitted. */
     submitSignUp = new EventEmitter();
     values = {};
     agreed = false;
+    declined = null;
+    ngOnChanges(changes) {
+        if (!changes['policies'])
+            return;
+        this.unwatch?.();
+        this.unwatch = this.policies?.subscribe(() => this.cdr.markForCheck()) ?? null;
+    }
+    ngOnDestroy() {
+        this.unwatch?.();
+    }
+    hasPolicies() {
+        return !!this.policies && this.policies.policies.length > 0;
+    }
     t(key, vars) {
         return translate(this.atlas.localization, key, vars);
     }
@@ -1748,8 +2846,17 @@ class SignUpFormComponent {
     }
     /** Email + password sign-up cannot complete: the app cannot send the verification email. */
     emailUnavailable() {
+        // A passkey sign-up that collects no email (or an unproven one) sends no mail.
+        if (this.passkey && this.passkey.email !== 'required')
+            return false;
         return this.settings?.emailDelivery?.passwordSignUp === false;
     }
+    showEmail() {
+        return !this.passkey || this.passkey.email !== 'off';
+    }
+    emailRequired() {
+        return !this.passkey || this.passkey.email === 'required';
+    }
     fields() {
         return this.settings?.signUpFields ?? [];
     }
@@ -1774,10 +2881,15 @@ class SignUpFormComponent {
         this.setValue(f.key, (on ? [...current, option] : current.filter((p) => p !== option)).join(', '));
     }
     showLegal() {
+        // Instance policies replace the legacy single "I agree to the Terms" row.
+        if (this.hasPolicies())
+            return false;
         const legal = this.settings?.legal;
         return !!legal && (!!legal.termsUrl || !!legal.privacyUrl);
     }
     consentOk() {
+        if (this.hasPolicies())
+            return this.policies.canSubmit();
         return !this.settings?.legal?.required || this.agreed;
     }
     formErrors() {
@@ -1790,13 +2902,27 @@ class SignUpFormComponent {
         event.preventDefault();
         if (this.emailUnavailable() || !this.consentOk())
             return;
+        this.declined = null;
+        if (this.hasPolicies()) {
+            // Scroll-mode policies are read in their unskippable dialog first.
+            const values = { ...this.values };
+            void confirmPolicies(this.policies, { t: policyUi(this.atlas).t }).then((res) => {
+                if (res.ok)
+                    this.submitSignUp.emit({ values, consent: true });
+                else {
+                    this.declined = res.declined;
+                    this.cdr.markForCheck();
+                }
+            });
+            return;
+        }
         this.submitSignUp.emit({
             values: { ...this.values },
             consent: this.settings?.legal?.required ? this.agreed : true,
         });
     }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: SignUpFormComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: SignUpFormComponent, isStandalone: true, selector: "atlas-sign-up-form", inputs: { settings: "settings", busy: "busy", errors: "errors", captcha: "captcha" }, outputs: { submitSignUp: "submitSignUp" }, ngImport: i0, template: `
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: SignUpFormComponent, isStandalone: true, selector: "atlas-sign-up-form", inputs: { settings: "settings", busy: "busy", errors: "errors", captcha: "captcha", passkey: "passkey", switchable: "switchable", policies: "policies" }, outputs: { switchMode: "switchMode", submitSignUp: "submitSignUp" }, usesOnChanges: true, ngImport: i0, template: `
     <div [class]="cls('card', 'atlas-card')">
       <h1 [class]="cls('headerTitle', 'atlas-title')">{{ t('signUp.title') }}</h1>
 
@@ -1885,14 +3011,17 @@ class SignUpFormComponent {
           }
         }
 
+        @if (showEmail()) {
         <label [class]="cls('formField', 'atlas-field')">
-          <span [class]="cls('formFieldLabel', 'atlas-field-label')">{{ t('signUp.emailLabel') }}</span>
+          <span [class]="cls('formFieldLabel', 'atlas-field-label')">{{
+            emailRequired() ? t('signUp.emailLabel') : t('signUp.optionalField', { label: t('signUp.emailLabel') })
+          }}</span>
           <input
             [class]="cls('formFieldInput', 'atlas-input')"
             type="email"
             name="email"
             autocomplete="email"
-            required
+            [required]="emailRequired()"
             [value]="values['email'] ?? ''"
             (input)="setValue('email', $any($event.target).value)"
           />
@@ -1900,7 +3029,11 @@ class SignUpFormComponent {
             <span [class]="cls('formFieldError', 'atlas-error')">{{ errorText(error) }}</span>
           }
         </label>
+        }
 
+        @if (passkey) {
+          <p class="atlas-text">{{ t('signUp.passkeyIntro') }}</p>
+        } @else {
         <label [class]="cls('formField', 'atlas-field')">
           <span [class]="cls('formFieldLabel', 'atlas-field-label')">{{ t('signUp.passwordLabel') }}</span>
           <input
@@ -1916,6 +3049,16 @@ class SignUpFormComponent {
             <span [class]="cls('formFieldError', 'atlas-error')">{{ errorText(error) }}</span>
           }
         </label>
+        }
+
+        @if (hasPolicies()) {
+          <div [atlasPolicies]="policies"></div>
+          @if (declined) {
+            <span [class]="cls('formFieldError', 'atlas-error')" role="alert" data-atlas-policy-declined="">
+              {{ t('policy.declined', { policy: declined }) }}
+            </span>
+          }
+        }
 
         @if (showLegal()) {
           <label [class]="cls('formField', 'atlas-consent')">
@@ -1956,10 +3099,26 @@ class SignUpFormComponent {
         >
           {{ t('signUp.submit') }}
         </button>
+        @if (hasPolicies()) {
+          <p atlasPolicyKind="clickwrap" [atlasPolicies]="policies"></p>
+        }
+        @if (switchable) {
+          <div class="atlas-alternatives">
+            <button
+              type="button"
+              [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+              [attr.data-atlas-sign-up-mode]="passkey ? 'password' : 'passkey'"
+              [disabled]="busy"
+              (click)="switchMode.emit()"
+            >
+              {{ t(passkey ? 'signUp.passwordOption' : 'signUp.passkeyOption') }}
+            </button>
+          </div>
+        }
       </form>
       }
     </div>
-  `, isInline: true, dependencies: [{ kind: "directive", type: AtlasCaptchaSlotDirective, selector: "[atlasCaptchaSlot]", inputs: ["atlasCaptchaSlot"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
+  `, isInline: true, dependencies: [{ kind: "directive", type: AtlasCaptchaSlotDirective, selector: "[atlasCaptchaSlot]", inputs: ["atlasCaptchaSlot"] }, { kind: "directive", type: AtlasPoliciesDirective, selector: "[atlasPolicies]", inputs: ["atlasPolicies", "atlasPolicyKind"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: SignUpFormComponent, decorators: [{
             type: Component,
@@ -1967,7 +3126,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
                     selector: 'atlas-sign-up-form',
                     standalone: true,
                     changeDetection: ChangeDetectionStrategy.OnPush,
-                    imports: [AtlasCaptchaSlotDirective],
+                    imports: [AtlasCaptchaSlotDirective, AtlasPoliciesDirective],
                     template: `
     <div [class]="cls('card', 'atlas-card')">
       <h1 [class]="cls('headerTitle', 'atlas-title')">{{ t('signUp.title') }}</h1>
@@ -2057,14 +3216,17 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
           }
         }
 
+        @if (showEmail()) {
         <label [class]="cls('formField', 'atlas-field')">
-          <span [class]="cls('formFieldLabel', 'atlas-field-label')">{{ t('signUp.emailLabel') }}</span>
+          <span [class]="cls('formFieldLabel', 'atlas-field-label')">{{
+            emailRequired() ? t('signUp.emailLabel') : t('signUp.optionalField', { label: t('signUp.emailLabel') })
+          }}</span>
           <input
             [class]="cls('formFieldInput', 'atlas-input')"
             type="email"
             name="email"
             autocomplete="email"
-            required
+            [required]="emailRequired()"
             [value]="values['email'] ?? ''"
             (input)="setValue('email', $any($event.target).value)"
           />
@@ -2072,7 +3234,11 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
             <span [class]="cls('formFieldError', 'atlas-error')">{{ errorText(error) }}</span>
           }
         </label>
+        }
 
+        @if (passkey) {
+          <p class="atlas-text">{{ t('signUp.passkeyIntro') }}</p>
+        } @else {
         <label [class]="cls('formField', 'atlas-field')">
           <span [class]="cls('formFieldLabel', 'atlas-field-label')">{{ t('signUp.passwordLabel') }}</span>
           <input
@@ -2088,6 +3254,16 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
             <span [class]="cls('formFieldError', 'atlas-error')">{{ errorText(error) }}</span>
           }
         </label>
+        }
+
+        @if (hasPolicies()) {
+          <div [atlasPolicies]="policies"></div>
+          @if (declined) {
+            <span [class]="cls('formFieldError', 'atlas-error')" role="alert" data-atlas-policy-declined="">
+              {{ t('policy.declined', { policy: declined }) }}
+            </span>
+          }
+        }
 
         @if (showLegal()) {
           <label [class]="cls('formField', 'atlas-consent')">
@@ -2128,6 +3304,22 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
         >
           {{ t('signUp.submit') }}
         </button>
+        @if (hasPolicies()) {
+          <p atlasPolicyKind="clickwrap" [atlasPolicies]="policies"></p>
+        }
+        @if (switchable) {
+          <div class="atlas-alternatives">
+            <button
+              type="button"
+              [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+              [attr.data-atlas-sign-up-mode]="passkey ? 'password' : 'passkey'"
+              [disabled]="busy"
+              (click)="switchMode.emit()"
+            >
+              {{ t(passkey ? 'signUp.passwordOption' : 'signUp.passkeyOption') }}
+            </button>
+          </div>
+        }
       </form>
       }
     </div>
@@ -2141,6 +3333,14 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
                 type: Input
             }], captcha: [{
                 type: Input
+            }], passkey: [{
+                type: Input
+            }], switchable: [{
+                type: Input
+            }], policies: [{
+                type: Input
+            }], switchMode: [{
+                type: Output
             }], submitSignUp: [{
                 type: Output
             }] } });
@@ -2162,24 +3362,70 @@ class SignUpComponent {
     /** Where to send the user once the flow completes. Reserved for host routing. */
     afterUrl;
     flow = new AtlasFlowController(this.atlas.createFapiClient(), () => this.atlas.reload(), this.atlas.pendingAttempt, (key) => translate(this.atlas.localization, key));
+    /** Password or passkey-only sign-up (the latter when the instance offers it). */
+    mode = signal('password');
+    canPasskey() {
+        return !!this.flow.settings()?.account.passkeySignUp && passkeysSupported();
+    }
+    passkeyForm() {
+        const offer = this.flow.settings()?.account.passkeySignUp ?? null;
+        return this.mode() === 'passkey' && offer && this.canPasskey() ? { email: offer.email } : null;
+    }
+    toggleMode() {
+        this.flow.state.update((current) => ({ ...current, errors: [] }));
+        this.mode.set(this.passkeyForm() ? 'password' : 'passkey');
+    }
+    awaitingPasskey() {
+        return awaitingPasskey(this.flow.state().attempt);
+    }
+    t(key) {
+        return translate(this.atlas.localization, key);
+    }
+    cls(key, base) {
+        return classFor(key, this.atlas.appearance, base);
+    }
+    errorText(error) {
+        const layer = this.atlas.errorLocalization;
+        return localizedErrorMessage(error, layer ?? this.atlas.localization, this.atlas.localization);
+    }
     ngOnInit() {
         // §5 the instance's sign-up fields, consent policy and captcha settings.
-        if (typeof window !== 'undefined')
+        if (typeof window !== 'undefined') {
             void this.flow.loadSettings();
+            void this.flow.loadPolicies(this.atlas.locale ?? undefined);
+        }
     }
     ngOnDestroy() {
         this.flow.destroy();
     }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: SignUpComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
     static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: SignUpComponent, isStandalone: true, selector: "atlas-sign-up", inputs: { afterUrl: "afterUrl" }, ngImport: i0, template: `
-    @if (flow.state().attempt) {
+    @if (awaitingPasskey()) {
+      <div [class]="cls('card', 'atlas-card')" data-atlas-passkey-sign-up="">
+        <h1 [class]="cls('headerTitle', 'atlas-title')">{{ t('signUp.title') }}</h1>
+        @for (error of flow.state().errors; track error.code) {
+          <p [class]="cls('formFieldError', 'atlas-error')" role="alert">{{ errorText(error) }}</p>
+        }
+        <p class="atlas-text">{{ t('signUp.passkeyPrompt') }}</p>
+        <button
+          [class]="cls('formButtonPrimary', 'atlas-button')"
+          type="button"
+          [disabled]="flow.state().busy"
+          (click)="flow.createPasskey()"
+        >
+          {{ t('signUp.passkeyCreate') }}
+        </button>
+      </div>
+    } @else if (flow.state().attempt) {
       <atlas-attempt-flow
         [attempt]="flow.state().attempt"
         [busy]="flow.state().busy"
         [errors]="flow.state().errors"
         [sessionKept]="flow.state().sessionKept"
         titleKey="signUp.title"
+        [emailVerification]="flow.settings()?.account?.emailVerification ?? 'code'"
         (submitFlow)="flow.submit($event)"
+        (resend)="flow.resendSignUp()"
       ></atlas-attempt-flow>
     } @else {
       <atlas-sign-up-form
@@ -2187,10 +3433,16 @@ class SignUpComponent {
         [busy]="flow.state().busy"
         [errors]="flow.state().errors"
         [captcha]="flow.signUpCaptchaDrawn() ? flow.signUpCaptcha : null"
-        (submitSignUp)="flow.create($event.values, $event.consent)"
+        [policies]="flow.policies"
+        [passkey]="passkeyForm()"
+        [switchable]="canPasskey()"
+        (switchMode)="toggleMode()"
+        (submitSignUp)="
+          passkeyForm() ? flow.createWithPasskey($event.values, $event.consent) : flow.create($event.values, $event.consent)
+        "
       ></atlas-sign-up-form>
     }
-  `, isInline: true, dependencies: [{ kind: "component", type: AttemptFlowComponent, selector: "atlas-attempt-flow", inputs: ["attempt", "busy", "errors", "sessionKept", "titleKey", "captcha", "firstFactors", "preparedFactor"], outputs: ["submitFlow", "chooseFactor"] }, { kind: "component", type: SignUpFormComponent, selector: "atlas-sign-up-form", inputs: ["settings", "busy", "errors", "captcha"], outputs: ["submitSignUp"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
+  `, isInline: true, dependencies: [{ kind: "component", type: AttemptFlowComponent, selector: "atlas-attempt-flow", inputs: ["attempt", "busy", "errors", "sessionKept", "titleKey", "captcha", "firstFactors", "preparedFactor", "offerEmailSecondFactor", "emailedSecondFactor", "offerSmsSecondFactor", "textedSecondFactor", "enrollment", "enrollmentState", "emailVerification"], outputs: ["submitFlow", "chooseFactor", "emailSecondFactor", "smsSecondFactor", "resend", "policyDeclined"] }, { kind: "component", type: SignUpFormComponent, selector: "atlas-sign-up-form", inputs: ["settings", "busy", "errors", "captcha", "passkey", "switchable", "policies"], outputs: ["switchMode", "submitSignUp"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: SignUpComponent, decorators: [{
             type: Component,
@@ -2200,14 +3452,32 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
                     changeDetection: ChangeDetectionStrategy.OnPush,
                     imports: [AttemptFlowComponent, SignUpFormComponent],
                     template: `
-    @if (flow.state().attempt) {
+    @if (awaitingPasskey()) {
+      <div [class]="cls('card', 'atlas-card')" data-atlas-passkey-sign-up="">
+        <h1 [class]="cls('headerTitle', 'atlas-title')">{{ t('signUp.title') }}</h1>
+        @for (error of flow.state().errors; track error.code) {
+          <p [class]="cls('formFieldError', 'atlas-error')" role="alert">{{ errorText(error) }}</p>
+        }
+        <p class="atlas-text">{{ t('signUp.passkeyPrompt') }}</p>
+        <button
+          [class]="cls('formButtonPrimary', 'atlas-button')"
+          type="button"
+          [disabled]="flow.state().busy"
+          (click)="flow.createPasskey()"
+        >
+          {{ t('signUp.passkeyCreate') }}
+        </button>
+      </div>
+    } @else if (flow.state().attempt) {
       <atlas-attempt-flow
         [attempt]="flow.state().attempt"
         [busy]="flow.state().busy"
         [errors]="flow.state().errors"
         [sessionKept]="flow.state().sessionKept"
         titleKey="signUp.title"
+        [emailVerification]="flow.settings()?.account?.emailVerification ?? 'code'"
         (submitFlow)="flow.submit($event)"
+        (resend)="flow.resendSignUp()"
       ></atlas-attempt-flow>
     } @else {
       <atlas-sign-up-form
@@ -2215,7 +3485,13 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
         [busy]="flow.state().busy"
         [errors]="flow.state().errors"
         [captcha]="flow.signUpCaptchaDrawn() ? flow.signUpCaptcha : null"
-        (submitSignUp)="flow.create($event.values, $event.consent)"
+        [policies]="flow.policies"
+        [passkey]="passkeyForm()"
+        [switchable]="canPasskey()"
+        (switchMode)="toggleMode()"
+        (submitSignUp)="
+          passkeyForm() ? flow.createWithPasskey($event.values, $event.consent) : flow.create($event.values, $event.consent)
+        "
       ></atlas-sign-up-form>
     }
   `,
@@ -2549,32 +3825,392 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
         }] });
 
 /**
- * `<atlas-organization-profile>` — the active organization's surface. The
- * Angular peer of React's `<OrganizationProfile/>`. Management controls are
- * gated on the ACTIVE org role via `*atlasProtect`, matching the server's rule
- * rather than duplicating a looser one. Renders nothing with no active org.
+ * `<atlas-organization-profile>` — the active organization's members (admins
+ * change roles and remove), invitations (admins invite, revoke and resend) and
+ * settings (leave; an admin deletes after confirming their password). The
+ * Angular peer of React's `<OrganizationProfile/>`, on the same headless
+ * controller. Every control is gated on the ACTIVE org role, matching the
+ * server's rule. Renders nothing with no active org. Emits `exit` with `left`
+ * or `deleted`.
  */
 class OrganizationProfileComponent {
     atlas = inject(AtlasService);
-    t(key) {
-        return translate(this.atlas.localization, key);
+    exit = new EventEmitter();
+    client = this.atlas.createFapiClient();
+    controller = null;
+    unsubscribe = null;
+    state = signal(null);
+    tab = signal('members');
+    email = signal('');
+    inviteRole = signal('org:member');
+    confirm = signal(null);
+    needsPassword = signal(false);
+    password = signal('');
+    // The custom-role editor: null = creating, else the id of the role being edited.
+    editingRole = signal(null);
+    roleKey = signal('');
+    roleName = signal('');
+    rolePerms = signal([]);
+    customRoles = computed(() => (this.state()?.roles ?? []).filter((r) => Boolean(r.organization_id)));
+    userId = computed(() => this.atlas.claims()?.sub ?? null);
+    canManage = computed(() => {
+        this.atlas.claims();
+        return this.atlas.has({ permission: 'org:sys_memberships:manage' });
+    });
+    isAdmin = computed(() => this.atlas.organization()?.role === 'org:admin');
+    tabs = computed(() => ['members', ...(this.canManage() ? ['invitations', 'roles'] : []), 'settings']);
+    roles = computed(() => {
+        const roles = this.state()?.roles ?? [];
+        return roles.length > 0 ? roles : [{ key: 'org:member', name: 'org:member' }];
+    });
+    errorMessage = computed(() => {
+        const err = this.state()?.error;
+        if (!err || err.needsReverification)
+            return null;
+        return localizedErrorMessage(err, this.atlas.errorLocalization, this.atlas.localization);
+    });
+    constructor() {
+        effect(() => {
+            const id = this.atlas.organization()?.organization.id ?? null;
+            untracked(() => this.bind(id));
+        });
+        inject(DestroyRef).onDestroy(() => this.unsubscribe?.());
+    }
+    bind(id) {
+        if (this.controller?.organizationId === id)
+            return;
+        this.unsubscribe?.();
+        this.controller = null;
+        this.state.set(null);
+        if (!id)
+            return;
+        const controller = new OrganizationProfileController(this.client, id, {
+            canManage: this.canManage(),
+            onChange: async () => {
+                await this.atlas.reload();
+            },
+        });
+        this.controller = controller;
+        this.unsubscribe = controller.subscribe((next) => this.state.set(next));
+        this.state.set(controller.getState());
+        void controller.load();
+    }
+    t(key, vars) {
+        return translate(this.atlas.localization, key, vars);
     }
     cls(key, base) {
         return classFor(key, this.atlas.appearance, base);
     }
+    memberName(m) {
+        return [m.user?.first_name, m.user?.last_name].filter(Boolean).join(' ') || this.t('organization.unnamedMember');
+    }
+    changeRole(userId, role) {
+        void this.controller?.changeRole(userId, role);
+    }
+    removeMember(userId) {
+        void this.controller?.removeMember(userId);
+    }
+    async sendInvite() {
+        const address = this.email().trim();
+        if (this.controller && address && (await this.controller.invite(address, this.inviteRole())))
+            this.email.set('');
+    }
+    resend(id) {
+        void this.controller?.resendInvitation(id);
+    }
+    revoke(id) {
+        void this.controller?.revokeInvitation(id);
+    }
+    async leave() {
+        if (this.controller && (await this.controller.leave()))
+            this.exit.emit('left');
+        this.confirm.set(null);
+    }
+    async remove() {
+        const controller = this.controller;
+        if (!controller)
+            return;
+        if (this.needsPassword()) {
+            try {
+                await this.atlas.reauthenticate(this.password());
+            }
+            catch {
+                return;
+            }
+            this.password.set('');
+            this.needsPassword.set(false);
+        }
+        if (await controller.deleteOrganization()) {
+            this.exit.emit('deleted');
+            this.confirm.set(null);
+            return;
+        }
+        const err = controller.getState().error;
+        if (err?.needsReverification)
+            this.needsPassword.set(true);
+    }
+    editRole(role) {
+        this.editingRole.set(role.id ?? null);
+        this.roleKey.set(role.key);
+        this.roleName.set(role.name);
+        this.rolePerms.set([...(role.permissions ?? [])]);
+    }
+    resetRoleForm() {
+        this.editingRole.set(null);
+        this.roleKey.set('');
+        this.roleName.set('');
+        this.rolePerms.set([]);
+    }
+    togglePermission(key, on) {
+        this.rolePerms.update((current) => (on ? [...current, key] : current.filter((k) => k !== key)));
+    }
+    async saveRole() {
+        const controller = this.controller;
+        if (!controller)
+            return;
+        const editing = this.editingRole();
+        const out = editing
+            ? await controller.updateRole(editing, { name: this.roleName().trim(), permissions: this.rolePerms() })
+            : await controller.createRole({ key: this.roleKey().trim(), name: this.roleName().trim(), permissions: this.rolePerms() });
+        if (out)
+            this.resetRoleForm();
+    }
+    deleteRole(role) {
+        if (role.id)
+            void this.controller?.deleteRole(role.id);
+    }
+    cancel() {
+        this.confirm.set(null);
+        this.needsPassword.set(false);
+        this.password.set('');
+    }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: OrganizationProfileComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: OrganizationProfileComponent, isStandalone: true, selector: "atlas-organization-profile", ngImport: i0, template: `
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: OrganizationProfileComponent, isStandalone: true, selector: "atlas-organization-profile", outputs: { exit: "exit" }, ngImport: i0, template: `
     @if (atlas.organization(); as membership) {
-      <div [class]="cls('card', 'atlas-card')">
-        <h1>{{ membership.organization.name }}</h1>
-        <p>{{ t('organization.roleLabel') }}: {{ membership.role }}</p>
+      @if (state(); as st) {
+        <div [class]="cls('card', 'atlas-card')" data-atlas="organization-profile">
+          <h1>{{ membership.organization.name }}</h1>
+          <p>{{ t('organization.roleLabel') }}: {{ membership.role }}</p>
 
-        <button *atlasProtect="{ permission: 'org:sys_memberships:manage' }">
-          {{ t('organization.invite') }}
-        </button>
-      </div>
+          <div [class]="cls('menu', 'atlas-menu')" role="tablist">
+            @for (key of tabs(); track key) {
+              <button
+                type="button"
+                role="tab"
+                [attr.aria-selected]="tab() === key"
+                [class]="cls('menuItem', 'atlas-menu-item')"
+                [attr.data-atlas]="'organization-tab-' + key"
+                (click)="tab.set(key)"
+              >
+                {{ t('organization.' + key) }}
+              </button>
+            }
+          </div>
+
+          @if (errorMessage(); as message) {
+            <p [class]="cls('formFieldError', 'atlas-error')" role="alert">{{ message }}</p>
+          }
+
+          @if (tab() === 'members') {
+            <ul class="atlas-list" data-atlas="organization-members">
+              @for (m of st.members; track m.id) {
+                <li data-atlas="organization-member">
+                  <span>{{ memberName(m) }}{{ m.user?.id === userId() ? ' ' + t('organization.you') : '' }}</span>
+                  @if (canManage() && m.user && m.user.id !== userId()) {
+                    <select
+                      [attr.aria-label]="t('organization.roleLabel')"
+                      [class]="cls('formFieldInput', 'atlas-input')"
+                      [disabled]="st.busy === 'role:' + m.user.id"
+                      (change)="changeRole(m.user.id, $any($event.target).value)"
+                    >
+                      @for (r of roles(); track r.key) {
+                        <option [value]="r.key" [selected]="r.key === m.role">{{ r.name }}</option>
+                      }
+                    </select>
+                    <button
+                      type="button"
+                      [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+                      [disabled]="st.busy === 'remove:' + m.user.id"
+                      (click)="removeMember(m.user.id)"
+                    >
+                      {{ t('organization.remove') }}
+                    </button>
+                  } @else {
+                    <span> · {{ m.role }}</span>
+                  }
+                </li>
+              }
+            </ul>
+          }
+
+          @if (tab() === 'invitations' && canManage()) {
+            <div data-atlas="organization-invitations">
+              <form (submit)="$event.preventDefault(); sendInvite()">
+                <label [class]="cls('formField', 'atlas-field')">
+                  <span [class]="cls('formFieldLabel', 'atlas-field-label')">{{ t('organization.emailLabel') }}</span>
+                  <input
+                    type="email"
+                    [class]="cls('formFieldInput', 'atlas-input')"
+                    [value]="email()"
+                    (input)="email.set($any($event.target).value)"
+                  />
+                </label>
+                <label [class]="cls('formField', 'atlas-field')">
+                  <span [class]="cls('formFieldLabel', 'atlas-field-label')">{{ t('organization.roleLabel') }}</span>
+                  <select [class]="cls('formFieldInput', 'atlas-input')" (change)="inviteRole.set($any($event.target).value)">
+                    @for (r of roles(); track r.key) {
+                      <option [value]="r.key" [selected]="r.key === inviteRole()">{{ r.name }}</option>
+                    }
+                  </select>
+                </label>
+                <button
+                  type="submit"
+                  [class]="cls('formButtonPrimary', 'atlas-button')"
+                  [disabled]="st.busy === 'invite' || !email().trim()"
+                >
+                  {{ t('organization.sendInvite') }}
+                </button>
+              </form>
+              @if (st.invitations.length === 0) {
+                <p class="atlas-text">{{ t('organization.noInvitations') }}</p>
+              } @else {
+                <ul class="atlas-list">
+                  @for (inv of st.invitations; track inv.id) {
+                    <li data-atlas="organization-invitation">
+                      <span>{{ inv.email_address }} · {{ inv.role }}</span>
+                      <button type="button" [class]="cls('formButtonSecondary', 'atlas-button-secondary')" (click)="resend(inv.id)">
+                        {{ t('organization.resend') }}
+                      </button>
+                      <button type="button" [class]="cls('formButtonSecondary', 'atlas-button-secondary')" (click)="revoke(inv.id)">
+                        {{ t('organization.revoke') }}
+                      </button>
+                    </li>
+                  }
+                </ul>
+              }
+            </div>
+          }
+
+          @if (tab() === 'roles' && canManage()) {
+            <div data-atlas="organization-roles">
+              @if (customRoles().length === 0) {
+                <p class="atlas-text">{{ t('organization.noCustomRoles') }}</p>
+              } @else {
+                <ul class="atlas-list">
+                  @for (role of customRoles(); track role.key) {
+                    <li data-atlas="organization-role">
+                      <span>{{ role.name }} · {{ role.key }}</span>
+                      <button type="button" [class]="cls('formButtonSecondary', 'atlas-button-secondary')" (click)="editRole(role)">
+                        {{ t('organization.editRole') }}
+                      </button>
+                      <button
+                        type="button"
+                        [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+                        [disabled]="!role.id || st.busy === 'role:delete:' + role.id"
+                        (click)="deleteRole(role)"
+                      >
+                        {{ t('organization.deleteRole') }}
+                      </button>
+                    </li>
+                  }
+                </ul>
+              }
+              <form data-atlas="organization-role-form" (submit)="$event.preventDefault(); saveRole()">
+                @if (!editingRole()) {
+                  <label [class]="cls('formField', 'atlas-field')">
+                    <span [class]="cls('formFieldLabel', 'atlas-field-label')">{{ t('organization.roleKey') }}</span>
+                    <input
+                      name="role_key"
+                      [class]="cls('formFieldInput', 'atlas-input')"
+                      [value]="roleKey()"
+                      (input)="roleKey.set($any($event.target).value)"
+                    />
+                  </label>
+                }
+                <label [class]="cls('formField', 'atlas-field')">
+                  <span [class]="cls('formFieldLabel', 'atlas-field-label')">{{ t('organization.roleName') }}</span>
+                  <input
+                    name="role_name"
+                    [class]="cls('formFieldInput', 'atlas-input')"
+                    [value]="roleName()"
+                    (input)="roleName.set($any($event.target).value)"
+                  />
+                </label>
+                <fieldset [class]="cls('formField', 'atlas-field')">
+                  <legend [class]="cls('formFieldLabel', 'atlas-field-label')">{{ t('organization.rolePermissions') }}</legend>
+                  @for (p of st.permissions; track p.key) {
+                    <label data-atlas="organization-role-permission">
+                      <input
+                        type="checkbox"
+                        [value]="p.key"
+                        [checked]="rolePerms().includes(p.key)"
+                        (change)="togglePermission(p.key, $any($event.target).checked)"
+                      />
+                      {{ p.name }}
+                    </label>
+                  }
+                </fieldset>
+                <button
+                  type="submit"
+                  [class]="cls('formButtonPrimary', 'atlas-button')"
+                  [disabled]="!roleName().trim() || (!editingRole() && !roleKey().trim()) || (st.busy ?? '').startsWith('role:')"
+                >
+                  {{ editingRole() ? t('organization.saveRole') : t('organization.createRole') }}
+                </button>
+                @if (editingRole()) {
+                  <button type="button" [class]="cls('formButtonSecondary', 'atlas-button-secondary')" (click)="resetRoleForm()">
+                    {{ t('organization.cancel') }}
+                  </button>
+                }
+              </form>
+            </div>
+          }
+
+          @if (tab() === 'settings') {
+            <div data-atlas="organization-settings">
+              @if (confirm(); as action) {
+                <p class="atlas-text">
+                  {{ t(action === 'leave' ? 'organization.leaveConfirm' : 'organization.deleteConfirm', { name: membership.organization.name }) }}
+                </p>
+                @if (needsPassword()) {
+                  <label [class]="cls('formField', 'atlas-field')">
+                    <span [class]="cls('formFieldLabel', 'atlas-field-label')">{{ t('organization.passwordPrompt') }}</span>
+                    <input
+                      type="password"
+                      autocomplete="current-password"
+                      [class]="cls('formFieldInput', 'atlas-input')"
+                      [value]="password()"
+                      (input)="password.set($any($event.target).value)"
+                    />
+                  </label>
+                }
+                <button
+                  type="button"
+                  [class]="cls('formButtonPrimary', 'atlas-button')"
+                  [disabled]="st.busy === 'leave' || st.busy === 'delete'"
+                  (click)="action === 'leave' ? leave() : remove()"
+                >
+                  {{ t('organization.confirm') }}
+                </button>
+                <button type="button" [class]="cls('formButtonSecondary', 'atlas-button-secondary')" (click)="cancel()">
+                  {{ t('organization.cancel') }}
+                </button>
+              } @else {
+                <button type="button" [class]="cls('formButtonSecondary', 'atlas-button-secondary')" (click)="confirm.set('leave')">
+                  {{ t('organization.leave') }}
+                </button>
+                @if (isAdmin()) {
+                  <button type="button" [class]="cls('formButtonSecondary', 'atlas-button-secondary')" (click)="confirm.set('delete')">
+                    {{ t('organization.delete') }}
+                  </button>
+                }
+              }
+            </div>
+          }
+        </div>
+      }
     }
-  `, isInline: true, dependencies: [{ kind: "directive", type: AtlasProtectDirective, selector: "[atlasProtect]", inputs: ["atlasProtect", "atlasProtectElse"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
+  `, isInline: true, changeDetection: i0.ChangeDetectionStrategy.OnPush });
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: OrganizationProfileComponent, decorators: [{
             type: Component,
@@ -2582,21 +4218,346 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
                     selector: 'atlas-organization-profile',
                     standalone: true,
                     changeDetection: ChangeDetectionStrategy.OnPush,
-                    imports: [AtlasProtectDirective],
                     template: `
     @if (atlas.organization(); as membership) {
-      <div [class]="cls('card', 'atlas-card')">
-        <h1>{{ membership.organization.name }}</h1>
-        <p>{{ t('organization.roleLabel') }}: {{ membership.role }}</p>
+      @if (state(); as st) {
+        <div [class]="cls('card', 'atlas-card')" data-atlas="organization-profile">
+          <h1>{{ membership.organization.name }}</h1>
+          <p>{{ t('organization.roleLabel') }}: {{ membership.role }}</p>
 
-        <button *atlasProtect="{ permission: 'org:sys_memberships:manage' }">
-          {{ t('organization.invite') }}
-        </button>
+          <div [class]="cls('menu', 'atlas-menu')" role="tablist">
+            @for (key of tabs(); track key) {
+              <button
+                type="button"
+                role="tab"
+                [attr.aria-selected]="tab() === key"
+                [class]="cls('menuItem', 'atlas-menu-item')"
+                [attr.data-atlas]="'organization-tab-' + key"
+                (click)="tab.set(key)"
+              >
+                {{ t('organization.' + key) }}
+              </button>
+            }
+          </div>
+
+          @if (errorMessage(); as message) {
+            <p [class]="cls('formFieldError', 'atlas-error')" role="alert">{{ message }}</p>
+          }
+
+          @if (tab() === 'members') {
+            <ul class="atlas-list" data-atlas="organization-members">
+              @for (m of st.members; track m.id) {
+                <li data-atlas="organization-member">
+                  <span>{{ memberName(m) }}{{ m.user?.id === userId() ? ' ' + t('organization.you') : '' }}</span>
+                  @if (canManage() && m.user && m.user.id !== userId()) {
+                    <select
+                      [attr.aria-label]="t('organization.roleLabel')"
+                      [class]="cls('formFieldInput', 'atlas-input')"
+                      [disabled]="st.busy === 'role:' + m.user.id"
+                      (change)="changeRole(m.user.id, $any($event.target).value)"
+                    >
+                      @for (r of roles(); track r.key) {
+                        <option [value]="r.key" [selected]="r.key === m.role">{{ r.name }}</option>
+                      }
+                    </select>
+                    <button
+                      type="button"
+                      [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+                      [disabled]="st.busy === 'remove:' + m.user.id"
+                      (click)="removeMember(m.user.id)"
+                    >
+                      {{ t('organization.remove') }}
+                    </button>
+                  } @else {
+                    <span> · {{ m.role }}</span>
+                  }
+                </li>
+              }
+            </ul>
+          }
+
+          @if (tab() === 'invitations' && canManage()) {
+            <div data-atlas="organization-invitations">
+              <form (submit)="$event.preventDefault(); sendInvite()">
+                <label [class]="cls('formField', 'atlas-field')">
+                  <span [class]="cls('formFieldLabel', 'atlas-field-label')">{{ t('organization.emailLabel') }}</span>
+                  <input
+                    type="email"
+                    [class]="cls('formFieldInput', 'atlas-input')"
+                    [value]="email()"
+                    (input)="email.set($any($event.target).value)"
+                  />
+                </label>
+                <label [class]="cls('formField', 'atlas-field')">
+                  <span [class]="cls('formFieldLabel', 'atlas-field-label')">{{ t('organization.roleLabel') }}</span>
+                  <select [class]="cls('formFieldInput', 'atlas-input')" (change)="inviteRole.set($any($event.target).value)">
+                    @for (r of roles(); track r.key) {
+                      <option [value]="r.key" [selected]="r.key === inviteRole()">{{ r.name }}</option>
+                    }
+                  </select>
+                </label>
+                <button
+                  type="submit"
+                  [class]="cls('formButtonPrimary', 'atlas-button')"
+                  [disabled]="st.busy === 'invite' || !email().trim()"
+                >
+                  {{ t('organization.sendInvite') }}
+                </button>
+              </form>
+              @if (st.invitations.length === 0) {
+                <p class="atlas-text">{{ t('organization.noInvitations') }}</p>
+              } @else {
+                <ul class="atlas-list">
+                  @for (inv of st.invitations; track inv.id) {
+                    <li data-atlas="organization-invitation">
+                      <span>{{ inv.email_address }} · {{ inv.role }}</span>
+                      <button type="button" [class]="cls('formButtonSecondary', 'atlas-button-secondary')" (click)="resend(inv.id)">
+                        {{ t('organization.resend') }}
+                      </button>
+                      <button type="button" [class]="cls('formButtonSecondary', 'atlas-button-secondary')" (click)="revoke(inv.id)">
+                        {{ t('organization.revoke') }}
+                      </button>
+                    </li>
+                  }
+                </ul>
+              }
+            </div>
+          }
+
+          @if (tab() === 'roles' && canManage()) {
+            <div data-atlas="organization-roles">
+              @if (customRoles().length === 0) {
+                <p class="atlas-text">{{ t('organization.noCustomRoles') }}</p>
+              } @else {
+                <ul class="atlas-list">
+                  @for (role of customRoles(); track role.key) {
+                    <li data-atlas="organization-role">
+                      <span>{{ role.name }} · {{ role.key }}</span>
+                      <button type="button" [class]="cls('formButtonSecondary', 'atlas-button-secondary')" (click)="editRole(role)">
+                        {{ t('organization.editRole') }}
+                      </button>
+                      <button
+                        type="button"
+                        [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+                        [disabled]="!role.id || st.busy === 'role:delete:' + role.id"
+                        (click)="deleteRole(role)"
+                      >
+                        {{ t('organization.deleteRole') }}
+                      </button>
+                    </li>
+                  }
+                </ul>
+              }
+              <form data-atlas="organization-role-form" (submit)="$event.preventDefault(); saveRole()">
+                @if (!editingRole()) {
+                  <label [class]="cls('formField', 'atlas-field')">
+                    <span [class]="cls('formFieldLabel', 'atlas-field-label')">{{ t('organization.roleKey') }}</span>
+                    <input
+                      name="role_key"
+                      [class]="cls('formFieldInput', 'atlas-input')"
+                      [value]="roleKey()"
+                      (input)="roleKey.set($any($event.target).value)"
+                    />
+                  </label>
+                }
+                <label [class]="cls('formField', 'atlas-field')">
+                  <span [class]="cls('formFieldLabel', 'atlas-field-label')">{{ t('organization.roleName') }}</span>
+                  <input
+                    name="role_name"
+                    [class]="cls('formFieldInput', 'atlas-input')"
+                    [value]="roleName()"
+                    (input)="roleName.set($any($event.target).value)"
+                  />
+                </label>
+                <fieldset [class]="cls('formField', 'atlas-field')">
+                  <legend [class]="cls('formFieldLabel', 'atlas-field-label')">{{ t('organization.rolePermissions') }}</legend>
+                  @for (p of st.permissions; track p.key) {
+                    <label data-atlas="organization-role-permission">
+                      <input
+                        type="checkbox"
+                        [value]="p.key"
+                        [checked]="rolePerms().includes(p.key)"
+                        (change)="togglePermission(p.key, $any($event.target).checked)"
+                      />
+                      {{ p.name }}
+                    </label>
+                  }
+                </fieldset>
+                <button
+                  type="submit"
+                  [class]="cls('formButtonPrimary', 'atlas-button')"
+                  [disabled]="!roleName().trim() || (!editingRole() && !roleKey().trim()) || (st.busy ?? '').startsWith('role:')"
+                >
+                  {{ editingRole() ? t('organization.saveRole') : t('organization.createRole') }}
+                </button>
+                @if (editingRole()) {
+                  <button type="button" [class]="cls('formButtonSecondary', 'atlas-button-secondary')" (click)="resetRoleForm()">
+                    {{ t('organization.cancel') }}
+                  </button>
+                }
+              </form>
+            </div>
+          }
+
+          @if (tab() === 'settings') {
+            <div data-atlas="organization-settings">
+              @if (confirm(); as action) {
+                <p class="atlas-text">
+                  {{ t(action === 'leave' ? 'organization.leaveConfirm' : 'organization.deleteConfirm', { name: membership.organization.name }) }}
+                </p>
+                @if (needsPassword()) {
+                  <label [class]="cls('formField', 'atlas-field')">
+                    <span [class]="cls('formFieldLabel', 'atlas-field-label')">{{ t('organization.passwordPrompt') }}</span>
+                    <input
+                      type="password"
+                      autocomplete="current-password"
+                      [class]="cls('formFieldInput', 'atlas-input')"
+                      [value]="password()"
+                      (input)="password.set($any($event.target).value)"
+                    />
+                  </label>
+                }
+                <button
+                  type="button"
+                  [class]="cls('formButtonPrimary', 'atlas-button')"
+                  [disabled]="st.busy === 'leave' || st.busy === 'delete'"
+                  (click)="action === 'leave' ? leave() : remove()"
+                >
+                  {{ t('organization.confirm') }}
+                </button>
+                <button type="button" [class]="cls('formButtonSecondary', 'atlas-button-secondary')" (click)="cancel()">
+                  {{ t('organization.cancel') }}
+                </button>
+              } @else {
+                <button type="button" [class]="cls('formButtonSecondary', 'atlas-button-secondary')" (click)="confirm.set('leave')">
+                  {{ t('organization.leave') }}
+                </button>
+                @if (isAdmin()) {
+                  <button type="button" [class]="cls('formButtonSecondary', 'atlas-button-secondary')" (click)="confirm.set('delete')">
+                    {{ t('organization.delete') }}
+                  </button>
+                }
+              }
+            </div>
+          }
+        </div>
+      }
+    }
+  `,
+                }]
+        }], ctorParameters: () => [], propDecorators: { exit: [{
+                type: Output
+            }] } });
+
+/**
+ * `<atlas-organization-audit-log>` — the active organization's audit trail for
+ * its admins, next to `<atlas-organization-profile>`. The Angular peer of
+ * React's `<OrganizationAuditLog/>`. Renders nothing for a member who may not
+ * read it (the server is the authority; the component just follows it). Labels
+ * are inputs so an app can localise them.
+ */
+class OrganizationAuditLogComponent {
+    /** Entries per page (the server caps it). */
+    pageSize;
+    /** Narrow to one action, or a prefix ending in `.`. */
+    action;
+    labels = {};
+    formatDate = (ms) => new Date(ms).toLocaleString();
+    atlas = inject(AtlasService);
+    /** Created in ngOnInit, once the inputs are set (templates render after it). */
+    log;
+    ngOnInit() {
+        this.log = this.atlas.organizationAuditLog({ pageSize: this.pageSize, action: this.action });
+    }
+    ngOnDestroy() {
+        this.log.destroy();
+    }
+    describe(action) {
+        return describeAuditAction(action);
+    }
+    cls(key, base) {
+        return classFor(key, this.atlas.appearance, base);
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: OrganizationAuditLogComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: OrganizationAuditLogComponent, isStandalone: true, selector: "atlas-organization-audit-log", inputs: { pageSize: "pageSize", action: "action", labels: "labels", formatDate: "formatDate" }, ngImport: i0, template: `
+    @if (atlas.organization() && !log.state().forbidden) {
+      <div [class]="cls('card', 'atlas-card')" data-atlas="organization-audit-log">
+        <h2 [class]="cls('headerTitle', 'atlas-title')">{{ labels.title ?? 'Audit log' }}</h2>
+        @if (log.state().entries.length === 0 && !log.state().loading) {
+          <p [class]="cls('headerSubtitle', 'atlas-subtitle')">{{ labels.empty ?? 'No activity recorded yet.' }}</p>
+        } @else {
+          <ul [class]="cls('list', 'atlas-audit-list')">
+            @for (entry of log.state().entries; track entry.id) {
+              <li [class]="cls('listItem', 'atlas-audit-item')" [attr.data-action]="entry.action">
+                <strong>{{ describe(entry.action) }}</strong>
+                <span class="atlas-audit-meta">
+                  · {{ formatDate(entry.created_at) }}{{ entry.actor.id ? ' · ' + (labels.actor ?? 'by') + ' ' + entry.actor.type + ' ' + entry.actor.id : '' }}
+                </span>
+              </li>
+            }
+          </ul>
+        }
+        @if (log.state().hasMore) {
+          <button
+            type="button"
+            [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+            [disabled]="log.state().loading"
+            (click)="log.loadMore()"
+          >
+            {{ labels.loadMore ?? 'Load more' }}
+          </button>
+        }
+      </div>
+    }
+  `, isInline: true, changeDetection: i0.ChangeDetectionStrategy.OnPush });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: OrganizationAuditLogComponent, decorators: [{
+            type: Component,
+            args: [{
+                    selector: 'atlas-organization-audit-log',
+                    standalone: true,
+                    changeDetection: ChangeDetectionStrategy.OnPush,
+                    template: `
+    @if (atlas.organization() && !log.state().forbidden) {
+      <div [class]="cls('card', 'atlas-card')" data-atlas="organization-audit-log">
+        <h2 [class]="cls('headerTitle', 'atlas-title')">{{ labels.title ?? 'Audit log' }}</h2>
+        @if (log.state().entries.length === 0 && !log.state().loading) {
+          <p [class]="cls('headerSubtitle', 'atlas-subtitle')">{{ labels.empty ?? 'No activity recorded yet.' }}</p>
+        } @else {
+          <ul [class]="cls('list', 'atlas-audit-list')">
+            @for (entry of log.state().entries; track entry.id) {
+              <li [class]="cls('listItem', 'atlas-audit-item')" [attr.data-action]="entry.action">
+                <strong>{{ describe(entry.action) }}</strong>
+                <span class="atlas-audit-meta">
+                  · {{ formatDate(entry.created_at) }}{{ entry.actor.id ? ' · ' + (labels.actor ?? 'by') + ' ' + entry.actor.type + ' ' + entry.actor.id : '' }}
+                </span>
+              </li>
+            }
+          </ul>
+        }
+        @if (log.state().hasMore) {
+          <button
+            type="button"
+            [class]="cls('formButtonSecondary', 'atlas-button-secondary')"
+            [disabled]="log.state().loading"
+            (click)="log.loadMore()"
+          >
+            {{ labels.loadMore ?? 'Load more' }}
+          </button>
+        }
       </div>
     }
   `,
                 }]
-        }] });
+        }], propDecorators: { pageSize: [{
+                type: Input
+            }], action: [{
+                type: Input
+            }], labels: [{
+                type: Input
+            }], formatDate: [{
+                type: Input
+            }] } });
 
 /**
  * Every standalone directive and component the SDK ships. Import the array in a
@@ -2620,6 +4581,10 @@ const ATLAS_UI = [
     OrganizationSwitcherComponent,
     UserProfileComponent,
     OrganizationProfileComponent,
+    OrganizationAuditLogComponent,
+    AtlasPoliciesDirective,
+    PolicyAcceptStepComponent,
+    PolicyGateComponent,
 ];
 
 /**
@@ -2677,7 +4642,7 @@ class AtlasModule {
         return { ngModule: AtlasModule, providers };
     }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AtlasModule, deps: [], target: i0.ɵɵFactoryTarget.NgModule });
-    static ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "17.3.12", ngImport: i0, type: AtlasModule, imports: [AtlasSignedInDirective, AtlasSignedOutDirective, AtlasLoadingDirective, AtlasLoadedDirective, AtlasProtectDirective, AtlasRootDirective, SignInComponent, SignUpComponent, UserButtonComponent, OrganizationSwitcherComponent, UserProfileComponent, OrganizationProfileComponent], exports: [AtlasSignedInDirective, AtlasSignedOutDirective, AtlasLoadingDirective, AtlasLoadedDirective, AtlasProtectDirective, AtlasRootDirective, SignInComponent, SignUpComponent, UserButtonComponent, OrganizationSwitcherComponent, UserProfileComponent, OrganizationProfileComponent] });
+    static ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "17.3.12", ngImport: i0, type: AtlasModule, imports: [AtlasSignedInDirective, AtlasSignedOutDirective, AtlasLoadingDirective, AtlasLoadedDirective, AtlasProtectDirective, AtlasRootDirective, SignInComponent, SignUpComponent, UserButtonComponent, OrganizationSwitcherComponent, UserProfileComponent, OrganizationProfileComponent, OrganizationAuditLogComponent, AtlasPoliciesDirective, PolicyAcceptStepComponent, PolicyGateComponent], exports: [AtlasSignedInDirective, AtlasSignedOutDirective, AtlasLoadingDirective, AtlasLoadedDirective, AtlasProtectDirective, AtlasRootDirective, SignInComponent, SignUpComponent, UserButtonComponent, OrganizationSwitcherComponent, UserProfileComponent, OrganizationProfileComponent, OrganizationAuditLogComponent, AtlasPoliciesDirective, PolicyAcceptStepComponent, PolicyGateComponent] });
     static ɵinj = i0.ɵɵngDeclareInjector({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AtlasModule });
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AtlasModule, decorators: [{
@@ -2690,6 +4655,75 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
                 }]
         }] });
 
+/**
+ * `<atlas-impersonation-banner>` — shown only while the active session is an
+ * impersonation, naming the user acted as, with "Return to admin" (or "End
+ * impersonation" when there is no session of the impersonator's to resume).
+ * Emits `ended` with the outcome. The Angular peer of React's
+ * `<ImpersonationBanner/>`.
+ */
+class ImpersonationBannerComponent {
+    atlas = inject(AtlasService);
+    ended = new EventEmitter();
+    busy = signal(false);
+    actor = computed(() => actorFromClaims(this.atlas.claims()) ?? this.atlas.session()?.actor ?? null);
+    canReturn = computed(() => this.actor() !== null && Boolean(this.atlas.session()?.actor_session_id));
+    name = computed(() => {
+        const u = this.atlas.user();
+        return ([u?.first_name, u?.last_name].filter(Boolean).join(' ') ||
+            u?.username ||
+            u?.email_addresses?.find((e) => e.primary)?.email_address ||
+            u?.id ||
+            '');
+    });
+    t(key, vars) {
+        return translate(this.atlas.localization, key, vars);
+    }
+    cls(key, base) {
+        return classFor(key, this.atlas.appearance, base);
+    }
+    async end() {
+        this.busy.set(true);
+        try {
+            this.ended.emit(await this.atlas.endImpersonation());
+        }
+        finally {
+            this.busy.set(false);
+        }
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: ImpersonationBannerComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: ImpersonationBannerComponent, isStandalone: true, selector: "atlas-impersonation-banner", outputs: { ended: "ended" }, ngImport: i0, template: `
+    @if (actor()) {
+      <div [class]="cls('card', 'atlas-alert atlas-impersonation-banner')" role="status">
+        <span [class]="cls('headerSubtitle', 'atlas-text')">{{ t('impersonation.banner', { name: name() }) }}</span>
+        <button type="button" [class]="cls('formButtonPrimary', 'atlas-button')" [disabled]="busy()" (click)="end()">
+          {{ canReturn() ? t('impersonation.returnToAdmin') : t('impersonation.end') }}
+        </button>
+      </div>
+    }
+  `, isInline: true, changeDetection: i0.ChangeDetectionStrategy.OnPush });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: ImpersonationBannerComponent, decorators: [{
+            type: Component,
+            args: [{
+                    selector: 'atlas-impersonation-banner',
+                    standalone: true,
+                    changeDetection: ChangeDetectionStrategy.OnPush,
+                    template: `
+    @if (actor()) {
+      <div [class]="cls('card', 'atlas-alert atlas-impersonation-banner')" role="status">
+        <span [class]="cls('headerSubtitle', 'atlas-text')">{{ t('impersonation.banner', { name: name() }) }}</span>
+        <button type="button" [class]="cls('formButtonPrimary', 'atlas-button')" [disabled]="busy()" (click)="end()">
+          {{ canReturn() ? t('impersonation.returnToAdmin') : t('impersonation.end') }}
+        </button>
+      </div>
+    }
+  `,
+                }]
+        }], propDecorators: { ended: [{
+                type: Output
+            }] } });
+
 /**
  * Route guard factory that gates a route on session — and optionally on a
  * permission/role. The Angular peer of using `<SignedIn>` / `<Protect>` to fence
@@ -2769,5 +4803,5 @@ function atlasChildGuard(options = {}) {
  * Generated bundle index. Do not edit.
  */
 
-export { ATLAS_ANGULAR_SDK, ATLAS_ANGULAR_VERSION, ATLAS_OPTIONS, ATLAS_UI, AtlasCaptchaSlotDirective, AtlasFlowController, AtlasLoadedDirective, AtlasLoadingDirective, AtlasModule, AtlasProtectDirective, AtlasRootDirective, AtlasService, AtlasSignedInDirective, AtlasSignedOutDirective, AttemptFlowComponent, DEFAULT_TOKENS, EN_US, OrganizationProfileComponent, OrganizationSwitcherComponent, SignInComponent, SignUpComponent, SignUpFormComponent, THEMES, UserButtonComponent, UserProfileComponent, atlasChildGuard, atlasGuard, classFor, cssVariables, explicitTokens, provideAtlas, renderAppearance, resolveTokens, translate, withFallback };
+export { ATLAS_ANGULAR_SDK, ATLAS_ANGULAR_VERSION, ATLAS_OPTIONS, ATLAS_UI, AtlasCaptchaSlotDirective, AtlasFlowController, AtlasLoadedDirective, AtlasLoadingDirective, AtlasModule, AtlasOrganizationAuditLog, AtlasPoliciesDirective, AtlasProtectDirective, AtlasRootDirective, AtlasService, AtlasSignedInDirective, AtlasSignedOutDirective, AttemptFlowComponent, DEFAULT_TOKENS, EN_US, ImpersonationBannerComponent, OrganizationAuditLogComponent, OrganizationProfileComponent, OrganizationSwitcherComponent, PolicyAcceptStepComponent, PolicyGateComponent, SignInComponent, SignUpComponent, SignUpFormComponent, THEMES, UserButtonComponent, UserProfileComponent, atlasChildGuard, atlasGuard, classFor, cssVariables, explicitTokens, provideAtlas, renderAppearance, resolveTokens, translate, withFallback };
 //# sourceMappingURL=atlasauth-angular.mjs.map