@atlasauth/backend 0.7.3 → 0.9.0

package/dist/client/instance.d.ts

@@ -12,6 +12,15 @@ export interface Instance {
     environment: string;
     publishable_key: string;
     frontend_api_host: string;
+    /**
+     * The `iss` this instance's session tokens carry. It changes when a custom
+     * domain goes active, so read it (and the two URLs below) rather than hard-coding it.
+     */
+    issuer: string;
+    /** The OpenID discovery document whose `issuer` equals {@link issuer}. */
+    discovery_url: string;
+    /** The JWKS holding this instance's signing keys. */
+    jwks_uri: string;
     allowed_origins: string[];
     auth_config: Metadata;
     created_at: number;
@@ -40,6 +49,30 @@ export interface PreflightFinding {
     /** Ids of what the finding is about (provider, client_id, domain, …). */
     subject?: Record<string, string>;
 }
+/** An advisory published for an Atlas browser SDK version. */
+export interface SdkAdvisory {
+    object: 'sdk_advisory';
+    /** e.g. `@atlasauth/react`. */
+    package: string;
+    /** The affected range, e.g. `<0.8.1`. */
+    affected: string;
+    fixed_in: string;
+    /** Stable code, e.g. `email_code_sign_in`. */
+    reason: string;
+    severity: 'critical' | 'high' | 'medium' | 'low';
+    summary: string;
+    /** ISO date. */
+    published_at: string;
+}
+/** An Atlas browser SDK version that called this instance recently. */
+export interface SdkVersionSeen {
+    package: string;
+    version: string;
+    /** Epoch ms. */
+    last_seen_at: number;
+    /** The advisories that apply to this version. */
+    advisories: SdkAdvisory[];
+}
 export interface PreflightReport {
     object: 'preflight';
     /** True when there are no error-severity findings. */
@@ -48,6 +81,8 @@ export interface PreflightReport {
     checked_at: number;
     /** Ordered error, then warning, then info. */
     findings: PreflightFinding[];
+    /** Atlas browser SDK versions seen in the last 7 days (newest first), with their advisories. */
+    sdk_versions_seen?: SdkVersionSeen[];
 }
 /** A consent tool whose documented "reopen preferences" trigger Atlas fills in. */
 export type CookieSettingsLinkPreset = 'cookiemunch' | 'cookiebot' | 'onetrust' | 'custom';
@@ -71,6 +106,27 @@ export interface CookieSettingsLink {
     /** The attributes the rendered link carries: `attributes` plus the preset's trigger. */
     rendered_attributes: Record<string, string>;
 }
+/** One cookie or browser-storage key Atlas writes for the instance (all strictly necessary). */
+export interface DeclaredCookie {
+    /** The exact name, or null when `pattern` describes a family of keys. */
+    name: string | null;
+    /** A `*` wildcard for keys with an id suffix, e.g. `atlasid:*`. */
+    pattern: string | null;
+    store: 'cookie' | 'localStorage' | 'sessionStorage' | 'indexedDB';
+    /** A cookie's Domain (or the exact Frontend API host); for storage, "your app's origin". */
+    domain: string;
+    /** Seconds; null = browser session (cookie) or until cleared (storage). */
+    lifetime_seconds: number | null;
+    /** The lifetime in words, for a cookie policy table. */
+    lifetime: string;
+    http_only: boolean;
+    category: 'necessary';
+    purpose: string;
+    written_when: string;
+    set_by: 'atlas_frontend_api' | 'atlas_sdk';
+}
+/** `page` (default): the consent tag carries the page language; `browser`: no attribute. */
+export type CookieConsentCulture = 'page' | 'browser';
 /** The cookie-consent script injected into the hosted sign-in, sign-up and account pages. */
 export interface CookieConsent {
     object: 'cookie_consent';
@@ -83,6 +139,9 @@ export interface CookieConsent {
     extra_origins?: string[];
     /** The footer "Cookie settings" link, or null when none is set. */
     settings_link?: CookieSettingsLink | null;
+    culture?: CookieConsentCulture;
+    /** Every cookie and browser-storage key Atlas writes for this instance, for your cookie policy. */
+    declared_cookies?: DeclaredCookie[];
 }
 export interface SetCookieConsentBody {
     /** Your consent script URL. Must be https; its origin is added to the page CSP. */
@@ -97,12 +156,154 @@ export interface SetCookieConsentBody {
     extra_origins?: string[];
     /** A footer "Cookie settings" link that reopens the consent preferences; null or omitted for none. */
     settings_link?: CookieSettingsLinkInput | null;
+    /** `page` (default) tags the consent script with the page language; `browser` leaves it to the tool. */
+    culture?: CookieConsentCulture | null;
+}
+/** `POST /v1/instance/move_origin` (and the platform app twin). */
+export interface OriginMoveRequest {
+    /** The old origin, `scheme://host[:port]`. */
+    from: string;
+    /** The new origin: https, or http only for localhost. */
+    to: string;
+    /** `true` reports the diff and any problems and writes nothing. */
+    dry_run?: boolean;
+}
+export interface OriginMoveChange {
+    object: 'instance' | 'oauth_client' | 'atlas_id_app' | 'webhook_endpoint' | 'redirect_url';
+    id: string;
+    /** e.g. `allowed_origins`, `redirect_uris`, `homepage_url`, `branding.legal.privacyUrl`. */
+    field: string;
+    before: string | string[] | null;
+    after: string | string[] | null;
+}
+export interface OriginMoveProblem {
+    object?: string;
+    id?: string;
+    field?: string;
+    url?: string;
+    message?: string;
+}
+/** The before → after diff of an origin move. A repeated run returns no changes. */
+export interface OriginMove {
+    object: 'origin_move';
+    from: string;
+    to: string;
+    dry_run: boolean;
+    /** True when this run wrote changes. */
+    applied: boolean;
+    changes: OriginMoveChange[];
+    /** Values the field would refuse; a real run with problems is a 422 and writes nothing. */
+    problems: OriginMoveProblem[];
+    /** Platform app twin only: the app after the move. */
+    app?: Record<string, unknown>;
+}
+/** One link from this instance to another platform, and its health. */
+export interface InstanceConnection {
+    object: 'connection';
+    kind: 'privacy_webhook' | 'cmp' | 'atlas_id_app' | 'jwt_template';
+    /** What was checked, e.g. `privacy_webhook_delivery`, `cmp_site`. */
+    check: string;
+    ok: boolean;
+    severity: 'error' | 'warning' | 'info';
+    subject: Record<string, string>;
+    /** What to do when `ok` is false. */
+    fix_hint: string | null;
+    /** Epoch ms. */
+    last_checked_at: number;
+    /** Kind-specific facts. */
+    details: Record<string, unknown>;
+}
+export interface InstanceConnections {
+    object: 'instance_connections';
+    /** False when any warning- or error-severity row is not ok. */
+    ok: boolean;
+    checked_at: number;
+    data: InstanceConnection[];
+}
+/** The Chatly connection (`enabled: false` and nothing else when none is set). */
+export interface ChatlyIntegration {
+    object: 'chatly_integration';
+    enabled: boolean;
+    channel?: string;
+    /** The template name to pass to `getToken({ template: 'chatly' })`. */
+    template?: 'chatly';
+    /** `chatly:<channel>`. */
+    audience?: string;
+    issuer?: string;
+    jwks_url?: string;
+    token_ttl_seconds?: number;
+    identity_verification?: {
+        mode?: 'oidc';
+        issuer?: string;
+        jwks_url?: string;
+        audience?: string;
+    };
+}
+export interface SetChatlyIntegrationBody {
+    /** The chat channel public id (letters, digits, `_` and `-`). */
+    channel: string;
+}
+/** The Forumulate connection (`enabled: false` and nothing else when none is set). */
+export interface ForumulateIntegration {
+    object: 'forumulate_integration';
+    enabled: boolean;
+    org_id?: string;
+    spaces?: Array<{
+        id: string;
+        redeem_url: string;
+    }>;
+    audience?: string;
+    issuer?: string;
+    jwks_url?: string;
+    token_ttl_seconds?: number;
+    /** The external_jwt provider to store on each space. */
+    reader_auth_provider?: {
+        method?: 'external_jwt';
+        order?: number;
+        config?: {
+            jwksUrl?: string;
+            issuer?: string;
+            clientId?: string;
+        };
+    };
+}
+export interface SetForumulateIntegrationBody {
+    org_id: string;
+    /** 1-50 space ids, or `{ id, redeem_url }`. */
+    spaces: Array<string | {
+        id: string;
+        redeem_url?: string | null;
+    }>;
+    /** The token `aud`. Default `forumulate:<org_id>`. */
+    audience?: string | null;
 }
 export declare function instanceResource(request: RequestFn): {
     get(): Promise<Instance>;
     update(body: UpdateInstanceBody): Promise<InstanceUpdateResult>;
     /** Check your setup in one call: configuration the server can see is broken or risky. */
     preflight(): Promise<PreflightReport>;
+    /**
+     * Move every URL that points at one origin to another (a domain move), across
+     * the instance, its OAuth clients, webhooks, redirect URLs and Sign in with
+     * Atlas apps. `dry_run: true` writes nothing.
+     */
+    moveOrigin(body: OriginMoveRequest): Promise<OriginMove>;
+    /** The instance's links to other platforms and their health. Read-only. */
+    connections(): Promise<InstanceConnections>;
+    /** Built-in connections to other platforms. */
+    integrations: {
+        chatly: {
+            get(): Promise<ChatlyIntegration>;
+            set(body: SetChatlyIntegrationBody): Promise<ChatlyIntegration>;
+            delete(): Promise<ChatlyIntegration>;
+        };
+        forumulate: {
+            get(): Promise<ForumulateIntegration>;
+            /** Replaces the whole connection. */
+            set(body: SetForumulateIntegrationBody): Promise<ForumulateIntegration>;
+            delete(): Promise<ForumulateIntegration>;
+        };
+    };
     /** The cookie-consent script on the hosted pages (any provider). */
     cookieConsent: {
         get(): Promise<CookieConsent>;

package/dist/client/instance.js

@@ -13,6 +13,44 @@ function instanceResource(request) {
         preflight() {
             return request({ method: 'GET', path: '/v1/instance/preflight' });
         },
+        /**
+         * Move every URL that points at one origin to another (a domain move), across
+         * the instance, its OAuth clients, webhooks, redirect URLs and Sign in with
+         * Atlas apps. `dry_run: true` writes nothing.
+         */
+        moveOrigin(body) {
+            return request({ method: 'POST', path: '/v1/instance/move_origin', body });
+        },
+        /** The instance's links to other platforms and their health. Read-only. */
+        connections() {
+            return request({ method: 'GET', path: '/v1/instance/connections' });
+        },
+        /** Built-in connections to other platforms. */
+        integrations: {
+            chatly: {
+                get() {
+                    return request({ method: 'GET', path: '/v1/instance/integrations/chatly' });
+                },
+                set(body) {
+                    return request({ method: 'PUT', path: '/v1/instance/integrations/chatly', body });
+                },
+                delete() {
+                    return request({ method: 'DELETE', path: '/v1/instance/integrations/chatly' });
+                },
+            },
+            forumulate: {
+                get() {
+                    return request({ method: 'GET', path: '/v1/instance/integrations/forumulate' });
+                },
+                /** Replaces the whole connection. */
+                set(body) {
+                    return request({ method: 'PUT', path: '/v1/instance/integrations/forumulate', body });
+                },
+                delete() {
+                    return request({ method: 'DELETE', path: '/v1/instance/integrations/forumulate' });
+                },
+            },
+        },
         /** The cookie-consent script on the hosted pages (any provider). */
         cookieConsent: {
             get() {

package/dist/client/instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AAgHA,4CA2BC;AA3BD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AAkSA,4CAiEC;AAjED,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,+CAA+C;QAC/C,YAAY,EAAE;YACZ,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/logout-notify-endpoints.d.ts

@@ -0,0 +1,71 @@
+import { type RequestFn } from './request';
+/**
+ * Logout fan-out ("also notify") endpoints: downstream services that receive the
+ * same signed `logout_token` as your OIDC apps whenever an Atlas session ends,
+ * plus a subject-wide one (sub, no sid) on ban, deletion or deprovisioning.
+ */
+export interface LogoutNotifyEndpoint {
+    object: 'logout_notify_endpoint';
+    id: string;
+    url: string;
+    /** The client_id this endpoint follows; null = instance-wide. */
+    oauth_client_id: string | null;
+    /** The `aud` its logout_tokens carry. */
+    audience: string;
+    description?: string | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateLogoutNotifyEndpointBody {
+    /** Public https endpoint. */
+    url: string;
+    /** A client_id of this instance to follow; omit for instance-wide. */
+    oauth_client_id?: string | null;
+    /** The logout_token `aud`. Default: the client_id when following a client, else the instance id. */
+    audience?: string | null;
+    /** Up to 200 characters. */
+    description?: string | null;
+}
+export interface UpdateLogoutNotifyEndpointBody {
+    url?: string;
+    audience?: string | null;
+    description?: string | null;
+}
+/** One logout_token sent to a fan-out endpoint. */
+export interface LogoutNotifyDelivery {
+    object: 'logout_notify_delivery';
+    id: string;
+    sub: string;
+    /** null = a subject-wide logout (ban / deletion). */
+    sid?: string | null;
+    status: 'pending' | 'success' | 'failed';
+    attempt_number: number;
+    http_status?: number | null;
+    response_snippet?: string | null;
+    next_retry_at?: number | null;
+    delivered_at?: number | null;
+    created_at: number;
+}
+export interface LogoutNotifyList<T> {
+    object: 'list';
+    data: T[];
+    has_more?: boolean;
+    next_cursor?: string | null;
+}
+export declare function logoutNotifyEndpointsResource(request: RequestFn): {
+    list(): Promise<LogoutNotifyList<LogoutNotifyEndpoint>>;
+    /** Register an endpoint. The URL must be public https. */
+    create(body: CreateLogoutNotifyEndpointBody, idempotencyKey?: string): Promise<LogoutNotifyEndpoint>;
+    get(id: string): Promise<LogoutNotifyEndpoint>;
+    update(id: string, body: UpdateLogoutNotifyEndpointBody, idempotencyKey?: string): Promise<LogoutNotifyEndpoint>;
+    /** Its queued deliveries go with it. */
+    delete(id: string, idempotencyKey?: string): Promise<{
+        object: "logout_notify_endpoint";
+        id: string;
+        deleted: true;
+    }>;
+    /** The endpoint's delivery log, newest first. */
+    listDeliveries(id: string, params?: {
+        limit?: number;
+    }): Promise<LogoutNotifyList<LogoutNotifyDelivery>>;
+};

package/dist/client/logout-notify-endpoints.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logoutNotifyEndpointsResource = logoutNotifyEndpointsResource;
+const request_1 = require("./request");
+function logoutNotifyEndpointsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/logout_notify_endpoints' });
+        },
+        /** Register an endpoint. The URL must be public https. */
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/logout_notify_endpoints', body, idempotencyKey });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/logout_notify_endpoints/${(0, request_1.enc)(id)}` });
+        },
+        update(id, body, idempotencyKey) {
+            return request({ method: 'PATCH', path: `/v1/logout_notify_endpoints/${(0, request_1.enc)(id)}`, body, idempotencyKey });
+        },
+        /** Its queued deliveries go with it. */
+        delete(id, idempotencyKey) {
+            return request({ method: 'DELETE', path: `/v1/logout_notify_endpoints/${(0, request_1.enc)(id)}`, idempotencyKey });
+        },
+        /** The endpoint's delivery log, newest first. */
+        listDeliveries(id, params = {}) {
+            return request({
+                method: 'GET',
+                path: `/v1/logout_notify_endpoints/${(0, request_1.enc)(id)}/deliveries`,
+                query: { ...params },
+            });
+        },
+    };
+}
+//# sourceMappingURL=logout-notify-endpoints.js.map

package/dist/client/logout-notify-endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout-notify-endpoints.js","sourceRoot":"","sources":["../../src/client/logout-notify-endpoints.ts"],"names":[],"mappings":";;AA4DA,sEA+BC;AA3FD,uCAAgD;AA4DhD,SAAgB,6BAA6B,CAAC,OAAkB;IAC9D,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,0DAA0D;QAC1D,MAAM,CAAC,IAAoC,EAAE,cAAuB;YAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAoC,EAAE,cAAuB;YAC9E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,wCAAwC;QACxC,MAAM,CACJ,EAAU,EACV,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,iDAAiD;QACjD,cAAc,CAAC,EAAU,EAAE,SAA6B,EAAE;YACxD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;gBACzD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/messaging.d.ts

@@ -193,6 +193,12 @@ interface ProviderBodyBase<T extends MessagingTransport> {
      * provider accepts. SMS: the sender number in E.164 format, e.g. `+15551234567`.
      */
     from_address?: string;
+    /**
+     * Email only. `development`: a development instance sends without a verified
+     * domain (Atlas sign-in templates only, `[Atlas test] ` subjects, capped);
+     * 409 on a production instance. Omitted on an update: the stored mode is kept.
+     */
+    mode?: 'standard' | 'development';
 }
 /**
  * First setup of transport `T` (or a switch to it): `config` carries every
@@ -246,8 +252,12 @@ type PublicConfigKey<T extends MessagingTransport> = Exclude<keyof MessagingTran
  */
 export interface MessagingProviderOf<C extends 'email' | 'sms', T extends MessagingTransport> {
     object: 'messaging_provider';
+    /** The provider id: pass it as `provider_id` to managed email or the development sender. */
+    id?: string;
     channel: C;
     transport: T;
+    /** How it sends: `standard` | `development` | `managed_domain`. */
+    mode?: 'standard' | 'development' | 'managed_domain';
     from_address: string | null;
     status: string;
     /** Non-secret config only — secret values are never returned. */
@@ -272,7 +282,131 @@ export interface MessagingProviders {
     object: 'messaging_providers';
     email: EmailProvider | null;
     sms: SmsProvider | null;
+    /** The Atlas-managed sending domain, when one is set up (summary). */
+    managed_email?: {
+        object: 'managed_email';
+        from_address: string;
+        domain: string;
+        status: string;
+        verified: boolean;
+    } | null;
+    /** The email provider in development mode, when it is. */
+    development_email?: {
+        object: 'development_email';
+        enabled: true;
+        from_address: string | null;
+    } | null;
+}
+/** A DNS record to publish for the managed sending domain. */
+export interface ManagedEmailRecord {
+    purpose: 'dkim' | 'spf' | 'return_path' | 'ownership' | 'dmarc' | 'other';
+    type: 'TXT' | 'MX' | 'CNAME';
+    /** Fully-qualified record name. */
+    name: string;
+    value: string;
+    priority?: number;
+    status?: string;
+}
+/** Managed email: Atlas sets your sending domain up on your own Resend or Brevo account and sends through your key. */
+export interface ManagedEmail {
+    object: 'managed_email';
+    id: string;
+    from_address: string;
+    domain: string;
+    provider: string;
+    /** The email service the domain lives on (your own account there): `resend` | `brevo`. */
+    backend?: 'resend' | 'brevo';
+    /** Your email provider (mode `managed_domain`) that holds the API key. */
+    provider_id?: string | null;
+    region: string | null;
+    /** `not_started` | `pending` | `verified` | `failed` | `temporary_failure`. Email sends only when verified. */
+    status: string;
+    verified: boolean;
+    records: ManagedEmailRecord[];
+    /** Always null: no Atlas limits apply, your provider account's own do. */
+    limits: null;
+    usage: {
+        sent: number;
+        bounces: number;
+        complaints: number;
+        last_bounce_at: number | null;
+        last_complaint_at: number | null;
+    };
+    reputation: 'your_provider_account';
+    /** Brevo, on create: whether the bounce / complaint webhook was registered on your account. */
+    feedback_webhook?: 'registered' | 'not_registered';
+    /** DNS automation, when set. The token is never returned. */
+    dns: {
+        provider: string;
+        token_set: boolean;
+    } | null;
+    failure_reason: string | null;
+    last_checked_at: number | null;
+    verified_at: number | null;
+    created_at: number;
+    updated_at: number;
+    /** Create only, with `dns`: the zone and the records Atlas wrote. */
+    dns_result?: Record<string, unknown>;
+    next_step?: string;
+}
+export interface CreateManagedEmailBody {
+    /** The From address, bare or `"Name <address>"`. Its domain becomes the sending domain. */
+    from_address: string;
+    /** Your own provider account Atlas sets the domain up on. Required with `config` unless `provider_id` is given. */
+    transport?: 'resend' | 'brevo';
+    /** Your provider API key (write-only). */
+    config?: {
+        api_key: string;
+    };
+    /** Instead of `transport` + `config`: your configured Resend or Brevo email provider. */
+    provider_id?: string;
+    region?: 'us-east-1' | 'eu-west-1' | 'sa-east-1' | 'ap-northeast-1';
+    /** Let Atlas write the DNS records. The token is write-only. */
+    dns?: {
+        provider: 'cloudflare';
+        /** A DNS API token with Zone Read and DNS Edit on the zone. Write-only. */
+        api_token: string;
+        /** Replace a conflicting existing record. */
+        overwrite?: boolean;
+    };
+}
+export interface DeletedManagedEmail {
+    object: 'managed_email';
+    domain: string;
+    deleted: true;
+    /** Whether the email provider that held the key (mode `managed_domain`) was removed too. */
+    provider_removed?: boolean;
 }
+/** Your own email provider in development mode (development instances, no verified domain). */
+export interface DevelopmentEmail {
+    object: 'development_email';
+    provider_id: string;
+    enabled: true;
+    /** False on a production instance (never sends) or when the provider is disabled. */
+    active: boolean;
+    transport: string;
+    from_address: string | null;
+    subject_prefix: string;
+    footer: string;
+    templates: string[];
+    limits: {
+        daily: number;
+        per_recipient_hourly: number;
+    };
+    /** Present for onboarding@resend.dev: Resend delivers it only to your Resend account address. */
+    note?: string;
+    next_step?: string;
+    updated_at: number;
+}
+/** `{ provider_id }`, or your provider exactly as `messaging.setEmail` takes it. */
+export type EnableDevelopmentEmailBody = {
+    provider_id: string;
+    from_address?: string;
+} | {
+    transport: 'resend' | 'ses' | 'smtp' | 'brevo' | 'mailgun';
+    config?: Record<string, string>;
+    from_address?: string;
+};
 export interface MessagingTestResult {
     object: 'messaging_test';
     channel: string;
@@ -323,6 +457,40 @@ export declare function messagingResource(request: RequestFn): {
     deleteChannel(channel: "email" | "sms", options?: {
         force?: boolean;
     }): Promise<DeletedMessagingProvider>;
+    /**
+     * Your own email provider in development mode: a development instance sends
+     * Atlas's sign-in emails without a verified domain ([Atlas test] subjects, capped).
+     */
+    developmentEmail: {
+        /** 404 when the provider is not in development mode. */
+        get(): Promise<DevelopmentEmail>;
+        /** Turn development mode on. 409 `DEVELOPMENT_EMAIL_NOT_ALLOWED` on a production instance. */
+        enable(body: EnableDevelopmentEmailBody): Promise<DevelopmentEmail>;
+        /** Back to standard mode; the provider stays. */
+        disable(): Promise<{
+            object: "development_email";
+            deleted: true;
+            provider_id: string;
+            mode: "standard";
+        }>;
+    };
+    /** Managed email: Atlas sets your sending domain up on your own Resend or Brevo account. */
+    managedEmail: {
+        /** 404 when none is configured. */
+        get(): Promise<ManagedEmail>;
+        /** Register the sending domain; returns the DNS `records` to publish. */
+        create(body: CreateManagedEmailBody): Promise<ManagedEmail>;
+        /** Re-check the DNS records now; `verified` is true once email can be sent. */
+        verify(): Promise<ManagedEmail>;
+        /**
+         * Stop using managed email (DNS records are left in place). Refused with
+         * `409 EMAIL_PROVIDER_IN_USE` while it is the only way to send email; pass
+         * `{ force: true }` to remove it anyway.
+         */
+        delete(options?: {
+            force?: boolean;
+        }): Promise<DeletedManagedEmail>;
+    };
     /** Send a fixed, clearly-marked test message through the channel's provider. */
     test(channel: "email" | "sms", body: {
         to: string;

package/dist/client/messaging.js

@@ -40,6 +40,51 @@ function messagingResource(request) {
                 ...(options.force ? { query: { force: 'true' } } : {}),
             });
         },
+        /**
+         * Your own email provider in development mode: a development instance sends
+         * Atlas's sign-in emails without a verified domain ([Atlas test] subjects, capped).
+         */
+        developmentEmail: {
+            /** 404 when the provider is not in development mode. */
+            get() {
+                return request({ method: 'GET', path: '/v1/messaging_providers/email/development' });
+            },
+            /** Turn development mode on. 409 `DEVELOPMENT_EMAIL_NOT_ALLOWED` on a production instance. */
+            enable(body) {
+                return request({ method: 'POST', path: '/v1/messaging_providers/email/development', body });
+            },
+            /** Back to standard mode; the provider stays. */
+            disable() {
+                return request({ method: 'DELETE', path: '/v1/messaging_providers/email/development' });
+            },
+        },
+        /** Managed email: Atlas sets your sending domain up on your own Resend or Brevo account. */
+        managedEmail: {
+            /** 404 when none is configured. */
+            get() {
+                return request({ method: 'GET', path: '/v1/messaging_providers/email/managed' });
+            },
+            /** Register the sending domain; returns the DNS `records` to publish. */
+            create(body) {
+                return request({ method: 'POST', path: '/v1/messaging_providers/email/managed', body });
+            },
+            /** Re-check the DNS records now; `verified` is true once email can be sent. */
+            verify() {
+                return request({ method: 'POST', path: '/v1/messaging_providers/email/managed/verify' });
+            },
+            /**
+             * Stop using managed email (DNS records are left in place). Refused with
+             * `409 EMAIL_PROVIDER_IN_USE` while it is the only way to send email; pass
+             * `{ force: true }` to remove it anyway.
+             */
+            delete(options = {}) {
+                return request({
+                    method: 'DELETE',
+                    path: '/v1/messaging_providers/email/managed',
+                    ...(options.force ? { query: { force: 'true' } } : {}),
+                });
+            },
+        },
         /** Send a fixed, clearly-marked test message through the channel's provider. */
         test(channel, body) {
             return request({

package/dist/client/messaging.js.map

@@ -1 +1 @@
-{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/client/messaging.ts"],"names":[],"mappings":";;AAsVA,8CA0DC;AAhZD,uCAAgD;AAsVhD,SAAgB,iBAAiB,CAAC,OAAkB;IAIlD,SAAS,QAAQ,CAAC,IAAa;QAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAKD,SAAS,MAAM,CAAC,IAAa;QAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,0EAA0E;QAC1E,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD;;;;WAIG;QACH,QAAQ;QACR;;;;WAIG;QACH,MAAM;QACN;;;;;;WAMG;QACH,aAAa,CACX,OAAwB,EACxB,UAA+B,EAAE;YAEjC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC/C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QACD,gFAAgF;QAChF,IAAI,CAAC,OAAwB,EAAE,IAAoB;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,OAAO;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/client/messaging.ts"],"names":[],"mappings":";;AAydA,8CAuGC;AAhkBD,uCAAgD;AAydhD,SAAgB,iBAAiB,CAAC,OAAkB;IAIlD,SAAS,QAAQ,CAAC,IAAa;QAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAKD,SAAS,MAAM,CAAC,IAAa;QAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,0EAA0E;QAC1E,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD;;;;WAIG;QACH,QAAQ;QACR;;;;WAIG;QACH,MAAM;QACN;;;;;;WAMG;QACH,aAAa,CACX,OAAwB,EACxB,UAA+B,EAAE;YAEjC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC/C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,gBAAgB,EAAE;YAChB,wDAAwD;YACxD,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,8FAA8F;YAC9F,MAAM,CAAC,IAAgC;gBACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,iDAAiD;YACjD,OAAO;gBACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YAC1F,CAAC;SACF;QACD,4FAA4F;QAC5F,YAAY,EAAE;YACZ,mCAAmC;YACnC,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,yEAAyE;YACzE,MAAM,CAAC,IAA4B;gBACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD;;;;eAIG;YACH,MAAM,CAAC,UAA+B,EAAE;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,uCAAuC;oBAC7C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;SACF;QACD,gFAAgF;QAChF,IAAI,CAAC,OAAwB,EAAE,IAAoB;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,OAAO;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}