@atlasauth/angular 0.9.0 → 0.11.0

package/dist/fesm2022/atlasauth-angular.mjs

@@ -4,7 +4,7 @@ import { isPlatformBrowser, DOCUMENT } from '@angular/common';
 import { toSignal } from '@angular/core/rxjs-interop';
 import { BehaviorSubject, Subject, combineLatest, firstValueFrom } from 'rxjs';
 import { map, distinctUntilChanged, filter, take } from 'rxjs/operators';
-import { createOrganizationAuditLog, TokenCache, SignOutNotifier, resolveFrontendApi, withDevBrowser, catalogLocale, configureReferralCapture, FapiClient, SignOutGuard, localizedErrorMessage, reauthenticate, getTemplateToken, getProviderToken, signOutReasonFromClient, readRedirectResult, completeOAuthPopupLanding, mapOAuthPopupPayload, stripRedirectParams, closeOAuthPopupAfterSignIn, SDK_HEADER, sdkHeaderValue, reportSdkAdvisory, readExpiry, msUntilRefresh, groupSetupKey, enrollmentSubmitKey, nextStep, awaitingSignUpLink, canDownloadRecoveryCodes, copyRecoveryCodes, downloadRecoveryCodes, createCaptchaController, atlasCaptchaLabels, flowFromPending, initialFlow, createMfaEnrollment, mfaChoicesFrom, fetchInstanceSettings, fetchLastSignInMethod, offeredFirstFactors, prepareFactor, signInCaptchaOptions, flowNeedsCaptcha, planFirstFactor, advanceWithCaptcha, createSignUp, prepareSecondFactorCode, resendSignUpVerification, createPasskeySignUp, finishPasskeySignUp, pendingRecoveryCodes, acknowledgeRecoveryCodes, shouldKeepPolling, pollAttempt, lastUsedMethodLabel, signUp, passkeysSupported, awaitingPasskey, OrganizationProfileController, describeAuditAction, actorFromClaims } from '@atlasauth/js';
+import { createOrganizationAuditLog, POLICY_STRINGS, TokenCache, SignOutNotifier, resolveFrontendApi, withDevBrowser, catalogLocale, configureReferralCapture, FapiClient, SignOutGuard, localizedErrorMessage, reauthenticate, getTemplateToken, getProviderToken, signOutReasonFromClient, readRedirectResult, completeOAuthPopupLanding, mapOAuthPopupPayload, stripRedirectParams, closeOAuthPopupAfterSignIn, SDK_HEADER, sdkHeaderValue, reportSdkAdvisory, readExpiry, msUntilRefresh, policyTranslator, injectPolicyStyles, mountPolicyClickwrap, mountPolicyConsent, controllerForPending, mountPolicyAcceptStep, joinTitles, formatPolicyDate, PolicyGateController, groupSetupKey, enrollmentSubmitKey, nextStep, awaitingSignUpLink, canDownloadRecoveryCodes, copyRecoveryCodes, downloadRecoveryCodes, createCaptchaController, atlasCaptchaLabels, PolicyAcceptanceController, flowFromPending, initialFlow, createMfaEnrollment, mfaChoicesFrom, fetchInstanceSettings, fetchLastSignInMethod, offeredFirstFactors, prepareFactor, signInCaptchaOptions, flowNeedsCaptcha, planFirstFactor, advanceWithCaptcha, loadPolicies, createSignUp, prepareSecondFactorCode, resendSignUpVerification, createPasskeySignUp, finishPasskeySignUp, pendingRecoveryCodes, acknowledgeRecoveryCodes, shouldKeepPolling, pollAttempt, lastUsedMethodLabel, signUp, confirmPolicies, passkeysSupported, awaitingPasskey, OrganizationProfileController, describeAuditAction, actorFromClaims } from '@atlasauth/js';
 export { FapiClient, SIGN_OUT_EVENT, SignOutError, advance, flowFromPending, getProviderToken, initialFlow, onAtlasSignOut, pollAttempt, prepareFactor, requestForStep, shouldKeepPolling } from '@atlasauth/js';
 import { evaluate } from '@atlasauth/authz';
 export { evaluate, hasFromClaims } from '@atlasauth/authz';
@@ -79,7 +79,7 @@ const DEFAULT_TOKENS = {
     colorPrimary: '#5b5bd6',
     colorText: '#1c1c1f',
     colorBackground: '#ffffff',
-    colorDanger: '#d64545',
+    colorDanger: '#c53030',
     colorBorder: '#e4e4e9',
     borderRadius: '8px',
     fontFamily: 'ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif',
@@ -327,6 +327,8 @@ const EN_US = {
     'impersonation.banner': 'You are signed in as {name} on someone else\'s behalf.',
     'impersonation.returnToAdmin': 'Return to admin',
     'impersonation.end': 'End impersonation',
+    // Policy acceptance (terms, privacy, any policy).
+    ...POLICY_STRINGS,
     'error.generic': 'Something went wrong. Please try again.',
     'error.network': 'We could not reach the server. Check your connection.',
     // Server errors, by the stable `reason` the Frontend API sends. Shown instead
@@ -804,7 +806,7 @@ class AtlasService {
     readPendingAttempt() {
         const result = readRedirectResult(window.location.search);
         return result?.status && !result.ticket
-            ? { id: result.attemptId, status: result.status }
+            ? { id: result.attemptId, status: result.status, ...(result.policyToken ? { policyToken: result.policyToken } : {}) }
             : null;
     }
     async call(path, init) {
@@ -1199,6 +1201,254 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
                 args: ['atlasCaptchaSlot']
             }] } });
 
+/** The policy UI's translator (the localization bundle, else the English policy strings) for the current Atlas service. */
+function policyUi(atlas) {
+    return {
+        t: policyTranslator((key, vars) => translate(atlas.localization, key, vars)),
+        classes: {
+            link: 'atlas-link',
+            text: 'atlas-text',
+            primaryButton: classFor('formButtonPrimary', atlas.appearance, 'atlas-button'),
+            error: classFor('formFieldError', atlas.appearance, 'atlas-error'),
+        },
+    };
+}
+/**
+ * `[atlasPolicies]="controller"` — draws the instance's policies (terms, privacy,
+ * …) into the host element: `kind="consent"` (default) is the checkbox block with
+ * its in-page viewer, `kind="clickwrap"` the "By continuing you agree to …" line.
+ * The state is the controller's (`AtlasFlowController.policies`); the DOM comes
+ * from `@atlasauth/js`, shared with every SDK.
+ */
+class AtlasPoliciesDirective {
+    host = inject(ElementRef);
+    atlas = inject(AtlasService);
+    mounted = null;
+    ready = false;
+    controller = null;
+    atlasPolicyKind = 'consent';
+    ngOnInit() {
+        this.ready = true;
+        this.draw();
+    }
+    ngOnChanges(changes) {
+        if (this.ready && (changes['controller'] || changes['atlasPolicyKind']))
+            this.draw();
+    }
+    ngOnDestroy() {
+        this.mounted?.destroy();
+    }
+    draw() {
+        this.mounted?.destroy();
+        this.mounted = null;
+        if (!this.controller)
+            return;
+        const el = this.host.nativeElement;
+        injectPolicyStyles(el.ownerDocument);
+        const ui = policyUi(this.atlas);
+        this.mounted =
+            this.atlasPolicyKind === 'clickwrap'
+                ? mountPolicyClickwrap(el, this.controller, ui)
+                : mountPolicyConsent(el, this.controller, ui);
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AtlasPoliciesDirective, deps: [], target: i0.ɵɵFactoryTarget.Directive });
+    static ɵdir = i0.ɵɵngDeclareDirective({ minVersion: "14.0.0", version: "17.3.12", type: AtlasPoliciesDirective, isStandalone: true, selector: "[atlasPolicies]", inputs: { controller: ["atlasPolicies", "controller"], atlasPolicyKind: "atlasPolicyKind" }, usesOnChanges: true, ngImport: i0 });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AtlasPoliciesDirective, decorators: [{
+            type: Directive,
+            args: [{ selector: '[atlasPolicies]', standalone: true }]
+        }], propDecorators: { controller: [{
+                type: Input,
+                args: ['atlasPolicies']
+            }], atlasPolicyKind: [{
+                type: Input
+            }] } });
+/**
+ * `<atlas-policy-accept-step>` — the sign-in step for a `needs_policy_acceptance`
+ * attempt: scroll-mode policies in their unskippable dialog, the rest as
+ * checkboxes, then "Accept and continue". Emits `submitFlow` with the
+ * `policy_acceptances` JSON for the flow, and `declined` with the policy title
+ * when the user declines (cancel the attempt).
+ */
+class PolicyAcceptStepComponent {
+    host = inject(ElementRef);
+    atlas = inject(AtlasService);
+    step = null;
+    alive = true;
+    attempt = null;
+    busy = false;
+    submitFlow = new EventEmitter();
+    declined = new EventEmitter();
+    loading = signal(true);
+    loadingText = policyUi(this.atlas).t('policy.loading');
+    ngOnInit() {
+        const client = this.atlas.createFapiClient();
+        void controllerForPending(client, this.attempt, { locale: this.atlas.locale ?? undefined }).then((controller) => {
+            if (!this.alive)
+                return;
+            this.loading.set(false);
+            const el = this.host.nativeElement.querySelector('.atlas-policy-step-host');
+            if (!el)
+                return;
+            injectPolicyStyles(el.ownerDocument);
+            this.step = mountPolicyAcceptStep(el, controller, {
+                ...policyUi(this.atlas),
+                onSubmit: (acceptances) => this.submitFlow.emit({ policy_acceptances: JSON.stringify(acceptances) }),
+                onDecline: (policy) => this.declined.emit(policy.title),
+            });
+            this.step.setBusy(this.busy);
+        });
+    }
+    ngOnChanges(changes) {
+        if (changes['busy'])
+            this.step?.setBusy(this.busy);
+    }
+    ngOnDestroy() {
+        this.alive = false;
+        this.step?.destroy();
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: PolicyAcceptStepComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: PolicyAcceptStepComponent, isStandalone: true, selector: "atlas-policy-accept-step", inputs: { attempt: "attempt", busy: "busy" }, outputs: { submitFlow: "submitFlow", declined: "declined" }, usesOnChanges: true, ngImport: i0, template: `@if (loading()) {<p class="atlas-text">{{ loadingText }}</p>}<div class="atlas-policy-step-host"></div>`, isInline: true, changeDetection: i0.ChangeDetectionStrategy.OnPush });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: PolicyAcceptStepComponent, decorators: [{
+            type: Component,
+            args: [{
+                    selector: 'atlas-policy-accept-step',
+                    standalone: true,
+                    changeDetection: ChangeDetectionStrategy.OnPush,
+                    template: `@if (loading()) {<p class="atlas-text">{{ loadingText }}</p>}<div class="atlas-policy-step-host"></div>`,
+                }]
+        }], propDecorators: { attempt: [{
+                type: Input
+            }], busy: [{
+                type: Input
+            }], submitFlow: [{
+                type: Output
+            }], declined: [{
+                type: Output
+            }] } });
+/**
+ * `<atlas-policy-gate>` — in-app re-acceptance. For a signed-in user, a banner
+ * when a policy needs re-acceptance; "Review and accept" opens the unskippable
+ * dialog / checkboxes and posts `/v1/client/me/policies/accept`. Projects its
+ * content always.
+ */
+class PolicyGateComponent {
+    host = inject(ElementRef);
+    atlas = inject(AtlasService);
+    ui = policyUi(this.atlas);
+    gate;
+    off = null;
+    step = null;
+    version = signal(0);
+    accepted = new EventEmitter();
+    reviewing = signal(false);
+    error = signal('');
+    title = this.ui.t('policy.bannerTitle');
+    reviewText = this.ui.t('policy.bannerReview');
+    linkClass = this.ui.classes.link ?? '';
+    errorClass = this.ui.classes.error ?? '';
+    bannerClass = 'atlas-policy-banner';
+    cardClass = classFor('card', this.atlas.appearance, 'atlas-card');
+    bannerText() {
+        this.version();
+        if (!this.gate || this.gate.pending.length === 0 || this.reviewing())
+            return null;
+        const t = this.ui.t;
+        const grace = this.gate.graceEndsAt;
+        return (t('policy.bannerBody', { policies: joinTitles(this.gate.pending.map((p) => p.title), t('policy.and')) }) +
+            (grace ? ` ${t('policy.bannerGrace', { date: formatPolicyDate(grace) })}` : ''));
+    }
+    ngOnInit() {
+        this.gate = new PolicyGateController(this.atlas.createFapiClient(), this.atlas.locale ?? undefined);
+        this.off = this.gate.subscribe(() => this.version.update((n) => n + 1));
+        if (this.atlas.status() === 'signed_in')
+            void this.gate.load();
+    }
+    async begin() {
+        const controller = await this.gate.begin();
+        this.reviewing.set(true);
+        await Promise.resolve();
+        const el = this.host.nativeElement.querySelector('.atlas-policy-gate-host');
+        if (!el)
+            return;
+        injectPolicyStyles(el.ownerDocument);
+        this.step = mountPolicyAcceptStep(el, controller, {
+            ...this.ui,
+            onSubmit: async () => {
+                this.step?.setBusy(true);
+                const res = await this.gate.accept(controller);
+                this.step?.setBusy(false);
+                if (!res.ok) {
+                    this.error.set(res.errors[0]?.message ?? this.ui.t('policy.requiredGeneric'));
+                    return;
+                }
+                this.close();
+                this.accepted.emit();
+            },
+            onDecline: () => this.close(),
+        });
+    }
+    close() {
+        this.step?.destroy();
+        this.step = null;
+        this.reviewing.set(false);
+    }
+    ngOnDestroy() {
+        this.off?.();
+        this.step?.destroy();
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: PolicyGateComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: PolicyGateComponent, isStandalone: true, selector: "atlas-policy-gate", outputs: { accepted: "accepted" }, ngImport: i0, template: `
+    @if (bannerText(); as text) {
+      <div [class]="bannerClass" role="status" data-atlas-policy-banner="">
+        <span
+          ><strong>{{ title }}. </strong>{{ text }}</span
+        >
+        <button type="button" [class]="linkClass" (click)="begin()">{{ reviewText }}</button>
+      </div>
+    }
+    @if (reviewing()) {
+      <div [class]="cardClass" data-atlas-policy-gate="">
+        <div class="atlas-policy-gate-host"></div>
+        @if (error()) {
+          <p [class]="errorClass" role="alert">{{ error() }}</p>
+        }
+      </div>
+    }
+    <ng-content></ng-content>
+  `, isInline: true, changeDetection: i0.ChangeDetectionStrategy.OnPush });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: PolicyGateComponent, decorators: [{
+            type: Component,
+            args: [{
+                    selector: 'atlas-policy-gate',
+                    standalone: true,
+                    changeDetection: ChangeDetectionStrategy.OnPush,
+                    template: `
+    @if (bannerText(); as text) {
+      <div [class]="bannerClass" role="status" data-atlas-policy-banner="">
+        <span
+          ><strong>{{ title }}. </strong>{{ text }}</span
+        >
+        <button type="button" [class]="linkClass" (click)="begin()">{{ reviewText }}</button>
+      </div>
+    }
+    @if (reviewing()) {
+      <div [class]="cardClass" data-atlas-policy-gate="">
+        <div class="atlas-policy-gate-host"></div>
+        @if (error()) {
+          <p [class]="errorClass" role="alert">{{ error() }}</p>
+        }
+      </div>
+    }
+    <ng-content></ng-content>
+  `,
+                }]
+        }], propDecorators: { accepted: [{
+                type: Output
+            }] } });
+
 /**
  * The server-driven flow shell, shared by `<atlas-sign-in>` and
  * `<atlas-sign-up>`. The Angular peer of React's internal `AttemptFlow`.
@@ -1267,6 +1517,8 @@ class AttemptFlowComponent {
      */
     emailVerification = 'code';
     resend = new EventEmitter();
+    /** The user declined a policy the sign-in was waiting on (`needs_policy_acceptance`): cancel the attempt. */
+    policyDeclined = new EventEmitter();
     values = {};
     t(key, vars) {
         return translate(this.atlas.localization, key, vars);
@@ -1366,6 +1618,10 @@ class AttemptFlowComponent {
             return null;
         return this.t('signIn.codeSentTo', { email: this.attempt?.identifier ?? '' });
     }
+    /** The attempt is `needs_policy_acceptance`. */
+    awaitingPolicies() {
+        return this.step().kind === 'accept_policies';
+    }
     showSubmit() {
         const kind = this.step().kind;
         // Nothing to submit on a first-factor step that only offers an emailed code
@@ -1377,7 +1633,7 @@ class AttemptFlowComponent {
         // Enrolment: nothing to submit while choosing a method or fetching the setup.
         if (this.enrolling() && this.enrollmentState && !enrollmentSubmitKey(this.enrollmentState))
             return false;
-        return kind !== 'done' && kind !== 'await_oauth';
+        return kind !== 'done' && kind !== 'await_oauth' && kind !== 'accept_policies';
     }
     fields() {
         const step = this.step();
@@ -1411,6 +1667,9 @@ class AttemptFlowComponent {
                 return this.linkOnly() ? [] : [{ kind: 'input', name: 'code', labelKey: 'signIn.emailCodeLabel', type: 'text' }];
             case 'collect_new_password':
                 return [{ kind: 'input', name: 'password', labelKey: 'reset.newPasswordLabel', type: 'password' }];
+            case 'accept_policies':
+                // Drawn by <atlas-policy-accept-step> above.
+                return [];
             case 'collect_captcha':
                 // §5 the server withheld the attempt until a captcha clears. Solving the
                 // widget resubmits the identifier on its own; the button retries.
@@ -1434,7 +1693,7 @@ class AttemptFlowComponent {
         }
     }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AttemptFlowComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: AttemptFlowComponent, isStandalone: true, selector: "atlas-attempt-flow", inputs: { attempt: "attempt", busy: "busy", errors: "errors", sessionKept: "sessionKept", titleKey: "titleKey", captcha: "captcha", firstFactors: "firstFactors", preparedFactor: "preparedFactor", offerEmailSecondFactor: "offerEmailSecondFactor", emailedSecondFactor: "emailedSecondFactor", offerSmsSecondFactor: "offerSmsSecondFactor", textedSecondFactor: "textedSecondFactor", enrollment: "enrollment", enrollmentState: "enrollmentState", emailVerification: "emailVerification" }, outputs: { submitFlow: "submitFlow", chooseFactor: "chooseFactor", emailSecondFactor: "emailSecondFactor", smsSecondFactor: "smsSecondFactor", resend: "resend" }, ngImport: i0, template: `
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: AttemptFlowComponent, isStandalone: true, selector: "atlas-attempt-flow", inputs: { attempt: "attempt", busy: "busy", errors: "errors", sessionKept: "sessionKept", titleKey: "titleKey", captcha: "captcha", firstFactors: "firstFactors", preparedFactor: "preparedFactor", offerEmailSecondFactor: "offerEmailSecondFactor", emailedSecondFactor: "emailedSecondFactor", offerSmsSecondFactor: "offerSmsSecondFactor", textedSecondFactor: "textedSecondFactor", enrollment: "enrollment", enrollmentState: "enrollmentState", emailVerification: "emailVerification" }, outputs: { submitFlow: "submitFlow", chooseFactor: "chooseFactor", emailSecondFactor: "emailSecondFactor", smsSecondFactor: "smsSecondFactor", resend: "resend", policyDeclined: "policyDeclined" }, ngImport: i0, template: `
     <div [class]="cls('card', 'atlas-card')">
       <h1 [class]="cls('headerTitle', 'atlas-title')">{{ t(titleKey) }}</h1>
 
@@ -1560,6 +1819,16 @@ class AttemptFlowComponent {
           }
         }
 
+        @if (awaitingPolicies()) {
+          <!-- A required policy changed: scroll-mode ones in their dialog, the rest as checkboxes. -->
+          <atlas-policy-accept-step
+            [attempt]="attempt"
+            [busy]="busy"
+            (submitFlow)="submitFlow.emit($event)"
+            (declined)="policyDeclined.emit($event)"
+          ></atlas-policy-accept-step>
+        }
+
         @if (showCaptcha()) {
           <div class="atlas-captcha" data-atlas-captcha="" [atlasCaptchaSlot]="captcha"></div>
         }
@@ -1626,7 +1895,7 @@ class AttemptFlowComponent {
         }
       </form>
     </div>
-  `, isInline: true, dependencies: [{ kind: "directive", type: AtlasCaptchaSlotDirective, selector: "[atlasCaptchaSlot]", inputs: ["atlasCaptchaSlot"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
+  `, isInline: true, dependencies: [{ kind: "directive", type: AtlasCaptchaSlotDirective, selector: "[atlasCaptchaSlot]", inputs: ["atlasCaptchaSlot"] }, { kind: "component", type: PolicyAcceptStepComponent, selector: "atlas-policy-accept-step", inputs: ["attempt", "busy"], outputs: ["submitFlow", "declined"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AttemptFlowComponent, decorators: [{
             type: Component,
@@ -1634,7 +1903,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
                     selector: 'atlas-attempt-flow',
                     standalone: true,
                     changeDetection: ChangeDetectionStrategy.OnPush,
-                    imports: [AtlasCaptchaSlotDirective],
+                    imports: [AtlasCaptchaSlotDirective, PolicyAcceptStepComponent],
                     template: `
     <div [class]="cls('card', 'atlas-card')">
       <h1 [class]="cls('headerTitle', 'atlas-title')">{{ t(titleKey) }}</h1>
@@ -1761,6 +2030,16 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
           }
         }
 
+        @if (awaitingPolicies()) {
+          <!-- A required policy changed: scroll-mode ones in their dialog, the rest as checkboxes. -->
+          <atlas-policy-accept-step
+            [attempt]="attempt"
+            [busy]="busy"
+            (submitFlow)="submitFlow.emit($event)"
+            (declined)="policyDeclined.emit($event)"
+          ></atlas-policy-accept-step>
+        }
+
         @if (showCaptcha()) {
           <div class="atlas-captcha" data-atlas-captcha="" [atlasCaptchaSlot]="captcha"></div>
         }
@@ -1869,6 +2148,8 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
                 type: Input
             }], resend: [{
                 type: Output
+            }], policyDeclined: [{
+                type: Output
             }] } });
 /** A read-only message row: `labelKey` holds the i18n key of the text to show. */
 function msg(labelKey) {
@@ -2055,6 +2336,11 @@ class AtlasFlowController {
     enrollment;
     /** {@link enrollment}'s state, for templates. */
     enrollmentState;
+    /**
+     * The instance's policies (terms, privacy, …) for the create-account form:
+     * {@link create} sends their acceptances and reloads them after a refusal.
+     */
+    policies = new PolicyAcceptanceController([]);
     pollTimer = null;
     identifier = '';
     constructor(client, reload, pending, 
@@ -2191,6 +2477,17 @@ class AtlasFlowController {
         this.identifier = out.identifier;
         await this.finish(out.state);
     }
+    /** Load the sign-up's policies into {@link policies} (`<atlas-sign-up>` calls it on init). */
+    async loadPolicies(locale) {
+        this.policies.setPolicies(await loadPolicies(this.client, { locale }));
+    }
+    /** The user declined a policy a sign-in was waiting on: cancel the attempt and say why. */
+    declinePolicy(title) {
+        this.state.set({
+            ...initialFlow,
+            errors: [{ code: 'POLICY_DECLINED', message: this.t('policy.declined').replace('{policy}', title) }],
+        });
+    }
     /**
      * Create an account (`POST /v1/client/sign_ups`) from a create-account form's
      * values — email, password and any configured sign-up fields — carrying the
@@ -2203,6 +2500,7 @@ class AtlasFlowController {
             consent,
             captcha: this.signUpCaptcha,
             t: this.t,
+            policies: this.policies,
         });
         await this.finish(next);
     }
@@ -2247,7 +2545,7 @@ class AtlasFlowController {
      */
     async createWithPasskey(values, consent = true) {
         this.state.update((current) => ({ ...current, busy: true, errors: [] }));
-        await this.finish(await createPasskeySignUp(this.client, values, { consent, captcha: this.signUpCaptcha, t: this.t }));
+        await this.finish(await createPasskeySignUp(this.client, values, { consent, captcha: this.signUpCaptcha, t: this.t, policies: this.policies }));
     }
     /** The passkey-only sign-up's last step: create the passkey, and with it the account. */
     async createPasskey() {
@@ -2429,6 +2727,7 @@ class SignInComponent {
       [enrollmentState]="flow.enrollmentState()"
       (emailSecondFactor)="flow.sendEmailSecondFactor()"
       (smsSecondFactor)="flow.sendSmsSecondFactor()"
+      (policyDeclined)="flow.declinePolicy($event)"
     ></atlas-attempt-flow>
     }
     @if (flow.state().attempt?.status !== 'complete' && signUpHref(); as href) {
@@ -2436,7 +2735,7 @@ class SignInComponent {
         {{ t('signIn.noAccount') }} <a class="atlas-link" [href]="href">{{ t('signIn.signUpLink') }}</a>
       </p>
     }
-  `, isInline: true, dependencies: [{ kind: "component", type: AttemptFlowComponent, selector: "atlas-attempt-flow", inputs: ["attempt", "busy", "errors", "sessionKept", "titleKey", "captcha", "firstFactors", "preparedFactor", "offerEmailSecondFactor", "emailedSecondFactor", "offerSmsSecondFactor", "textedSecondFactor", "enrollment", "enrollmentState", "emailVerification"], outputs: ["submitFlow", "chooseFactor", "emailSecondFactor", "smsSecondFactor", "resend"] }, { kind: "component", type: RecoveryCodesComponent, selector: "atlas-recovery-codes", inputs: ["codes", "busy"], outputs: ["saved"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
+  `, isInline: true, dependencies: [{ kind: "component", type: AttemptFlowComponent, selector: "atlas-attempt-flow", inputs: ["attempt", "busy", "errors", "sessionKept", "titleKey", "captcha", "firstFactors", "preparedFactor", "offerEmailSecondFactor", "emailedSecondFactor", "offerSmsSecondFactor", "textedSecondFactor", "enrollment", "enrollmentState", "emailVerification"], outputs: ["submitFlow", "chooseFactor", "emailSecondFactor", "smsSecondFactor", "resend", "policyDeclined"] }, { kind: "component", type: RecoveryCodesComponent, selector: "atlas-recovery-codes", inputs: ["codes", "busy"], outputs: ["saved"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: SignInComponent, decorators: [{
             type: Component,
@@ -2473,6 +2772,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
       [enrollmentState]="flow.enrollmentState()"
       (emailSecondFactor)="flow.sendEmailSecondFactor()"
       (smsSecondFactor)="flow.sendSmsSecondFactor()"
+      (policyDeclined)="flow.declinePolicy($event)"
     ></atlas-attempt-flow>
     }
     @if (flow.state().attempt?.status !== 'complete' && signUpHref(); as href) {
@@ -2498,6 +2798,8 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
  */
 class SignUpFormComponent {
     atlas = inject(AtlasService);
+    cdr = inject(ChangeDetectorRef);
+    unwatch = null;
     settings = null;
     busy = false;
     errors = [];
@@ -2506,12 +2808,27 @@ class SignUpFormComponent {
     passkey = null;
     /** Whether the password / passkey toggle is shown (both are offered). */
     switchable = false;
+    /** The instance's policies (terms, privacy, …); they replace the legacy consent row. */
+    policies = null;
     /** The user asked for the other sign-up method. */
     switchMode = new EventEmitter();
     /** Emits the typed values and the consent tick when the form is submitted. */
     submitSignUp = new EventEmitter();
     values = {};
     agreed = false;
+    declined = null;
+    ngOnChanges(changes) {
+        if (!changes['policies'])
+            return;
+        this.unwatch?.();
+        this.unwatch = this.policies?.subscribe(() => this.cdr.markForCheck()) ?? null;
+    }
+    ngOnDestroy() {
+        this.unwatch?.();
+    }
+    hasPolicies() {
+        return !!this.policies && this.policies.policies.length > 0;
+    }
     t(key, vars) {
         return translate(this.atlas.localization, key, vars);
     }
@@ -2564,10 +2881,15 @@ class SignUpFormComponent {
         this.setValue(f.key, (on ? [...current, option] : current.filter((p) => p !== option)).join(', '));
     }
     showLegal() {
+        // Instance policies replace the legacy single "I agree to the Terms" row.
+        if (this.hasPolicies())
+            return false;
         const legal = this.settings?.legal;
         return !!legal && (!!legal.termsUrl || !!legal.privacyUrl);
     }
     consentOk() {
+        if (this.hasPolicies())
+            return this.policies.canSubmit();
         return !this.settings?.legal?.required || this.agreed;
     }
     formErrors() {
@@ -2580,13 +2902,27 @@ class SignUpFormComponent {
         event.preventDefault();
         if (this.emailUnavailable() || !this.consentOk())
             return;
+        this.declined = null;
+        if (this.hasPolicies()) {
+            // Scroll-mode policies are read in their unskippable dialog first.
+            const values = { ...this.values };
+            void confirmPolicies(this.policies, { t: policyUi(this.atlas).t }).then((res) => {
+                if (res.ok)
+                    this.submitSignUp.emit({ values, consent: true });
+                else {
+                    this.declined = res.declined;
+                    this.cdr.markForCheck();
+                }
+            });
+            return;
+        }
         this.submitSignUp.emit({
             values: { ...this.values },
             consent: this.settings?.legal?.required ? this.agreed : true,
         });
     }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: SignUpFormComponent, deps: [], target: i0.ɵɵFactoryTarget.Component });
-    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: SignUpFormComponent, isStandalone: true, selector: "atlas-sign-up-form", inputs: { settings: "settings", busy: "busy", errors: "errors", captcha: "captcha", passkey: "passkey", switchable: "switchable" }, outputs: { switchMode: "switchMode", submitSignUp: "submitSignUp" }, ngImport: i0, template: `
+    static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "17.0.0", version: "17.3.12", type: SignUpFormComponent, isStandalone: true, selector: "atlas-sign-up-form", inputs: { settings: "settings", busy: "busy", errors: "errors", captcha: "captcha", passkey: "passkey", switchable: "switchable", policies: "policies" }, outputs: { switchMode: "switchMode", submitSignUp: "submitSignUp" }, usesOnChanges: true, ngImport: i0, template: `
     <div [class]="cls('card', 'atlas-card')">
       <h1 [class]="cls('headerTitle', 'atlas-title')">{{ t('signUp.title') }}</h1>
 
@@ -2715,6 +3051,15 @@ class SignUpFormComponent {
         </label>
         }
 
+        @if (hasPolicies()) {
+          <div [atlasPolicies]="policies"></div>
+          @if (declined) {
+            <span [class]="cls('formFieldError', 'atlas-error')" role="alert" data-atlas-policy-declined="">
+              {{ t('policy.declined', { policy: declined }) }}
+            </span>
+          }
+        }
+
         @if (showLegal()) {
           <label [class]="cls('formField', 'atlas-consent')">
             @if (settings?.legal?.required) {
@@ -2754,6 +3099,9 @@ class SignUpFormComponent {
         >
           {{ t('signUp.submit') }}
         </button>
+        @if (hasPolicies()) {
+          <p atlasPolicyKind="clickwrap" [atlasPolicies]="policies"></p>
+        }
         @if (switchable) {
           <div class="atlas-alternatives">
             <button
@@ -2770,7 +3118,7 @@ class SignUpFormComponent {
       </form>
       }
     </div>
-  `, isInline: true, dependencies: [{ kind: "directive", type: AtlasCaptchaSlotDirective, selector: "[atlasCaptchaSlot]", inputs: ["atlasCaptchaSlot"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
+  `, isInline: true, dependencies: [{ kind: "directive", type: AtlasCaptchaSlotDirective, selector: "[atlasCaptchaSlot]", inputs: ["atlasCaptchaSlot"] }, { kind: "directive", type: AtlasPoliciesDirective, selector: "[atlasPolicies]", inputs: ["atlasPolicies", "atlasPolicyKind"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: SignUpFormComponent, decorators: [{
             type: Component,
@@ -2778,7 +3126,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
                     selector: 'atlas-sign-up-form',
                     standalone: true,
                     changeDetection: ChangeDetectionStrategy.OnPush,
-                    imports: [AtlasCaptchaSlotDirective],
+                    imports: [AtlasCaptchaSlotDirective, AtlasPoliciesDirective],
                     template: `
     <div [class]="cls('card', 'atlas-card')">
       <h1 [class]="cls('headerTitle', 'atlas-title')">{{ t('signUp.title') }}</h1>
@@ -2908,6 +3256,15 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
         </label>
         }
 
+        @if (hasPolicies()) {
+          <div [atlasPolicies]="policies"></div>
+          @if (declined) {
+            <span [class]="cls('formFieldError', 'atlas-error')" role="alert" data-atlas-policy-declined="">
+              {{ t('policy.declined', { policy: declined }) }}
+            </span>
+          }
+        }
+
         @if (showLegal()) {
           <label [class]="cls('formField', 'atlas-consent')">
             @if (settings?.legal?.required) {
@@ -2947,6 +3304,9 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
         >
           {{ t('signUp.submit') }}
         </button>
+        @if (hasPolicies()) {
+          <p atlasPolicyKind="clickwrap" [atlasPolicies]="policies"></p>
+        }
         @if (switchable) {
           <div class="atlas-alternatives">
             <button
@@ -2977,6 +3337,8 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
                 type: Input
             }], switchable: [{
                 type: Input
+            }], policies: [{
+                type: Input
             }], switchMode: [{
                 type: Output
             }], submitSignUp: [{
@@ -3028,8 +3390,10 @@ class SignUpComponent {
     }
     ngOnInit() {
         // §5 the instance's sign-up fields, consent policy and captcha settings.
-        if (typeof window !== 'undefined')
+        if (typeof window !== 'undefined') {
             void this.flow.loadSettings();
+            void this.flow.loadPolicies(this.atlas.locale ?? undefined);
+        }
     }
     ngOnDestroy() {
         this.flow.destroy();
@@ -3069,6 +3433,7 @@ class SignUpComponent {
         [busy]="flow.state().busy"
         [errors]="flow.state().errors"
         [captcha]="flow.signUpCaptchaDrawn() ? flow.signUpCaptcha : null"
+        [policies]="flow.policies"
         [passkey]="passkeyForm()"
         [switchable]="canPasskey()"
         (switchMode)="toggleMode()"
@@ -3077,7 +3442,7 @@ class SignUpComponent {
         "
       ></atlas-sign-up-form>
     }
-  `, isInline: true, dependencies: [{ kind: "component", type: AttemptFlowComponent, selector: "atlas-attempt-flow", inputs: ["attempt", "busy", "errors", "sessionKept", "titleKey", "captcha", "firstFactors", "preparedFactor", "offerEmailSecondFactor", "emailedSecondFactor", "offerSmsSecondFactor", "textedSecondFactor", "enrollment", "enrollmentState", "emailVerification"], outputs: ["submitFlow", "chooseFactor", "emailSecondFactor", "smsSecondFactor", "resend"] }, { kind: "component", type: SignUpFormComponent, selector: "atlas-sign-up-form", inputs: ["settings", "busy", "errors", "captcha", "passkey", "switchable"], outputs: ["switchMode", "submitSignUp"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
+  `, isInline: true, dependencies: [{ kind: "component", type: AttemptFlowComponent, selector: "atlas-attempt-flow", inputs: ["attempt", "busy", "errors", "sessionKept", "titleKey", "captcha", "firstFactors", "preparedFactor", "offerEmailSecondFactor", "emailedSecondFactor", "offerSmsSecondFactor", "textedSecondFactor", "enrollment", "enrollmentState", "emailVerification"], outputs: ["submitFlow", "chooseFactor", "emailSecondFactor", "smsSecondFactor", "resend", "policyDeclined"] }, { kind: "component", type: SignUpFormComponent, selector: "atlas-sign-up-form", inputs: ["settings", "busy", "errors", "captcha", "passkey", "switchable", "policies"], outputs: ["switchMode", "submitSignUp"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush });
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: SignUpComponent, decorators: [{
             type: Component,
@@ -3120,6 +3485,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImpo
         [busy]="flow.state().busy"
         [errors]="flow.state().errors"
         [captcha]="flow.signUpCaptchaDrawn() ? flow.signUpCaptcha : null"
+        [policies]="flow.policies"
         [passkey]="passkeyForm()"
         [switchable]="canPasskey()"
         (switchMode)="toggleMode()"
@@ -4216,6 +4582,9 @@ const ATLAS_UI = [
     UserProfileComponent,
     OrganizationProfileComponent,
     OrganizationAuditLogComponent,
+    AtlasPoliciesDirective,
+    PolicyAcceptStepComponent,
+    PolicyGateComponent,
 ];
 
 /**
@@ -4273,7 +4642,7 @@ class AtlasModule {
         return { ngModule: AtlasModule, providers };
     }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AtlasModule, deps: [], target: i0.ɵɵFactoryTarget.NgModule });
-    static ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "17.3.12", ngImport: i0, type: AtlasModule, imports: [AtlasSignedInDirective, AtlasSignedOutDirective, AtlasLoadingDirective, AtlasLoadedDirective, AtlasProtectDirective, AtlasRootDirective, SignInComponent, SignUpComponent, UserButtonComponent, OrganizationSwitcherComponent, UserProfileComponent, OrganizationProfileComponent, OrganizationAuditLogComponent], exports: [AtlasSignedInDirective, AtlasSignedOutDirective, AtlasLoadingDirective, AtlasLoadedDirective, AtlasProtectDirective, AtlasRootDirective, SignInComponent, SignUpComponent, UserButtonComponent, OrganizationSwitcherComponent, UserProfileComponent, OrganizationProfileComponent, OrganizationAuditLogComponent] });
+    static ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "17.3.12", ngImport: i0, type: AtlasModule, imports: [AtlasSignedInDirective, AtlasSignedOutDirective, AtlasLoadingDirective, AtlasLoadedDirective, AtlasProtectDirective, AtlasRootDirective, SignInComponent, SignUpComponent, UserButtonComponent, OrganizationSwitcherComponent, UserProfileComponent, OrganizationProfileComponent, OrganizationAuditLogComponent, AtlasPoliciesDirective, PolicyAcceptStepComponent, PolicyGateComponent], exports: [AtlasSignedInDirective, AtlasSignedOutDirective, AtlasLoadingDirective, AtlasLoadedDirective, AtlasProtectDirective, AtlasRootDirective, SignInComponent, SignUpComponent, UserButtonComponent, OrganizationSwitcherComponent, UserProfileComponent, OrganizationProfileComponent, OrganizationAuditLogComponent, AtlasPoliciesDirective, PolicyAcceptStepComponent, PolicyGateComponent] });
     static ɵinj = i0.ɵɵngDeclareInjector({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AtlasModule });
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.12", ngImport: i0, type: AtlasModule, decorators: [{
@@ -4434,5 +4803,5 @@ function atlasChildGuard(options = {}) {
  * Generated bundle index. Do not edit.
  */
 
-export { ATLAS_ANGULAR_SDK, ATLAS_ANGULAR_VERSION, ATLAS_OPTIONS, ATLAS_UI, AtlasCaptchaSlotDirective, AtlasFlowController, AtlasLoadedDirective, AtlasLoadingDirective, AtlasModule, AtlasOrganizationAuditLog, AtlasProtectDirective, AtlasRootDirective, AtlasService, AtlasSignedInDirective, AtlasSignedOutDirective, AttemptFlowComponent, DEFAULT_TOKENS, EN_US, ImpersonationBannerComponent, OrganizationAuditLogComponent, OrganizationProfileComponent, OrganizationSwitcherComponent, SignInComponent, SignUpComponent, SignUpFormComponent, THEMES, UserButtonComponent, UserProfileComponent, atlasChildGuard, atlasGuard, classFor, cssVariables, explicitTokens, provideAtlas, renderAppearance, resolveTokens, translate, withFallback };
+export { ATLAS_ANGULAR_SDK, ATLAS_ANGULAR_VERSION, ATLAS_OPTIONS, ATLAS_UI, AtlasCaptchaSlotDirective, AtlasFlowController, AtlasLoadedDirective, AtlasLoadingDirective, AtlasModule, AtlasOrganizationAuditLog, AtlasPoliciesDirective, AtlasProtectDirective, AtlasRootDirective, AtlasService, AtlasSignedInDirective, AtlasSignedOutDirective, AttemptFlowComponent, DEFAULT_TOKENS, EN_US, ImpersonationBannerComponent, OrganizationAuditLogComponent, OrganizationProfileComponent, OrganizationSwitcherComponent, PolicyAcceptStepComponent, PolicyGateComponent, SignInComponent, SignUpComponent, SignUpFormComponent, THEMES, UserButtonComponent, UserProfileComponent, atlasChildGuard, atlasGuard, classFor, cssVariables, explicitTokens, provideAtlas, renderAppearance, resolveTokens, translate, withFallback };
 //# sourceMappingURL=atlasauth-angular.mjs.map