@wtfalch/foundry 0.72.2 → 0.73.0

package/dist/plan/platform-diff.d.ts

@@ -70,12 +70,14 @@ export declare const AUTH_TUNNEL_ROUTES_VERSION = "2";
 export declare const PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY = "auth_tunnel_routes_applied";
 /**
  * The version of the env `provisionAuthStack` writes to the login apps (`LOGIN_MAIL_FROM`,
- * `LETTERMINT_API_TOKEN`, `LOGIN_PASSKEY_RP_ID`). Raise it when a key is added or its meaning changes, so an applied
+ * `LETTERMINT_API_TOKEN`, `LOGIN_PASSKEY_RP_ID`, `ZITADEL_DOMAIN`, `LOGIN_COMPANY_NAME`). Raise it when a key is added or its meaning changes, so an applied
  * sign-in plans its step once more and the apps get the env. Never holds a value.
  * 1: the login apps send their own invite and verification mail (auth 0.35.0, foundry 0.68.0).
  * 2: a company's login apps get `LOGIN_PASSKEY_RP_ID` (foundry 0.70.2).
+ * 3: the login apps get `ZITADEL_DOMAIN` (foundry 0.72.2; written from 0.72.3).
+ * 4: the login apps get `LOGIN_COMPANY_NAME`, the sign-in page's wordmark (foundry 0.73.0).
  */
-export declare const AUTH_LOGIN_ENV_VERSION = "2";
+export declare const AUTH_LOGIN_ENV_VERSION = "4";
 /**
  * What the login apps' env is written for: the version, the sender address (`LOGIN_MAIL_FROM`) and the
  * passkey RP ID (`LOGIN_PASSKEY_RP_ID`, none for the platform and a company without its own domain).

package/dist/plan/platform-diff.js

@@ -77,12 +77,14 @@ export const AUTH_TUNNEL_ROUTES_VERSION = '2';
 export const PLATFORM_AUTH_TUNNEL_ROUTES_SCOPE_KEY = 'auth_tunnel_routes_applied';
 /**
  * The version of the env `provisionAuthStack` writes to the login apps (`LOGIN_MAIL_FROM`,
- * `LETTERMINT_API_TOKEN`, `LOGIN_PASSKEY_RP_ID`). Raise it when a key is added or its meaning changes, so an applied
+ * `LETTERMINT_API_TOKEN`, `LOGIN_PASSKEY_RP_ID`, `ZITADEL_DOMAIN`, `LOGIN_COMPANY_NAME`). Raise it when a key is added or its meaning changes, so an applied
  * sign-in plans its step once more and the apps get the env. Never holds a value.
  * 1: the login apps send their own invite and verification mail (auth 0.35.0, foundry 0.68.0).
  * 2: a company's login apps get `LOGIN_PASSKEY_RP_ID` (foundry 0.70.2).
+ * 3: the login apps get `ZITADEL_DOMAIN` (foundry 0.72.2; written from 0.72.3).
+ * 4: the login apps get `LOGIN_COMPANY_NAME`, the sign-in page's wordmark (foundry 0.73.0).
  */
-export const AUTH_LOGIN_ENV_VERSION = '2';
+export const AUTH_LOGIN_ENV_VERSION = '4';
 /**
  * What the login apps' env is written for: the version, the sender address (`LOGIN_MAIL_FROM`) and the
  * passkey RP ID (`LOGIN_PASSKEY_RP_ID`, none for the platform and a company without its own domain).

package/dist/plan/platform-providers.js

@@ -1575,11 +1575,12 @@ const PLATFORM_AUTH_RESERVED_USERNAME = 'admin';
 /** #216 (building on #209/#215): the narrower `IAM_LOGIN_CLIENT` machine user for the login app and the broker. */
 const PLATFORM_AUTH_LOGIN_CLIENT_USER_NAME = 'foundry-login-client';
 export const PLATFORM_AUTH_ORG_NAME = 'foundry';
+const LOGIN_COMPANY_NAME_ENV = 'LOGIN_COMPANY_NAME';
 /**
  * The instance's first organisation (the default one, whose name the login shows as its wordmark).
  * A company's own instance passes the recorded id (the platform passes none and keeps the name `foundry`);
- * found by that id when there is one, because a company's own instance has it renamed to the
- * company's name (`applySigninMail`), and a lookup by name would then make a second `foundry` org. The
+ * found by that id when there is one, because a company's own instance may have it renamed (foundry
+ * before 0.73.0 did), and a lookup by name would then make a second `foundry` org. The
  * name is the way in only before the id is recorded. A recorded id ZITADEL no longer has is a failure,
  * never a reason to make another org.
  */
@@ -2228,6 +2229,11 @@ export async function provisionAuthStack(scope, deps, target, input) {
         },
         // #1086: the login builds redirects for an unbound host from this, never from a header.
         { key: 'ZITADEL_DOMAIN', value: hostname },
+        // The wordmark on the sign-in page: a company's own name, `Archon` for the platform's login.
+        {
+            key: LOGIN_COMPANY_NAME_ENV,
+            value: input.mailBranding ? signinMailName(input.mailBranding.companyName) : 'Archon',
+        },
         { key: 'OTEL_NODE_RESOURCE_DETECTORS', value: 'none' },
         { key: 'API_CACHE_CONFIG', value: '{"defaultMinutes":2,"longMinutes":5}' },
         // #405: the login app's own requestId-free fallback (`resolveRedirectUri`
@@ -2856,17 +2862,12 @@ export async function provisionAuthStack(scope, deps, target, input) {
             (deps.signinMailWritable !== true ||
                 typeof mailZitadel.ensureEmailOtpMessageText !== 'function' ||
                 typeof mailZitadel.ensureLabelPolicy !== 'function' ||
-                typeof mailZitadel.ensureOrgName !== 'function' ||
                 typeof mailZitadel.ensureEmailOtpGenerator !== 'function')) {
             console.info(`${label}: the host cannot write message texts, so the sign-in mail keeps ZITADEL's default text`);
         }
         else if (input.mailBranding) {
-            const firstOrgId = scope.recordedIds()[PLATFORM_ZITADEL_ORG_SCOPE_KEY];
-            if (!firstOrgId) {
-                throw new Error(`${label}: the instance's first organisation is not recorded`);
-            }
             try {
-                await applySigninMail(mailZitadel, input.mailBranding.companyName, firstOrgId);
+                await applySigninMail(mailZitadel, input.mailBranding.companyName);
             }
             catch (error) {
                 const cause = redactSecrets(error instanceof Error ? error.message : String(error), [

package/dist/plan/signin-mail.d.ts

@@ -18,16 +18,8 @@ export declare const SIGNIN_MAIL_CODE: {
     readonly length: 6;
     readonly expirySeconds: 300;
 };
-/** The four ZITADEL calls the sign-in mail needs. */
+/** The three ZITADEL calls the sign-in mail needs. */
 export interface PlatformZitadelMailBranding {
-    /**
-     * Renames an organisation, only when its name differs (`PUT /management/v1/orgs/me` as that
-     * organisation). The login shows the instance's default organisation's name as its wordmark when the
-     * host is bound to no company, so a company's own instance names it after the company.
-     */
-    ensureOrgName(orgId: string, name: string): Promise<{
-        changed: boolean;
-    }>;
     ensureEmailOtpMessageText(language: string, text: {
         title: string;
         preHeader: string;
@@ -104,7 +96,7 @@ export declare const SIGNIN_MAIL_LABEL_POLICY: {
     readonly warnColorDark: "#FF9C8C";
     readonly disableWatermark: true;
 };
-/** Names the default organisation after the company, then writes the text, the look and the code, each only when it differs. Throws the client's fixed-text error. */
-export declare function applySigninMail(zitadel: PlatformZitadelMailBranding, companyName: string, defaultOrgId: string): Promise<{
+/** Writes the text, the look and the code, each only when it differs. Throws the client's fixed-text error. The wordmark is the login's `LOGIN_COMPANY_NAME`, not an organisation name. */
+export declare function applySigninMail(zitadel: PlatformZitadelMailBranding, companyName: string): Promise<{
     changed: boolean;
 }>;

package/dist/plan/signin-mail.js

@@ -71,13 +71,12 @@ export const SIGNIN_MAIL_LABEL_POLICY = {
     warnColorDark: '#FF9C8C',
     disableWatermark: true,
 };
-/** Names the default organisation after the company, then writes the text, the look and the code, each only when it differs. Throws the client's fixed-text error. */
-export async function applySigninMail(zitadel, companyName, defaultOrgId) {
-    const name = await zitadel.ensureOrgName(defaultOrgId, signinMailName(companyName));
+/** Writes the text, the look and the code, each only when it differs. Throws the client's fixed-text error. The wordmark is the login's `LOGIN_COMPANY_NAME`, not an organisation name. */
+export async function applySigninMail(zitadel, companyName) {
     const text = await zitadel.ensureEmailOtpMessageText(SIGNIN_MAIL_LANGUAGE, signinMailText(companyName));
     const look = await zitadel.ensureLabelPolicy({ ...SIGNIN_MAIL_LABEL_POLICY });
     const code = await zitadel.ensureEmailOtpGenerator({ ...SIGNIN_MAIL_CODE });
     return {
-        changed: name.changed || text.changed || look.changed || code.changed,
+        changed: text.changed || look.changed || code.changed,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.72.2",
+  "version": "0.73.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",