@logto/schemas 1.38.0 → 1.40.0

package/lib/db-entries/application-access-control-org-role-relation.js

@@ -0,0 +1,33 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    applicationId: z.string().min(1).max(21),
+    organizationId: z.string().min(1).max(21),
+    organizationRoleId: z.string().min(1).max(21),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    applicationId: z.string().min(1).max(21),
+    organizationId: z.string().min(1).max(21),
+    organizationRoleId: z.string().min(1).max(21),
+});
+export const ApplicationAccessControlOrgRoleRelations = Object.freeze({
+    table: 'application_access_control_org_role_relations',
+    tableSingular: 'application_access_control_org_role_relation',
+    fields: {
+        tenantId: 'tenant_id',
+        applicationId: 'application_id',
+        organizationId: 'organization_id',
+        organizationRoleId: 'organization_role_id',
+    },
+    fieldKeys: [
+        'tenantId',
+        'applicationId',
+        'organizationId',
+        'organizationRoleId',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/application-access-control-organization-relation.d.ts

@@ -0,0 +1,20 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The organization membership allow relations for application-level access control.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link ApplicationAccessControlOrganizationRelation} for the original type.
+ */
+export type CreateApplicationAccessControlOrganizationRelation = {
+    tenantId?: string;
+    applicationId: string;
+    organizationId: string;
+};
+/** The organization membership allow relations for application-level access control. */
+export type ApplicationAccessControlOrganizationRelation = {
+    tenantId: string;
+    applicationId: string;
+    organizationId: string;
+};
+export type ApplicationAccessControlOrganizationRelationKeys = 'tenantId' | 'applicationId' | 'organizationId';
+export declare const ApplicationAccessControlOrganizationRelations: GeneratedSchema<ApplicationAccessControlOrganizationRelationKeys, CreateApplicationAccessControlOrganizationRelation, ApplicationAccessControlOrganizationRelation, 'application_access_control_organization_relations', 'application_access_control_organization_relation'>;

package/lib/db-entries/application-access-control-organization-relation.js

@@ -0,0 +1,29 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    applicationId: z.string().min(1).max(21),
+    organizationId: z.string().min(1).max(21),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    applicationId: z.string().min(1).max(21),
+    organizationId: z.string().min(1).max(21),
+});
+export const ApplicationAccessControlOrganizationRelations = Object.freeze({
+    table: 'application_access_control_organization_relations',
+    tableSingular: 'application_access_control_organization_relation',
+    fields: {
+        tenantId: 'tenant_id',
+        applicationId: 'application_id',
+        organizationId: 'organization_id',
+    },
+    fieldKeys: [
+        'tenantId',
+        'applicationId',
+        'organizationId',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/application-access-control-user-relation.d.ts

@@ -0,0 +1,20 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The direct user allow relations for application-level access control.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link ApplicationAccessControlUserRelation} for the original type.
+ */
+export type CreateApplicationAccessControlUserRelation = {
+    tenantId?: string;
+    applicationId: string;
+    userId: string;
+};
+/** The direct user allow relations for application-level access control. */
+export type ApplicationAccessControlUserRelation = {
+    tenantId: string;
+    applicationId: string;
+    userId: string;
+};
+export type ApplicationAccessControlUserRelationKeys = 'tenantId' | 'applicationId' | 'userId';
+export declare const ApplicationAccessControlUserRelations: GeneratedSchema<ApplicationAccessControlUserRelationKeys, CreateApplicationAccessControlUserRelation, ApplicationAccessControlUserRelation, 'application_access_control_user_relations', 'application_access_control_user_relation'>;

package/lib/db-entries/application-access-control-user-relation.js

@@ -0,0 +1,29 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    applicationId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(21),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    applicationId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(21),
+});
+export const ApplicationAccessControlUserRelations = Object.freeze({
+    table: 'application_access_control_user_relations',
+    tableSingular: 'application_access_control_user_relation',
+    fields: {
+        tenantId: 'tenant_id',
+        applicationId: 'application_id',
+        userId: 'user_id',
+    },
+    fieldKeys: [
+        'tenantId',
+        'applicationId',
+        'userId',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/application-access-control-user-role-relation.d.ts

@@ -0,0 +1,20 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The user role allow relations for application-level access control.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link ApplicationAccessControlUserRoleRelation} for the original type.
+ */
+export type CreateApplicationAccessControlUserRoleRelation = {
+    tenantId?: string;
+    applicationId: string;
+    roleId: string;
+};
+/** The user role allow relations for application-level access control. */
+export type ApplicationAccessControlUserRoleRelation = {
+    tenantId: string;
+    applicationId: string;
+    roleId: string;
+};
+export type ApplicationAccessControlUserRoleRelationKeys = 'tenantId' | 'applicationId' | 'roleId';
+export declare const ApplicationAccessControlUserRoleRelations: GeneratedSchema<ApplicationAccessControlUserRoleRelationKeys, CreateApplicationAccessControlUserRoleRelation, ApplicationAccessControlUserRoleRelation, 'application_access_control_user_role_relations', 'application_access_control_user_role_relation'>;

package/lib/db-entries/application-access-control-user-role-relation.js

@@ -0,0 +1,29 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    applicationId: z.string().min(1).max(21),
+    roleId: z.string().min(1).max(21),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    applicationId: z.string().min(1).max(21),
+    roleId: z.string().min(1).max(21),
+});
+export const ApplicationAccessControlUserRoleRelations = Object.freeze({
+    table: 'application_access_control_user_role_relations',
+    tableSingular: 'application_access_control_user_role_relation',
+    fields: {
+        tenantId: 'tenant_id',
+        applicationId: 'application_id',
+        roleId: 'role_id',
+    },
+    fieldKeys: [
+        'tenantId',
+        'applicationId',
+        'roleId',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/application.d.ts

@@ -18,6 +18,7 @@ export type CreateApplication = {
     protectedAppMetadata?: ProtectedAppMetadata | null;
     customData?: JsonObject;
     isThirdParty?: boolean;
+    appLevelAccessControlEnabled?: boolean;
     createdAt?: number;
 };
 export type Application = {
@@ -33,7 +34,8 @@ export type Application = {
     protectedAppMetadata: ProtectedAppMetadata | null;
     customData: JsonObject;
     isThirdParty: boolean;
+    appLevelAccessControlEnabled: boolean;
     createdAt: number;
 };
-export type ApplicationKeys = 'tenantId' | 'id' | 'name' | 'secret' | 'description' | 'type' | 'oidcClientMetadata' | 'customClientMetadata' | 'protectedAppMetadata' | 'customData' | 'isThirdParty' | 'createdAt';
+export type ApplicationKeys = 'tenantId' | 'id' | 'name' | 'secret' | 'description' | 'type' | 'oidcClientMetadata' | 'customClientMetadata' | 'protectedAppMetadata' | 'customData' | 'isThirdParty' | 'appLevelAccessControlEnabled' | 'createdAt';
 export declare const Applications: GeneratedSchema<ApplicationKeys, CreateApplication, Application, 'applications', 'application'>;

package/lib/db-entries/application.js

@@ -14,6 +14,7 @@ const createGuard = z.object({
     protectedAppMetadata: protectedAppMetadataGuard.nullable().optional(),
     customData: jsonObjectGuard.optional(),
     isThirdParty: z.boolean().optional(),
+    appLevelAccessControlEnabled: z.boolean().optional(),
     createdAt: z.number().optional(),
 });
 const guard = z.object({
@@ -28,6 +29,7 @@ const guard = z.object({
     protectedAppMetadata: protectedAppMetadataGuard.nullable(),
     customData: jsonObjectGuard,
     isThirdParty: z.boolean(),
+    appLevelAccessControlEnabled: z.boolean(),
     createdAt: z.number(),
 });
 export const Applications = Object.freeze({
@@ -45,6 +47,7 @@ export const Applications = Object.freeze({
         protectedAppMetadata: 'protected_app_metadata',
         customData: 'custom_data',
         isThirdParty: 'is_third_party',
+        appLevelAccessControlEnabled: 'app_level_access_control_enabled',
         createdAt: 'created_at',
     },
     fieldKeys: [
@@ -59,6 +62,7 @@ export const Applications = Object.freeze({
         'protectedAppMetadata',
         'customData',
         'isThirdParty',
+        'appLevelAccessControlEnabled',
         'createdAt',
     ],
     createGuard,

package/lib/db-entries/index.d.ts

@@ -5,6 +5,10 @@ export * from './-before-all.js';
 export * from './-function.js';
 export * from './account-center.js';
 export * from './aggregated-daily-active-user.js';
+export * from './application-access-control-org-role-relation.js';
+export * from './application-access-control-organization-relation.js';
+export * from './application-access-control-user-relation.js';
+export * from './application-access-control-user-role-relation.js';
 export * from './application-secret.js';
 export * from './application-sign-in-experience.js';
 export * from './application-user-consent-organization-resource-scope.js';

package/lib/db-entries/index.js

@@ -6,6 +6,10 @@ export * from './-before-all.js';
 export * from './-function.js';
 export * from './account-center.js';
 export * from './aggregated-daily-active-user.js';
+export * from './application-access-control-org-role-relation.js';
+export * from './application-access-control-organization-relation.js';
+export * from './application-access-control-user-relation.js';
+export * from './application-access-control-user-role-relation.js';
 export * from './application-secret.js';
 export * from './application-sign-in-experience.js';
 export * from './application-user-consent-organization-resource-scope.js';

package/lib/db-entries/sign-in-experience.d.ts

@@ -1,4 +1,4 @@
-import { Color, Branding, LanguageInfo, SignIn, SignUp, SocialSignIn, ConnectorTargets, CustomContent, CustomUiAssets, PartialPasswordPolicy, Mfa, AdaptiveMfa, CaptchaPolicy, SentinelPolicy, EmailBlocklistPolicy, ForgotPasswordMethods, PasskeySignIn, GeneratedSchema } from './../foundations/index.js';
+import { Color, Branding, LanguageInfo, SignIn, SignUp, SocialSignIn, ConnectorTargets, CustomContent, CustomUiAssets, CustomUiCsp, PartialPasswordPolicy, Mfa, AdaptiveMfa, CaptchaPolicy, SentinelPolicy, EmailBlocklistPolicy, ForgotPasswordMethods, PasskeySignIn, SignUpProfileFields, GeneratedSchema } from './../foundations/index.js';
 import { AgreeToTermsPolicy, SignInMode } from './custom-types.js';
 /**
  *
@@ -24,6 +24,7 @@ export type CreateSignInExperience = {
     customCss?: string | null;
     customContent?: CustomContent;
     customUiAssets?: CustomUiAssets | null;
+    customUiCsp?: CustomUiCsp;
     passwordPolicy?: PartialPasswordPolicy;
     mfa?: Mfa;
     adaptiveMfa?: AdaptiveMfa;
@@ -36,6 +37,8 @@ export type CreateSignInExperience = {
     emailBlocklistPolicy?: EmailBlocklistPolicy;
     forgotPasswordMethods?: ForgotPasswordMethods | null;
     passkeySignIn?: PasskeySignIn;
+    /** Nullable by design: null keeps legacy full-catalog behavior and [] collects no custom profile fields. */
+    signUpProfileFields?: SignUpProfileFields | null;
 };
 export type SignInExperience = {
     tenantId: string;
@@ -56,6 +59,7 @@ export type SignInExperience = {
     customCss: string | null;
     customContent: CustomContent;
     customUiAssets: CustomUiAssets | null;
+    customUiCsp: CustomUiCsp;
     passwordPolicy: PartialPasswordPolicy;
     mfa: Mfa;
     adaptiveMfa: AdaptiveMfa;
@@ -68,6 +72,8 @@ export type SignInExperience = {
     emailBlocklistPolicy: EmailBlocklistPolicy;
     forgotPasswordMethods: ForgotPasswordMethods | null;
     passkeySignIn: PasskeySignIn;
+    /** Nullable by design: null keeps legacy full-catalog behavior and [] collects no custom profile fields. */
+    signUpProfileFields: SignUpProfileFields | null;
 };
-export type SignInExperienceKeys = 'tenantId' | 'id' | 'color' | 'branding' | 'hideLogtoBranding' | 'languageInfo' | 'termsOfUseUrl' | 'privacyPolicyUrl' | 'agreeToTermsPolicy' | 'signIn' | 'signUp' | 'socialSignIn' | 'socialSignInConnectorTargets' | 'signInMode' | 'customCss' | 'customContent' | 'customUiAssets' | 'passwordPolicy' | 'mfa' | 'adaptiveMfa' | 'singleSignOnEnabled' | 'supportEmail' | 'supportWebsiteUrl' | 'unknownSessionRedirectUrl' | 'captchaPolicy' | 'sentinelPolicy' | 'emailBlocklistPolicy' | 'forgotPasswordMethods' | 'passkeySignIn';
+export type SignInExperienceKeys = 'tenantId' | 'id' | 'color' | 'branding' | 'hideLogtoBranding' | 'languageInfo' | 'termsOfUseUrl' | 'privacyPolicyUrl' | 'agreeToTermsPolicy' | 'signIn' | 'signUp' | 'socialSignIn' | 'socialSignInConnectorTargets' | 'signInMode' | 'customCss' | 'customContent' | 'customUiAssets' | 'customUiCsp' | 'passwordPolicy' | 'mfa' | 'adaptiveMfa' | 'singleSignOnEnabled' | 'supportEmail' | 'supportWebsiteUrl' | 'unknownSessionRedirectUrl' | 'captchaPolicy' | 'sentinelPolicy' | 'emailBlocklistPolicy' | 'forgotPasswordMethods' | 'passkeySignIn' | 'signUpProfileFields';
 export declare const SignInExperiences: GeneratedSchema<SignInExperienceKeys, CreateSignInExperience, SignInExperience, 'sign_in_experiences', 'sign_in_experience'>;

package/lib/db-entries/sign-in-experience.js

@@ -1,6 +1,6 @@
 // THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
 import { z } from 'zod';
-import { colorGuard, brandingGuard, languageInfoGuard, signInGuard, signUpGuard, socialSignInGuard, connectorTargetsGuard, customContentGuard, customUiAssetsGuard, partialPasswordPolicyGuard, mfaGuard, adaptiveMfaGuard, captchaPolicyGuard, sentinelPolicyGuard, emailBlocklistPolicyGuard, forgotPasswordMethodsGuard, passkeySignInGuard } from './../foundations/index.js';
+import { colorGuard, brandingGuard, languageInfoGuard, signInGuard, signUpGuard, socialSignInGuard, connectorTargetsGuard, customContentGuard, customUiAssetsGuard, customUiCspGuard, partialPasswordPolicyGuard, mfaGuard, adaptiveMfaGuard, captchaPolicyGuard, sentinelPolicyGuard, emailBlocklistPolicyGuard, forgotPasswordMethodsGuard, passkeySignInGuard, signUpProfileFieldsGuard } from './../foundations/index.js';
 import { AgreeToTermsPolicy, SignInMode } from './custom-types.js';
 const createGuard = z.object({
     tenantId: z.string().max(21).optional(),
@@ -20,6 +20,7 @@ const createGuard = z.object({
     customCss: z.string().nullable().optional(),
     customContent: customContentGuard.optional(),
     customUiAssets: customUiAssetsGuard.nullable().optional(),
+    customUiCsp: customUiCspGuard.optional(),
     passwordPolicy: partialPasswordPolicyGuard.optional(),
     mfa: mfaGuard.optional(),
     adaptiveMfa: adaptiveMfaGuard.optional(),
@@ -32,6 +33,7 @@ const createGuard = z.object({
     emailBlocklistPolicy: emailBlocklistPolicyGuard.optional(),
     forgotPasswordMethods: forgotPasswordMethodsGuard.nullable().optional(),
     passkeySignIn: passkeySignInGuard.optional(),
+    signUpProfileFields: signUpProfileFieldsGuard.nullable().optional(),
 });
 const guard = z.object({
     tenantId: z.string().max(21),
@@ -51,6 +53,7 @@ const guard = z.object({
     customCss: z.string().nullable(),
     customContent: customContentGuard,
     customUiAssets: customUiAssetsGuard.nullable(),
+    customUiCsp: customUiCspGuard,
     passwordPolicy: partialPasswordPolicyGuard,
     mfa: mfaGuard,
     adaptiveMfa: adaptiveMfaGuard,
@@ -63,6 +66,7 @@ const guard = z.object({
     emailBlocklistPolicy: emailBlocklistPolicyGuard,
     forgotPasswordMethods: forgotPasswordMethodsGuard.nullable(),
     passkeySignIn: passkeySignInGuard,
+    signUpProfileFields: signUpProfileFieldsGuard.nullable(),
 });
 export const SignInExperiences = Object.freeze({
     table: 'sign_in_experiences',
@@ -85,6 +89,7 @@ export const SignInExperiences = Object.freeze({
         customCss: 'custom_css',
         customContent: 'custom_content',
         customUiAssets: 'custom_ui_assets',
+        customUiCsp: 'custom_ui_csp',
         passwordPolicy: 'password_policy',
         mfa: 'mfa',
         adaptiveMfa: 'adaptive_mfa',
@@ -97,6 +102,7 @@ export const SignInExperiences = Object.freeze({
         emailBlocklistPolicy: 'email_blocklist_policy',
         forgotPasswordMethods: 'forgot_password_methods',
         passkeySignIn: 'passkey_sign_in',
+        signUpProfileFields: 'sign_up_profile_fields',
     },
     fieldKeys: [
         'tenantId',
@@ -116,6 +122,7 @@ export const SignInExperiences = Object.freeze({
         'customCss',
         'customContent',
         'customUiAssets',
+        'customUiCsp',
         'passwordPolicy',
         'mfa',
         'adaptiveMfa',
@@ -128,6 +135,7 @@ export const SignInExperiences = Object.freeze({
         'emailBlocklistPolicy',
         'forgotPasswordMethods',
         'passkeySignIn',
+        'signUpProfileFields',
     ],
     createGuard,
     guard,

package/lib/foundations/jsonb-types/account-centers.d.ts

@@ -49,3 +49,30 @@ export declare const accountCenterFieldControlGuard: z.ZodObject<{
 export type AccountCenterFieldControl = z.infer<typeof accountCenterFieldControlGuard>;
 export declare const webauthnRelatedOriginsGuard: z.ZodArray<z.ZodString, "many">;
 export type WebauthnRelatedOrigins = z.infer<typeof webauthnRelatedOriginsGuard>;
+/**
+ * Configuration for which custom profile fields are exposed in the prebuilt account center and
+ * in which order. Each entry references an existing field by name in the `custom_profile_fields`
+ * catalog; fields in the catalog but not in this list are not shown in the account center.
+ *
+ * Kept separate from `signUpProfileFields` so the sign-up and account-center surfaces can be
+ * configured independently against the same catalog.
+ */
+export type AccountCenterProfileFieldItem = {
+    name: string;
+};
+export declare const accountCenterProfileFieldItemGuard: z.ZodObject<{
+    name: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+}, {
+    name: string;
+}>;
+export declare const accountCenterProfileFieldsGuard: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+}, {
+    name: string;
+}>, "many">;
+export type AccountCenterProfileFields = z.infer<typeof accountCenterProfileFieldsGuard>;
+export declare const deleteAccountUrlGuard: z.ZodEffects<z.ZodString, string, string>;

package/lib/foundations/jsonb-types/account-centers.js

@@ -26,3 +26,15 @@ export const accountCenterFieldControlGuard = z
 })
     .partial();
 export const webauthnRelatedOriginsGuard = z.array(z.string());
+export const accountCenterProfileFieldItemGuard = z.object({
+    name: z.string(),
+});
+export const accountCenterProfileFieldsGuard = z.array(accountCenterProfileFieldItemGuard);
+export const deleteAccountUrlGuard = z
+    .string()
+    .max(2048)
+    .refine((value) => value === '' ||
+    ((value.startsWith('https://') || value.startsWith('http://')) &&
+        z.string().url().safeParse(value).success), {
+    message: 'deleteAccountUrl must be a valid http(s) URL',
+});

package/lib/foundations/jsonb-types/applications.d.ts

@@ -217,6 +217,7 @@ export declare const protectedAppMetadataGuard: z.ZodObject<{
     }, {
         path: string;
     }>, "many">;
+    additionalScopes: z.ZodOptional<z.ZodArray<z.ZodEnum<[import("@logto/core-kit").UserScope.CustomData, import("@logto/core-kit").UserScope.Identities, import("@logto/core-kit").UserScope.Roles, import("@logto/core-kit").UserScope.Organizations, import("@logto/core-kit").UserScope.OrganizationRoles]>, "many">>;
     customDomains: z.ZodOptional<z.ZodArray<z.ZodObject<{
         domain: z.ZodString;
         status: z.ZodNativeEnum<typeof import("./custom-domain.js").DomainStatus>;
@@ -327,6 +328,7 @@ export declare const protectedAppMetadataGuard: z.ZodObject<{
     pageRules: {
         path: string;
     }[];
+    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
     customDomains?: {
         status: import("./custom-domain.js").DomainStatus;
         domain: string;
@@ -355,6 +357,7 @@ export declare const protectedAppMetadataGuard: z.ZodObject<{
     pageRules: {
         path: string;
     }[];
+    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
     customDomains?: {
         status: import("./custom-domain.js").DomainStatus;
         domain: string;

package/lib/foundations/jsonb-types/applications.js

@@ -1,5 +1,7 @@
+import { protectedAppAdditionalScopes } from '@logto/core-kit';
 import { z } from 'zod';
 import { cloudflareDataGuard, domainDnsRecordsGuard, domainStatusGuard } from './custom-domain.js';
+const protectedAppAdditionalScopeGuard = z.enum(protectedAppAdditionalScopes);
 export const customDomainGuard = z.object({
     /* The domain name, e.g app.example.com */
     domain: z.string(),
@@ -24,6 +26,8 @@ export const protectedAppMetadataGuard = z.object({
         /* The path pattern (regex) to match */
         path: z.string(),
     })),
+    /* Additional scopes requested by protected app sign-in */
+    additionalScopes: z.array(protectedAppAdditionalScopeGuard).optional(),
     /* Custom domain */
     customDomains: customDomainsGuard.optional(),
 });

package/lib/foundations/jsonb-types/applications.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/foundations/jsonb-types/applications.test.js

@@ -0,0 +1,23 @@
+import { UserScope } from '@logto/core-kit';
+import { describe, expect, it } from 'vitest';
+import { protectedAppMetadataGuard } from './applications.js';
+const protectedAppMetadata = {
+    host: 'example.com',
+    origin: 'https://example.com',
+    sessionDuration: 3600,
+    pageRules: [],
+};
+describe('protectedAppMetadataGuard', () => {
+    it('accepts additional scopes with extended ID token claims', () => {
+        expect(protectedAppMetadataGuard.safeParse({
+            ...protectedAppMetadata,
+            additionalScopes: [UserScope.CustomData],
+        }).success).toBe(true);
+    });
+    it('rejects additional scopes without extended ID token claims', () => {
+        expect(protectedAppMetadataGuard.safeParse({
+            ...protectedAppMetadata,
+            additionalScopes: [UserScope.Sessions],
+        }).success).toBe(false);
+    });
+});

package/lib/foundations/jsonb-types/sign-in-experience.d.ts

@@ -415,4 +415,30 @@ export declare const passkeySignInGuard: z.ZodObject<{
     showPasskeyButton?: boolean | undefined;
     allowAutofill?: boolean | undefined;
 }>;
-export {};
+/**
+ * Configuration for which custom profile fields are shown on the sign-up page and in which order.
+ *
+ * The list is a pure projection over the catalog in `custom_profile_fields` — each entry references
+ * an existing field by name. Fields in the catalog but not in this list are not collected during
+ * sign-up. This enables reusing the same catalog for other surfaces (e.g. account center) without
+ * affecting sign-up.
+ */
+export type SignUpProfileFieldItem = {
+    name: string;
+};
+export declare const signUpProfileFieldItemGuard: z.ZodObject<{
+    name: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+}, {
+    name: string;
+}>;
+export declare const signUpProfileFieldsGuard: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+}, {
+    name: string;
+}>, "many">;
+export type SignUpProfileFields = z.infer<typeof signUpProfileFieldsGuard>;
+export { customUiCspGuard, type CustomUiCsp } from '@logto/core-kit';

package/lib/foundations/jsonb-types/sign-in-experience.js

@@ -138,3 +138,8 @@ export const passkeySignInGuard = z
     allowAutofill: z.boolean(),
 })
     .partial();
+export const signUpProfileFieldItemGuard = z.object({
+    name: z.string(),
+});
+export const signUpProfileFieldsGuard = z.array(signUpProfileFieldItemGuard);
+export { customUiCspGuard } from '@logto/core-kit';

package/lib/foundations/jsonb-types/sign-in-experience.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/foundations/jsonb-types/sign-in-experience.test.js

@@ -0,0 +1,18 @@
+import { describe, expect, it } from 'vitest';
+import { customUiCspGuard } from './sign-in-experience.js';
+describe('customUiCspGuard', () => {
+    it.each([
+        {},
+        { scriptSrc: ['https://example.com'] },
+        { connectSrc: ['https://api.example.com'] },
+        {
+            scriptSrc: ['https://example.com'],
+            connectSrc: ['https://api.example.com'],
+        },
+    ])('accepts %p', (value) => {
+        expect(customUiCspGuard.safeParse(value).success).toBe(true);
+    });
+    it('rejects unsupported directives', () => {
+        expect(customUiCspGuard.safeParse({ imgSrc: ['https://example.com'] }).success).toBe(false);
+    });
+});

package/lib/seeds/application.js

@@ -21,6 +21,7 @@ const buildSpaApplicationData = (tenantId, { id, name, description, }) => ({
     customClientMetadata: {},
     protectedAppMetadata: null,
     isThirdParty: false,
+    appLevelAccessControlEnabled: false,
     createdAt: 0,
     customData: {},
 });
@@ -45,6 +46,7 @@ const buildNativeApplicationData = (tenantId, { id, name, description, }) => ({
     customClientMetadata: { isDeviceFlow: true },
     protectedAppMetadata: null,
     isThirdParty: false,
+    appLevelAccessControlEnabled: false,
     createdAt: 0,
     customData: {},
 });

package/lib/seeds/sign-in-experience.d.ts

@@ -3,4 +3,16 @@ export declare const defaultPrimaryColor = "#6139F6";
 export declare const createDefaultSignInExperience: (forTenantId: string, isCloud: boolean) => Readonly<CreateSignInExperience>;
 /** @deprecated Use `createDefaultSignInExperience()` instead. */
 export declare const defaultSignInExperience: Readonly<CreateSignInExperience>;
-export declare const createAdminTenantSignInExperience: () => Readonly<CreateSignInExperience>;
+export type AdminSignInExperienceSeedOptions = {
+    /**
+     * When true, the seeded admin-tenant `passwordPolicy` explicitly disables the
+     * HaveIBeenPwned (HIBP) breach check by setting `rejects.pwned = false`. Intended
+     * for air-gapped or offline OSS deployments where `api.pwnedpasswords.com` is
+     * unreachable; otherwise the first admin sign-up will hang on the breach check.
+     *
+     * Defaults to `false`, which preserves the historical seeded value (`{}`) and lets
+     * the runtime fall back to the default policy (HIBP check enabled).
+     */
+    disablePwnedPasswordCheck?: boolean;
+};
+export declare const createAdminTenantSignInExperience: (options?: AdminSignInExperienceSeedOptions) => Readonly<CreateSignInExperience>;

package/lib/seeds/sign-in-experience.js

@@ -50,7 +50,7 @@ export const createDefaultSignInExperience = (forTenantId, isCloud) => Object.fr
 });
 /** @deprecated Use `createDefaultSignInExperience()` instead. */
 export const defaultSignInExperience = createDefaultSignInExperience(defaultTenantId, false);
-export const createAdminTenantSignInExperience = () => Object.freeze({
+export const createAdminTenantSignInExperience = (options = {}) => Object.freeze({
     ...defaultSignInExperience,
     tenantId: adminTenantId,
     color: {
@@ -62,6 +62,15 @@ export const createAdminTenantSignInExperience = () => Object.freeze({
         logoUrl: 'https://logto.io/logo.svg',
         darkLogoUrl: 'https://logto.io/logo-dark.svg',
     },
+    passwordPolicy: options.disablePwnedPasswordCheck
+        ? {
+            ...defaultSignInExperience.passwordPolicy,
+            rejects: {
+                ...defaultSignInExperience.passwordPolicy?.rejects,
+                pwned: false,
+            },
+        }
+        : defaultSignInExperience.passwordPolicy,
     mfa: {
         factors: [MfaFactor.TOTP, MfaFactor.WebAuthn, MfaFactor.BackupCode],
         policy: MfaPolicy.NoPrompt,

package/lib/seeds/sign-in-experience.test.d.ts

@@ -0,0 +1 @@
+export {};