From 7fbaff0a232367f7600e1d3e85bcec207da62987 Mon Sep 17 00:00:00 2001
From: Brandon Corbett <Bccorb@users.noreply.github.com>
Date: Fri, 24 Jul 2026 23:12:10 -0400
Subject: [PATCH] feat(init): enable ALLOW_UNCREDENTIALED_DELIVERY_SECRETS in
 the scaffolded auth env
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Companion to the email_otp default: with it set, seamless login --local reads the
OTP from the auth server's response instead of needing a mail provider, so signing
in to a fresh local stack works end to end. Dev-only — the auth server ignores it
under a production NODE_ENV, and the scaffold runs as development.
---
 .changeset/scaffold-local-delivery.md | 11 +++++++++++
 src/generators/docker/docker.test.ts  |  1 +
 src/generators/docker/docker.ts       |  5 +++++
 3 files changed, 17 insertions(+)
 create mode 100644 .changeset/scaffold-local-delivery.md

diff --git a/.changeset/scaffold-local-delivery.md b/.changeset/scaffold-local-delivery.md
new file mode 100644
index 0000000..7605454
--- /dev/null
+++ b/.changeset/scaffold-local-delivery.md
@@ -0,0 +1,11 @@
+---
+"seamless-cli": minor
+---
+
+Enable `ALLOW_UNCREDENTIALED_DELIVERY_SECRETS=true` in the scaffolded auth server env.
+
+Companion to the `email_otp` default: with it set, `seamless login --local`
+reads the OTP straight from the auth server's response instead of needing a mail
+provider, so signing in to a freshly scaffolded local stack works end to end.
+It's a dev-only escape hatch — the auth server ignores it under a production
+`NODE_ENV`, and the scaffold runs as development.
diff --git a/src/generators/docker/docker.test.ts b/src/generators/docker/docker.test.ts
index 2e37ab8..a2e34ee 100644
--- a/src/generators/docker/docker.test.ts
+++ b/src/generators/docker/docker.test.ts
@@ -97,6 +97,7 @@ describe("buildAuthEnv", () => {
     expect(env.APP_ORIGINS).toBe("http://localhost:3000");
     expect(env.ORIGINS).toBe("http://localhost:5173,http://localhost:5174");
     expect(env.LOGIN_METHODS).toBe("passkey,magic_link,email_otp");
+    expect(env.ALLOW_UNCREDENTIALED_DELIVERY_SECRETS).toBe("true");
     expect(shared.kid).toBe("dev-main");
   });
 
diff --git a/src/generators/docker/docker.ts b/src/generators/docker/docker.ts
index 80803c1..72f2870 100644
--- a/src/generators/docker/docker.ts
+++ b/src/generators/docker/docker.ts
@@ -263,6 +263,11 @@ export function buildAuthEnv(
   // method the CLI can drive without a browser authenticator.
   env.LOGIN_METHODS = withLoginMethod(env.LOGIN_METHODS, "email_otp");
 
+  // Let `seamless login --local` read the OTP straight from the response instead
+  // of needing a mail provider. Dev-only: the auth server ignores this under a
+  // production NODE_ENV, and the scaffold runs as development.
+  env.ALLOW_UNCREDENTIALED_DELIVERY_SECRETS = "true";
+
   // When the OAuth template collected providers, wire them into the auth server
   // (OAUTH_PROVIDERS, per-provider secret env vars, OAUTH_STATE_SECRET) and enable
   // the oauth login method.