@logto/schemas 1.38.0 → 1.40.0

package/lib/seeds/sign-in-experience.test.js

@@ -0,0 +1,27 @@
+import { describe, expect, it } from 'vitest';
+import { createAdminTenantSignInExperience, createDefaultSignInExperience, } from './sign-in-experience.js';
+import { adminTenantId } from './tenant.js';
+describe('createAdminTenantSignInExperience', () => {
+    it('seeds an empty passwordPolicy by default', () => {
+        const row = createAdminTenantSignInExperience();
+        expect(row.passwordPolicy).toEqual({});
+    });
+    it('seeds an empty passwordPolicy when option is explicitly false', () => {
+        const row = createAdminTenantSignInExperience({ disablePwnedPasswordCheck: false });
+        expect(row.passwordPolicy).toEqual({});
+    });
+    it('seeds rejects.pwned=false when disablePwnedPasswordCheck is true', () => {
+        const row = createAdminTenantSignInExperience({ disablePwnedPasswordCheck: true });
+        expect(row.passwordPolicy).toEqual({ rejects: { pwned: false } });
+    });
+    it('still targets the admin tenant id when the option is set', () => {
+        const row = createAdminTenantSignInExperience({ disablePwnedPasswordCheck: true });
+        expect(row.tenantId).toBe(adminTenantId);
+    });
+});
+describe('createDefaultSignInExperience (unchanged contract)', () => {
+    it('still has a two-parameter signature and seeds an empty passwordPolicy', () => {
+        const row = createDefaultSignInExperience('some-tenant-id', false);
+        expect(row.passwordPolicy).toEqual({});
+    });
+});

package/lib/types/alteration.d.ts

@@ -1,4 +1,9 @@
 import type { CommonQueryMethods, DatabaseTransactionConnection } from '@silverhand/slonik';
+/**
+ * IMPORTANT: Logto Cloud has a parallel `AlterationScript` type in `@logto/cloud-alterations`
+ * (logto-cloud repo: `packages/cloud-alterations/src/types.ts`).
+ * Any changes to this type must be synchronized with the Cloud type definition.
+ */
 export type AlterationScript = {
     /**
      * Optional hook that runs before `up` outside of a transaction.

package/lib/types/application.d.ts

@@ -48,6 +48,7 @@ export declare const featuredApplicationGuard: z.ZodObject<Pick<{
         pageRules: {
             path: string;
         }[];
+        additionalScopes?: (UserScope.CustomData | UserScope.Identities | UserScope.Roles | UserScope.Organizations | UserScope.OrganizationRoles)[] | undefined;
         customDomains?: {
             status: import("../index.js").DomainStatus;
             domain: string;
@@ -76,6 +77,7 @@ export declare const featuredApplicationGuard: z.ZodObject<Pick<{
         pageRules: {
             path: string;
         }[];
+        additionalScopes?: (UserScope.CustomData | UserScope.Identities | UserScope.Roles | UserScope.Organizations | UserScope.OrganizationRoles)[] | undefined;
         customDomains?: {
             status: import("../index.js").DomainStatus;
             domain: string;
@@ -100,6 +102,7 @@ export declare const featuredApplicationGuard: z.ZodObject<Pick<{
     } | null>;
     customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
     isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     createdAt: z.ZodType<number, z.ZodTypeDef, number>;
 }, "type" | "name" | "id">, "strip", z.ZodTypeAny, {
     type: import("../db-entries/custom-types.js").ApplicationType;
@@ -144,6 +147,7 @@ export declare const applicationCreateGuard: z.ZodObject<{
         pageRules: {
             path: string;
         }[];
+        additionalScopes?: (UserScope.CustomData | UserScope.Identities | UserScope.Roles | UserScope.Organizations | UserScope.OrganizationRoles)[] | undefined;
         customDomains?: {
             status: import("../index.js").DomainStatus;
             domain: string;
@@ -172,6 +176,7 @@ export declare const applicationCreateGuard: z.ZodObject<{
         pageRules: {
             path: string;
         }[];
+        additionalScopes?: (UserScope.CustomData | UserScope.Identities | UserScope.Roles | UserScope.Organizations | UserScope.OrganizationRoles)[] | undefined;
         customDomains?: {
             status: import("../index.js").DomainStatus;
             domain: string;
@@ -251,6 +256,7 @@ export declare const applicationPatchGuard: z.ZodObject<Omit<{
         pageRules: {
             path: string;
         }[];
+        additionalScopes?: (UserScope.CustomData | UserScope.Identities | UserScope.Roles | UserScope.Organizations | UserScope.OrganizationRoles)[] | undefined;
         customDomains?: {
             status: import("../index.js").DomainStatus;
             domain: string;
@@ -279,6 +285,7 @@ export declare const applicationPatchGuard: z.ZodObject<Omit<{
         pageRules: {
             path: string;
         }[];
+        additionalScopes?: (UserScope.CustomData | UserScope.Identities | UserScope.Roles | UserScope.Organizations | UserScope.OrganizationRoles)[] | undefined;
         customDomains?: {
             status: import("../index.js").DomainStatus;
             domain: string;
@@ -319,6 +326,98 @@ export declare const applicationPatchGuard: z.ZodObject<Omit<{
     customClientMetadata?: import("../index.js").CustomClientMetadata;
     protectedAppMetadata?: import("../index.js").ProtectedAppMetadata | null;
 }>;
+/** The guard for one organization role access-control rule group. */
+export declare const applicationAccessControlOrganizationRoleRuleGuard: z.ZodObject<{
+    organizationId: z.ZodString;
+    organizationRoleIds: z.ZodPipeline<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    organizationId: string;
+    organizationRoleIds: string[];
+}, {
+    organizationId: string;
+    organizationRoleIds: string[];
+}>;
+/** The guard for application-level access control rule payloads. */
+export declare const applicationAccessControlGuard: z.ZodPipeline<z.ZodEffects<z.ZodObject<{
+    userIds: z.ZodPipeline<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, z.ZodArray<z.ZodString, "many">>;
+    userRoleIds: z.ZodPipeline<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, z.ZodArray<z.ZodString, "many">>;
+    organizationIds: z.ZodPipeline<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, z.ZodArray<z.ZodString, "many">>;
+    organizationRoleRules: z.ZodArray<z.ZodObject<{
+        organizationId: z.ZodString;
+        organizationRoleIds: z.ZodPipeline<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }, {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    userIds: string[];
+    userRoleIds: string[];
+    organizationIds: string[];
+    organizationRoleRules: {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }[];
+}, {
+    userIds: string[];
+    userRoleIds: string[];
+    organizationIds: string[];
+    organizationRoleRules: {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }[];
+}>, {
+    organizationRoleRules: {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }[];
+    userIds: string[];
+    userRoleIds: string[];
+    organizationIds: string[];
+}, {
+    userIds: string[];
+    userRoleIds: string[];
+    organizationIds: string[];
+    organizationRoleRules: {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }[];
+}>, z.ZodObject<{
+    userIds: z.ZodArray<z.ZodString, "many">;
+    userRoleIds: z.ZodArray<z.ZodString, "many">;
+    organizationIds: z.ZodArray<z.ZodString, "many">;
+    organizationRoleRules: z.ZodArray<z.ZodObject<{
+        organizationId: z.ZodString;
+        organizationRoleIds: z.ZodPipeline<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }, {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    userIds: string[];
+    userRoleIds: string[];
+    organizationIds: string[];
+    organizationRoleRules: {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }[];
+}, {
+    userIds: string[];
+    userRoleIds: string[];
+    organizationIds: string[];
+    organizationRoleRules: {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }[];
+}>>;
+export type ApplicationAccessControl = z.infer<typeof applicationAccessControlGuard>;
+/** Create an empty application-level access control rule set. */
+export declare const createDefaultApplicationAccessControl: () => ApplicationAccessControl;
 export declare const applicationUserConsentScopesResponseGuard: z.ZodObject<{
     organizationScopes: z.ZodArray<z.ZodObject<Pick<{
         tenantId: z.ZodType<string, z.ZodTypeDef, string>;
@@ -549,16 +648,16 @@ export declare const applicationSignInExperienceCreateGuard: z.ZodObject<Omit<{
     privacyPolicyUrl: z.ZodUnion<[z.ZodNullable<z.ZodOptional<z.ZodString>>, z.ZodLiteral<"">]>;
 }, "strip", z.ZodTypeAny, {
     displayName?: string | null;
+    customCss?: string | null;
     color?: import("../index.js").PartialColor;
     branding?: import("../index.js").Branding;
-    customCss?: string | null;
     termsOfUseUrl?: string | null | undefined;
     privacyPolicyUrl?: string | null | undefined;
 }, {
     displayName?: string | null;
+    customCss?: string | null;
     color?: import("../index.js").PartialColor;
     branding?: import("../index.js").Branding;
-    customCss?: string | null;
     termsOfUseUrl?: string | null | undefined;
     privacyPolicyUrl?: string | null | undefined;
 }>;

package/lib/types/application.js

@@ -9,6 +9,7 @@ export const featuredApplicationGuard = Applications.guard.pick({
 });
 export const applicationCreateGuard = Applications.createGuard
     .omit({
+    appLevelAccessControlEnabled: true,
     id: true,
     createdAt: true,
     secret: true,
@@ -20,6 +21,60 @@ export const applicationPatchGuard = applicationCreateGuard.partial().omit({
     type: true,
     isThirdParty: true,
 });
+const applicationAccessControlRuleLimit = 1000;
+const applicationAccessControlRawRuleLimit = applicationAccessControlRuleLimit * 2;
+const uniqueStringArrayGuard = z
+    .array(z.string())
+    .max(applicationAccessControlRawRuleLimit)
+    .transform((values) => [...new Set(values)])
+    .pipe(z.array(z.string()).max(applicationAccessControlRuleLimit));
+/** The guard for one organization role access-control rule group. */
+export const applicationAccessControlOrganizationRoleRuleGuard = z.object({
+    organizationId: z.string(),
+    organizationRoleIds: uniqueStringArrayGuard,
+});
+/** The guard for application-level access control rule payloads. */
+export const applicationAccessControlGuard = z
+    .object({
+    userIds: uniqueStringArrayGuard,
+    userRoleIds: uniqueStringArrayGuard,
+    organizationIds: uniqueStringArrayGuard,
+    organizationRoleRules: z
+        .array(applicationAccessControlOrganizationRoleRuleGuard)
+        .max(applicationAccessControlRawRuleLimit),
+})
+    .transform(({ organizationRoleRules, ...rest }) => {
+    const organizationRoleRulesMap = new Map();
+    for (const { organizationId, organizationRoleIds } of organizationRoleRules) {
+        const roleIds = organizationRoleRulesMap.get(organizationId) ?? new Set();
+        for (const roleId of organizationRoleIds) {
+            roleIds.add(roleId);
+        }
+        organizationRoleRulesMap.set(organizationId, roleIds);
+    }
+    return {
+        ...rest,
+        organizationRoleRules: [...organizationRoleRulesMap.entries()].map(([organizationId, organizationRoleIds]) => ({
+            organizationId,
+            organizationRoleIds: [...organizationRoleIds],
+        })),
+    };
+})
+    .pipe(z.object({
+    userIds: z.array(z.string()).max(applicationAccessControlRuleLimit),
+    userRoleIds: z.array(z.string()).max(applicationAccessControlRuleLimit),
+    organizationIds: z.array(z.string()).max(applicationAccessControlRuleLimit),
+    organizationRoleRules: z
+        .array(applicationAccessControlOrganizationRoleRuleGuard)
+        .max(applicationAccessControlRuleLimit),
+}));
+/** Create an empty application-level access control rule set. */
+export const createDefaultApplicationAccessControl = () => ({
+    userIds: [],
+    userRoleIds: [],
+    organizationIds: [],
+    organizationRoleRules: [],
+});
 const resourceScopesGuard = z.array(z.object({
     resource: Resources.guard.pick({ id: true, name: true, indicator: true }),
     scopes: z.array(Scopes.guard.pick({ id: true, name: true, description: true })),

package/lib/types/application.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/types/application.test.js

@@ -0,0 +1,120 @@
+import { describe, expect, it } from 'vitest';
+import { applicationAccessControlGuard, createDefaultApplicationAccessControl, } from './application.js';
+describe('applicationAccessControlGuard', () => {
+    it('deduplicates direct user and role rules', () => {
+        expect(applicationAccessControlGuard.parse({
+            userIds: ['user-1', 'user-2', 'user-1'],
+            userRoleIds: ['role-1', 'role-1', 'role-2'],
+            organizationIds: ['organization-1', 'organization-1', 'organization-2'],
+            organizationRoleRules: [],
+        })).toMatchObject({
+            userIds: ['user-1', 'user-2'],
+            userRoleIds: ['role-1', 'role-2'],
+            organizationIds: ['organization-1', 'organization-2'],
+            organizationRoleRules: [],
+        });
+    });
+    it('merges organization role rules by organization', () => {
+        expect(applicationAccessControlGuard.parse({
+            userIds: [],
+            userRoleIds: [],
+            organizationIds: [],
+            organizationRoleRules: [
+                {
+                    organizationId: 'organization-1',
+                    organizationRoleIds: ['organization-role-1', 'organization-role-2'],
+                },
+                {
+                    organizationId: 'organization-1',
+                    organizationRoleIds: ['organization-role-1', 'organization-role-3'],
+                },
+                {
+                    organizationId: 'organization-2',
+                    organizationRoleIds: ['organization-role-1'],
+                },
+            ],
+        })).toMatchObject({
+            userIds: [],
+            userRoleIds: [],
+            organizationIds: [],
+            organizationRoleRules: [
+                {
+                    organizationId: 'organization-1',
+                    organizationRoleIds: [
+                        'organization-role-1',
+                        'organization-role-2',
+                        'organization-role-3',
+                    ],
+                },
+                {
+                    organizationId: 'organization-2',
+                    organizationRoleIds: ['organization-role-1'],
+                },
+            ],
+        });
+    });
+    it('creates a fresh default rule set', () => {
+        const first = createDefaultApplicationAccessControl();
+        const second = createDefaultApplicationAccessControl();
+        expect(first).not.toBe(second);
+        expect(first.userIds).not.toBe(second.userIds);
+        expect(first.userRoleIds).not.toBe(second.userRoleIds);
+        expect(first.organizationIds).not.toBe(second.organizationIds);
+        expect(first.organizationRoleRules).not.toBe(second.organizationRoleRules);
+    });
+    it('rejects oversized rule lists', () => {
+        const oversizedIds = Array.from({ length: 1001 }, (_, index) => `id-${index}`);
+        const emptyAccessControl = createDefaultApplicationAccessControl();
+        expect(() => applicationAccessControlGuard.parse({ ...emptyAccessControl, userIds: oversizedIds })).toThrow();
+        expect(() => applicationAccessControlGuard.parse({
+            ...emptyAccessControl,
+            organizationRoleRules: oversizedIds.map((organizationId) => ({
+                organizationId,
+                organizationRoleIds: [],
+            })),
+        })).toThrow();
+        expect(() => applicationAccessControlGuard.parse({
+            ...emptyAccessControl,
+            organizationRoleRules: [
+                { organizationId: 'organization-1', organizationRoleIds: oversizedIds },
+            ],
+        })).toThrow();
+    });
+    it('enforces rule list limits after normalization', () => {
+        const emptyAccessControl = createDefaultApplicationAccessControl();
+        const duplicateHeavyIds = Array.from({ length: 1001 }, () => 'user-1');
+        const mergedOrganizationRoleRules = [
+            {
+                organizationId: 'organization-1',
+                organizationRoleIds: Array.from({ length: 1000 }, (_, index) => `role-${index}`),
+            },
+            {
+                organizationId: 'organization-1',
+                organizationRoleIds: ['role-1000'],
+            },
+        ];
+        expect(applicationAccessControlGuard.parse({ ...emptyAccessControl, userIds: duplicateHeavyIds })).toMatchObject({ userIds: ['user-1'] });
+        expect(() => applicationAccessControlGuard.parse({
+            ...emptyAccessControl,
+            organizationRoleRules: mergedOrganizationRoleRules,
+        })).toThrow();
+    });
+    it('rejects overly large raw rule inputs before normalization', () => {
+        const emptyAccessControl = createDefaultApplicationAccessControl();
+        const oversizedDuplicateIds = Array.from({ length: 2001 }, () => 'id-1');
+        expect(() => applicationAccessControlGuard.parse({ ...emptyAccessControl, userIds: oversizedDuplicateIds })).toThrow();
+        expect(() => applicationAccessControlGuard.parse({
+            ...emptyAccessControl,
+            organizationRoleRules: oversizedDuplicateIds.map(() => ({
+                organizationId: 'organization-1',
+                organizationRoleIds: [],
+            })),
+        })).toThrow();
+        expect(() => applicationAccessControlGuard.parse({
+            ...emptyAccessControl,
+            organizationRoleRules: [
+                { organizationId: 'organization-1', organizationRoleIds: oversizedDuplicateIds },
+            ],
+        })).toThrow();
+    });
+});

package/lib/types/consent.d.ts

@@ -179,6 +179,7 @@ export declare const publicApplicationGuard: z.ZodObject<Pick<{
         pageRules: {
             path: string;
         }[];
+        additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
         customDomains?: {
             status: import("../index.js").DomainStatus;
             domain: string;
@@ -207,6 +208,7 @@ export declare const publicApplicationGuard: z.ZodObject<Pick<{
         pageRules: {
             path: string;
         }[];
+        additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
         customDomains?: {
             status: import("../index.js").DomainStatus;
             domain: string;
@@ -231,6 +233,7 @@ export declare const publicApplicationGuard: z.ZodObject<Pick<{
     } | null>;
     customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
     isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     createdAt: z.ZodType<number, z.ZodTypeDef, number>;
 }, "name" | "id">, "strip", z.ZodTypeAny, {
     name: string;
@@ -502,6 +505,7 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
             pageRules: {
                 path: string;
             }[];
+            additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
             customDomains?: {
                 status: import("../index.js").DomainStatus;
                 domain: string;
@@ -530,6 +534,7 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
             pageRules: {
                 path: string;
             }[];
+            additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
             customDomains?: {
                 status: import("../index.js").DomainStatus;
                 domain: string;
@@ -554,6 +559,7 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
         } | null>;
         customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
         isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+        appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
         createdAt: z.ZodType<number, z.ZodTypeDef, number>;
     }, "name" | "id"> & {
         displayName: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;

package/lib/types/custom-profile-fields.d.ts

@@ -2383,11 +2383,10 @@ export declare const updateCustomProfileFieldSieOrderGuard: z.ZodObject<{
     sieOrder: number;
 }>;
 export type UpdateCustomProfileFieldSieOrder = z.infer<typeof updateCustomProfileFieldSieOrderGuard>;
-/**
- * Reserved custom data keys, which are used by the system and should not be used by custom profile fields.
- */
+/** Reserved custom data keys, which are used by the system and should not be used by custom profile fields. */
 export declare const reservedCustomDataKeyGuard: z.ZodObject<{
     onboarding: z.ZodOptional<z.ZodString>;
+    ossOnboarding: z.ZodOptional<z.ZodString>;
     guideRequests: z.ZodOptional<z.ZodString>;
     adminConsolePreferences: z.ZodOptional<z.ZodString>;
     defaultTenantId: z.ZodOptional<z.ZodString>;
@@ -2396,17 +2395,16 @@ export declare const reservedCustomDataKeyGuard: z.ZodObject<{
     guideRequests?: string | undefined;
     defaultTenantId?: string | undefined;
     onboarding?: string | undefined;
+    ossOnboarding?: string | undefined;
 }, {
     adminConsolePreferences?: string | undefined;
     guideRequests?: string | undefined;
     defaultTenantId?: string | undefined;
     onboarding?: string | undefined;
+    ossOnboarding?: string | undefined;
 }>;
-export declare const reservedCustomDataKeys: readonly ["adminConsolePreferences", "guideRequests", "defaultTenantId", "onboarding"];
-/**
- * Disallow sign-in identifiers related field keys in custom profile fields, as this is conflicting
- * with the built-in sign-in/sign-up experience flows.
- */
+export declare const reservedCustomDataKeys: readonly ["adminConsolePreferences", "guideRequests", "defaultTenantId", "onboarding", "ossOnboarding"];
+/** Disallow sign-in identifier related field keys in custom profile fields to avoid conflicts with built-in sign-in/sign-up flows. */
 export declare const signInIdentifierKeyGuard: z.ZodObject<Pick<{
     tenantId: z.ZodOptional<z.ZodType<string, z.ZodTypeDef, string>>;
     id: z.ZodType<string, z.ZodTypeDef, string>;
@@ -2544,11 +2542,7 @@ export declare const signInIdentifierKeyGuard: z.ZodObject<Pick<{
     primaryPhone?: string | null;
 }>;
 export declare const reservedSignInIdentifierKeys: readonly ["username", "email", "phone", "primaryEmail", "primaryPhone"];
-/**
- * Reserved user profile keys.
- * Currently only `preferredUsername` is reserved since it is the standard username property used
- * by most identity providers. Should not allow user updating this field via profile related APIs.
- */
+/** Reserved user profile keys. Currently only `preferredUsername` is reserved for standard IdP usage. */
 export declare const reservedBuiltInProfileKeyGuard: z.ZodObject<Pick<{
     familyName: z.ZodOptional<z.ZodString>;
     givenName: z.ZodOptional<z.ZodString>;

package/lib/types/custom-profile-fields.js

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { Users } from '../db-entries/user.js';
 import { CustomProfileFieldType, customProfileFieldTypeGuard, fieldPartGuard, userProfileAddressKeys, userProfileGuard, } from '../foundations/index.js';
-import { userOnboardingDataKey } from './onboarding.js';
+import { ossUserOnboardingDataKey, userOnboardingDataKey } from './onboarding.js';
 import { defaultTenantIdKey } from './tenant.js';
 import { consoleUserPreferenceKey, guideRequestsKey } from './user.js';
 const baseProfileFieldGuard = z.object({
@@ -129,22 +129,18 @@ export const updateCustomProfileFieldSieOrderGuard = z.object({
     name: z.string(),
     sieOrder: z.number(),
 });
-/**
- * Reserved custom data keys, which are used by the system and should not be used by custom profile fields.
- */
+/** Reserved custom data keys, which are used by the system and should not be used by custom profile fields. */
 export const reservedCustomDataKeyGuard = z
     .object({
     [userOnboardingDataKey]: z.string(),
+    [ossUserOnboardingDataKey]: z.string(),
     [guideRequestsKey]: z.string(),
     [consoleUserPreferenceKey]: z.string(),
     [defaultTenantIdKey]: z.string(),
 })
     .partial();
 export const reservedCustomDataKeys = Object.freeze(reservedCustomDataKeyGuard.keyof().options);
-/**
- * Disallow sign-in identifiers related field keys in custom profile fields, as this is conflicting
- * with the built-in sign-in/sign-up experience flows.
- */
+/** Disallow sign-in identifier related field keys in custom profile fields to avoid conflicts with built-in sign-in/sign-up flows. */
 export const signInIdentifierKeyGuard = Users.createGuard
     .pick({
     username: true,
@@ -156,11 +152,7 @@ export const signInIdentifierKeyGuard = Users.createGuard
     phone: z.string().nullable().optional(),
 });
 export const reservedSignInIdentifierKeys = Object.freeze(signInIdentifierKeyGuard.keyof().options);
-/**
- * Reserved user profile keys.
- * Currently only `preferredUsername` is reserved since it is the standard username property used
- * by most identity providers. Should not allow user updating this field via profile related APIs.
- */
+/** Reserved user profile keys. Currently only `preferredUsername` is reserved for standard IdP usage. */
 export const reservedBuiltInProfileKeyGuard = userProfileGuard.pick({ preferredUsername: true });
 export const reservedBuiltInProfileKeys = Object.freeze(reservedBuiltInProfileKeyGuard.keyof().options);
 export var SupportedDateFormat;
@@ -176,3 +168,4 @@ export var Gender;
     Gender["Male"] = "male";
     Gender["Other"] = "prefer_not_to_say";
 })(Gender || (Gender = {}));
+/* eslint-enable max-lines */