@atlasauth/react 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,90 @@
 # @atlasauth/react changelog
 
+## 0.5.0
+- **`<SignUp>` now creates accounts.** Its first step is a create-account form (the instance's
+  configured sign-up fields, email, password and the legal-consent row) that posts
+  `POST /v1/client/sign_ups`; the emailed-code step and completion then run through the shared flow.
+  Previously `<SignUp>` rendered the sign-in identifier step and could not create an account.
+- **Captcha renders automatically.** When the instance turns captcha on for a flow, `<SignUp>` and
+  `<SignIn>` show the provider's widget (Turnstile, hCaptcha, reCAPTCHA v2/v3/Enterprise) in the
+  configured mode (`visible`, `managed`, or `invisible` — run on submit), send its token as
+  `captcha_token`, answer the sign-in `needs_captcha` step (continuing as soon as it is solved), and on
+  `CAPTCHA_REQUIRED` / `CAPTCHA_FAILED` show a localized message and a fresh widget.
+- **Added** `useAtlas().instanceSettings: InstanceSettings | null` — the instance's public
+  `captchaFlows`, `signUpFields` and `legal` settings from `GET /v1/appearance`. The provider now
+  fetches `/v1/appearance` even with `appearance.instanceDesign: false` (the design is still not
+  applied then).
+- **Added types** `InstanceSettings`, `PublicSignUpField`, and re-exported `FlowCaptcha`,
+  `CaptchaFlowKey`, `CaptchaWidgetMode` from `@atlasauth/js`.
+- **Added catalog keys** (en-US): `signUp.emailLabel`, `signUp.passwordLabel`, `signUp.optionalField`,
+  `signUp.selectPlaceholder`, `signUp.consentAgree`, `signUp.consentNotice`, `signUp.terms`,
+  `signUp.privacy`, `signUp.and`, `captcha.prompt`, `captcha.required`, `captcha.failed`.
+- `InstanceSettings`, `PublicSignUpField` and `localizeCaptchaErrors` now come from `@atlasauth/js`
+  (same shapes; one implementation shared with the other framework SDKs).
+- **Added base classes** `atlas-captcha`, `atlas-consent`, `atlas-choices`, `atlas-choice` (new `ATLAS_FLOW_CSS` export, appended to `ATLAS_STYLES_CSS`; `ATLAS_BASE_CSS` is unchanged). The flow's inputs now carry `name` attributes.
+- **Added base classes** `atlas-captcha`, `atlas-consent`, `atlas-choices`, `atlas-choice` (new `ATLAS_FLOW_CSS` export, appended to `ATLAS_STYLES_CSS`). The flow's inputs now carry `name` attributes.
+- **`frontendApi` is validated at render.** A missing (`undefined`/`null`), non-string, blank or malformed value now
+  throws an **`AtlasConfigError`** (exported; `code: 'FRONTEND_API_REQUIRED' | 'FRONTEND_API_INVALID'`, type
+  `AtlasConfigErrorCode`) instead of silently sending every request to relative URLs on the app's own
+  origin. Accepted: an absolute `https:` URL (`http:` only for localhost / local development hosts), or
+  `"same-origin"` (exported as `SAME_ORIGIN_FRONTEND_API`) / a root-relative path such as `"/atlas"` for a
+  reverse proxy.
+- **Deprecated:** `frontendApi=""` (the original same-origin spelling) still works as same-origin, with a one-time
+  console warning; use `"same-origin"` instead.
+- **`signOut()` now resolves `SignOutResult`** — `{ revoked: boolean; activeSessionId?: string }` (was
+  `Promise<void>`; `await signOut()` keeps working). Changed on both `useAtlas()` and `useAuth()`
+  (`UseAuthReturn.signOut`).
+  - The revoke is retried once. If it still fails, the user is signed out locally anyway and the session id
+    is remembered (this tab + sibling tabs via the session broadcast), so focus, a sibling tab's signal or a
+    failed token refresh never re-adopt it from the still-valid refresh cookie; the next re-check retries the
+    revoke in the background.
+  - The revoke runs even when no token is cached (it falls back to the booted session, or asks the Frontend
+    API which session the browser's cookies carry).
+  - When the server promotes another account signed in on this browser, the provider adopts it and
+    `activeSessionId` names it.
+  - **New option `signOut({ strict: true })`** rejects with a **`SignOutError`** (exported;
+    `code: 'SIGN_OUT_REVOKE_FAILED'`, `sessionId`, `status`) after the local sign-out when the revoke fails.
+  - `sessions` is now cleared on sign-out too.
+- **New `locale` prop on `<AtlasProvider>`** (`SupportedLocale | string`): `'en'`, `'en-US'`, `'es'`, `'es-ES'`,
+  `'fr'`, `'fr-FR'`, `'de'`, `'de-DE'`, `'pt'`, `'pt-BR'`, `'ja'`, `'ja-JP'`, `'nl'`, `'nl-NL'`, and regional
+  variants that fall back to their language. Unknown → English with a console warning. `localization` still
+  overrides key by key on top. Re-exported from `@atlasauth/localizations`: `resolveLocale`,
+  `LOCALIZATION_KEYS`, `missingKeys`, type `SupportedLocale`. New dependency: `@atlasauth/localizations`
+  (bundled statically: the catalogs are small, and a synchronous lookup means no English flash and identical
+  SSR output).
+- **New context method `broadcastSessionChange()`** on `useAtlas()`: tells sibling tabs to re-check. The
+  built-in flows call it after completing a sign-in, so other tabs update immediately instead of on focus.
+- **Popup OAuth:** a popup that closes without posting back but left a session behind (the browser severed
+  `window.opener`) now completes the sign-in in the opener (re-boot, `afterUrl`, sibling tabs) instead of
+  being treated as a cancel.
+- **Accessibility / appearance:**
+  - New `appearance.variables.colorTextOnPrimary` (→ `--atlas-color-text-on-primary`): primary button and avatar
+    text. Defaults to white or near-black, whichever contrasts more with the resolved `colorPrimary` (was a
+    fixed `#fff`). The `dark` and `neobrutalist` themes now get dark button text.
+  - New `appearance.variables.colorFocusRing` (→ `--atlas-color-focus-ring`): a solid 2px `:focus-visible`
+    outline (2px offset) on inputs, buttons, social buttons, menu items, tabs and the avatar, replacing the
+    translucent glow. Defaults to the primary (`neobrutalist`: black).
+  - With a design active, explicit `colorTextOnPrimary` / `colorFocusRing` still win over the design's ink
+    and ring; design-mode focus is a solid outline too.
+  - Inputs are at least 16px (base and design mode), so iOS Safari no longer zooms on focus.
+  - `DesignTokens`, `DEFAULT_TOKENS` and `THEMES` gain both keys. The base stylesheet (`ATLAS_BASE_CSS`)
+    changed deliberately for these fixes.
+- **`<ApiKeys/>` and `useApiKeys()`.** Let signed-in users manage their own API keys: list, create
+  (prompts for the password and retries when the server asks for a recent sign-in), show the new
+  secret once with a copy button, rename, and revoke after a confirmation. Props: `organizationId`,
+  `renderClaimsFields` (alias `claimsForm`) for extra fields that go into the key's `claims`,
+  `onCreate`, and `expiryOptionsDays`. Shows a key's `limits` when present.
+- New exported types: `ApiKeysProps`, `ApiKeysStatus`, `ApiKeyClaimsFieldsContext`,
+  `UseApiKeysResult`, and re-exports of `UserApiKey`, `CreatedUserApiKey`, `CreateUserApiKeyInput`.
+- New en-US catalog keys under `apiKeys.*` (32 keys).
+
+## 0.4.1
+- **Front-channel logout on sign-out.** `signOut()` now loads the `frontchannel_logout_urls` the
+  Frontend API returns (apps signed in with "Sign in with Atlas" through this session) in hidden,
+  sandboxed iframes, so those apps clear their sessions in this browser too. It waits until the frames
+  load or 5 s pass, never fails the sign-out, only loads `https:` URLs (and `http://localhost`), and
+  does nothing during SSR. Pass `signOut({ frontchannel: false })` to skip it.
+
 ## 0.4.0
 - **Design system.** Components now adopt the design configured in the Atlas dashboard
   automatically (fetched from the Frontend API; opt out with `appearance.instanceDesign: false`).
@@ -26,6 +111,16 @@
 - `useAuth()` has an exported return type, `UseAuthReturn`; annotate with it and TypeScript
   rejects fields that don't exist.
 
+## 0.3.0
+- **Popup sign-in for "Sign in with Atlas".** New `signInWithAtlasPopup(opts)` signs in from a
+  popup with no full-page redirect and no callback page; the code is exchanged in the page with
+  PKCE. It rejects with `popup_closed` if the user closes the popup, and falls back to the
+  redirect flow when the popup is blocked.
+- `<SignInWithAtlasButton>` accepts `uxMode: 'redirect' | 'popup'` (default `'redirect'`) and
+  `onSuccess(result)` for popup mode.
+- The sign-in result (`AtlasIdResult`) now also includes `credential` (the id_token).
+- Changed: the default issuer is `https://atlasauth.net`.
+
 ## 0.2.0
 - **New: `<SignInWithAtlasButton>` + `completeSignInWithAtlas()`** — "Sign in with Atlas" for any
   website via OIDC authorization-code + PKCE against `https://atlasauth.net`. Standalone: no
@@ -53,6 +148,9 @@
   but never read; it now redirects after the session is established. No-op when unset.
 - **Provider icons render at a real size** (D12). Brand marks (GitHub especially) carried only a
   `viewBox` and collapsed to 0×0 in the SDK; they now have an intrinsic size plus a CSS rule.
+- **`frontendApi` is now a REQUIRED prop on `<AtlasProvider>`**. It was silently
+- **`<SignIn afterUrl>` / `<SignUp afterUrl>` now navigate** on completion. It was typed
+- **Provider icons render at a real size**. Brand marks (GitHub especially) carried only a
 
 ## 0.1.29
 - **Fix — the invisible Google overlay is no longer rendered at exactly `opacity:0`.** GSI's
@@ -117,6 +215,35 @@
   Redirect for Google requires a `client_secret` to be configured on the provider.
 - **Add `hideTitle` prop** to `<SignIn>` / `<SignUp>`. Set it when your page already renders its own "Sign in" heading above the panel, so the title doesn't appear twice.
 
+## 0.1.23
+- The headless `<SocialSignInButton provider="google">` (and `useSignIn()`) now use the same
+  in-page Google button as the built-in `<SignIn>`, so Google sign-in completes without a
+  redirect or a stranded tab. Other providers keep the popup / redirect flow.
+
+## 0.1.22
+- Social buttons in `<SignIn>` now show a provider icon: the built-in brand mark, or a custom
+  icon URL configured for the provider in the dashboard.
+
+## 0.1.21
+- Added: `onSignedIn(user)` prop on `<AtlasProvider>`. Fires once on a real signed-out →
+  signed-in transition (including after a popup sign-in), never when a session is restored on
+  page load.
+
+## 0.1.20
+- Social buttons in `<SignIn>` now use the per-instance button label configured in the
+  dashboard when one is set, instead of always "Continue with {provider}".
+
+## 0.1.19
+- Added: popup-mode social / OIDC sign-in. Set `oauthMode: 'popup' | 'redirect'` on
+  `<AtlasProvider>` as the app default or on `<SignIn>` to override; the default stays
+  `'redirect'`. A blocked popup falls back to redirect.
+- Added: `useSignIn().startOauth({ provider, mode })` and a headless `<SocialSignInButton>`
+  with `onOpen`, `onError` and `onBlockedFallback` callbacks.
+
+## 0.1.18
+- Added: `hideTitle` prop on `<SignIn>` / `<SignUp>` to hide the panel's own heading when the
+  page already shows one.
+
 ## 0.1.17
 - **Fix — SSR-safe base styles.** The base stylesheet is now rendered as a `<style id="atlas-base-styles">` in `AtlasProvider`'s own output, so prebuilt components are styled in server-rendered HTML **and** on the client (no flash of unstyled content on SSR/Next.js). `ATLAS_BASE_CSS` and `injectAtlasStyles` are exported for manual/advanced use.
 - **Use `>= 0.1.17`** if you rely on the prebuilt components styling themselves. 0.1.15/0.1.16 did not ship usable CSS (see below).
@@ -130,3 +257,79 @@
 ---
 
 Components are styled out of the box from 0.1.17 with no CSS import — see the guide: https://atlasauth.net/docs/react-appearance-and-styling
+## 0.1.14
+- Added: billing hooks `useBilling()`, `useCheckout()` and `useSubscription()` (user- or
+  organization-scoped via `{ orgId }`) and a `<PricingTable>` component; checkout and the billing
+  portal open on Stripe-hosted pages. New `CheckoutParams`, `AtlasBillingPlan` and
+  `AtlasBillingSubscription` types.
+
+## 0.1.13
+- Added: multiple signed-in accounts per browser. `useSessionList()` lists them and
+  `setActive({ session })` switches; `<UserButton>` lists other accounts for one-click
+  switching; `<MultisessionAppSupport>` remounts its children on a switch. New
+  `AtlasSessionResource` type.
+- Added: extension points for prebuilt components — `<UserButton.MenuItems>` with
+  `<UserButton.Action>` / `<UserButton.Link>`, and `<UserProfile.Page>` / `<UserProfile.Link>`.
+
+## 0.1.12
+- Added: `useOrganizationList()`, `<CreateOrganization>` and `<OrganizationList>`.
+- Added: `<Waitlist>` and `useWaitlist()`.
+- Added: `useReverification()` — headless wrapper for step-up re-authentication.
+
+## 0.1.11
+- Added: `<SignInButton>`, `<SignUpButton>` and `<SignOutButton>` (new `AuthButtonProps` type),
+  `<RedirectToSignIn>` / `<RedirectToSignUp>`, `<UserAvatar>`, and the headless `useSignUp()`.
+
+## 0.1.10
+- Fixed: republished with resolved dependency versions; 0.1.9 was published with unresolved
+  workspace dependencies and could not be installed (deprecated on npm).
+
+## 0.1.9
+- Added: `<ManagePasskeys>` — list, add and remove passkeys; included in `<UserProfile>`. Shows a
+  "not supported" note when the browser has no WebAuthn.
+
+## 0.1.8
+- Added: `<ManageMfa>` — enrol an authenticator app (TOTP), verify, show backup codes and turn
+  2FA off; included in `<UserProfile>`.
+
+## 0.1.7
+- Added: `<ProfileCard>` (editable name, email addresses) and `<ActiveSessions>` (devices with
+  per-device sign-out and "sign out of all other devices"). `<UserProfile>` now composes them.
+
+## 0.1.6
+- `<SignIn>` now shows a button for every enabled social provider: Google in-page, the others
+  via redirect back to the current page.
+
+## 0.1.5
+- Sign-in, sign-out and organization switches now propagate to other open tabs, and a tab
+  re-checks the session on focus, so a tab that started a sign-in elsewhere updates itself.
+
+## 0.1.4
+- The Google button in `<SignIn>` now has default styling from the `--atlas-*` appearance
+  variables, so it looks like a button without any custom CSS.
+
+## 0.1.3
+- Changed: the Google button in `<SignIn>` is now your themed button (the `socialButton`
+  appearance element) with Google's real button overlaid invisibly, instead of Google's own
+  fixed-style button.
+
+## 0.1.2
+- Added: `<SignIn>` shows a native in-page Google button when the Google connection is enabled
+  with a client id; One Tap is opt-in via `googleOneTap`.
+- Added: headless `useSignIn()` for apps that render their own Google button.
+
+## 0.1.1
+- First published release.
+- `<AtlasProvider>` with `useAtlas()`, `useAuth()`, `useUser()`, `useSession()`,
+  `useOrganization()`.
+- Components: `<SignIn>`, `<SignUp>`, `<UserButton>`, `<UserProfile>`,
+  `<OrganizationSwitcher>`, `<OrganizationProfile>`, `<SignedIn>`, `<SignedOut>`, `<Protect>`,
+  `<AtlasLoading>`, `<AtlasLoaded>`.
+- Theming via `appearance` (design tokens, themes, per-element classes) and i18n.
+- Silent cross-site session check: `useSilentAuth()`, plus `checkSession` /
+  `handleSilentCallback` re-exported from `@atlasauth/js`.
+
+---
+
+Components are styled out of the box from 0.1.17 with no CSS import — see the guide: https://atlasauth.net/docs/react-appearance-and-styling
+

package/dist/AtlasProvider.d.ts

@@ -1,7 +1,9 @@
 import { type ReactNode } from 'react';
-import { type ProviderToken } from '@atlasauth/js';
+import { type ProviderToken, type SignOutOptions, type SignOutResult } from '@atlasauth/js';
+import { type SupportedLocale } from '@atlasauth/localizations';
 import { type Appearance } from './appearance';
 import { type Catalog } from './i18n';
+import { type InstanceSettings } from './instance-settings';
 import type { AtlasOrganizationMembership, AtlasSession, AtlasSessionResource, AtlasUser, SessionClaims } from './types';
 /**
  * §10.1 `<AtlasProvider publishableKey>`.
@@ -27,6 +29,13 @@ interface AtlasContextValue {
     claims: SessionClaims | null;
     memberships: AtlasOrganizationMembership[];
     appearance?: Appearance;
+    /**
+     * The instance's public sign-in / sign-up settings (per-flow captcha, sign-up
+     * fields, legal consent) from `GET /v1/appearance`. Null until loaded, or when
+     * the server could not be reached — the components then fall back to their
+     * defaults and the server still enforces every gate.
+     */
+    instanceSettings: InstanceSettings | null;
     /** §oauth popup mode — app-wide default for social/OIDC sign-in (see AtlasProviderProps). */
     oauthMode?: 'popup' | 'redirect';
     catalog: Catalog;
@@ -48,7 +57,24 @@ interface AtlasContextValue {
      * server refreshes a stale token on read; the refresh token is never exposed.
      */
     getProviderToken(provider: string): Promise<ProviderToken | null>;
-    signOut(): Promise<void>;
+    /**
+     * Sign out of the active session: revoke it on the Frontend API (retried
+     * once), run front-channel logout, drop local state and sign sibling tabs out.
+     *
+     * Resolves `{ revoked, activeSessionId? }`. `revoked: false` means the server
+     * could not confirm the revoke; the user is still signed out locally and this
+     * browser never re-adopts that session. `activeSessionId` is set when another
+     * account signed in on this browser was promoted (multi-session) — the
+     * provider adopts it. With `{ strict: true }` a failed revoke rejects with a
+     * `SignOutError` (after the local sign-out).
+     */
+    signOut(options?: SignOutOptions): Promise<SignOutResult>;
+    /**
+     * Tell other tabs of this app that auth changed here, so they re-check.
+     * `reload()` deliberately does not do this (a received signal must not loop);
+     * call it after completing a sign-in yourself.
+     */
+    broadcastSessionChange(): void;
     setActiveOrganization(organizationId: string | null): Promise<void>;
     /**
      * §L1 switch which signed-in account is active on this browser (Clerk
@@ -74,15 +100,30 @@ export interface AtlasProviderProps {
      *   - on the hosted fleet, before you verify a custom domain, the shared host
      *     `https://atlasauth.net` (FAPI resolves the instance from the key);
      *   - once a custom domain is verified, that host, e.g. `https://auth.acme.com`;
-     *   - `""` for a same-origin / reverse-proxy setup where you serve FAPI under
-     *     your own origin (requests then go to relative paths).
+     *   - `"same-origin"` (or a path such as `"/atlas"`) for a reverse-proxy setup
+     *     where you serve FAPI under your own origin (requests then go to
+     *     relative paths).
      *
-     * It is required (not optional) so that omitting it is a COMPILE error rather
-     * than a silent fall-through to relative URLs that hit the app's own origin and
-     * fail. Pass `""` deliberately for the same-origin case.
+     * `""` is the deprecated same-origin spelling: it still works, with a
+     * one-time console warning. Missing or malformed values throw an `AtlasConfigError`
+     * (`code: 'FRONTEND_API_REQUIRED'` / `'FRONTEND_API_INVALID'`) when the
+     * provider renders, instead of silently sending requests to the app's own
+     * origin. Plain `http:` is accepted only for localhost and local development
+     * hosts.
      */
     frontendApi: string;
     appearance?: Appearance;
+    /**
+     * The UI language, as a BCP-47 tag: `"en"`, `"en-US"`, `"es"`, `"es-ES"`,
+     * `"fr"`, `"fr-FR"`, `"de"`, `"de-DE"`, `"pt-BR"`, `"ja"`, `"nl"`, … A region
+     * the catalogs don't have falls back to its language (`"es-MX"` → Spanish);
+     * an unknown language falls back to English. Defaults to English.
+     */
+    locale?: SupportedLocale | (string & {});
+    /**
+     * String overrides, key by key (`{ 'signIn.title': 'Welcome back' }`), or a
+     * whole bundle from `@atlasauth/localizations`. Applied on top of `locale`.
+     */
     localization?: Catalog;
     /**
      * §oauth popup mode — the app-wide default for social/OIDC sign-in. `"popup"`

package/dist/AtlasProvider.js

@@ -5,16 +5,20 @@ exports.useAtlas = useAtlas;
 const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
 const js_1 = require("@atlasauth/js");
+const localizations_1 = require("@atlasauth/localizations");
 const appearance_1 = require("./appearance");
 const styles_1 = require("./styles");
 const i18n_1 = require("./i18n");
+const instance_settings_1 = require("./instance-settings");
 const AtlasContext = (0, react_1.createContext)(null);
 /** §R3.2 the cross-tab "auth changed here, re-check" signal. Carries no token —
  *  a receiving tab re-boots from the shared cookies, never from the channel. */
 const SESSION_SIGNAL = 'atlas:session';
 function AtlasProvider(props) {
-    const { publishableKey, children, appearance, localization } = props;
-    const baseUrl = props.frontendApi ?? '';
+    const { publishableKey, children, appearance, localization, locale } = props;
+    // Throws an AtlasConfigError at render for a missing/malformed value — the
+    // old silent `?? ''` fallback sent every request to the app's own origin.
+    const baseUrl = (0, react_1.useMemo)(() => (0, js_1.resolveFrontendApi)(props.frontendApi, { component: '<AtlasProvider>' }), [props.frontendApi]);
     const doFetch = props.fetchImpl ?? fetch;
     const [status, setStatus] = (0, react_1.useState)('loading');
     const [user, setUser] = (0, react_1.useState)(null);
@@ -22,6 +26,8 @@ function AtlasProvider(props) {
     const [sessions, setSessions] = (0, react_1.useState)([]);
     const [claims, setClaims] = (0, react_1.useState)(null);
     const [memberships, setMemberships] = (0, react_1.useState)([]);
+    // Filled from GET /v1/appearance (see the effect beside the dashboard design).
+    const [instanceSettings, setInstanceSettings] = (0, react_1.useState)(null);
     const cache = (0, react_1.useRef)(new js_1.TokenCache());
     const timer = (0, react_1.useRef)(null);
     // §R3.2 cross-tab session channel + refs the tab-propagation effect reads
@@ -29,6 +35,12 @@ function AtlasProvider(props) {
     const channel = (0, react_1.useRef)(null);
     const statusRef = (0, react_1.useRef)('loading');
     const reloadRef = (0, react_1.useRef)(() => Promise.resolve());
+    // Sessions this tab signed out of: never re-adopted from a still-valid
+    // refresh cookie, even when the revoke did not reach the server.
+    const tombstones = (0, react_1.useRef)(null);
+    if (!tombstones.current)
+        tombstones.current = new js_1.SessionTombstones();
+    const sessionIdRef = (0, react_1.useRef)(null);
     /**
      * Captured synchronously during the first render (not in an effect) so it is
      * already in context before <SignIn> reads it — a needs_second_factor redirect
@@ -56,6 +68,10 @@ function AtlasProvider(props) {
         });
     }, [baseUrl, doFetch, publishableKey]);
     const applyToken = (0, react_1.useCallback)((jwt, sessionId) => {
+        // A refresh that was in flight when the user signed out must not put the
+        // signed-out session's token back.
+        if (tombstones.current?.has(sessionId))
+            return;
         const expiresAt = (0, js_1.readExpiry)(jwt);
         if (!expiresAt)
             return;
@@ -68,7 +84,16 @@ function AtlasProvider(props) {
             if (!response.ok)
                 throw new Error('boot failed');
             const body = (await response.json());
-            if (!body.session || !body.user) {
+            const tombstoned = body.session ? tombstones.current?.has(body.session.id) : false;
+            if (tombstoned && body.session) {
+                // The browser still holds a refresh cookie for a session this tab signed
+                // out of (the revoke never landed). Stay signed out, and try the revoke
+                // again in the background — when it lands the server clears the cookies
+                // (or promotes a parked account, which the next re-check adopts).
+                void (0, js_1.revokeSession)(call, body.session.id, { retries: 0 });
+            }
+            if (!body.session || !body.user || tombstoned) {
+                sessionIdRef.current = null;
                 cache.current.clear();
                 setStatus('signed_out');
                 setUser(null);
@@ -78,6 +103,7 @@ function AtlasProvider(props) {
                 setMemberships([]);
                 return;
             }
+            sessionIdRef.current = body.session.id;
             setUser(body.user);
             setSession(body.session);
             // §L1 the multi-session list, active first. Older servers omit it; fall
@@ -138,9 +164,13 @@ function AtlasProvider(props) {
         };
     }, [status, claims, refresh]);
     /** §R3.2 tell sibling tabs that auth changed here, so they re-check. */
-    const announceSessionChange = (0, react_1.useCallback)(() => {
-        channel.current?.post({ type: SESSION_SIGNAL });
+    const announceSessionChange = (0, react_1.useCallback)((signedOut) => {
+        const message = signedOut?.length
+            ? { type: SESSION_SIGNAL, signedOut }
+            : { type: SESSION_SIGNAL };
+        channel.current?.post(message);
     }, []);
+    const broadcastSessionChange = (0, react_1.useCallback)(() => announceSessionChange(), [announceSessionChange]);
     // Keep refs current for the once-mounted tab-propagation effect below, so it
     // reads live `status`/`reload` without re-subscribing every render.
     (0, react_1.useEffect)(() => {
@@ -172,8 +202,18 @@ function AtlasProvider(props) {
         const ch = (0, js_1.bestChannel)('atlas-session');
         channel.current = ch;
         const unsub = ch?.subscribe((msg) => {
-            if (msg?.type === SESSION_SIGNAL)
-                void reloadRef.current();
+            const signal = msg;
+            if (signal?.type !== SESSION_SIGNAL)
+                return;
+            // Learn the sessions a sibling signed out of BEFORE re-checking, so this
+            // tab cannot re-adopt one from a refresh cookie the revoke did not clear.
+            if (Array.isArray(signal.signedOut)) {
+                const ids = signal.signedOut.filter((id) => typeof id === 'string');
+                tombstones.current?.add(...ids);
+                if (sessionIdRef.current && ids.includes(sessionIdRef.current))
+                    cache.current.clear();
+            }
+            void reloadRef.current();
         });
         const onVisible = () => {
             if (document.visibilityState === 'visible' && statusRef.current !== 'signed_in') {
@@ -236,21 +276,57 @@ function AtlasProvider(props) {
      */
     const fapiClient = (0, react_1.useMemo)(() => new js_1.FapiClient({ publishableKey, baseUrl, fetchImpl: doFetch }), [publishableKey, baseUrl, doFetch]);
     const getProviderToken = (0, react_1.useCallback)((provider) => (0, js_1.getProviderToken)(fapiClient, provider), [fapiClient]);
-    const signOut = (0, react_1.useCallback)(async () => {
-        const current = cache.current.peek();
-        if (current) {
-            await call(`/v1/client/sessions/${current.sessionId}/revoke`, { method: 'POST' }).catch(() => undefined);
+    const signOut = (0, react_1.useCallback)(async (options) => {
+        // The session to end: from the token cache, else the booted session, else
+        // (no state yet — e.g. called before boot finished) whatever session the
+        // browser's cookies carry. The revoke route works from the cookies, so a
+        // missing in-memory token never skips the server-side sign-out.
+        let sessionId = cache.current.peek()?.sessionId ?? sessionIdRef.current;
+        let outcome = { revoked: true, status: 200 };
+        if (!sessionId) {
+            try {
+                const response = await call('/v1/client');
+                if (!response.ok)
+                    throw new Error('boot failed');
+                const body = (await response.json());
+                sessionId = body.session?.id ?? null;
+            }
+            catch {
+                outcome = { revoked: false, status: 0 };
+            }
+        }
+        if (sessionId) {
+            // Remember it first: from here on nothing in this tab may re-adopt it.
+            tombstones.current?.add(sessionId);
+            outcome = await (0, js_1.revokeSession)(call, sessionId);
+            // OIDC Front-Channel Logout: let the apps signed in through this session
+            // clear theirs in this browser (hidden iframes, capped at 5 s). Best-effort.
+            if (options?.frontchannel !== false)
+                await (0, js_1.runFrontChannelLogoutFromResponse)(outcome.response);
         }
+        sessionIdRef.current = null;
         cache.current.clear();
         setStatus('signed_out');
         setUser(null);
         setSession(null);
+        setSessions([]);
         setClaims(null);
         setMemberships([]);
+        // §L1 the server promoted another account signed in on this browser: adopt
+        // it deliberately (the revoke response already set its cookies).
+        if (outcome.activeSessionId && !tombstones.current?.has(outcome.activeSessionId)) {
+            await reload();
+        }
         // §R3.2 sign every sibling tab out too, so a shared device doesn't leave a
         // live-looking session in another tab after the user signed out here.
-        announceSessionChange();
-    }, [announceSessionChange, call]);
+        announceSessionChange(sessionId ? [sessionId] : undefined);
+        if (!outcome.revoked && options?.strict) {
+            throw new js_1.SignOutError(sessionId ?? '', outcome.status);
+        }
+        return outcome.activeSessionId
+            ? { revoked: outcome.revoked, activeSessionId: outcome.activeSessionId }
+            : { revoked: outcome.revoked };
+    }, [announceSessionChange, call, reload]);
     const setActiveOrganization = (0, react_1.useCallback)(async (organizationId) => {
         const current = cache.current.peek();
         if (!current)
@@ -283,7 +359,15 @@ function AtlasProvider(props) {
         // §R3.2 the active account is session state other tabs reflect — nudge them.
         announceSessionChange();
     }, [announceSessionChange, applyToken, call, reload]);
-    const catalog = (0, react_1.useMemo)(() => (localization ? (0, i18n_1.withFallback)(localization) : i18n_1.EN_US), [localization]);
+    const catalog = (0, react_1.useMemo)(() => {
+        // A built-in language bundle, then the app's own overrides key by key.
+        const base = locale ? (0, localizations_1.resolveLocale)(locale) : undefined;
+        if (locale && !base)
+            warnUnknownLocale(locale);
+        if (!base && !localization)
+            return i18n_1.EN_US;
+        return (0, i18n_1.withFallback)({ ...base, ...localization });
+    }, [locale, localization]);
     // §onSignedIn: fire once on a genuine signed_out → signed_in transition (a NEW
     // sign-in, including the post-popup re-boot), never on a cached-boot load. Uses
     // a ref for the callback so a new function identity each render can't re-fire it.
@@ -308,17 +392,21 @@ function AtlasProvider(props) {
         claims,
         memberships,
         appearance,
+        instanceSettings,
         catalog,
         pendingAttempt,
         getToken,
         getProviderToken,
         signOut,
+        broadcastSessionChange,
         setActiveOrganization,
         setActiveSession,
         reload,
     }), [
         appearance,
+        instanceSettings,
         baseUrl,
+        broadcastSessionChange,
         publishableKey,
         props.oauthMode,
         catalog,
@@ -344,20 +432,24 @@ function AtlasProvider(props) {
     const [instanceDesign, setInstanceDesign] = (0, react_1.useState)(null);
     const wantsInstanceDesign = appearance?.instanceDesign !== false;
     (0, react_1.useEffect)(() => {
-        if (!wantsInstanceDesign)
-            return;
         let alive = true;
         void (async () => {
             try {
                 const response = await call('/v1/appearance');
                 if (!response.ok)
                     return;
-                const design = (0, appearance_1.instanceDesignFrom)(await response.json());
-                if (alive)
-                    setInstanceDesign(design);
+                const body = await response.json();
+                if (!alive)
+                    return;
+                // The sign-in / sign-up settings (captcha, fields, consent) are read even
+                // when the app opted out of the dashboard DESIGN: they are behaviour, not
+                // styling, and the server enforces them either way.
+                setInstanceSettings((0, instance_settings_1.instanceSettingsFrom)(body));
+                if (wantsInstanceDesign)
+                    setInstanceDesign((0, appearance_1.instanceDesignFrom)(body));
             }
             catch {
-                // No dashboard design is the safe fallback.
+                // No dashboard design / default settings are the safe fallback.
             }
         })();
         return () => {
@@ -380,6 +472,13 @@ function useAtlas() {
     }
     return value;
 }
+const warnedLocales = new Set();
+function warnUnknownLocale(locale) {
+    if (warnedLocales.has(locale) || typeof console === 'undefined')
+        return;
+    warnedLocales.add(locale);
+    console.warn(`[Atlas] No built-in strings for locale "${locale}"; falling back to English.`);
+}
 function decodeClaims(jwt) {
     const parts = jwt.split('.');
     if (parts.length !== 3)