@wtfalch/foundry 0.56.0 → 0.58.0

package/dist/plan/desktop-callback.d.ts

@@ -11,15 +11,27 @@ export declare function desktopCallbackUri(host: string): string;
 /** The URIs to add to an app's current list: current first, then each wanted one it lacks. */
 export declare function unionRedirectUris(current: readonly string[], wanted: readonly string[]): string[];
 /**
- * The ZITADEL app id of company app `appKey` once its desktop callback was
- * registered. `planDesktopCallbacks` names an app while its recorded id
- * differs, so an app made before the callback existed, or made again under a
- * new id, is repaired once.
+ * The redirect URIs a company web app signs in with: `/auth/callback` and the
+ * desktop callback on each of its hosts. Agora's own client holds only its
+ * `/callback`. `zitadelApp` creates the app with this list, and
+ * `zitadelDesktopCallback` adds what an existing app lacks.
+ */
+export declare function signInRedirectUris(org: DeclaredOrg, appKey: string): string[];
+/**
+ * The marker value for an app: its ZITADEL id and the URIs it must hold, in a
+ * fixed order. A changed hostname or a re-created app gives a different
+ * value, so the next plan names the app again.
+ */
+export declare function signInCallbackAppliedValue(appId: string, uris: readonly string[]): string;
+/**
+ * Marker of company app `appKey`: `signInCallbackAppliedValue` once its
+ * sign-in callbacks were registered. A marker holding only the app id (the
+ * desktop-only form of #339) differs, so such an app is repaired once.
  */
 export declare function zitadelAppDesktopCallbackAppliedScopeKey(appKey: string): string;
 /**
  * One `zitadel:desktop-callback` step names every live web sign-in app whose
- * recorded id differs from its marker. Plans nothing when the host's ZITADEL
+ * marker differs from the one its recorded id and wanted URIs give. Plans nothing when the host's ZITADEL
  * client lacks the two redirect URI calls (`wired`), before the org and
  * project are recorded, or while the platform's sign-in is not ready.
  */

package/dist/plan/desktop-callback.js

@@ -1,3 +1,6 @@
+import { agoraHostnameFor } from './agora.js';
+import { bouleHostnameFor } from './boule.js';
+import { appHostname, cmsStudioHostnameFor, entryHostnames } from './hostnames.js';
 /**
  * #339: the desktop app signs in through the company's web app, so every
  * `@wtfalch/auth` web client foundry makes registers this path beside
@@ -12,19 +15,48 @@ export function unionRedirectUris(current, wanted) {
     return [...new Set([...current, ...wanted])];
 }
 /**
- * The ZITADEL app id of company app `appKey` once its desktop callback was
- * registered. `planDesktopCallbacks` names an app while its recorded id
- * differs, so an app made before the callback existed, or made again under a
- * new id, is repaired once.
+ * The redirect URIs a company web app signs in with: `/auth/callback` and the
+ * desktop callback on each of its hosts. Agora's own client holds only its
+ * `/callback`. `zitadelApp` creates the app with this list, and
+ * `zitadelDesktopCallback` adds what an existing app lacks.
+ */
+export function signInRedirectUris(org, appKey) {
+    if (appKey === 'agora')
+        return [`https://${agoraHostnameFor(org)}/callback`];
+    const authEntry = org.hosting.entries.find((e) => e.key === appKey && e.uses?.auth);
+    const hosts = authEntry
+        ? entryHostnames(org, authEntry)
+        : [
+            appKey === 'cms' && org.site.enabled
+                ? cmsStudioHostnameFor(org)
+                : appKey === 'boule'
+                    ? bouleHostnameFor(org)
+                    : appHostname(org),
+        ];
+    return [
+        ...hosts.map((host) => `https://${host}/auth/callback`),
+        ...hosts.map(desktopCallbackUri),
+    ];
+}
+/**
+ * The marker value for an app: its ZITADEL id and the URIs it must hold, in a
+ * fixed order. A changed hostname or a re-created app gives a different
+ * value, so the next plan names the app again.
+ */
+export function signInCallbackAppliedValue(appId, uris) {
+    return `${appId} ${[...uris].sort().join(' ')}`;
+}
+/**
+ * Marker of company app `appKey`: `signInCallbackAppliedValue` once its
+ * sign-in callbacks were registered. A marker holding only the app id (the
+ * desktop-only form of #339) differs, so such an app is repaired once.
  */
 export function zitadelAppDesktopCallbackAppliedScopeKey(appKey) {
     return `zitadel_app_desktop_callback_applied.${appKey}`;
 }
-/** The fixed Agora client keeps its own `/callback`; it is not built on `@wtfalch/auth`. */
-const NO_DESKTOP_CALLBACK_APPS = new Set(['agora']);
 /**
  * One `zitadel:desktop-callback` step names every live web sign-in app whose
- * recorded id differs from its marker. Plans nothing when the host's ZITADEL
+ * marker differs from the one its recorded id and wanted URIs give. Plans nothing when the host's ZITADEL
  * client lacks the two redirect URI calls (`wired`), before the org and
  * project are recorded, or while the platform's sign-in is not ready.
  */
@@ -32,10 +64,7 @@ export function planDesktopCallbacks(org, live, recordedIds, plannedSteps, authR
     if (!wired || !authReady || !recordedIds.zitadel_org || !recordedIds.zitadel_project)
         return null;
     const apps = live
-        .filter((r) => r.system === 'zitadel' &&
-        r.kind === 'app' &&
-        r.config.appType === 'web' &&
-        !NO_DESKTOP_CALLBACK_APPS.has(r.key))
+        .filter((r) => r.system === 'zitadel' && r.kind === 'app' && r.config.appType === 'web')
         .map((r) => r.key)
         // An app this plan recreates gets its marker when it is made.
         .filter((appKey) => !plannedSteps.some((s) => s.action.system === 'zitadel' &&
@@ -44,14 +73,16 @@ export function planDesktopCallbacks(org, live, recordedIds, plannedSteps, authR
         s.action.desired.recreate === true))
         .filter((appKey) => {
         const appId = recordedIds[`zitadel:app:${appKey}`];
-        return (Boolean(appId) && recordedIds[zitadelAppDesktopCallbackAppliedScopeKey(appKey)] !== appId);
+        return (Boolean(appId) &&
+            recordedIds[zitadelAppDesktopCallbackAppliedScopeKey(appKey)] !==
+                signInCallbackAppliedValue(appId, signInRedirectUris(org, appKey)));
     });
     if (apps.length === 0)
         return null;
     return {
         action: { system: 'zitadel', kind: 'desktop-callback', key: org.id, desired: { apps } },
         step: {
-            description: `register the desktop sign-in callback for ${org.slug}'s sign-in apps (${apps.join(', ')})`,
+            description: `register the sign-in callbacks for ${org.slug}'s sign-in apps (${apps.join(', ')})`,
             destroys: false,
             migrates: false,
         },

package/dist/plan/executor.d.ts

@@ -2022,7 +2022,7 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     /** Whether the held keys can store a new company's sign-in database CA and certificate (#746). */
     ownSigninDbKeysPuttable(): boolean;
     /**
-     * Whether the host says its company ZITADEL port has `ensureEmailOtpMessageText` and `ensureLabelPolicy`
+     * Whether the host says its company ZITADEL port has `ensureEmailOtpMessageText`, `ensureLabelPolicy` and `ensureEmailOtpGenerator`
      * (`provision.auth.signinMailWritable`). The port is a lazy proxy that answers any name, so it cannot be probed.
      */
     ownSigninMailWritable(): boolean;
@@ -2212,20 +2212,16 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      */
     private zitadelPostLogoutUris;
     /**
-     * #339: registers `/auth/desktop/callback` on each live web sign-in app the
-     * planner named, keeping every redirect URI the app already holds (the
-     * union of the current list and the wanted one; a write only when the
-     * union is larger). An app's marker (its ZITADEL app id) is recorded and
+     * #339: registers the sign-in callbacks (`signInRedirectUris`: `/auth/callback`
+     * and `/auth/desktop/callback` per host, Agora's `/callback`) on each live web
+     * sign-in app the planner named, keeping every redirect URI the app already
+     * holds (the union of the current list and the wanted ones; a write only when
+     * the union is larger). An app's marker (its app id and wanted URIs) is recorded and
      * persisted only after its read and write resolved, so a failure leaves no
      * marker and the next plan names the app again. The error names ids only,
      * never the cause.
      */
     private zitadelDesktopCallback;
-    /**
-     * The hostnames a company web app signs in at: the same rule `zitadelApp`
-     * uses for the redirect URIs it creates the app with.
-     */
-    private signInHostnames;
     /**
      * `plan/diff.ts`'s `planLoginHost` (#267): adds the org's own company
      * login host (`action.desired.host`) to the ZITADEL instance's trusted

package/dist/plan/executor.js

@@ -22,7 +22,7 @@ import { previewsOn } from './coolify-previews.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
 import { waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
 import { DESKTOP_AUTH_APP_SCOPE_KEY, DESKTOP_AUTH_DEPLOYED_SCOPE_KEY, DESKTOP_AUTH_DOCKERFILE, DESKTOP_AUTH_HOME, DESKTOP_AUTH_ORIGIN_SCOPE_KEY, DESKTOP_AUTH_READY_PATH, DESKTOP_AUTH_READY_SCOPE_KEY, DESKTOP_AUTH_REDIRECT_SCOPE_KEY, DESKTOP_AUTH_REVISION_SCOPE_KEY, desktopAuthCallbackUri, desktopAuthEnv, desktopAuthInputs, desktopAuthRedirectUnsupported, desktopAuthRevision, } from './desktop-auth.js';
-import { desktopCallbackUri, unionRedirectUris, zitadelAppDesktopCallbackAppliedScopeKey, } from './desktop-callback.js';
+import { signInCallbackAppliedValue, signInRedirectUris, unionRedirectUris, zitadelAppDesktopCallbackAppliedScopeKey, } from './desktop-callback.js';
 import { PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, onPlatformNetwork, placed, placedByScope, } from './destinations.js';
 import { DEFAULT_AI_LIMIT_MICROS } from './diff.js';
 import { createEdgeAccess, isNotFound as isEdgeNotFound, } from './edge-access.js';
@@ -1014,7 +1014,7 @@ export class FoundryStepExecutor {
         return Boolean(this.ports.ownServices?.provision.auth.heldKeys?.put);
     }
     /**
-     * Whether the host says its company ZITADEL port has `ensureEmailOtpMessageText` and `ensureLabelPolicy`
+     * Whether the host says its company ZITADEL port has `ensureEmailOtpMessageText`, `ensureLabelPolicy` and `ensureEmailOtpGenerator`
      * (`provision.auth.signinMailWritable`). The port is a lazy proxy that answers any name, so it cannot be probed.
      */
     ownSigninMailWritable() {
@@ -1967,10 +1967,11 @@ export class FoundryStepExecutor {
         return {};
     }
     /**
-     * #339: registers `/auth/desktop/callback` on each live web sign-in app the
-     * planner named, keeping every redirect URI the app already holds (the
-     * union of the current list and the wanted one; a write only when the
-     * union is larger). An app's marker (its ZITADEL app id) is recorded and
+     * #339: registers the sign-in callbacks (`signInRedirectUris`: `/auth/callback`
+     * and `/auth/desktop/callback` per host, Agora's `/callback`) on each live web
+     * sign-in app the planner named, keeping every redirect URI the app already
+     * holds (the union of the current list and the wanted ones; a write only when
+     * the union is larger). An app's marker (its app id and wanted URIs) is recorded and
      * persisted only after its read and write resolved, so a failure leaves no
      * marker and the next plan names the app again. The error names ids only,
      * never the cause.
@@ -1991,7 +1992,7 @@ export class FoundryStepExecutor {
             const appId = recorded[`zitadel:app:${appKey}`];
             if (!appId)
                 continue;
-            const wanted = this.signInHostnames(org, appKey).map(desktopCallbackUri);
+            const wanted = signInRedirectUris(org, appKey);
             try {
                 const current = await read(zitadelOrgId, projectId, appId);
                 const union = unionRedirectUris(current, wanted);
@@ -1999,27 +2000,13 @@ export class FoundryStepExecutor {
                     await write(zitadelOrgId, projectId, appId, union);
             }
             catch {
-                throw new Error(`zitadel:desktop-callback for ${org.slug}: registering the desktop callback failed for app '${appKey}' (${appId})`);
+                throw new Error(`zitadel:desktop-callback for ${org.slug}: registering the sign-in callbacks failed for app '${appKey}' (${appId})`);
             }
-            context.recordScopeId(zitadelAppDesktopCallbackAppliedScopeKey(appKey), appId);
+            context.recordScopeId(zitadelAppDesktopCallbackAppliedScopeKey(appKey), signInCallbackAppliedValue(appId, wanted));
             await context.persistScopeIds();
         }
         return {};
     }
-    /**
-     * The hostnames a company web app signs in at: the same rule `zitadelApp`
-     * uses for the redirect URIs it creates the app with.
-     */
-    signInHostnames(org, appKey) {
-        const authEntry = org.hosting.entries.find((e) => e.key === appKey && e.uses?.auth);
-        if (appKey === 'cms' && org.site.enabled)
-            return [cmsHostnameFor(org)];
-        if (appKey === 'boule')
-            return [bouleHostnameFor(org)];
-        if (authEntry)
-            return entryHostnames(org, authEntry);
-        return [appHostname(org)];
-    }
     /**
      * `plan/diff.ts`'s `planLoginHost` (#267): adds the org's own company
      * login host (`action.desired.host`) to the ZITADEL instance's trusted
@@ -2701,55 +2688,24 @@ export class FoundryStepExecutor {
             await this.ports.deliverSecret(`zitadel:app:${org.slug}:${action.key}`, created.clientSecret);
             return { resourceId: created.appId };
         }
-        // #139: the fixed `cms` client (`diff.ts`'s `planCmsClient`) signs
-        // people into the cms studio at `cmsHostnameFor(org)` -- `cms.<domain>`,
-        // or `<slug>-cms.oikos.host` for a company without a domain -- not the
-        // org's own app hostname. #164: the fixed `agora` client (`diff.ts`'s
-        // `planAgoraClient`) is the same shape, always -- there is no
-        // `org.site.enabled`-style guard to check, since Agora is always on.
         // The Agora client stays `appType: 'web'`: providers' `createOidcApp`
         // makes every non-native app a public client (authorization code + PKCE,
         // `OIDC_AUTH_METHOD_TYPE_NONE`, no secret), which is what Agora's browser
         // SPA needs. Providers cannot create ZITADEL's `USER_AGENT` app kind.
-        // #161: the fixed `boule` client signs people into the org's Boule at its
-        // own hostname, on the standard `/auth/callback` path (Boule is built on
-        // `@wtfalch/auth` like every other web app here).
-        const hostname = isCmsClient
-            ? cmsHostnameFor(org)
-            : isAgoraClient
-                ? agoraHostnameFor(org)
-                : isBouleClient
-                    ? bouleHostnameFor(org)
-                    : appHostname(org);
         // Native apps sign in via device code, with no redirect of their own
         // (auth/scripts/provision.mjs:475-497, prior art cited in the decisions
         // file) -- empty arrays rather than a web app's callback/logout URLs.
-        // #164: Agora's own callback path is `/callback`, not `/auth/callback`
-        // (agora/apps/agora/README.md, "Deploying an Agora": "The issuer's OAuth
-        // client needs `https://<agora address>/callback` as a redirect URI") --
-        // Agora is not built on `@wtfalch/auth`'s `NextAuth` mount the way every
-        // other web app this file provisions is.
-        const redirectUri = isAgoraClient
-            ? `https://${hostname}/callback`
-            : `https://${hostname}/auth/callback`;
-        // An entry with `uses.auth` signs in at its own exact hostnames, one pair
-        // of addresses each; a `*` adds none (`entryHostnames`).
-        const hosts = authEntry ? entryHostnames(org, authEntry) : null;
+        // `signInRedirectUris` holds each web app's hosts and callback paths (the
+        // cms, Agora, Boule and entry hostnames; Agora's `/callback`).
         const postLogoutUris = appType === 'native' ? [] : companyAppPostLogoutUris(org, action.key);
-        // #339: every `@wtfalch/auth` web client also takes the desktop callback (Agora's own client does not).
-        const desktopCallbacks = appType === 'web' && !isAgoraClient ? (hosts ?? [hostname]).map(desktopCallbackUri) : [];
+        // The same rule the repair step uses (`signInRedirectUris`).
+        const signInUris = appType === 'web' ? signInRedirectUris(org, action.key) : [];
         const created = await this.ports.zitadel.createOidcApp(zitadelOrgId, projectId, {
             name: action.key,
             appType,
             redirectUris: appType === 'native'
                 ? []
-                : hosts
-                    ? [
-                        ...hosts.map((host) => `https://${host}/auth/callback`),
-                        ...desktopCallbacks,
-                        ...(authEntry?.uses?.auth?.mcp ? [mcpCallbackUri(org)] : []),
-                    ]
-                    : [redirectUri, ...desktopCallbacks],
+                : [...signInUris, ...(authEntry?.uses?.auth?.mcp ? [mcpCallbackUri(org)] : [])],
             postLogoutRedirectUris: postLogoutUris,
             ...(authEntry?.uses?.auth?.mcp ? { accessTokenType: 'jwt' } : {}),
         });
@@ -2769,8 +2725,8 @@ export class FoundryStepExecutor {
         if (appType === 'web') {
             context.recordScopeId(zitadelAppPostLogoutAppliedScopeKey(action.key), postLogoutAppliedValue(created.appId, postLogoutUris));
         }
-        if (desktopCallbacks.length > 0) {
-            context.recordScopeId(zitadelAppDesktopCallbackAppliedScopeKey(action.key), created.appId);
+        if (appType === 'web') {
+            context.recordScopeId(zitadelAppDesktopCallbackAppliedScopeKey(action.key), signInCallbackAppliedValue(created.appId, signInUris));
         }
         return { resourceId: created.appId };
     }

package/dist/plan/platform-providers.js

@@ -2551,11 +2551,12 @@ export async function provisionAuthStack(scope, deps, target, input) {
             throw new Error(`${label}: could not configure ZITADEL's SMTP provider for ${hostname}: ${cause}`);
         }
         // A company's own sign-in: its name and design in the code mail. Idempotent; the marker is
-        // recorded after both writes, so a failure halfway is repeated.
+        // recorded after all three writes, so a failure halfway is repeated.
         if (input.mailBranding &&
             (deps.signinMailWritable !== true ||
                 typeof mailZitadel.ensureEmailOtpMessageText !== 'function' ||
-                typeof mailZitadel.ensureLabelPolicy !== 'function')) {
+                typeof mailZitadel.ensureLabelPolicy !== 'function' ||
+                typeof mailZitadel.ensureEmailOtpGenerator !== 'function')) {
             console.info(`${label}: the host cannot write message texts, so the sign-in mail keeps ZITADEL's default text`);
         }
         else if (input.mailBranding) {

package/dist/plan/signin-mail.d.ts

@@ -2,17 +2,23 @@
  * The sign-in code mail of a company that runs its own sign-in: the company's name in the sender and
  * the text, the platform's design tokens for the look. ZITADEL's email-code message is built from the
  * instance's custom text and label policy; both are written through `PlatformZitadelMailBranding`
- * (`@wtfalch/providers` 0.13.0), each only when it differs.
+ * (`@wtfalch/providers` 0.14.0), each only when it differs. The code itself (six digits, five minutes)
+ * is the instance's email-OTP generator.
  *
  * The look: no company declares a design foundry can read (an `OrgTheme` lives in cms and reaches
  * Agora, Boule and the site as data), so every company gets the login's house colours
  * (`SIGNIN_MAIL_LABEL_POLICY`). No logo: ZITADEL takes it as a multipart upload the client does not make.
  */
 /** Raise it when the text or the look changes, so an applied company plans its sign-in step again. */
-export declare const AUTH_SIGNIN_MAIL_VERSION = "1";
+export declare const AUTH_SIGNIN_MAIL_VERSION = "2";
 /** `signinMailMarker` of the company name and version last written, recorded after both writes. */
 export declare const PLATFORM_AUTH_SIGNIN_MAIL_SCOPE_KEY = "auth_signin_mail_applied";
-/** The two ZITADEL calls the sign-in mail needs. `@wtfalch/providers` 0.13.0's `ZitadelClient` has both. */
+/** The code the mail carries: six digits, valid five minutes (`123-456` in the mail, see `signinMailText`). */
+export declare const SIGNIN_MAIL_CODE: {
+    readonly length: 6;
+    readonly expirySeconds: 300;
+};
+/** The three ZITADEL calls the sign-in mail needs. `@wtfalch/providers` 0.14.0's `ZitadelClient` has all. */
 export interface PlatformZitadelMailBranding {
     ensureEmailOtpMessageText(language: string, text: {
         title: string;
@@ -38,6 +44,12 @@ export interface PlatformZitadelMailBranding {
     }): Promise<{
         changed: boolean;
     }>;
+    ensureEmailOtpGenerator(generator: {
+        length: number;
+        expirySeconds: number;
+    }): Promise<{
+        changed: boolean;
+    }>;
 }
 /** What the marker holds: the version and the company name, so a rename writes the mail again. */
 export declare function signinMailMarker(companyName: string): string;
@@ -49,7 +61,9 @@ export declare function signinMailName(companyName: string): string;
 export declare const SIGNIN_MAIL_LANGUAGE = "en";
 /**
  * English text. `{{.OTP}}` is the code variable of this message (ZITADEL's `otp.go` sets it; the link
- * behind the button carries the code as `{{.Code}}` from the login's `urlTemplate`). No greeting by
+ * behind the button carries the code as `{{.Code}}` from the login's `urlTemplate`). The greeting
+ * holds the code, split in the middle with Go's `slice` (`123-456`), because ZITADEL renders the
+ * greeting as the large heading, so the code is the first thing the reader sees. No greeting by
  * name: the login fills names from the email address, so it would read "Wtfalch Wtfalch".
  */
 export declare function signinMailText(companyName: string): {
@@ -77,7 +91,7 @@ export declare const SIGNIN_MAIL_LABEL_POLICY: {
     readonly warnColorDark: "#FF9C8C";
     readonly disableWatermark: true;
 };
-/** Writes the text and the look, each only when it differs. Throws the client's fixed-text error. */
+/** Writes the text, the look and the code, each only when it differs. Throws the client's fixed-text error. */
 export declare function applySigninMail(zitadel: PlatformZitadelMailBranding, companyName: string): Promise<{
     changed: boolean;
 }>;

package/dist/plan/signin-mail.js

@@ -2,16 +2,19 @@
  * The sign-in code mail of a company that runs its own sign-in: the company's name in the sender and
  * the text, the platform's design tokens for the look. ZITADEL's email-code message is built from the
  * instance's custom text and label policy; both are written through `PlatformZitadelMailBranding`
- * (`@wtfalch/providers` 0.13.0), each only when it differs.
+ * (`@wtfalch/providers` 0.14.0), each only when it differs. The code itself (six digits, five minutes)
+ * is the instance's email-OTP generator.
  *
  * The look: no company declares a design foundry can read (an `OrgTheme` lives in cms and reaches
  * Agora, Boule and the site as data), so every company gets the login's house colours
  * (`SIGNIN_MAIL_LABEL_POLICY`). No logo: ZITADEL takes it as a multipart upload the client does not make.
  */
 /** Raise it when the text or the look changes, so an applied company plans its sign-in step again. */
-export const AUTH_SIGNIN_MAIL_VERSION = '1';
+export const AUTH_SIGNIN_MAIL_VERSION = '2';
 /** `signinMailMarker` of the company name and version last written, recorded after both writes. */
 export const PLATFORM_AUTH_SIGNIN_MAIL_SCOPE_KEY = 'auth_signin_mail_applied';
+/** The code the mail carries: six digits, valid five minutes (`123-456` in the mail, see `signinMailText`). */
+export const SIGNIN_MAIL_CODE = { length: 6, expirySeconds: 300 };
 /** What the marker holds: the version and the company name, so a rename writes the mail again. */
 export function signinMailMarker(companyName) {
     return `${AUTH_SIGNIN_MAIL_VERSION}:${signinMailName(companyName)}`;
@@ -30,7 +33,9 @@ export function signinMailName(companyName) {
 export const SIGNIN_MAIL_LANGUAGE = 'en';
 /**
  * English text. `{{.OTP}}` is the code variable of this message (ZITADEL's `otp.go` sets it; the link
- * behind the button carries the code as `{{.Code}}` from the login's `urlTemplate`). No greeting by
+ * behind the button carries the code as `{{.Code}}` from the login's `urlTemplate`). The greeting
+ * holds the code, split in the middle with Go's `slice` (`123-456`), because ZITADEL renders the
+ * greeting as the large heading, so the code is the first thing the reader sees. No greeting by
  * name: the login fills names from the email address, so it would read "Wtfalch Wtfalch".
  */
 export function signinMailText(companyName) {
@@ -39,8 +44,8 @@ export function signinMailText(companyName) {
         title: 'Your sign-in code',
         preHeader: `Your ${name} sign-in code`,
         subject: `Your ${name} sign-in code`,
-        greeting: 'Hello,',
-        text: 'Your code is {{.OTP}}. It works for five minutes. Or use the button to sign in on this device.',
+        greeting: '{{slice .OTP 0 3}}-{{slice .OTP 3}}',
+        text: 'Enter this code to sign in. It works for five minutes. Or use the button to sign in on this device.',
         buttonText: 'Sign in',
         footerText: name,
     };
@@ -61,9 +66,10 @@ export const SIGNIN_MAIL_LABEL_POLICY = {
     warnColorDark: '#FF9C8C',
     disableWatermark: true,
 };
-/** Writes the text and the look, each only when it differs. Throws the client's fixed-text error. */
+/** Writes the text, the look and the code, each only when it differs. Throws the client's fixed-text error. */
 export async function applySigninMail(zitadel, companyName) {
     const text = await zitadel.ensureEmailOtpMessageText(SIGNIN_MAIL_LANGUAGE, signinMailText(companyName));
     const look = await zitadel.ensureLabelPolicy({ ...SIGNIN_MAIL_LABEL_POLICY });
-    return { changed: text.changed || look.changed };
+    const code = await zitadel.ensureEmailOtpGenerator({ ...SIGNIN_MAIL_CODE });
+    return { changed: text.changed || look.changed || code.changed };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.56.0",
+  "version": "0.58.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",