@logto/schemas 1.41.0 → 1.43.0

package/alterations-js/1.43.0-1785481546-add-tenant-aware-scope-indexes.js

@@ -0,0 +1,28 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    beforeUp: async (pool) => {
+        await pool.query(sql `
+      create unique index concurrently scopes__tenant_id_id
+        on scopes (tenant_id, id);
+    `);
+        await pool.query(sql `
+      create unique index concurrently organization_scopes__tenant_id_id
+        on organization_scopes (tenant_id, id);
+    `);
+    },
+    up: async () => {
+        // The indexes must be created outside of a transaction.
+    },
+    beforeDown: async (pool) => {
+        await pool.query(sql `
+      drop index concurrently if exists organization_scopes__tenant_id_id;
+    `);
+        await pool.query(sql `
+      drop index concurrently if exists scopes__tenant_id_id;
+    `);
+    },
+    down: async () => {
+        // The indexes must be dropped outside of a transaction.
+    },
+};
+export default alteration;

package/alterations-js/1.43.0-1785488115-add-cimd-permission-ceiling-tables.js

@@ -0,0 +1,69 @@
+import { sql } from '@silverhand/slonik';
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+/**
+ * Add the tenant-level permission ceiling tables for client ID metadata document (CIMD) clients.
+ * The ceiling is tenant-wide because CIMD clients are unregistered and have no per-client record
+ * to attach configuration to. The tables reference the tenant and scope tables directly (not the
+ * CIMD config row), so disabling CIMD does not wipe the permission settings.
+ * Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not
+ * expressible.
+ */
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      create table cimd_user_scopes (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        user_scope varchar(64) not null,
+        primary key (tenant_id, user_scope)
+      );
+    `);
+        await applyTableRls(pool, 'cimd_user_scopes');
+        await pool.query(sql `
+      create table cimd_resource_scopes (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        scope_id varchar(21) not null,
+        primary key (tenant_id, scope_id),
+        foreign key (tenant_id, scope_id)
+          references scopes (tenant_id, id) on update cascade on delete cascade
+      );
+    `);
+        await applyTableRls(pool, 'cimd_resource_scopes');
+        await pool.query(sql `
+      create table cimd_organization_scopes (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        organization_scope_id varchar(21) not null,
+        primary key (tenant_id, organization_scope_id),
+        foreign key (tenant_id, organization_scope_id)
+          references organization_scopes (tenant_id, id) on update cascade on delete cascade
+      );
+    `);
+        await applyTableRls(pool, 'cimd_organization_scopes');
+        await pool.query(sql `
+      create table cimd_organization_resource_scopes (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        scope_id varchar(21) not null,
+        primary key (tenant_id, scope_id),
+        foreign key (tenant_id, scope_id)
+          references scopes (tenant_id, id) on update cascade on delete cascade
+      );
+    `);
+        await applyTableRls(pool, 'cimd_organization_resource_scopes');
+    },
+    down: async (pool) => {
+        await dropTableRls(pool, 'cimd_organization_resource_scopes');
+        await dropTableRls(pool, 'cimd_organization_scopes');
+        await dropTableRls(pool, 'cimd_resource_scopes');
+        await dropTableRls(pool, 'cimd_user_scopes');
+        await pool.query(sql `
+      drop table cimd_organization_resource_scopes;
+      drop table cimd_organization_scopes;
+      drop table cimd_resource_scopes;
+      drop table cimd_user_scopes;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.43.0-1785722831-add-oidc-session-extensions-account-id-index.js

@@ -0,0 +1,23 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    beforeUp: async (pool) => {
+        // Add index to optimize deleting session extensions by accountId, including the
+        // cascades from the users table. See the index comment in tables/oidc_session_extensions.sql.
+        await pool.query(sql `
+      create index concurrently oidc_session_extensions__account_id
+        on oidc_session_extensions (account_id);
+    `);
+    },
+    up: async () => {
+        /** 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty. */
+    },
+    beforeDown: async (pool) => {
+        await pool.query(sql `
+      drop index concurrently oidc_session_extensions__account_id;
+    `);
+    },
+    down: async () => {
+        /** 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty. */
+    },
+};
+export default alteration;

package/alterations-js/1.43.0-1785835991-add-cimd-client-identifier-columns.js

@@ -0,0 +1,27 @@
+import { sql } from '@silverhand/slonik';
+/**
+ * Registered application IDs (21 chars, referencing `applications`) and CIMD (client ID metadata
+ * document) client identifier URLs are different value spaces, so each gets its own column instead
+ * of sharing one.
+ */
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      alter table users
+        add column cimd_client_id varchar(2048);
+
+      alter table oidc_session_extensions
+        add column cimd_client_id varchar(2048);
+    `);
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      alter table users
+        drop column cimd_client_id;
+
+      alter table oidc_session_extensions
+        drop column cimd_client_id;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.43.0-1786325989-add-cimd-grant-organizations-table.js

@@ -0,0 +1,49 @@
+import { sql } from '@silverhand/slonik';
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+/**
+ * Add the grant-scoped organization authorization table for client ID metadata document (CIMD)
+ * clients. CIMD clients are unregistered URL identities with no deletion lifecycle and
+ * transferable ownership, so organization access follows the single authorization instead of a
+ * long-lived cross-grant relation: rows cascade away with the Grant row (revocation hard-deletes
+ * it) and with the user's organization membership.
+ */
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      create table cimd_grant_organizations (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        grant_id varchar(128) not null,
+        grant_model_name varchar(64) not null default 'Grant',
+        organization_id varchar(21) not null,
+        user_id varchar(21) not null,
+        primary key (tenant_id, grant_id, organization_id),
+        constraint cimd_grant_organizations__grant_model_name
+          check (grant_model_name = 'Grant'),
+        foreign key (tenant_id, grant_model_name, grant_id)
+          references oidc_model_instances (tenant_id, model_name, id)
+          on update cascade on delete cascade,
+        foreign key (tenant_id, organization_id, user_id)
+          references organization_user_relations (tenant_id, organization_id, user_id)
+          on update cascade on delete cascade
+      );
+    `);
+        /**
+         * Backs the membership FK's cascade lookup; the PK leaves `organization_id` outside its
+         * usable prefix. The table is created empty in this transaction, so a plain (non-concurrent)
+         * index build is free.
+         */
+        await pool.query(sql `
+      create index cimd_grant_organizations__organization_id_user_id
+        on cimd_grant_organizations (tenant_id, organization_id, user_id);
+    `);
+        await applyTableRls(pool, 'cimd_grant_organizations');
+    },
+    down: async (pool) => {
+        await dropTableRls(pool, 'cimd_grant_organizations');
+        await pool.query(sql `
+      drop table cimd_grant_organizations;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.43.0-1786333495-add-trusted-devices.js

@@ -0,0 +1,50 @@
+import { sql } from '@silverhand/slonik';
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      create table trusted_devices (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        id varchar(21) not null,
+        user_id varchar(12) not null
+          references users (id) on update cascade on delete cascade,
+        secret_hash bytea not null,
+        user_agent text,
+        ip text,
+        country varchar(16),
+        city text,
+        created_at timestamptz not null default(now()),
+        last_used_at timestamptz not null default(now()),
+        expires_at timestamptz not null,
+        primary key (id)
+      );
+
+      create index trusted_devices__tenant_user_expires_at
+        on trusted_devices (tenant_id, user_id, expires_at);
+
+      create index trusted_devices__tenant_expires_at
+        on trusted_devices (tenant_id, expires_at);
+
+      alter table sign_in_experiences
+        add column trusted_device jsonb not null default '{}'::jsonb;
+
+      alter table organizations
+        add column is_trusted_device_allowed boolean not null default true;
+    `);
+        await applyTableRls(pool, 'trusted_devices');
+    },
+    down: async (pool) => {
+        await dropTableRls(pool, 'trusted_devices');
+        await pool.query(sql `
+      drop table trusted_devices;
+
+      alter table sign_in_experiences
+        drop column trusted_device;
+
+      alter table organizations
+        drop column is_trusted_device_allowed;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.43.0-1786373004-tighten-cimd-grant-organizations-pkey.js

@@ -0,0 +1,24 @@
+import { sql } from '@silverhand/slonik';
+/**
+ * Tighten the `cimd_grant_organizations` primary key to `(tenant_id, grant_id)` so the schema
+ * itself enforces the at-most-one-organization-per-grant invariant that token issuance relies on,
+ * instead of leaving it to the consent flow's composition. The table is dev-feature-gated and
+ * empty in every environment, so swapping the constraint needs no data migration.
+ */
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      alter table cimd_grant_organizations
+        drop constraint cimd_grant_organizations_pkey,
+        add primary key (tenant_id, grant_id);
+    `);
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      alter table cimd_grant_organizations
+        drop constraint cimd_grant_organizations_pkey,
+        add primary key (tenant_id, grant_id, organization_id);
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.43.0-1786414712-add-service-logs-email-indexes.js

@@ -0,0 +1,30 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    beforeUp: async (pool) => {
+        await pool.query(sql `
+      create index concurrently service_logs__email__tenant_id__created_at__id
+        on service_logs (tenant_id, created_at desc, id desc)
+        where type in ('sendEmail', 'sendEmailFailed');
+    `);
+        await pool.query(sql `
+      create index concurrently service_logs__email__tenant_id__recipient__created_at__id
+        on service_logs (tenant_id, lower(payload->'data'->>'to'), created_at desc, id desc)
+        where type in ('sendEmail', 'sendEmailFailed');
+    `);
+    },
+    up: async () => {
+        /** 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty. */
+    },
+    beforeDown: async (pool) => {
+        await pool.query(sql `
+      drop index concurrently service_logs__email__tenant_id__recipient__created_at__id;
+    `);
+        await pool.query(sql `
+      drop index concurrently service_logs__email__tenant_id__created_at__id;
+    `);
+    },
+    down: async () => {
+        /** 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty. */
+    },
+};
+export default alteration;

package/alterations-js/1.43.0-1786431364-add-cimd-grant-client-snapshots-table.js

@@ -0,0 +1,38 @@
+import { sql } from '@silverhand/slonik';
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+/**
+ * Add the per-grant client display snapshot table for client ID metadata document (CIMD) clients.
+ * CIMD clients are unregistered URL identities without an `applications` row, and an unvetted
+ * client can rewrite its hosted document at any time — so the grant list renders the snapshot
+ * captured at consent instead of refetching the document. Rows cascade away with the Grant row.
+ */
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      create table cimd_grant_client_snapshots (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        grant_id varchar(128) not null,
+        grant_model_name varchar(64) not null default 'Grant',
+        client_id varchar(2048) not null,
+        name varchar(256),
+        logo_uri varchar(2048),
+        created_at timestamptz not null default(now()),
+        primary key (tenant_id, grant_id),
+        constraint cimd_grant_client_snapshots__grant_model_name
+          check (grant_model_name = 'Grant'),
+        foreign key (tenant_id, grant_model_name, grant_id)
+          references oidc_model_instances (tenant_id, model_name, id)
+          on update cascade on delete cascade
+      );
+    `);
+        await applyTableRls(pool, 'cimd_grant_client_snapshots');
+    },
+    down: async (pool) => {
+        await dropTableRls(pool, 'cimd_grant_client_snapshots');
+        await pool.query(sql `
+      drop table cimd_grant_client_snapshots;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/utils/1704934999-tables.js

@@ -1,10 +1,28 @@
 import { sql } from '@silverhand/slonik';
 const getId = (value) => sql.identifier([value]);
+/**
+ * Returns the suffix used in the base Logto role name for the current database
+ * (`logto_tenant_<suffix>`).
+ *
+ * Historically the suffix was the raw database name (which may contain hyphens). A later
+ * convention normalised it by replacing hyphens with underscores. To remain compatible with
+ * both conventions we probe `pg_roles` for the normalised name first and fall back to the
+ * raw database name for legacy installations.
+ */
 const getDatabaseName = async (pool) => {
     const { currentDatabase } = await pool.one(sql `
     select current_database();
   `);
-    return currentDatabase.replaceAll('-', '_');
+    const normalized = currentDatabase.replaceAll('-', '_');
+    if (normalized === currentDatabase) {
+        return currentDatabase;
+    }
+    const { exists } = await pool.one(sql `
+    select exists(
+      select 1 from pg_roles where rolname = ${'logto_tenant_' + normalized}
+    ) as exists;
+  `);
+    return exists ? normalized : currentDatabase;
 };
 /**
  * A function to call after the table is created. It will apply the necessary row-level security

package/lib/consts/experience.d.ts

@@ -10,6 +10,7 @@ export declare const experience: Readonly<{
         readonly identifierRegister: "identifier-register";
         readonly switchAccount: "switch-account";
         readonly oneTimeToken: "one-time-token";
+        readonly accountSuspended: "account-suspended";
     }>;
 }>;
 /** `postMessage` sender tag from admin Console sign-in experience live preview. */

package/lib/consts/experience.js

@@ -9,6 +9,7 @@ const routes = Object.freeze({
     identifierRegister: 'identifier-register',
     switchAccount: 'switch-account',
     oneTimeToken: 'one-time-token',
+    accountSuspended: 'account-suspended',
 });
 export const experience = Object.freeze({
     routes,

package/lib/consts/index.d.ts

@@ -10,3 +10,4 @@ export * from './message-rate-limit.js';
 export * from './verification-code.js';
 export * from './product-event.js';
 export * from './application.js';
+export * from './social-state.js';

package/lib/consts/index.js

@@ -10,3 +10,4 @@ export * from './message-rate-limit.js';
 export * from './verification-code.js';
 export * from './product-event.js';
 export * from './application.js';
+export * from './social-state.js';

package/lib/consts/product-event.d.ts

@@ -67,7 +67,11 @@ export declare enum ProductEvent {
     MfaEnabled = "mfa enabled",
     MfaDisabled = "mfa disabled",
     CustomDomainCreated = "custom domain created",
-    CustomDomainDeleted = "custom domain deleted"
+    CustomDomainDeleted = "custom domain deleted",
+    /** The tenant has turned on dynamic app (CIMD) client access. */
+    DynamicAppEnabled = "dynamic app enabled",
+    /** The tenant has turned off dynamic app (CIMD) client access. */
+    DynamicAppDisabled = "dynamic app disabled"
 }
 /** The PostHog groups for product events. */
 export declare enum EventGroup {

package/lib/consts/product-event.js

@@ -69,6 +69,10 @@ export var ProductEvent;
     ProductEvent["MfaDisabled"] = "mfa disabled";
     ProductEvent["CustomDomainCreated"] = "custom domain created";
     ProductEvent["CustomDomainDeleted"] = "custom domain deleted";
+    /** The tenant has turned on dynamic app (CIMD) client access. */
+    ProductEvent["DynamicAppEnabled"] = "dynamic app enabled";
+    /** The tenant has turned off dynamic app (CIMD) client access. */
+    ProductEvent["DynamicAppDisabled"] = "dynamic app disabled";
 })(ProductEvent || (ProductEvent = {}));
 /** The PostHog groups for product events. */
 export var EventGroup;

package/lib/consts/social-state.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Prefixes of the OAuth `state` parameter used by the first-party clients that share the
+ * `/callback/:connectorId` social callback URI.
+ *
+ * Logto Core routes an incoming callback by looking at the `state` prefix, so the prefixes must
+ * never be a prefix of each other. Keep them defined together to preserve that invariant.
+ *
+ * A `state` carrying no known prefix falls back to the Sign-in Experience, which keeps in-flight
+ * requests and custom sign-in UIs that build their own `state` working.
+ */
+export declare const accountCenterSocialStatePrefix = "ac_";
+export declare const experienceSocialStatePrefix = "se_";

package/lib/consts/social-state.js

@@ -0,0 +1,12 @@
+/**
+ * Prefixes of the OAuth `state` parameter used by the first-party clients that share the
+ * `/callback/:connectorId` social callback URI.
+ *
+ * Logto Core routes an incoming callback by looking at the `state` prefix, so the prefixes must
+ * never be a prefix of each other. Keep them defined together to preserve that invariant.
+ *
+ * A `state` carrying no known prefix falls back to the Sign-in Experience, which keeps in-flight
+ * requests and custom sign-in UIs that build their own `state` working.
+ */
+export const accountCenterSocialStatePrefix = 'ac_';
+export const experienceSocialStatePrefix = 'se_';

package/lib/db-entries/cimd-grant-client-snapshot.d.ts

@@ -0,0 +1,32 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The client identity a user approved at consent time for a client ID metadata document (CIMD) client, captured per Grant. CIMD clients are unregistered URL identities without an `applications` row, and an unvetted client can rewrite its hosted document at any time — so the grant list renders this snapshot instead of refetching the document.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link CimdGrantClientSnapshot} for the original type.
+ */
+export type CreateCimdGrantClientSnapshot = {
+    tenantId?: string;
+    /** The ID of the Grant row in `oidc_model_instances`. */
+    grantId: string;
+    /** Fixed discriminator so the composite foreign key can target Grant rows in the polymorphic `oidc_model_instances` table. */
+    grantModelName?: string;
+    clientId: string;
+    name?: string | null;
+    logoUri?: string | null;
+    createdAt?: number;
+};
+/** The client identity a user approved at consent time for a client ID metadata document (CIMD) client, captured per Grant. CIMD clients are unregistered URL identities without an `applications` row, and an unvetted client can rewrite its hosted document at any time — so the grant list renders this snapshot instead of refetching the document. */
+export type CimdGrantClientSnapshot = {
+    tenantId: string;
+    /** The ID of the Grant row in `oidc_model_instances`. */
+    grantId: string;
+    /** Fixed discriminator so the composite foreign key can target Grant rows in the polymorphic `oidc_model_instances` table. */
+    grantModelName: string;
+    clientId: string;
+    name: string | null;
+    logoUri: string | null;
+    createdAt: number;
+};
+export type CimdGrantClientSnapshotKeys = 'tenantId' | 'grantId' | 'grantModelName' | 'clientId' | 'name' | 'logoUri' | 'createdAt';
+export declare const CimdGrantClientSnapshots: GeneratedSchema<CimdGrantClientSnapshotKeys, CreateCimdGrantClientSnapshot, CimdGrantClientSnapshot, 'cimd_grant_client_snapshots', 'cimd_grant_client_snapshot'>;

package/lib/db-entries/cimd-grant-client-snapshot.js

@@ -0,0 +1,45 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    grantId: z.string().min(1).max(128),
+    grantModelName: z.string().min(1).max(64).optional(),
+    clientId: z.string().min(1).max(2048),
+    name: z.string().max(256).nullable().optional(),
+    logoUri: z.string().max(2048).nullable().optional(),
+    createdAt: z.number().optional(),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    grantId: z.string().min(1).max(128),
+    grantModelName: z.string().max(64),
+    clientId: z.string().min(1).max(2048),
+    name: z.string().max(256).nullable(),
+    logoUri: z.string().max(2048).nullable(),
+    createdAt: z.number(),
+});
+export const CimdGrantClientSnapshots = Object.freeze({
+    table: 'cimd_grant_client_snapshots',
+    tableSingular: 'cimd_grant_client_snapshot',
+    fields: {
+        tenantId: 'tenant_id',
+        grantId: 'grant_id',
+        grantModelName: 'grant_model_name',
+        clientId: 'client_id',
+        name: 'name',
+        logoUri: 'logo_uri',
+        createdAt: 'created_at',
+    },
+    fieldKeys: [
+        'tenantId',
+        'grantId',
+        'grantModelName',
+        'clientId',
+        'name',
+        'logoUri',
+        'createdAt',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/cimd-grant-organization.d.ts

@@ -0,0 +1,30 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The organization authorized on a single OIDC Grant for a client ID metadata document (CIMD) client. CIMD clients are unregistered URL identities with no deletion lifecycle and transferable ownership, so organization access follows the single authorization instead of a long-lived cross-grant relation: rows cascade away with the Grant row and with the user's organization membership.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link CimdGrantOrganization} for the original type.
+ */
+export type CreateCimdGrantOrganization = {
+    tenantId?: string;
+    /** The ID of the Grant row in `oidc_model_instances`. */
+    grantId: string;
+    /** Fixed discriminator so the composite foreign key can target Grant rows in the polymorphic `oidc_model_instances` table. */
+    grantModelName?: string;
+    organizationId: string;
+    /** The user the grant was issued to and the membership FK's target. Must match the Grant payload's `accountId` (unreachable by FK) — the consent write enforces the pairing. */
+    userId: string;
+};
+/** The organization authorized on a single OIDC Grant for a client ID metadata document (CIMD) client. CIMD clients are unregistered URL identities with no deletion lifecycle and transferable ownership, so organization access follows the single authorization instead of a long-lived cross-grant relation: rows cascade away with the Grant row and with the user's organization membership. */
+export type CimdGrantOrganization = {
+    tenantId: string;
+    /** The ID of the Grant row in `oidc_model_instances`. */
+    grantId: string;
+    /** Fixed discriminator so the composite foreign key can target Grant rows in the polymorphic `oidc_model_instances` table. */
+    grantModelName: string;
+    organizationId: string;
+    /** The user the grant was issued to and the membership FK's target. Must match the Grant payload's `accountId` (unreachable by FK) — the consent write enforces the pairing. */
+    userId: string;
+};
+export type CimdGrantOrganizationKeys = 'tenantId' | 'grantId' | 'grantModelName' | 'organizationId' | 'userId';
+export declare const CimdGrantOrganizations: GeneratedSchema<CimdGrantOrganizationKeys, CreateCimdGrantOrganization, CimdGrantOrganization, 'cimd_grant_organizations', 'cimd_grant_organization'>;

package/lib/db-entries/cimd-grant-organization.js

@@ -0,0 +1,37 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    grantId: z.string().min(1).max(128),
+    grantModelName: z.string().min(1).max(64).optional(),
+    organizationId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(21),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    grantId: z.string().min(1).max(128),
+    grantModelName: z.string().max(64),
+    organizationId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(21),
+});
+export const CimdGrantOrganizations = Object.freeze({
+    table: 'cimd_grant_organizations',
+    tableSingular: 'cimd_grant_organization',
+    fields: {
+        tenantId: 'tenant_id',
+        grantId: 'grant_id',
+        grantModelName: 'grant_model_name',
+        organizationId: 'organization_id',
+        userId: 'user_id',
+    },
+    fieldKeys: [
+        'tenantId',
+        'grantId',
+        'grantModelName',
+        'organizationId',
+        'userId',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/cimd-organization-resource-scope.d.ts

@@ -0,0 +1,20 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The organization API resource scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request. The scopes are granted to users through organization roles. Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link CimdOrganizationResourceScope} for the original type.
+ */
+export type CreateCimdOrganizationResourceScope = {
+    tenantId?: string;
+    /** The globally unique identifier of the API resource scope. */
+    scopeId: string;
+};
+/** The organization API resource scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request. The scopes are granted to users through organization roles. Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible. */
+export type CimdOrganizationResourceScope = {
+    tenantId: string;
+    /** The globally unique identifier of the API resource scope. */
+    scopeId: string;
+};
+export type CimdOrganizationResourceScopeKeys = 'tenantId' | 'scopeId';
+export declare const CimdOrganizationResourceScopes: GeneratedSchema<CimdOrganizationResourceScopeKeys, CreateCimdOrganizationResourceScope, CimdOrganizationResourceScope, 'cimd_organization_resource_scopes', 'cimd_organization_resource_scope'>;

package/lib/db-entries/cimd-organization-resource-scope.js

@@ -0,0 +1,25 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    scopeId: z.string().min(1).max(21),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    scopeId: z.string().min(1).max(21),
+});
+export const CimdOrganizationResourceScopes = Object.freeze({
+    table: 'cimd_organization_resource_scopes',
+    tableSingular: 'cimd_organization_resource_scope',
+    fields: {
+        tenantId: 'tenant_id',
+        scopeId: 'scope_id',
+    },
+    fieldKeys: [
+        'tenantId',
+        'scopeId',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});