@wtfalch/foundry 0.35.2 → 0.36.1

package/dist/bootstrap/versions.d.ts

@@ -34,10 +34,16 @@ export declare const DIGESTS: PinnedVersions;
  */
 export declare function pinnedRef(key: keyof PinnedVersions): string;
 /**
- * A declared tag that equals the pinned one gets its digest; any other
- * declared tag (an override) is passed through unchanged.
+ * The two image fields Coolify accepts. Its tag rule has no `@` or `:`, so a
+ * digest goes in the name as `<image>@sha256` and the tag holds the bare
+ * 64-hex digest (Coolify pulls `<name>:<tag>`). A declared tag that equals the
+ * pinned one gets its digest; any other declared tag (an override) is passed
+ * through unchanged.
  */
-export declare function pinnedTagFor(key: keyof PinnedVersions, tag: string): string;
+export declare function coolifyImageFor(key: keyof PinnedVersions, image: string, tag: string): {
+    docker_registry_image_name: string;
+    docker_registry_image_tag: string;
+};
 /**
  * Why an image tag cannot be used, or `null`. #248: generalised out of what
  * was `platform-providers.ts`'s `mailImageTagBlocked`, the one guard

package/dist/bootstrap/versions.js

@@ -41,11 +41,20 @@ export function pinnedRef(key) {
     return `${VERSIONS[key]}@${DIGESTS[key]}`;
 }
 /**
- * A declared tag that equals the pinned one gets its digest; any other
- * declared tag (an override) is passed through unchanged.
+ * The two image fields Coolify accepts. Its tag rule has no `@` or `:`, so a
+ * digest goes in the name as `<image>@sha256` and the tag holds the bare
+ * 64-hex digest (Coolify pulls `<name>:<tag>`). A declared tag that equals the
+ * pinned one gets its digest; any other declared tag (an override) is passed
+ * through unchanged.
  */
-export function pinnedTagFor(key, tag) {
-    return tag === VERSIONS[key] ? pinnedRef(key) : tag;
+export function coolifyImageFor(key, image, tag) {
+    if (tag !== VERSIONS[key]) {
+        return { docker_registry_image_name: image, docker_registry_image_tag: tag };
+    }
+    return {
+        docker_registry_image_name: `${image}@sha256`,
+        docker_registry_image_tag: DIGESTS[key].replace(/^sha256:/, ''),
+    };
 }
 /**
  * Tag spellings that resolve to whatever the registry currently has, not a

package/dist/plan/diff.js

@@ -899,7 +899,7 @@ function planOrgRegistrationClosed(org, recordedIds, authReady, issuerStep) {
         },
     };
 }
-/** The blocked item for an org sign-in domain the sign-in server refused to make primary. */
+/** The note for an org sign-in domain the sign-in server refused to make primary, while it is not registered. */
 function orgDomainBlocked(org, recordedIds) {
     const domain = signInOrgDomain(org);
     if (recordedIds[ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY]?.toLowerCase() !== domain)
@@ -925,9 +925,7 @@ function planOrgDomain(org, recordedIds, authReady, issuerStep) {
     const domain = signInOrgDomain(org);
     if (recordedIds[ZITADEL_ORG_DOMAIN_SCOPE_KEY]?.toLowerCase() === domain)
         return null;
-    // Refused once: reported as blocked (see `orgDomainBlocked`), not planned again.
-    if (recordedIds[ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY]?.toLowerCase() === domain)
-        return null;
+    // A refused domain is planned again (and reported, see `orgDomainBlocked`): the step sets the policy it needs.
     return {
         action: { system: 'zitadel', kind: 'domain', key: org.id, desired: { domain } },
         step: {

package/dist/plan/executor.d.ts

@@ -936,6 +936,15 @@ export interface ZitadelPort {
     addOrgDomain(orgId: string, domain: string): Promise<void>;
     /** Makes a domain already on the org its primary one. Idempotent: no-op when it already is. */
     setPrimaryOrgDomain(orgId: string, domain: string): Promise<void>;
+    /** Removes a domain from the org. The server refuses the primary one. */
+    removeOrgDomain(orgId: string, domain: string): Promise<void>;
+    /** Sets the instance's domain policy. Writes only when a field differs. */
+    ensureDomainPolicy(want: {
+        userLoginMustBeDomain: boolean;
+        validateOrgDomains: boolean;
+    }): Promise<{
+        changed: boolean;
+    }>;
     setUserMetadata(orgId: string, userId: string, key: string, value: string): Promise<void>;
     getUserMetadata(orgId: string, userId: string, key: string): Promise<string | null>;
     findUserByEmail(orgId: string, email: string): Promise<{

package/dist/plan/executor.js

@@ -1,7 +1,7 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { randomBytes, randomUUID } from 'node:crypto';
 import { URL } from 'node:url';
-import { pinnedTagFor } from '../bootstrap/versions.js';
+import { coolifyImageFor } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { resolveCallsSfuUrls } from '../calls-sfu.js';
 import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
@@ -3870,8 +3870,7 @@ export class FoundryStepExecutor {
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
-            docker_registry_image_name: SYNAPSE_IMAGE,
-            docker_registry_image_tag: pinnedTagFor('synapse', synapseTag),
+            ...coolifyImageFor('synapse', SYNAPSE_IMAGE, synapseTag),
             ports_exposes: '8008',
             name: names.synapse,
             description: `Synapse for ${org.slug}'s calls stack (${SYNAPSE_IMAGE}:${synapseTag})`,

package/dist/plan/own-sfu.js

@@ -1,4 +1,4 @@
-import { pinnedTagFor } from '../bootstrap/versions.js';
+import { coolifyImageFor } from '../bootstrap/versions.js';
 import { mintLivekitCredentials } from '../calls-sfu-keys.js';
 import { LIVEKIT_SIGNALLING_PORT, sfuSlotPorts } from '../calls-sfu.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
@@ -105,8 +105,7 @@ export async function provisionSfuApp(scope, deps, target, input) {
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
-            docker_registry_image_name: OWN_SFU_IMAGE,
-            docker_registry_image_tag: pinnedTagFor('livekit', input.version),
+            ...coolifyImageFor('livekit', OWN_SFU_IMAGE, input.version),
             ports_exposes: String(LIVEKIT_SIGNALLING_PORT),
             ports_mappings: sfuPortsMappings(input.slot),
             name: target.names.sfuApp,
@@ -122,7 +121,7 @@ export async function provisionSfuApp(scope, deps, target, input) {
     // Set on every run: a declared version or slot reaches an existing app here.
     await coolify.updateApplication(appId, {
         custom_internal_name: target.internal.sfu,
-        docker_registry_image_tag: pinnedTagFor('livekit', input.version),
+        ...coolifyImageFor('livekit', OWN_SFU_IMAGE, input.version),
         ports_exposes: String(LIVEKIT_SIGNALLING_PORT),
         ports_mappings: sfuPortsMappings(input.slot),
         ...healthCheckSettings('/', LIVEKIT_SIGNALLING_PORT),

package/dist/plan/platform-diff.js

@@ -9,7 +9,7 @@ import { legacyAppHostname } from './hostnames.js';
 import { PLATFORM_MAIL_RELAY_KEY, planMailRelay } from './mail-relay.js';
 import { planOikosIngress } from './oikos-ingress.js';
 import { callsSfuAppliedFingerprint } from './platform-sfu.js';
-import { ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, signInDomainBlockedText } from './sign-in-org.js';
+import { signInDomainBlockedText } from './sign-in-org.js';
 import { withStepSystem } from './step-system.js';
 /**
  * The `Plan` (#19's public contract) a {@link PlatformPlanDetail} carries,
@@ -2905,8 +2905,8 @@ export const ARCHON_ORG_BLOCKED = 'Archon is blocked, not planned: its own sign-
  * {@link PLATFORM_ARCHON_KEY}, planned while any of those is not recorded
  * against the recorded org, and always before `platform:archon`. Blocked, not
  * planned, while the host cannot reach the instance. A refused domain is
- * reported as a standing note (as the owner org's is) and does not hold the
- * step; an invite that cannot be sent (no work address, no mail port) is a
+ * reported as a standing note (as the owner org's is) and planned again, since
+ * the step sets the domain policy it needs; an invite that cannot be sent (no work address, no mail port) is a
  * standing note and does not hold it either.
  */
 function planArchonOrg(platform, recordedIds, executorBlocked, inviteBlocked, ownerSignIn) {
@@ -2914,7 +2914,8 @@ function planArchonOrg(platform, recordedIds, executorBlocked, inviteBlocked, ow
         return { step: null, blocked: null };
     const orgId = recordedIds[PLATFORM_ARCHON_ORG_SCOPE_KEY];
     const blockedDomain = recordedIds[PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY];
-    const domainDone = Boolean(recordedIds[PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY]) || Boolean(blockedDomain);
+    // A refused domain is planned again: the step sets the domain policy it needs.
+    const domainDone = Boolean(recordedIds[PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY]);
     const inviteRecorded = recordedIds[PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY];
     const inviteDone = Boolean(inviteBlocked) ||
         inviteRecorded === 'none' ||
@@ -2922,7 +2923,7 @@ function planArchonOrg(platform, recordedIds, executorBlocked, inviteBlocked, ow
     const standing = [
         inviteBlocked,
         blockedDomain && !recordedIds[PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY]
-            ? `Archon's sign-in domain ${blockedDomain} is blocked, not planned: the sign-in server refused to make it primary because its domain policy wants proof of ownership. Set the policy ValidateOrgDomains to false on the sign-in server, then remove the recorded key ${PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY}`
+            ? signInDomainBlockedText('Archon', blockedDomain)
             : null,
     ].filter((v) => Boolean(v));
     const standingNote = standing.length > 0 ? standing.join('; ') : null;
@@ -3042,5 +3043,5 @@ function ownerDomainBlockedText(recordedIds) {
         return null;
     if (recordedIds[PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY] === blockedDomain)
         return null;
-    return signInDomainBlockedText('the platform owner', blockedDomain).replace(ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY);
+    return signInDomainBlockedText('the platform owner', blockedDomain);
 }

package/dist/plan/platform-providers.d.ts

@@ -112,7 +112,7 @@ export interface PlatformAuthDeps {
     tunnels: PlatformTunnelsFactory;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own new instance (its issuer), or `zitadelForInstance` must be set. */
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'mintAdminMachineUser' | 'mintLoginClientMachineUser' | 'listLoginClientPats' | 'reserveUserName' | 'closeSelfRegistration' | 'enforceSecondFactor' | 'inviteOrgOwner' | 'addOrgDomain' | 'setPrimaryOrgDomain' | 'setUserMetadata' | 'getUserMetadata'> & PlatformZitadelSmtp;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'mintAdminMachineUser' | 'mintLoginClientMachineUser' | 'listLoginClientPats' | 'reserveUserName' | 'closeSelfRegistration' | 'enforceSecondFactor' | 'inviteOrgOwner' | 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain' | 'setUserMetadata' | 'getUserMetadata'> & PlatformZitadelSmtp;
     /**
      * Mails the owner's first-sign-in link to their personal address (the same
      * port as `FoundryStepExecutorPorts.ownerInviteMail`). The link carries the

package/dist/plan/platform-providers.js

@@ -1,7 +1,7 @@
 import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, randomUUID, sign, } from 'node:crypto';
 import { isIPv4 } from 'node:net';
 import { applyObjects, openInstance, platformMailSettingsObjects } from '@wtfalch/email/postmaster';
-import { VERSIONS, floatingTagBlocked, pinnedRef, pinnedTagFor } from '../bootstrap/versions.js';
+import { VERSIONS, coolifyImageFor, floatingTagBlocked, pinnedRef } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { ownerMailboxes } from '../org.js';
 import { BOULE_BRIDGE_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_PEER_ROLE, bouleHostnameFor, } from './boule.js';
@@ -2539,8 +2539,7 @@ export async function provisionMailServer(scope, deps, target, input) {
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
-            docker_registry_image_name: STALWART_IMAGE,
-            docker_registry_image_tag: pinnedTagFor('stalwart', imageTag),
+            ...coolifyImageFor('stalwart', STALWART_IMAGE, imageTag),
             ports_exposes: STALWART_PORTS_EXPOSES,
             ...(hostPorts ? { ports_mappings: hostPorts } : {}),
             name: target.names.mailApp,
@@ -2560,7 +2559,7 @@ export async function provisionMailServer(scope, deps, target, input) {
     // `'ready'` probe below. Stalwart's own readiness route and HTTP port.
     await deps.coolify.updateApplication(appId, {
         custom_internal_name: target.internal.mail,
-        docker_registry_image_tag: pinnedTagFor('stalwart', imageTag),
+        ...coolifyImageFor('stalwart', STALWART_IMAGE, imageTag),
         ...healthCheckSettings(STALWART_READY_PATH, Number(STALWART_HTTP_PORT)),
         // Only a platform that uses the shared relay, or one that did, changes a published port.
         ...(portsChanged ? { ports_mappings: hostPorts } : {}),
@@ -7263,8 +7262,7 @@ async function provisionPlatformHc(context, deps) {
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
-            docker_registry_image_name: HC_IMAGE,
-            docker_registry_image_tag: pinnedTagFor('hc', gitRef),
+            ...coolifyImageFor('hc', HC_IMAGE, gitRef),
             ports_exposes: HC_PORT,
             name: PLATFORM_HC_APP_NAME,
             description: `Healthchecks for the platform's own heartbeats (#540, ${HC_IMAGE}:${gitRef})`,
@@ -7277,7 +7275,7 @@ async function provisionPlatformHc(context, deps) {
     // own rule. The image tag too, so a declared release change reaches the app.
     await deps.coolify.updateApplication(appId, {
         custom_internal_name: HC_INTERNAL_NAME,
-        docker_registry_image_tag: pinnedTagFor('hc', gitRef),
+        ...coolifyImageFor('hc', HC_IMAGE, gitRef),
         ...healthCheckSettings(HC_HEALTH_CHECK_PATH, Number(HC_PORT)),
     });
     // ---- env, parsed off the database's own owner credentials -----------------

package/dist/plan/sign-in-org.d.ts

@@ -9,30 +9,41 @@ export declare const ZITADEL_ORG_DOMAIN_SCOPE_KEY = "zitadel_org_domain";
 export declare const ZITADEL_ORG_REGISTRATION_CLOSED_SCOPE_KEY = "zitadel_org_registration_closed";
 /** Closes self-registration on the org (idempotent) and records it under `scopeKey`, in that order. */
 export declare function closeSignInOrgRegistration(zitadel: Pick<ZitadelPort, 'closeSelfRegistration'>, orgId: string, recordScopeId: (key: string, id: string) => void, scopeKey?: string): Promise<void>;
-/** Scope id: the domain the sign-in server refused to make primary (its domain policy wants proof). Set instead of failing; the planner reports it as blocked. */
+/** Scope id: the domain the sign-in server still refused to make primary after foundry set its domain policy and added the domain again. Set instead of failing; the planner reports it and plans the domain again. */
 export declare const ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY = "zitadel_org_domain_blocked";
-/** The fixed text of the blocked item for a refused sign-in domain. No cause, no value but names. */
+/** The fixed text of the note for a refused sign-in domain. No cause, no value but names. */
 export declare function signInDomainBlockedText(orgName: string, domain: string): string;
+/**
+ * The domain policy a sign-in server needs before foundry gives an org its
+ * domain. The server holds only orgs foundry made, so a domain needs no proof
+ * of ownership, and a person's login name carries their org's domain.
+ */
+export declare const SIGN_IN_DOMAIN_POLICY: {
+    userLoginMustBeDomain: boolean;
+    validateOrgDomains: boolean;
+};
 /** The domain an org's owners sign in on: its own, or `<slug>.oikos.host` when it has none. */
 export declare function signInOrgDomain(org: {
     slug: string;
     domain: string | null;
 }): string;
 /**
- * Adds `domain` to the ZITADEL org and makes it primary. Both calls are
- * idempotent. A failure after the add leaves the domain on the org but not
- * primary, and nothing is recorded, so the next run repeats both.
+ * Sets the server's domain policy ({@link SIGN_IN_DOMAIN_POLICY}), adds
+ * `domain` to the ZITADEL org and makes it primary. Every call is idempotent.
+ * A domain added while the policy still wanted proof stays unverified, so it
+ * is removed and added again. A failure after the add leaves the domain on
+ * the org but not primary, and nothing is recorded, so the next run repeats.
  */
-export declare function registerSignInDomain(zitadel: Pick<ZitadelPort, 'addOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string, sleep?: (ms: number) => Promise<void>): Promise<void>;
+export declare function registerSignInDomain(zitadel: Pick<ZitadelPort, 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string, sleep?: (ms: number) => Promise<void>): Promise<void>;
 /**
  * {@link registerSignInDomain}, except that a refusal to make the domain
- * primary (the sign-in server's domain policy wants proof) is recorded under
+ * primary (still unverified after the policy and the second add) is recorded under
  * `blockedScopeKey` and returns `false` instead of throwing on every apply.
  * Any other failure throws. Returns `true` when the domain is primary.
  */
-export declare function registerSignInDomainOrBlock(zitadel: Pick<ZitadelPort, 'addOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string, recordScopeId: (key: string, id: string) => void, blockedScopeKey?: string): Promise<boolean>;
+export declare function registerSignInDomainOrBlock(zitadel: Pick<ZitadelPort, 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain'>, orgId: string, domain: string, recordScopeId: (key: string, id: string) => void, blockedScopeKey?: string): Promise<boolean>;
 export interface EnsureSignInOrgOptions {
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'addOrgDomain' | 'setPrimaryOrgDomain' | 'closeSelfRegistration'>;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain' | 'closeSelfRegistration'>;
     /** Where the successful close is recorded (the org id). Absent: not recorded; the caller closes on every run. */
     registrationClosedScopeKey?: string;
     /** Defaults to {@link ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY}. */

package/dist/plan/sign-in-org.js

@@ -11,12 +11,18 @@ export async function closeSignInOrgRegistration(zitadel, orgId, recordScopeId,
     await zitadel.closeSelfRegistration(orgId);
     recordScopeId(scopeKey, orgId);
 }
-/** Scope id: the domain the sign-in server refused to make primary (its domain policy wants proof). Set instead of failing; the planner reports it as blocked. */
+/** Scope id: the domain the sign-in server still refused to make primary after foundry set its domain policy and added the domain again. Set instead of failing; the planner reports it and plans the domain again. */
 export const ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY = 'zitadel_org_domain_blocked';
-/** The fixed text of the blocked item for a refused sign-in domain. No cause, no value but names. */
+/** The fixed text of the note for a refused sign-in domain. No cause, no value but names. */
 export function signInDomainBlockedText(orgName, domain) {
-    return `${orgName}'s sign-in domain ${domain} is blocked, not planned: the sign-in server refused to make it primary because its domain policy wants proof of ownership. Set the policy ValidateOrgDomains to false (and UserLoginMustBeDomain to true) on the sign-in server, then remove the recorded key ${ZITADEL_ORG_DOMAIN_BLOCKED_SCOPE_KEY}`;
+    return `${orgName}'s sign-in domain ${domain} was refused: the sign-in server would not make it primary even after foundry turned off its proof of ownership (ValidateOrgDomains) and added the domain again. The next apply tries again`;
 }
+/**
+ * The domain policy a sign-in server needs before foundry gives an org its
+ * domain. The server holds only orgs foundry made, so a domain needs no proof
+ * of ownership, and a person's login name carries their org's domain.
+ */
+export const SIGN_IN_DOMAIN_POLICY = { userLoginMustBeDomain: true, validateOrgDomains: false };
 /** True for the providers' "domain is not verified" refusal of `setPrimaryOrgDomain`. */
 function isPrimaryDomainRefused(error) {
     return error instanceof Error && /is not verified/.test(error.message);
@@ -31,30 +37,51 @@ const DOMAIN_LISTED_WAIT_MS = 500;
 export function signInOrgDomain(org) {
     return (org.domain ?? `${org.slug}.oikos.host`).toLowerCase();
 }
-/**
- * Adds `domain` to the ZITADEL org and makes it primary. Both calls are
- * idempotent. A failure after the add leaves the domain on the org but not
- * primary, and nothing is recorded, so the next run repeats both.
- */
-export async function registerSignInDomain(zitadel, orgId, domain, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
-    await zitadel.addOrgDomain(orgId, domain);
-    // The sign-in server lists a domain a moment after it accepts the add, and
-    // `setPrimaryOrgDomain` reads that list first: ask again, for five seconds.
+/** Retries `work` while `retry` accepts its error, for five seconds. */
+async function untilListed(work, retry, sleep) {
     for (let attempt = 1;; attempt += 1) {
         try {
-            await zitadel.setPrimaryOrgDomain(orgId, domain);
+            await work();
             return;
         }
         catch (error) {
-            if (attempt >= DOMAIN_LISTED_TRIES || !isDomainNotListed(error))
+            if (attempt >= DOMAIN_LISTED_TRIES || !retry(error))
                 throw error;
             await sleep(DOMAIN_LISTED_WAIT_MS);
         }
     }
 }
+/**
+ * Sets the server's domain policy ({@link SIGN_IN_DOMAIN_POLICY}), adds
+ * `domain` to the ZITADEL org and makes it primary. Every call is idempotent.
+ * A domain added while the policy still wanted proof stays unverified, so it
+ * is removed and added again. A failure after the add leaves the domain on
+ * the org but not primary, and nothing is recorded, so the next run repeats.
+ */
+export async function registerSignInDomain(zitadel, orgId, domain, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
+    await zitadel.ensureDomainPolicy(SIGN_IN_DOMAIN_POLICY);
+    await zitadel.addOrgDomain(orgId, domain);
+    // The sign-in server lists a domain a moment after it accepts the add, and
+    // `setPrimaryOrgDomain` reads that list first: ask again, for five seconds.
+    try {
+        await untilListed(() => zitadel.setPrimaryOrgDomain(orgId, domain), isDomainNotListed, sleep);
+        return;
+    }
+    catch (error) {
+        if (!isPrimaryDomainRefused(error))
+            throw error;
+    }
+    await zitadel.removeOrgDomain(orgId, domain);
+    // Until the server lists the removal, the add sees the old unverified
+    // domain and skips: both answers are a moment late, so ask again.
+    await untilListed(async () => {
+        await zitadel.addOrgDomain(orgId, domain);
+        await zitadel.setPrimaryOrgDomain(orgId, domain);
+    }, (error) => isDomainNotListed(error) || isPrimaryDomainRefused(error), sleep);
+}
 /**
  * {@link registerSignInDomain}, except that a refusal to make the domain
- * primary (the sign-in server's domain policy wants proof) is recorded under
+ * primary (still unverified after the policy and the second add) is recorded under
  * `blockedScopeKey` and returns `false` instead of throwing on every apply.
  * Any other failure throws. Returns `true` when the domain is primary.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.35.2",
+  "version": "0.36.1",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -38,7 +38,7 @@
     "status": "node scripts/status.mjs"
   },
   "peerDependencies": {
-    "@wtfalch/providers": ">=0.7.4",
+    "@wtfalch/providers": ">=0.10.0",
     "drizzle-orm": ">=0.45.2"
   },
   "dependencies": {
@@ -46,7 +46,7 @@
     "@wtfalch/auth": "0.16.0",
     "@wtfalch/edge": "0.13.0",
     "@wtfalch/email": "^0.20.0",
-    "@wtfalch/providers": "0.7.5",
+    "@wtfalch/providers": "0.10.0",
     "ssh2": "1.17.0",
     "zod": "4.6.5"
   },