@atlasauth/backend 0.8.0 → 0.9.1

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # @atlasauth/backend changelog
 
+## 0.9.1
+- **Allowed origins with an integration.** `UpdateInstanceBody.allowed_origins` and the platform app, instance and accountless-app bodies accept `AllowedOriginInput` entries: an origin string or `{ origin, integration }` (`OriginIntegration`: `redirect` | `embedded` | `auto`, or `null` to clear). `Instance`, `InstanceUpdateResult` and `PlatformApp` gain optional `allowed_origin_integrations`. New types: `AllowedOriginEntry`, `AllowedOriginInput`, `OriginIntegration`.
+- **Login readiness.** `LoginReadiness` gains `integration` (`LoginReadinessIntegration`: `assumed`, `source`, `reason`); `LoginReadinessCheck` gains `applies`.
+- **Branding audiences.** `Branding` accepts `audiences` (hint → `BrandingAudience` `{ heading, subheading, logoUrl, primaryColor }`, `null` deletes one); `ResolvedBranding` gains `audiences`. Start a hosted sign-in with `audienceHint` (or `audience_hint` on the URL) to use one.
+- **Error codes.** `AtlasErrorCodes` adds `READ_ONLY_FIELD`, `DEVELOPMENT_EMAIL_NOT_ALLOWED`, `DEVELOPMENT_EMAIL_UNAVAILABLE`, `DEVELOPMENT_EMAIL_LIMIT_REACHED` and `DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED`.
+- **Webhooks, several signatures.** `verifyWebhook` accepts an `atlas-signature` header with several space-separated `v1,<signature>` entries and verifies when any one matches (each compared in constant time). This prepares for webhook secret rotation with an overlap. A header with a single signature works as before.
+- **Compatible.** New types, optional fields and error codes only; a single-signature webhook header verifies as before.
+
+## 0.9.0
+- **OIDC relying party.** New `oidc` namespace and standalone functions for the hosted-redirect sign-in: `oidcStart` (`oidc.start`), `oidcCallback` (`oidc.callback`), `oidcLogoutUrl` (`oidc.logoutUrl`), `oidcVerifyIdToken` (`oidc.verifyIdToken`), `oidcClearCookie` (`oidc.clearCookie`). `start({ issuer, clientId, redirectUri, scope?, prompt?, loginHint?, audienceHint?, extraParams?, cookieName?, secret? })` returns `{ url, cookie, state, nonce }`: a PKCE (S256) authorize URL from discovery and a `Set-Cookie` for a 10-minute, httpOnly, `SameSite=Lax`, callback-path flow cookie, AES-GCM sealed when `secret` is set. `callback({ …, clientSecret?, clientAuth?: 'client_secret_basic' | 'client_secret_post' | 'none', query, cookie, secret?, clockToleranceSec? })` returns `OidcIdentity` (`sub`, `namespacedSub` = `${issuer}#${sub}`, `email`, `emailVerified`, `name`, `idToken`, `accessToken`, `refreshToken?`, `expiresAt` in epoch ms, `claims`, `clearCookie`). The ID token is verified with RS256 pinned, exact `iss`, `aud` containing the client id (and `azp` when present or when there are several audiences), `nonce`, `exp`/`iat` with tolerance, and `at_hash`. Discovery is cached per issuer for an hour.
+- **Errors.** `AtlasOidcError` with `code` (`AtlasOidcErrorCode`: `state_mismatch`, `issuer_mismatch`, `invalid_request`, `invalid_token`, `token_exchange_failed`, `access_denied`, `discovery_failed`), `oauthError`, `description`, `status`, `clearCookie` and `cause`.
+- **`AtlasBackend#oidc`.** The same helpers with the backend's `issuer`, `fetchImpl` and `now` filled in (`AtlasBackendOidc`).
+- **Test issuer.** `createTestIssuer` accepts `clientId`, `clientSecret` and `idTokenTtlSeconds`, and the returned `TestIssuer` gains `clientId`, `mintIdToken(claims?, { aud?, nonce?, accessToken?, ttlSeconds?, tamper? })`, `authorize(authorizeUrl, { sub?, claims?, tamper?, error? })`, `fetch` (an offline discovery, JWKS and token endpoint) and `endpoints`. `mintSession(claims?, { tamper? })` accepts a tamper too. `TestTokenTamper` is `wrong_aud`, `wrong_iss`, `foreign_key`, `expired`, `wrong_nonce` or `alg_none`; `TEST_TOKEN_TAMPERS` lists all six. New types: `MintIdTokenOptions`, `TestAuthorizeOptions`, `TestAuthorizeResult`.
+- **OAuth client secret rotation with overlap.** `oauthClients.rotateSecret(id, { overlap_seconds? }, idempotencyKey?)` takes how long the previous secret keeps working: default 86400 (24 hours), `0` revokes it now, at most 604800 (7 days). It returns `OAuthClientSecretRotation` (`client_secret`, `overlap_seconds`, `previous_secret_expires_at`: epoch ms, or null when the old secret already stopped working). New type `RotateOAuthClientSecretBody`. `OAuthClient` gains optional `previous_secret_expires_at`.
+- **Issuer and verification endpoints.** `Instance` (`instance.get()`) and the platform client's `PlatformApp` gain `issuer`, `discovery_url` and `jwks_uri`; `PlatformApp` also gains `frontend_api_host`. They change when a custom domain goes active, so read them rather than hard-coding them.
+- **Email verification.** `EmailAddress` gains optional `verification` (`{ status: 'verified' | 'unverified', strategy?: string | null }`). `verified` and `email_verified` are now true only for a proven address: one that signed up while `requireEmailVerification` was false reads `verified: false`, with `verification.strategy: 'skipped'`. Do not grant access on an unverified address.
+- **Email templates.** `EmailTemplateName` adds `account_secured` (variable `when`): sent when the owner of an address proves it and the account is secured from whoever had set it up without proof.
+- **Managed email uses your own provider account.** `messaging.managedEmail.create` now sets the domain up on YOUR Resend or Brevo account: `CreateManagedEmailBody` gains `transport` (`resend` | `brevo`) + `config.api_key`, or `provider_id`. `ManagedEmail` gains `backend`, `provider_id` and `feedback_webhook`; `limits` is now always `null` and `reputation` is `your_provider_account`. `DeletedManagedEmail` gains `provider_removed`. `ManagedEmailRecord.purpose` adds `ownership` and `dmarc`.
+- **Development email sender.** New `messaging.developmentEmail.get / enable / disable` (`DevelopmentEmail`, `EnableDevelopmentEmailBody`): your own email provider in development mode, for a development instance without a verified domain. `MessagingProviders` gains `development_email`.
+- **Provider mode.** Email provider bodies accept `mode` (`standard` | `development`); provider responses gain optional `id` and `mode` (`standard` | `development` | `managed_domain`).
+- **Compatible** except `ManagedEmail.limits` (was `{ hourly, daily }`, now `null`) and `ManagedEmail.reputation` (new constant). Everything else is new exports, optional parameters and fields; `rotateSecret(id)` behaves as before.
+
 ## 0.8.0
 - **Back-channel logout, retryable failures.** A failed `LogoutTokenResult` gains `retryable: boolean`. It is `true` for `no_keys` (the issuer's keys could not be fetched: a network error, a JWKS outage, or a just-rotated key whose refetch failed) and `false` for `malformed`, `invalid` and `replayed`. Answer `503` with `Retry-After` when it is true, so Atlas retries the delivery, and `400` otherwise. The README example does this.
 - **Back-channel delivery log and test.** `oauthClients.listBackchannelDeliveries(id, { limit?, starting_after? })` returns `BackchannelLogoutDeliveryPage` (`BackchannelLogoutDelivery`: `status`, `http_status`, `latency_ms`, `attempt_number`, `error`, `location`, `test`, timestamps). `oauthClients.testBackchannelLogout(id)` returns `BackchannelLogoutTest` (`ok`, `status`, `latency_ms`, `error`, `location`, `blocked_reason`, `body_excerpt`, `sid`, `delivery_id`). The platform client's `atlasIdApps` gains the same two methods plus `preflight(id)` (`AtlasIdAppPreflight`).

package/README.md

@@ -3,6 +3,7 @@
 Server-side Atlas for Node, Deno, Bun and edge runtimes. It does three things:
 
 - verifies Atlas session tokens, webhooks and back-channel logout tokens
+- runs the server side of a hosted-redirect (OpenID Connect) sign-in
 - gives you a typed client for the Backend API, using your secret key (`sk_...`)
 - gives you a typed client for the Platform API, using your platform key (`psk_...`)
 
@@ -24,6 +25,150 @@ if (result.ok) console.log(result.claims.sub);
 
 The JWKS is found from the issuer and cached. Instances on the shared host also pass `instanceId` (or `publishableKey`).
 
+## Sign in with a redirect (OpenID Connect)
+
+`oidc` runs the relying-party side of the hosted-redirect integration: state, nonce and PKCE, the flow cookie, the code exchange and the ID-token checks (RS256 only, `iss`, `aud` = your client id, `nonce`, `exp`).
+
+```ts
+import { oidc, AtlasOidcError } from '@atlasauth/backend';
+
+const config = {
+  issuer: 'https://bright-fox-42-fapi.atlasauth.net', // https:// + frontend_api_host
+  clientId: process.env.ATLAS_CLIENT_ID!,
+  redirectUri: 'https://app.example.com/auth/callback',
+  secret: process.env.OIDC_COOKIE_SECRET!, // 32+ random characters; seals the flow cookie
+};
+
+// Start: set the flow cookie, redirect.
+const { url, cookie } = await oidc.start({ ...config, scope: 'openid profile email' });
+
+// Callback: one call does every check.
+const identity = await oidc.callback({
+  ...config,
+  clientSecret: process.env.ATLAS_CLIENT_SECRET!,
+  query: request.url, // or URLSearchParams, or req.query
+  cookie: request.headers.get('cookie'),
+});
+// identity: { sub, namespacedSub, email, emailVerified, name, idToken, accessToken, refreshToken?, expiresAt, claims, clearCookie }
+
+// Sign out: end your session, then end the Atlas one.
+const logout = await oidc.logoutUrl({ ...config, postLogoutRedirectUri: 'https://app.example.com/', idTokenHint });
+```
+
+- The flow cookie is `httpOnly`, `SameSite=Lax`, `Secure` (except on a `http://localhost` callback), scoped to the callback path, and lasts 10 minutes. With `secret` it is encrypted (AES-GCM), so it can't be read or forged. Without `secret` it is only encoded. Always pass one in production.
+- `namespacedSub` is `${issuer}#${sub}`. Key users on it if you accept more than one instance, so two instances' users never collide.
+- `clientAuth` is `client_secret_basic` (default with a secret), `client_secret_post`, or `none` (public client, PKCE only).
+- `new AtlasBackend({ issuer }).oidc` has the same methods with `issuer` filled in.
+- Did your own code exchange? `oidc.verifyIdToken(idToken, { issuer, clientId, nonce })` runs just the token checks.
+
+Failures throw `AtlasOidcError` with a stable `code`:
+
+| `code` | Meaning |
+|---|---|
+| `state_mismatch` | No flow cookie, a different `state`, a cookie from another sign-in or secret, or a flow older than 10 minutes. Start again. |
+| `access_denied` | Atlas redirected back with an OAuth `error`. The exact value is in `oauthError` (`access_denied`, `login_required`, …). |
+| `issuer_mismatch` | The callback's `iss` parameter names a different server. |
+| `invalid_request` | The callback has no `code`. |
+| `token_exchange_failed` | The token endpoint refused the code or client (`oauthError`, `status`). |
+| `invalid_token` | The ID token failed a check: algorithm, signature, `iss`, `aud`/`azp`, `nonce`, `exp`/`iat` or `at_hash`. |
+| `discovery_failed` | The discovery document or the signing keys could not be fetched or don't match the issuer. |
+
+Every error from `callback` carries `clearCookie`: send it with your error page too.
+
+### Next.js (App Router)
+
+```ts
+// app/auth/login/route.ts
+import { oidc } from '@atlasauth/backend';
+import { config } from '@/lib/atlas';
+
+export async function GET() {
+  const { url, cookie } = await oidc.start(config);
+  return new Response(null, { status: 302, headers: { location: url, 'set-cookie': cookie } });
+}
+
+// app/auth/callback/route.ts
+import { oidc, AtlasOidcError } from '@atlasauth/backend';
+import { config } from '@/lib/atlas';
+
+export async function GET(request: Request) {
+  try {
+    const user = await oidc.callback({
+      ...config,
+      clientSecret: process.env.ATLAS_CLIENT_SECRET!,
+      query: request.url,
+      cookie: request.headers.get('cookie'),
+    });
+    const headers = new Headers({ location: '/' });
+    headers.append('set-cookie', user.clearCookie);
+    headers.append('set-cookie', await createAppSession(user)); // your own session cookie
+    return new Response(null, { status: 302, headers });
+  } catch (error) {
+    if (!(error instanceof AtlasOidcError)) throw error;
+    return new Response(`Sign-in failed (${error.code})`, {
+      status: 400,
+      headers: error.clearCookie ? { 'set-cookie': error.clearCookie } : {},
+    });
+  }
+}
+```
+
+### Express
+
+```ts
+import express from 'express';
+import { oidc, AtlasOidcError } from '@atlasauth/backend';
+
+const app = express();
+
+app.get('/auth/login', async (req, res) => {
+  const { url, cookie } = await oidc.start(config);
+  res.append('Set-Cookie', cookie).redirect(url);
+});
+
+app.get('/auth/callback', async (req, res) => {
+  try {
+    const user = await oidc.callback({
+      ...config,
+      clientSecret: process.env.ATLAS_CLIENT_SECRET!,
+      query: req.originalUrl,
+      cookie: req.headers.cookie,
+    });
+    res.append('Set-Cookie', user.clearCookie);
+    await startYourSession(req, res, user.namespacedSub);
+    res.redirect('/');
+  } catch (error) {
+    if (!(error instanceof AtlasOidcError)) throw error;
+    if (error.clearCookie) res.append('Set-Cookie', error.clearCookie);
+    res.status(400).send(`Sign-in failed (${error.code})`);
+  }
+});
+```
+
+## Test offline
+
+`createTestIssuer()` mints session tokens and ID tokens with a throwaway key, and its `fetch` serves discovery, the JWKS and a token endpoint, so a full redirect sign-in runs in a unit test with no network.
+
+```ts
+import { createTestIssuer, oidc, TEST_TOKEN_TAMPERS } from '@atlasauth/backend';
+
+const fx = await createTestIssuer({ clientSecret: 'test-secret' });
+const config = { issuer: fx.issuer, clientId: fx.clientId, redirectUri: 'https://app.example.com/auth/callback', secret: '…32+ chars…', fetchImpl: fx.fetch };
+
+const { url, cookie } = await oidc.start(config);
+const { callbackUrl } = await fx.authorize(url, { sub: 'user_1', claims: { email: 'a@example.com', email_verified: true } });
+const user = await oidc.callback({ ...config, clientSecret: 'test-secret', query: callbackUrl, cookie });
+
+// Negative cases: wrong_aud, wrong_iss, foreign_key, expired, wrong_nonce, alg_none.
+for (const tamper of TEST_TOKEN_TAMPERS) {
+  const { url, cookie } = await oidc.start(config);
+  const { callbackUrl } = await fx.authorize(url, { tamper });
+  await expect(oidc.callback({ ...config, clientSecret: 'test-secret', query: callbackUrl, cookie })).rejects.toMatchObject({ code: 'invalid_token' });
+}
+```
+
+`fx.mintIdToken(claims, { aud, nonce, tamper })` and `fx.mintSession(claims, { tamper })` mint single tokens. `@atlasauth/testing` re-exports `createTestIssuer`.
+
 ## Management client (secret key)
 
 ```ts
@@ -254,3 +399,5 @@ To check the route end to end, `oauthClients.testBackchannelLogout(id)` sends a
 ## Webhooks
 
 `verifyWebhook` checks the signature on events Atlas sends to your webhook endpoints. You manage endpoints with `atlas.webhooks.endpoints`: create, update, reveal or rotate a secret, send a test event, and redeliver a past delivery.
+
+The `atlas-signature` header can carry more than one signature, separated by spaces (`v1,<sig> v1,<sig>`). While an endpoint secret rotates, Atlas may sign each delivery with the old and the new secret. `verifyWebhook` accepts the delivery when any one signature matches your secret.

package/dist/client/branding.d.ts

@@ -51,6 +51,13 @@ export interface Branding {
     };
     /** How a verification code is entered — segmented `boxes` (default) or `single`. */
     codeInput?: 'boxes' | 'single';
+    /**
+     * Per-audience branding for the hosted pages, keyed by audience hint
+     * (`[a-z0-9_-]{1,32}`, at most 20). A sign-in started with
+     * `audience_hint=<hint>` uses that entry. An update merges per hint: an entry
+     * replaces that hint, `null` deletes it, `audiences: null` removes them all.
+     */
+    audiences?: Record<string, BrandingAudience | null> | null;
     card?: {
         width?: 'narrow' | 'default' | 'wide';
         align?: 'left' | 'center';
@@ -108,6 +115,17 @@ export interface HostedBackground {
     angle?: number;
     imageUrl?: string;
 }
+/** The hosted-page branding for one audience hint. */
+export interface BrandingAudience {
+    /** Replaces the card heading (up to 120 characters). */
+    heading?: string;
+    /** Replaces the line under the heading (up to 240 characters). */
+    subheading?: string;
+    /** Replaces the logo (https). */
+    logoUrl?: string;
+    /** Replaces the primary colour (hex, rgb() or a CSS colour name). */
+    primaryColor?: string;
+}
 /** What the renderers actually use — everything already escaped or dropped. */
 export interface ResolvedBranding {
     applicationName: string;
@@ -137,6 +155,8 @@ export interface ResolvedBranding {
     providerHidden?: string[];
     socialButtons?: Record<string, unknown>;
     codeInput?: 'boxes' | 'single';
+    /** Every audience the hosted page can theme for, as it reads them (invalid values dropped). */
+    audiences?: Record<string, BrandingAudience>;
     card?: {
         width: string;
         align: string;

package/dist/client/branding.js.map

@@ -1 +1 @@
-{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../src/client/branding.ts"],"names":[],"mappings":";;AAkLA,4CAcC;AAdD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,kEAAkE;QAClE,MAAM,CAAC,IAAuB;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,0EAA0E;QAC1E,OAAO,CAAC,IAAuB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../src/client/branding.ts"],"names":[],"mappings":";;AAuMA,4CAcC;AAdD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,kEAAkE;QAClE,MAAM,CAAC,IAAuB;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,0EAA0E;QAC1E,OAAO,CAAC,IAAuB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/diagnostics.d.ts

@@ -8,6 +8,11 @@ export interface LoginReadinessParams {
 export interface LoginReadinessCheck {
     name: string;
     pass: boolean;
+    /**
+     * `false` when the check does not matter for the assumed integration (it
+     * then never makes `ready` false). Absent from older servers.
+     */
+    applies?: boolean;
     observed: unknown;
     /** What was seen, and the fix when it fails. */
     detail: string;
@@ -17,9 +22,20 @@ export interface LoginReadiness {
     origin: string;
     live: boolean;
     data_region?: string | null;
+    /** Every check that applies to the assumed integration passes. */
     ready: boolean;
+    /** The integration the checks assumed for this origin, and why. */
+    integration?: LoginReadinessIntegration;
     checks: LoginReadinessCheck[];
 }
+export interface LoginReadinessIntegration {
+    /** `redirect`: hosted-redirect OIDC, so the `cors` and `session_cookie` checks do not apply. */
+    assumed: 'redirect' | 'embedded';
+    /** `declared` | `embedded_traffic` | `redirect_clients` | `default`. */
+    source: 'declared' | 'embedded_traffic' | 'redirect_clients' | 'default';
+    /** A plain sentence saying why. */
+    reason: string;
+}
 export interface RequestInspectorParams {
     /** The browser origin making the request. */
     origin: string;

package/dist/client/diagnostics.js.map

@@ -1 +1 @@
-{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../src/client/diagnostics.ts"],"names":[],"mappings":";;AAsDA,kDAmBC;AAnBD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,yGAAyG;QACzG,cAAc,CAAC,MAA4B;YACzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,iCAAiC;gBACvC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;QACD,uFAAuF;QACvF,gBAAgB,CAAC,MAA8B;YAC7C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,mCAAmC;gBACzC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../src/client/diagnostics.ts"],"names":[],"mappings":";;AAuEA,kDAmBC;AAnBD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,yGAAyG;QACzG,cAAc,CAAC,MAA4B;YACzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,iCAAiC;gBACvC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;QACD,uFAAuF;QACvF,gBAAgB,CAAC,MAA8B;YAC7C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,mCAAmC;gBACzC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/email-templates.d.ts

@@ -1,7 +1,7 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
 /** The transactional email a template drives. */
-export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'team_member_added' | 'team_role_changed';
+export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'account_secured' | 'team_member_added' | 'team_role_changed';
 /** The customizable body of a template: a subject line and a text body. */
 export interface EmailTemplateBody {
     subject?: string;

package/dist/client/email-templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AAwDA,wDAkBC;AA1ED,uCAAgD;AAwDhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AAyDA,wDAkBC;AA3ED,uCAAgD;AAyDhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/error.d.ts

@@ -47,6 +47,16 @@ export declare const AtlasErrorCodes: {
     readonly CAPTCHA_IN_USE: "CAPTCHA_IN_USE";
     /** Strict mode: the body had a field this endpoint does not accept (`param` names it). */
     readonly UNKNOWN_FIELD: "UNKNOWN_FIELD";
+    /** 422 — the body set a field that is not writable on this endpoint (`param` names it; the message names the call that changes it). */
+    readonly READ_ONLY_FIELD: "READ_ONLY_FIELD";
+    /** 409 — the development email sender is not available on a production instance. */
+    readonly DEVELOPMENT_EMAIL_NOT_ALLOWED: "DEVELOPMENT_EMAIL_NOT_ALLOWED";
+    /** 503 — the development email sender is not available on this deployment. */
+    readonly DEVELOPMENT_EMAIL_UNAVAILABLE: "DEVELOPMENT_EMAIL_UNAVAILABLE";
+    /** 429 — the development sender's daily or per-recipient hourly cap is spent (`meta.window`, `meta.retry_after_seconds`). */
+    readonly DEVELOPMENT_EMAIL_LIMIT_REACHED: "DEVELOPMENT_EMAIL_LIMIT_REACHED";
+    /** 422 — the development sender sends only Atlas's own sign-in emails, never custom templates. */
+    readonly DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED: "DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED";
     /** The billing plan still has subscribers and cannot be removed. */
     readonly PLAN_IN_USE: "PLAN_IN_USE";
     /** The key is valid but for another API surface (e.g. a platform key on the Backend API). */

package/dist/client/error.js

@@ -43,6 +43,16 @@ exports.AtlasErrorCodes = {
     CAPTCHA_IN_USE: 'CAPTCHA_IN_USE',
     /** Strict mode: the body had a field this endpoint does not accept (`param` names it). */
     UNKNOWN_FIELD: 'UNKNOWN_FIELD',
+    /** 422 — the body set a field that is not writable on this endpoint (`param` names it; the message names the call that changes it). */
+    READ_ONLY_FIELD: 'READ_ONLY_FIELD',
+    /** 409 — the development email sender is not available on a production instance. */
+    DEVELOPMENT_EMAIL_NOT_ALLOWED: 'DEVELOPMENT_EMAIL_NOT_ALLOWED',
+    /** 503 — the development email sender is not available on this deployment. */
+    DEVELOPMENT_EMAIL_UNAVAILABLE: 'DEVELOPMENT_EMAIL_UNAVAILABLE',
+    /** 429 — the development sender's daily or per-recipient hourly cap is spent (`meta.window`, `meta.retry_after_seconds`). */
+    DEVELOPMENT_EMAIL_LIMIT_REACHED: 'DEVELOPMENT_EMAIL_LIMIT_REACHED',
+    /** 422 — the development sender sends only Atlas's own sign-in emails, never custom templates. */
+    DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED: 'DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED',
     /** The billing plan still has subscribers and cannot be removed. */
     PLAN_IN_USE: 'PLAN_IN_USE',
     /** The key is valid but for another API surface (e.g. a platform key on the Backend API). */

package/dist/client/error.js.map

@@ -1 +1 @@
-{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/client/error.ts"],"names":[],"mappings":";;;AAoBA,MAAa,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;IACzC,0CAA0C;IACjC,MAAM,CAAS;IACxB,8CAA8C;IACrC,MAAM,CAAmB;IAElC,YAAY,MAAc,EAAE,MAAwB,EAAE,OAAgB;QACpE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,wCAAwC,MAAM,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;CACF;AAzBD,sCAyBC;AAED;;;;GAIG;AACU,QAAA,eAAe,GAAG;IAC7B,+EAA+E;IAC/E,6BAA6B,EAAE,+BAA+B;IAC9D,mEAAmE;IACnE,uBAAuB,EAAE,yBAAyB;IAClD,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,wGAAwG;IACxG,cAAc,EAAE,gBAAgB;IAChC,0FAA0F;IAC1F,aAAa,EAAE,eAAe;IAC9B,oEAAoE;IACpE,WAAW,EAAE,aAAa;IAC1B,6FAA6F;IAC7F,iBAAiB,EAAE,mBAAmB;IACtC,gDAAgD;IAChD,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,4FAA4F;IAC5F,oBAAoB,EAAE,sBAAsB;IAC5C,yFAAyF;IACzF,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,oBAAoB,EAAE,sBAAsB;IAC5C,eAAe,EAAE,iBAAiB;IAClC,aAAa,EAAE,eAAe;IAC9B,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;CACZ,CAAC"}
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/client/error.ts"],"names":[],"mappings":";;;AAoBA,MAAa,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;IACzC,0CAA0C;IACjC,MAAM,CAAS;IACxB,8CAA8C;IACrC,MAAM,CAAmB;IAElC,YAAY,MAAc,EAAE,MAAwB,EAAE,OAAgB;QACpE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,wCAAwC,MAAM,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;CACF;AAzBD,sCAyBC;AAED;;;;GAIG;AACU,QAAA,eAAe,GAAG;IAC7B,+EAA+E;IAC/E,6BAA6B,EAAE,+BAA+B;IAC9D,mEAAmE;IACnE,uBAAuB,EAAE,yBAAyB;IAClD,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,wGAAwG;IACxG,cAAc,EAAE,gBAAgB;IAChC,0FAA0F;IAC1F,aAAa,EAAE,eAAe;IAC9B,uIAAuI;IACvI,eAAe,EAAE,iBAAiB;IAClC,oFAAoF;IACpF,6BAA6B,EAAE,+BAA+B;IAC9D,8EAA8E;IAC9E,6BAA6B,EAAE,+BAA+B;IAC9D,6HAA6H;IAC7H,+BAA+B,EAAE,iCAAiC;IAClE,kGAAkG;IAClG,sCAAsC,EAAE,wCAAwC;IAChF,oEAAoE;IACpE,WAAW,EAAE,aAAa;IAC1B,6FAA6F;IAC7F,iBAAiB,EAAE,mBAAmB;IACtC,gDAAgD;IAChD,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,4FAA4F;IAC5F,oBAAoB,EAAE,sBAAsB;IAC5C,yFAAyF;IACzF,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,oBAAoB,EAAE,sBAAsB;IAC5C,eAAe,EAAE,iBAAiB;IAClC,aAAa,EAAE,eAAe;IAC9B,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;CACZ,CAAC"}

package/dist/client/index.d.ts

@@ -341,7 +341,7 @@ declare function buildNamespaces(request: RequestFn): {
         get(id: string): Promise<import("./oauth-clients").OAuthClient>;
         create(body: import("./oauth-clients").CreateOAuthClientBody, idempotencyKey?: string): Promise<import("./oauth-clients").OAuthClientWithSecret>;
         update(id: string, body: import("./oauth-clients").UpdateOAuthClientBody): Promise<import("./oauth-clients").OAuthClient>;
-        rotateSecret(id: string): Promise<import("./oauth-clients").OAuthClientWithSecret>;
+        rotateSecret(id: string, body?: import("./oauth-clients").RotateOAuthClientSecretBody, idempotencyKey?: string): Promise<import("./oauth-clients").OAuthClientSecretRotation>;
         delete(id: string): Promise<{
             object: "oauth_client";
             id: string;
@@ -841,6 +841,16 @@ declare function buildNamespaces(request: RequestFn): {
         deleteChannel(channel: "email" | "sms", options?: {
             force?: boolean;
         }): Promise<import("./messaging").DeletedMessagingProvider>;
+        developmentEmail: {
+            get(): Promise<import("./messaging").DevelopmentEmail>;
+            enable(body: import("./messaging").EnableDevelopmentEmailBody): Promise<import("./messaging").DevelopmentEmail>;
+            disable(): Promise<{
+                object: "development_email";
+                deleted: true;
+                provider_id: string;
+                mode: "standard";
+            }>;
+        };
         managedEmail: {
             get(): Promise<import("./messaging").ManagedEmail>;
             create(body: import("./messaging").CreateManagedEmailBody): Promise<import("./messaging").ManagedEmail>;

package/dist/client/instance.d.ts

@@ -12,13 +12,40 @@ export interface Instance {
     environment: string;
     publishable_key: string;
     frontend_api_host: string;
+    /**
+     * The `iss` this instance's session tokens carry. It changes when a custom
+     * domain goes active, so read it (and the two URLs below) rather than hard-coding it.
+     */
+    issuer: string;
+    /** The OpenID discovery document whose `issuer` equals {@link issuer}. */
+    discovery_url: string;
+    /** The JWKS holding this instance's signing keys. */
+    jwks_uri: string;
     allowed_origins: string[];
+    /**
+     * The declared integration per allowed origin (`redirect` or `embedded`). An
+     * origin not listed is inferred by preflight and login readiness.
+     */
+    allowed_origin_integrations?: Record<string, 'redirect' | 'embedded'>;
     auth_config: Metadata;
     created_at: number;
 }
+/**
+ * How an allowed origin signs in: `redirect` (hosted-redirect OIDC: the app
+ * never runs the embedded components), `embedded` (the sign-in components run
+ * on the origin), or `auto` / `null` (clear the hint; Atlas infers it).
+ */
+export type OriginIntegration = 'redirect' | 'embedded' | 'auto';
+/** An `allowed_origins` entry that also declares how the origin signs in. */
+export interface AllowedOriginEntry {
+    origin: string;
+    integration?: OriginIntegration | null;
+}
+/** An origin string, or `{ origin, integration }`. A plain string keeps the origin's current hint. */
+export type AllowedOriginInput = string | AllowedOriginEntry;
 export interface UpdateInstanceBody {
-    /** Exact origins only — a wildcard or a path is rejected (§13.1). */
-    allowed_origins?: string[];
+    /** Exact origins only — a wildcard or a path is rejected (§13.1). The list replaces the stored one. */
+    allowed_origins?: AllowedOriginInput[];
     auth_config?: Record<string, unknown>;
 }
 /** `PATCH /v1/instance` echoes only the mutable fields, not a full Instance. */
@@ -26,6 +53,7 @@ export interface InstanceUpdateResult {
     object: 'instance';
     id: string;
     allowed_origins: string[];
+    allowed_origin_integrations?: Record<string, 'redirect' | 'embedded'>;
     auth_config: Metadata;
 }
 /** One problem (or note) the setup check found. */

package/dist/client/instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AAyRA,4CAiEC;AAjED,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,+CAA+C;QAC/C,YAAY,EAAE;YACZ,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AAwTA,4CAiEC;AAjED,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,+CAA+C;QAC/C,YAAY,EAAE;YACZ,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/messaging.d.ts

@@ -193,6 +193,12 @@ interface ProviderBodyBase<T extends MessagingTransport> {
      * provider accepts. SMS: the sender number in E.164 format, e.g. `+15551234567`.
      */
     from_address?: string;
+    /**
+     * Email only. `development`: a development instance sends without a verified
+     * domain (Atlas sign-in templates only, `[Atlas test] ` subjects, capped);
+     * 409 on a production instance. Omitted on an update: the stored mode is kept.
+     */
+    mode?: 'standard' | 'development';
 }
 /**
  * First setup of transport `T` (or a switch to it): `config` carries every
@@ -246,8 +252,12 @@ type PublicConfigKey<T extends MessagingTransport> = Exclude<keyof MessagingTran
  */
 export interface MessagingProviderOf<C extends 'email' | 'sms', T extends MessagingTransport> {
     object: 'messaging_provider';
+    /** The provider id: pass it as `provider_id` to managed email or the development sender. */
+    id?: string;
     channel: C;
     transport: T;
+    /** How it sends: `standard` | `development` | `managed_domain`. */
+    mode?: 'standard' | 'development' | 'managed_domain';
     from_address: string | null;
     status: string;
     /** Non-secret config only — secret values are never returned. */
@@ -280,10 +290,16 @@ export interface MessagingProviders {
         status: string;
         verified: boolean;
     } | null;
+    /** The email provider in development mode, when it is. */
+    development_email?: {
+        object: 'development_email';
+        enabled: true;
+        from_address: string | null;
+    } | null;
 }
 /** A DNS record to publish for the managed sending domain. */
 export interface ManagedEmailRecord {
-    purpose: 'dkim' | 'spf' | 'return_path' | 'other';
+    purpose: 'dkim' | 'spf' | 'return_path' | 'ownership' | 'dmarc' | 'other';
     type: 'TXT' | 'MX' | 'CNAME';
     /** Fully-qualified record name. */
     name: string;
@@ -291,22 +307,24 @@ export interface ManagedEmailRecord {
     priority?: number;
     status?: string;
 }
-/** Atlas-managed email: your own sending domain on Atlas's email account. */
+/** Managed email: Atlas sets your sending domain up on your own Resend or Brevo account and sends through your key. */
 export interface ManagedEmail {
     object: 'managed_email';
     id: string;
     from_address: string;
     domain: string;
     provider: string;
+    /** The email service the domain lives on (your own account there): `resend` | `brevo`. */
+    backend?: 'resend' | 'brevo';
+    /** Your email provider (mode `managed_domain`) that holds the API key. */
+    provider_id?: string | null;
     region: string | null;
     /** `not_started` | `pending` | `verified` | `failed` | `temporary_failure`. Email sends only when verified. */
     status: string;
     verified: boolean;
     records: ManagedEmailRecord[];
-    limits: {
-        hourly: number;
-        daily: number;
-    };
+    /** Always null: no Atlas limits apply, your provider account's own do. */
+    limits: null;
     usage: {
         sent: number;
         bounces: number;
@@ -314,7 +332,9 @@ export interface ManagedEmail {
         last_bounce_at: number | null;
         last_complaint_at: number | null;
     };
-    reputation: 'shared_platform_account';
+    reputation: 'your_provider_account';
+    /** Brevo, on create: whether the bounce / complaint webhook was registered on your account. */
+    feedback_webhook?: 'registered' | 'not_registered';
     /** DNS automation, when set. The token is never returned. */
     dns: {
         provider: string;
@@ -332,6 +352,14 @@ export interface ManagedEmail {
 export interface CreateManagedEmailBody {
     /** The From address, bare or `"Name <address>"`. Its domain becomes the sending domain. */
     from_address: string;
+    /** Your own provider account Atlas sets the domain up on. Required with `config` unless `provider_id` is given. */
+    transport?: 'resend' | 'brevo';
+    /** Your provider API key (write-only). */
+    config?: {
+        api_key: string;
+    };
+    /** Instead of `transport` + `config`: your configured Resend or Brevo email provider. */
+    provider_id?: string;
     region?: 'us-east-1' | 'eu-west-1' | 'sa-east-1' | 'ap-northeast-1';
     /** Let Atlas write the DNS records. The token is write-only. */
     dns?: {
@@ -346,7 +374,39 @@ export interface DeletedManagedEmail {
     object: 'managed_email';
     domain: string;
     deleted: true;
+    /** Whether the email provider that held the key (mode `managed_domain`) was removed too. */
+    provider_removed?: boolean;
 }
+/** Your own email provider in development mode (development instances, no verified domain). */
+export interface DevelopmentEmail {
+    object: 'development_email';
+    provider_id: string;
+    enabled: true;
+    /** False on a production instance (never sends) or when the provider is disabled. */
+    active: boolean;
+    transport: string;
+    from_address: string | null;
+    subject_prefix: string;
+    footer: string;
+    templates: string[];
+    limits: {
+        daily: number;
+        per_recipient_hourly: number;
+    };
+    /** Present for onboarding@resend.dev: Resend delivers it only to your Resend account address. */
+    note?: string;
+    next_step?: string;
+    updated_at: number;
+}
+/** `{ provider_id }`, or your provider exactly as `messaging.setEmail` takes it. */
+export type EnableDevelopmentEmailBody = {
+    provider_id: string;
+    from_address?: string;
+} | {
+    transport: 'resend' | 'ses' | 'smtp' | 'brevo' | 'mailgun';
+    config?: Record<string, string>;
+    from_address?: string;
+};
 export interface MessagingTestResult {
     object: 'messaging_test';
     channel: string;
@@ -397,7 +457,24 @@ export declare function messagingResource(request: RequestFn): {
     deleteChannel(channel: "email" | "sms", options?: {
         force?: boolean;
     }): Promise<DeletedMessagingProvider>;
-    /** Atlas-managed email: send from your own domain without your own email provider. */
+    /**
+     * Your own email provider in development mode: a development instance sends
+     * Atlas's sign-in emails without a verified domain ([Atlas test] subjects, capped).
+     */
+    developmentEmail: {
+        /** 404 when the provider is not in development mode. */
+        get(): Promise<DevelopmentEmail>;
+        /** Turn development mode on. 409 `DEVELOPMENT_EMAIL_NOT_ALLOWED` on a production instance. */
+        enable(body: EnableDevelopmentEmailBody): Promise<DevelopmentEmail>;
+        /** Back to standard mode; the provider stays. */
+        disable(): Promise<{
+            object: "development_email";
+            deleted: true;
+            provider_id: string;
+            mode: "standard";
+        }>;
+    };
+    /** Managed email: Atlas sets your sending domain up on your own Resend or Brevo account. */
     managedEmail: {
         /** 404 when none is configured. */
         get(): Promise<ManagedEmail>;

package/dist/client/messaging.js

@@ -40,7 +40,25 @@ function messagingResource(request) {
                 ...(options.force ? { query: { force: 'true' } } : {}),
             });
         },
-        /** Atlas-managed email: send from your own domain without your own email provider. */
+        /**
+         * Your own email provider in development mode: a development instance sends
+         * Atlas's sign-in emails without a verified domain ([Atlas test] subjects, capped).
+         */
+        developmentEmail: {
+            /** 404 when the provider is not in development mode. */
+            get() {
+                return request({ method: 'GET', path: '/v1/messaging_providers/email/development' });
+            },
+            /** Turn development mode on. 409 `DEVELOPMENT_EMAIL_NOT_ALLOWED` on a production instance. */
+            enable(body) {
+                return request({ method: 'POST', path: '/v1/messaging_providers/email/development', body });
+            },
+            /** Back to standard mode; the provider stays. */
+            disable() {
+                return request({ method: 'DELETE', path: '/v1/messaging_providers/email/development' });
+            },
+        },
+        /** Managed email: Atlas sets your sending domain up on your own Resend or Brevo account. */
         managedEmail: {
             /** 404 when none is configured. */
             get() {