@atlasauth/svelte 0.8.0 → 0.10.0

package/dist/components/PolicyGate.svelte

@@ -0,0 +1,83 @@
+<script>import { onDestroy } from "svelte";
+import {
+  FapiClient,
+  PolicyGateController,
+  formatPolicyDate,
+  injectPolicyStyles,
+  joinTitles,
+  mountPolicyAcceptStep
+} from "@atlasauth/js";
+import { useAtlas } from "../context";
+import { classFor } from "../appearance";
+import { usePolicyUi } from "../policies";
+import { ATLAS_SVELTE_SDK } from "../version";
+export let onAccepted = void 0;
+const atlas = useAtlas();
+const status = atlas.status;
+const ui = usePolicyUi();
+const gate = new PolicyGateController(
+  new FapiClient({ publishableKey: atlas.publishableKey, baseUrl: atlas.frontendApi, locale: atlas.locale, sdk: ATLAS_SVELTE_SDK }),
+  atlas.locale ?? void 0
+);
+let pending = gate.pending;
+let grace = gate.graceEndsAt;
+let controller = null;
+let error = "";
+let step = null;
+const off = gate.subscribe(() => {
+  pending = gate.pending;
+  grace = gate.graceEndsAt;
+});
+onDestroy(() => {
+  off();
+  step?.destroy();
+});
+$: if ($status === "signed_in") void gate.load();
+async function begin() {
+  controller = await gate.begin();
+}
+function host(node, c) {
+  injectPolicyStyles(node.ownerDocument);
+  step = mountPolicyAcceptStep(node, c, {
+    ...ui,
+    onSubmit: async () => {
+      step?.setBusy(true);
+      const res = await gate.accept(c);
+      step?.setBusy(false);
+      if (!res.ok) {
+        error = res.errors[0]?.message ?? ui.t("policy.requiredGeneric");
+        return;
+      }
+      controller = null;
+      onAccepted?.();
+    },
+    onDecline: () => {
+      controller = null;
+    }
+  });
+  return {
+    destroy() {
+      step?.destroy();
+      step = null;
+    }
+  };
+}
+</script>
+
+{#if pending.length > 0 && !controller}
+  <div class={classFor('alert', atlas.appearance, 'atlas-policy-banner')} role="status" data-atlas-policy-banner="">
+    <span>
+      <strong>{ui.t('policy.bannerTitle')}. </strong>
+      {ui.t('policy.bannerBody', { policies: joinTitles(pending.map((p) => p.title), ui.t('policy.and')) })}
+      {#if grace}{' '}{ui.t('policy.bannerGrace', { date: formatPolicyDate(grace) })}{/if}
+    </span>
+    <button type="button" class={ui.classes.link} on:click={begin}>{ui.t('policy.bannerReview')}</button>
+  </div>
+{/if}
+{#if controller}
+  <div class={classFor('card', atlas.appearance, 'atlas-card')} data-atlas-policy-gate="">
+    <div use:host={controller} />
+    {#if error}<p class={ui.classes.error} role="alert">{error}</p>{/if}
+  </div>
+{/if}
+<slot />

package/dist/components/PolicyGate.svelte.d.ts

@@ -0,0 +1,24 @@
+import { SvelteComponent } from "svelte";
+declare const __propDef: {
+    props: {
+        /**
+           * In-app re-acceptance. For a signed-in user, a banner when a policy needs
+           * re-acceptance; "Review and accept" opens the unskippable dialog / checkboxes
+           * and posts `/v1/client/me/policies/accept`. Renders its slot always.
+           */ onAccepted?: (() => void) | undefined;
+    };
+    events: {
+        [evt: string]: CustomEvent<any>;
+    };
+    slots: {
+        default: {};
+    };
+    exports?: {} | undefined;
+    bindings?: string | undefined;
+};
+export type PolicyGateProps = typeof __propDef.props;
+export type PolicyGateEvents = typeof __propDef.events;
+export type PolicyGateSlots = typeof __propDef.slots;
+export default class PolicyGate extends SvelteComponent<PolicyGateProps, PolicyGateEvents, PolicyGateSlots> {
+}
+export {};

package/dist/components/RecoveryCodes.svelte

@@ -0,0 +1,55 @@
+<script>import { canDownloadRecoveryCodes, copyRecoveryCodes, downloadRecoveryCodes } from "@atlasauth/js";
+import { useAtlas } from "../context";
+import { classFor } from "../appearance";
+import { translate } from "../i18n";
+export let codes;
+export let busy = false;
+export let onSaved;
+const atlas = useAtlas();
+const cls = (key, base) => classFor(key, atlas.appearance, base);
+const t = (key) => translate(atlas.catalog, key);
+const canCopy = typeof navigator !== "undefined" && !!navigator.clipboard?.writeText;
+const canDownload = canDownloadRecoveryCodes();
+let copied = false;
+$: if (codes) copied = false;
+async function copy() {
+  copied = await copyRecoveryCodes(codes);
+}
+</script>
+
+<div class={cls('card', 'atlas-card')} data-atlas="recovery-codes">
+  <h1 class={cls('headerTitle', 'atlas-title')}>{t('mfa.recoveryCodesTitle')}</h1>
+  <p class="atlas-text">{t('mfa.recoveryCodesHelp')}</p>
+  <ul
+    class="atlas-recovery-codes"
+    data-atlas="recovery-codes-list"
+    style="list-style:none;padding:0;margin:8px 0 12px;display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:6px;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;text-align:center"
+  >
+    {#each codes as code (code)}
+      <li><code>{code}</code></li>
+    {/each}
+  </ul>
+  <div class="atlas-alternatives">
+    {#if canCopy}
+      <button class={cls('formButtonSecondary', 'atlas-button-secondary')} type="button" data-atlas="recovery-codes-copy" on:click={() => void copy()}>
+        {t('mfa.recoveryCodesCopy')}
+      </button>
+    {/if}
+    {#if canDownload}
+      <button
+        class={cls('formButtonSecondary', 'atlas-button-secondary')}
+        type="button"
+        data-atlas="recovery-codes-download"
+        on:click={() => downloadRecoveryCodes(codes)}
+      >
+        {t('mfa.recoveryCodesDownload')}
+      </button>
+    {/if}
+  </div>
+  {#if copied}
+    <p class="atlas-text" aria-live="polite" data-atlas="recovery-codes-copied">{t('mfa.recoveryCodesCopied')}</p>
+  {/if}
+  <button class={cls('formButtonPrimary', 'atlas-button')} type="button" data-atlas="recovery-codes-saved" disabled={busy} on:click={onSaved}>
+    {t('mfa.recoveryCodesSaved')}
+  </button>
+</div>

package/dist/components/RecoveryCodes.svelte.d.ts

@@ -0,0 +1,25 @@
+import { SvelteComponent } from "svelte";
+declare const __propDef: {
+    props: {
+        /**
+           * The recovery codes a mid-sign-in MFA enrolment came with, shown once before
+           * the sign-in finishes: copy them, download them as a .txt file, then
+           * "I've saved my codes" (`onSaved`) exchanges the ticket. The codes live only
+           * in the flow's memory and are forgotten once saved.
+           */ codes: string[];
+        busy?: boolean;
+        onSaved: () => void;
+    };
+    events: {
+        [evt: string]: CustomEvent<any>;
+    };
+    slots: {};
+    exports?: {} | undefined;
+    bindings?: string | undefined;
+};
+export type RecoveryCodesProps = typeof __propDef.props;
+export type RecoveryCodesEvents = typeof __propDef.events;
+export type RecoveryCodesSlots = typeof __propDef.slots;
+export default class RecoveryCodes extends SvelteComponent<RecoveryCodesProps, RecoveryCodesEvents, RecoveryCodesSlots> {
+}
+export {};

package/dist/components/SignIn.svelte

@@ -1,10 +1,11 @@
 <script>import { onDestroy } from "svelte";
-import { signUp as hostedSignUp } from "@atlasauth/js";
+import { lastUsedMethodLabel, pendingRecoveryCodes, signUp as hostedSignUp } from "@atlasauth/js";
 import { signIn } from "../accessors";
 import { useAtlas } from "../context";
 import { classFor } from "../appearance";
 import { translate } from "../i18n";
 import AttemptFlow from "./AttemptFlow.svelte";
+import RecoveryCodes from "./RecoveryCodes.svelte";
 export let afterUrl = void 0;
 export let signUpUrl = void 0;
 const atlas = useAtlas();
@@ -26,11 +27,24 @@ $: promptHref = $flowState.attempt?.status !== "complete" ? signUpHref(signUpUrl
 const flow = signIn();
 const flowState = flow.state;
 const settings = flow.settings;
+const lastMethod = flow.lastMethod;
+const enrollmentState = flow.enrollmentState;
 onDestroy(() => flow.destroy());
+$: recoveryCodes = pendingRecoveryCodes($flowState);
+$: lastLabel = !$flowState.attempt ? lastUsedMethodLabel($lastMethod, t) : null;
 const drawn = (..._deps) => flow.captcha.needed ? flow.captcha : null;
 $: captcha = drawn($settings, $flowState);
 </script>
 
+{#if lastLabel}
+  <p class={classFor('badge', atlas.appearance, 'atlas-text atlas-last-used-hint')} data-atlas="last-used" data-atlas-method={$lastMethod}>
+    {t('signIn.lastUsed')}: {lastLabel}
+  </p>
+{/if}
+
+{#if recoveryCodes}
+  <RecoveryCodes codes={recoveryCodes} busy={$flowState.busy} onSaved={flow.saveRecoveryCodes} />
+{:else}
 <AttemptFlow
   attempt={$flowState.attempt}
   busy={$flowState.busy}
@@ -39,9 +53,15 @@ $: captcha = drawn($settings, $flowState);
   titleKey="signIn.title"
   onSubmit={flow.submit}
   onPrepare={flow.prepare}
+  onEmailSecondFactor={$settings?.account.emailSecondFactor ? flow.sendEmailSecondFactor : null}
+  onSmsSecondFactor={$settings && flow.mfaChoices().sms ? flow.sendSmsSecondFactor : null}
+  enrollment={flow.enrollment}
+  enrollmentState={$enrollmentState}
   emailDelivery={$settings?.emailDelivery ?? null}
   {captcha}
+  onPolicyDecline={flow.declinePolicy}
 />
+{/if}
 
 {#if promptHref}
   <p class={classFor('footerAction', atlas.appearance, 'atlas-footer')} data-atlas-sign-up-prompt="">

package/dist/components/SignUp.svelte

@@ -1,17 +1,31 @@
-<script>import { onDestroy } from "svelte";
+<script>import { onDestroy, onMount } from "svelte";
+import { awaitingPasskey, passkeysSupported } from "@atlasauth/js";
 import { signUp } from "../accessors";
 import AttemptFlow from "./AttemptFlow.svelte";
+import PasskeySignUpStep from "./PasskeySignUpStep.svelte";
 import SignUpForm from "./SignUpForm.svelte";
 export let afterUrl = void 0;
 const flow = signUp();
 const flowState = flow.state;
 const settings = flow.settings;
 onDestroy(() => flow.destroy());
+onMount(() => {
+  void flow.loadPolicies();
+});
 const drawn = (..._deps) => flow.signUpCaptcha.needed ? flow.signUpCaptcha : null;
 $: captcha = drawn($settings, $flowState);
+let mode = "password";
+$: offer = $settings?.account.passkeySignUp ?? null;
+$: canPasskey = !!offer && passkeysSupported();
+$: usingPasskey = mode === "passkey" && canPasskey;
+function switchMode() {
+  mode = usingPasskey ? "password" : "passkey";
+}
 </script>
 
-{#if $flowState.attempt}
+{#if $flowState.attempt && awaitingPasskey($flowState.attempt)}
+  <PasskeySignUpStep busy={$flowState.busy} errors={$flowState.errors} onCreate={flow.createPasskey} />
+{:else if $flowState.attempt}
   <AttemptFlow
     attempt={$flowState.attempt}
     busy={$flowState.busy}
@@ -19,6 +33,8 @@ $: captcha = drawn($settings, $flowState);
     sessionKept={$flowState.sessionKept}
     titleKey="signUp.title"
     onSubmit={flow.submit}
+    emailVerification={$settings?.account.emailVerification ?? 'code'}
+    onResend={flow.resendSignUp}
   />
 {:else}
   <SignUpForm
@@ -26,6 +42,9 @@ $: captcha = drawn($settings, $flowState);
     busy={$flowState.busy}
     errors={$flowState.errors}
     {captcha}
-    onSubmit={flow.create}
+    policies={flow.policies}
+    onSubmit={usingPasskey ? flow.createWithPasskey : flow.create}
+    passkey={usingPasskey && offer ? { email: offer.email } : null}
+    onSwitchMode={canPasskey ? switchMode : undefined}
   />
 {/if}

package/dist/components/SignUpForm.svelte

@@ -1,26 +1,50 @@
 <script>import {
-  localizedErrorMessage
+  confirmPolicies,
+  localizedErrorMessage,
+  policyTranslator
 } from "@atlasauth/js";
+import { onDestroy } from "svelte";
 import { useAtlas } from "../context";
 import { classFor } from "../appearance";
 import { translate } from "../i18n";
 import CaptchaSlot from "./CaptchaSlot.svelte";
+import PolicyClickwrap from "./PolicyClickwrap.svelte";
+import PolicyConsent from "./PolicyConsent.svelte";
 export let settings = null;
 export let busy = false;
 export let errors = [];
 export let captcha = null;
 export let onSubmit;
+export let passkey = null;
+export let onSwitchMode = void 0;
+export let policies = null;
 const atlas = useAtlas();
 const cls = (key, base) => classFor(key, atlas.appearance, base);
 const t = (key, vars) => translate(atlas.catalog, key, vars);
 const errorText = (error) => localizedErrorMessage(error, atlas.errorCatalog ?? atlas.catalog, atlas.catalog);
 let values = {};
 let agreed = false;
-$: legal = settings?.legal;
+let declined = null;
+let policyTick = 0;
+let watched = null;
+let unwatch = null;
+$: if (policies !== watched) {
+  unwatch?.();
+  watched = policies;
+  unwatch = policies ? policies.subscribe(() => policyTick += 1) : null;
+}
+onDestroy(() => unwatch?.());
+const hasAny = (_tick, c) => !!c && c.policies.length > 0;
+const okFor = (_tick, c) => !c || c.policies.length === 0 || c.canSubmit();
+$: hasPolicies = hasAny(policyTick, policies);
+$: legal = hasPolicies ? void 0 : settings?.legal;
 $: showLegal = !!legal && (!!legal.termsUrl || !!legal.privacyUrl);
-$: consentOk = !legal?.required || agreed;
+$: policyOk = okFor(policyTick, policies);
+$: consentOk = (!legal?.required || agreed) && policyOk;
 $: fields = settings?.signUpFields ?? [];
-$: emailUnavailable = settings?.emailDelivery?.passwordSignUp === false;
+$: emailUnavailable = settings?.emailDelivery?.passwordSignUp === false && !(passkey && passkey.email !== "required");
+$: showEmail = !passkey || passkey.email !== "off";
+$: emailRequired = !passkey || passkey.email === "required";
 const label = (f) => f.required ? f.label : t("signUp.optionalField", { label: f.label });
 const inputType = (f) => ["email", "tel", "url", "number", "date"].includes(f.type) ? f.type : "text";
 const picked = (key) => values[key] ? values[key].split(", ") : [];
@@ -34,6 +58,14 @@ function toggle(f, option, on) {
 function handleSubmit(event) {
   event.preventDefault();
   if (!consentOk) return;
+  declined = null;
+  if (hasPolicies && policies) {
+    void confirmPolicies(policies, { t: policyTranslator(t) }).then((res) => {
+      if (res.ok) onSubmit({ ...values }, true);
+      else declined = res.declined;
+    });
+    return;
+  }
   onSubmit({ ...values }, legal?.required ? agreed : true);
 }
 </script>
@@ -123,22 +155,29 @@ function handleSubmit(event) {
         {/if}
       {/each}
 
-      <label class={cls('formField', 'atlas-field')}>
-        <span class={cls('formFieldLabel', 'atlas-field-label')}>{t('signUp.emailLabel')}</span>
-        <input
-          class={cls('formFieldInput', 'atlas-input')}
-          type="email"
-          name="email"
-          autocomplete="email"
-          required
-          value={values.email ?? ''}
-          on:input={(e) => (values.email = e.currentTarget.value)}
-        />
-        {#each errors.filter((e) => e.param === 'email') as error (error.code)}
-          <span class={cls('formFieldError', 'atlas-error')}>{errorText(error)}</span>
-        {/each}
-      </label>
+      {#if showEmail}
+        <label class={cls('formField', 'atlas-field')}>
+          <span class={cls('formFieldLabel', 'atlas-field-label')}
+            >{emailRequired ? t('signUp.emailLabel') : t('signUp.optionalField', { label: t('signUp.emailLabel') })}</span
+          >
+          <input
+            class={cls('formFieldInput', 'atlas-input')}
+            type="email"
+            name="email"
+            autocomplete="email"
+            required={emailRequired}
+            value={values.email ?? ''}
+            on:input={(e) => (values.email = e.currentTarget.value)}
+          />
+          {#each errors.filter((e) => e.param === 'email') as error (error.code)}
+            <span class={cls('formFieldError', 'atlas-error')}>{errorText(error)}</span>
+          {/each}
+        </label>
+      {/if}
 
+      {#if passkey}
+        <p class="atlas-text">{t('signUp.passkeyIntro')}</p>
+      {:else}
       <label class={cls('formField', 'atlas-field')}>
         <span class={cls('formFieldLabel', 'atlas-field-label')}>{t('signUp.passwordLabel')}</span>
         <input
@@ -154,6 +193,7 @@ function handleSubmit(event) {
           <span class={cls('formFieldError', 'atlas-error')}>{errorText(error)}</span>
         {/each}
       </label>
+      {/if}
 
       {#if showLegal && legal}
         <label class={cls('formField', 'atlas-consent')}>
@@ -176,6 +216,15 @@ function handleSubmit(event) {
         </label>
       {/if}
 
+      {#if hasPolicies && policies}
+        <PolicyConsent controller={policies} />
+        {#if declined}
+          <span class={cls('formFieldError', 'atlas-error')} role="alert" data-atlas-policy-declined="">
+            {t('policy.declined', { policy: declined })}
+          </span>
+        {/if}
+      {/if}
+
       {#if captcha}
         <CaptchaSlot controller={captcha} />
       {/if}
@@ -187,6 +236,22 @@ function handleSubmit(event) {
       >
         {t('signUp.submit')}
       </button>
+      {#if hasPolicies && policies}
+        <PolicyClickwrap controller={policies} />
+      {/if}
+      {#if onSwitchMode}
+        <div class="atlas-alternatives">
+          <button
+            type="button"
+            class={cls('formButtonSecondary', 'atlas-button-secondary')}
+            data-atlas-sign-up-mode={passkey ? 'password' : 'passkey'}
+            disabled={busy}
+            on:click={() => onSwitchMode?.()}
+          >
+            {t(passkey ? 'signUp.passwordOption' : 'signUp.passkeyOption')}
+          </button>
+        </div>
+      {/if}
     </form>
   {/if}
 </div>

package/dist/components/SignUpForm.svelte.d.ts

@@ -1,5 +1,5 @@
 import { SvelteComponent } from "svelte";
-import { type CaptchaController, type FieldError, type InstanceSettings } from '@atlasauth/js';
+import { type CaptchaController, type FieldError, type InstanceSettings, type PolicyAcceptanceController } from '@atlasauth/js';
 declare const __propDef: {
     props: {
         /**
@@ -16,6 +16,11 @@ declare const __propDef: {
         errors?: FieldError[];
         captcha?: CaptchaController | null;
         onSubmit: (values: Record<string, string>, consent: boolean) => void;
+        /** Passkey-only sign-up: no password field; the email per the instance's mode. */ passkey?: {
+            email: "off" | "optional" | "required";
+        } | null;
+        /** Toggle between the password and passkey forms (only when both are offered). */ onSwitchMode?: (() => void) | undefined;
+        /** The instance's policies (terms, privacy, …); they replace the legacy consent row. */ policies?: PolicyAcceptanceController | null;
     };
     events: {
         [evt: string]: CustomEvent<any>;

package/dist/context.d.ts

@@ -1,5 +1,5 @@
 import { type Readable } from 'svelte/store';
-import { type ProviderToken, type SignOutOptions, type SignOutResult, type SignOutEvent, type SignOutListener, type ReferralConsent } from '@atlasauth/js';
+import { type ProviderToken, type SignOutOptions, type SignOutResult, type EndImpersonationResult, type SignOutEvent, type SignOutListener, type ReferralConsent } from '@atlasauth/js';
 import { type Catalog } from './i18n';
 import { type Appearance, type InstanceDesign } from './appearance';
 import type { AtlasOrganizationMembership, AtlasSession, AtlasUser, SessionClaims } from './types';
@@ -95,6 +95,7 @@ export interface AtlasClient extends AtlasStores {
     pendingAttempt: {
         id: string;
         status: string;
+        policyToken?: string;
     } | null;
     /** The session JWT; with `{ template }` a short-lived named-template token (e.g. `'chatly'`). */
     getToken(options?: {
@@ -126,6 +127,13 @@ export interface AtlasClient extends AtlasStores {
      */
     signOut(options?: SignOutOptions): Promise<SignOutResult>;
     setActiveOrganization(organizationId: string | null): Promise<void>;
+    /**
+     * End the active impersonation ("return to admin"): the impersonator's own
+     * session on this browser becomes active again with no sign-in
+     * (`resumed: true`); with none, another account signed in here is adopted,
+     * or this browser is signed out.
+     */
+    endImpersonation(): Promise<EndImpersonationResult>;
     /** Re-boot from the Frontend API. Resolves true when a session now exists in this browser. */
     reload(): Promise<boolean>;
     /**

package/dist/context.js

@@ -52,7 +52,7 @@ export function createAtlasClient(options) {
             return null;
         const result = readRedirectResult(window.location.search);
         return result?.status && !result.ticket
-            ? { id: result.attemptId, status: result.status }
+            ? { id: result.attemptId, status: result.status, ...(result.policyToken ? { policyToken: result.policyToken } : {}) }
             : null;
     })();
     async function call(path, init) {
@@ -235,6 +235,22 @@ export function createAtlasClient(options) {
         applyToken(body.jwt, current.sessionId);
         await reload();
     }
+    async function endImpersonation() {
+        const outcome = await guard.endImpersonation(cache.peek()?.sessionId ?? get(session)?.id ?? null);
+        if (!outcome.ended)
+            return outcome;
+        if (!outcome.activeSessionId) {
+            if (timer)
+                clearTimeout(timer);
+            timer = null;
+            clearSession('user');
+            return outcome;
+        }
+        if (outcome.jwt)
+            applyToken(outcome.jwt, outcome.activeSessionId);
+        await reload();
+        return outcome;
+    }
     async function boot() {
         if (booted)
             return;
@@ -322,6 +338,7 @@ export function createAtlasClient(options) {
         getProviderToken,
         signOut,
         setActiveOrganization,
+        endImpersonation,
         reload,
         boot,
         loadInstanceDesign,

package/dist/i18n.js

@@ -9,7 +9,7 @@
  * A missing key renders the KEY, not an empty string. A blank button is a bug
  * nobody can report; a button reading `signIn.submit` is one anyone can.
  */
-import { EMAIL_UNAVAILABLE_MESSAGE } from '@atlasauth/js';
+import { EMAIL_UNAVAILABLE_MESSAGE, POLICY_STRINGS } from '@atlasauth/js';
 export const EN_US = {
     'signIn.title': 'Sign in',
     'signIn.subtitle': 'to continue to {application}',
@@ -18,6 +18,7 @@ export const EN_US = {
     'signIn.submit': 'Continue',
     'signIn.forgotPassword': 'Forgot password?',
     'signIn.noAccount': 'No account?',
+    'signIn.lastUsed': 'Last used',
     'signIn.signUpLink': 'Sign up',
     'signIn.orDivider': 'or',
     'signIn.socialButton': 'Continue with {provider}',
@@ -49,6 +50,13 @@ export const EN_US = {
     'signUp.and': 'and',
     // Shown instead of the email + password form when the app cannot send email.
     'signUp.emailUnavailable': EMAIL_UNAVAILABLE_MESSAGE,
+    'signUp.passkeyOption': 'Sign up with a passkey instead',
+    'signUp.passwordOption': 'Sign up with a password instead',
+    'signUp.passkeyIntro': "No password needed: you'll sign in with a passkey saved on this device or in your password manager.",
+    'signUp.passkeyPrompt': 'Create a passkey to finish setting up your account.',
+    'signUp.passkeyCreate': 'Create passkey',
+    'signUp.passkeyCancelled': "The passkey wasn't created. Try again when you're ready.",
+    'signUp.linkSentTo': 'We sent a confirmation link to {email}. Open it on any device; this page continues on its own.',
     'captcha.prompt': 'Complete the security check to continue.',
     'captcha.required': 'Please complete the security check, then try again.',
     'captcha.failed': "The security check didn't pass. Please try again.",
@@ -66,6 +74,24 @@ export const EN_US = {
     'mfa.usePasskey': 'Use a passkey instead',
     'mfa.useBackupCode': 'Use a recovery code',
     'mfa.submit': 'Verify',
+    'mfa.enrollChoose': 'Set up a second step for signing in.',
+    'mfa.enrollTotpOption': 'Use an authenticator app',
+    'mfa.enrollSmsOption': 'Use text messages',
+    'mfa.enrollScan': 'Scan this QR code with your authenticator app, or enter the setup key.',
+    'mfa.enrollQrAlt': 'QR code for your authenticator app',
+    'mfa.enrollSetupKey': 'Setup key',
+    'mfa.enrollPreparing': 'Setting up…',
+    'mfa.phoneLabel': 'Mobile number',
+    'mfa.phoneHint': 'Include the country code, for example +14155550101.',
+    'mfa.sendCode': 'Text me a code',
+    'mfa.codeTextedTo': 'Enter the code we texted to {phone}.',
+    'mfa.smsCodeOption': 'Text me a code instead',
+    'mfa.recoveryCodesTitle': 'Save your recovery codes',
+    'mfa.recoveryCodesHelp': "Each code works once. If you can't use your second step, sign in with one of these. Keep them somewhere safe: they won't be shown again.",
+    'mfa.recoveryCodesCopy': 'Copy codes',
+    'mfa.recoveryCodesCopied': 'Copied.',
+    'mfa.recoveryCodesDownload': 'Download as .txt',
+    'mfa.recoveryCodesSaved': "I've saved my codes",
     'reset.title': 'Reset your password',
     'reset.submit': 'Send reset code',
     'reset.newPasswordLabel': 'New password',
@@ -93,6 +119,37 @@ export const EN_US = {
     'organization.members': 'Members',
     'organization.invite': 'Invite member',
     'organization.roleLabel': 'Role',
+    'organization.invitations': 'Invitations',
+    'organization.settings': 'Settings',
+    'organization.emailLabel': 'Email address',
+    'organization.sendInvite': 'Send invitation',
+    'organization.noInvitations': 'No pending invitations.',
+    'organization.remove': 'Remove',
+    'organization.revoke': 'Revoke',
+    'organization.resend': 'Resend',
+    'organization.you': '(you)',
+    'organization.leave': 'Leave organization',
+    'organization.leaveConfirm': 'Leave {name}? You will lose access until you are invited again.',
+    'organization.delete': 'Delete organization',
+    'organization.deleteConfirm': 'Delete {name} for every member? This cannot be undone.',
+    'organization.confirm': 'Confirm',
+    'organization.cancel': 'Cancel',
+    'organization.unnamedMember': 'Unnamed member',
+    'organization.passwordPrompt': 'Enter your password to confirm.',
+    'organization.roles': 'Roles',
+    'organization.roleName': 'Role name',
+    'organization.roleKey': 'Role key (for example org:auditor)',
+    'organization.rolePermissions': 'Permissions',
+    'organization.createRole': 'Create role',
+    'organization.saveRole': 'Save role',
+    'organization.editRole': 'Edit',
+    'organization.deleteRole': 'Delete',
+    'organization.noCustomRoles': 'This organization has no roles of its own yet.',
+    'impersonation.banner': 'You are signed in as {name} on someone else\'s behalf.',
+    'impersonation.returnToAdmin': 'Return to admin',
+    'impersonation.end': 'End impersonation',
+    // Policy acceptance (terms, privacy, any policy).
+    ...POLICY_STRINGS,
     'error.generic': 'Something went wrong. Please try again.',
     'error.network': 'We could not reach the server. Check your connection.',
     // Server errors, by the stable `reason` the Frontend API sends. Shown instead

package/dist/index.d.ts

@@ -16,7 +16,7 @@ export * from './i18n';
 export * from './types';
 export * from './fapi';
 export { ATLAS_KEY, initAtlas, createAtlasClient, useAtlas, type AuthStatus, type AtlasInitOptions, type AtlasStores, type AtlasClient, } from './context';
-export { getUser, getSession, getAuth, getOrganization, getToken, signIn, signUp, signOut, type UseUser, type UseSession, type UseAuth, type UseOrganization, type FlowController, } from './accessors';
+export { getUser, getSession, getAuth, getOrganization, getOrganizationAuditLog, getToken, signIn, signUp, signOut, type UseUser, type UseSession, type UseAuth, type UseOrganization, type OrganizationAuditLogStore, type FlowController, } from './accessors';
 export { default as AtlasProvider } from './components/AtlasProvider.svelte';
 export { default as SignedIn } from './components/SignedIn.svelte';
 export { default as SignedOut } from './components/SignedOut.svelte';
@@ -29,6 +29,13 @@ export { default as UserButton } from './components/UserButton.svelte';
 export { default as UserProfile } from './components/UserProfile.svelte';
 export { default as OrganizationSwitcher } from './components/OrganizationSwitcher.svelte';
 export { default as OrganizationProfile } from './components/OrganizationProfile.svelte';
+export { default as OrganizationAuditLog } from './components/OrganizationAuditLog.svelte';
+export type { OrganizationAuditLogEntry, OrganizationAuditLogState } from '@atlasauth/js';
+export { default as ImpersonationBanner } from './components/ImpersonationBanner.svelte';
+export { default as PolicyConsent } from './components/PolicyConsent.svelte';
+export { default as PolicyClickwrap } from './components/PolicyClickwrap.svelte';
+export { default as PolicyAcceptStep } from './components/PolicyAcceptStep.svelte';
+export { default as PolicyGate } from './components/PolicyGate.svelte';
 export type { InstanceSettings, EmailDelivery, PublicSignUpField, CaptchaController, CaptchaFlowKey, CaptchaWidgetMode, FlowCaptcha, } from '@atlasauth/js';
 export { SignOutError } from '@atlasauth/js';
 export type { SignOutOptions, SignOutResult } from '@atlasauth/js';