@logto/schemas 1.42.0 → 1.43.0

package/alterations-js/1.43.0-1786333495-add-trusted-devices.js

@@ -0,0 +1,50 @@
+import { sql } from '@silverhand/slonik';
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      create table trusted_devices (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        id varchar(21) not null,
+        user_id varchar(12) not null
+          references users (id) on update cascade on delete cascade,
+        secret_hash bytea not null,
+        user_agent text,
+        ip text,
+        country varchar(16),
+        city text,
+        created_at timestamptz not null default(now()),
+        last_used_at timestamptz not null default(now()),
+        expires_at timestamptz not null,
+        primary key (id)
+      );
+
+      create index trusted_devices__tenant_user_expires_at
+        on trusted_devices (tenant_id, user_id, expires_at);
+
+      create index trusted_devices__tenant_expires_at
+        on trusted_devices (tenant_id, expires_at);
+
+      alter table sign_in_experiences
+        add column trusted_device jsonb not null default '{}'::jsonb;
+
+      alter table organizations
+        add column is_trusted_device_allowed boolean not null default true;
+    `);
+        await applyTableRls(pool, 'trusted_devices');
+    },
+    down: async (pool) => {
+        await dropTableRls(pool, 'trusted_devices');
+        await pool.query(sql `
+      drop table trusted_devices;
+
+      alter table sign_in_experiences
+        drop column trusted_device;
+
+      alter table organizations
+        drop column is_trusted_device_allowed;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.43.0-1786373004-tighten-cimd-grant-organizations-pkey.js

@@ -0,0 +1,24 @@
+import { sql } from '@silverhand/slonik';
+/**
+ * Tighten the `cimd_grant_organizations` primary key to `(tenant_id, grant_id)` so the schema
+ * itself enforces the at-most-one-organization-per-grant invariant that token issuance relies on,
+ * instead of leaving it to the consent flow's composition. The table is dev-feature-gated and
+ * empty in every environment, so swapping the constraint needs no data migration.
+ */
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      alter table cimd_grant_organizations
+        drop constraint cimd_grant_organizations_pkey,
+        add primary key (tenant_id, grant_id);
+    `);
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      alter table cimd_grant_organizations
+        drop constraint cimd_grant_organizations_pkey,
+        add primary key (tenant_id, grant_id, organization_id);
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.43.0-1786414712-add-service-logs-email-indexes.js

@@ -0,0 +1,30 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    beforeUp: async (pool) => {
+        await pool.query(sql `
+      create index concurrently service_logs__email__tenant_id__created_at__id
+        on service_logs (tenant_id, created_at desc, id desc)
+        where type in ('sendEmail', 'sendEmailFailed');
+    `);
+        await pool.query(sql `
+      create index concurrently service_logs__email__tenant_id__recipient__created_at__id
+        on service_logs (tenant_id, lower(payload->'data'->>'to'), created_at desc, id desc)
+        where type in ('sendEmail', 'sendEmailFailed');
+    `);
+    },
+    up: async () => {
+        /** 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty. */
+    },
+    beforeDown: async (pool) => {
+        await pool.query(sql `
+      drop index concurrently service_logs__email__tenant_id__recipient__created_at__id;
+    `);
+        await pool.query(sql `
+      drop index concurrently service_logs__email__tenant_id__created_at__id;
+    `);
+    },
+    down: async () => {
+        /** 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty. */
+    },
+};
+export default alteration;

package/alterations-js/1.43.0-1786431364-add-cimd-grant-client-snapshots-table.js

@@ -0,0 +1,38 @@
+import { sql } from '@silverhand/slonik';
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+/**
+ * Add the per-grant client display snapshot table for client ID metadata document (CIMD) clients.
+ * CIMD clients are unregistered URL identities without an `applications` row, and an unvetted
+ * client can rewrite its hosted document at any time — so the grant list renders the snapshot
+ * captured at consent instead of refetching the document. Rows cascade away with the Grant row.
+ */
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      create table cimd_grant_client_snapshots (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        grant_id varchar(128) not null,
+        grant_model_name varchar(64) not null default 'Grant',
+        client_id varchar(2048) not null,
+        name varchar(256),
+        logo_uri varchar(2048),
+        created_at timestamptz not null default(now()),
+        primary key (tenant_id, grant_id),
+        constraint cimd_grant_client_snapshots__grant_model_name
+          check (grant_model_name = 'Grant'),
+        foreign key (tenant_id, grant_model_name, grant_id)
+          references oidc_model_instances (tenant_id, model_name, id)
+          on update cascade on delete cascade
+      );
+    `);
+        await applyTableRls(pool, 'cimd_grant_client_snapshots');
+    },
+    down: async (pool) => {
+        await dropTableRls(pool, 'cimd_grant_client_snapshots');
+        await pool.query(sql `
+      drop table cimd_grant_client_snapshots;
+    `);
+    },
+};
+export default alteration;

package/lib/consts/index.d.ts

@@ -10,3 +10,4 @@ export * from './message-rate-limit.js';
 export * from './verification-code.js';
 export * from './product-event.js';
 export * from './application.js';
+export * from './social-state.js';

package/lib/consts/index.js

@@ -10,3 +10,4 @@ export * from './message-rate-limit.js';
 export * from './verification-code.js';
 export * from './product-event.js';
 export * from './application.js';
+export * from './social-state.js';

package/lib/consts/product-event.d.ts

@@ -67,7 +67,11 @@ export declare enum ProductEvent {
     MfaEnabled = "mfa enabled",
     MfaDisabled = "mfa disabled",
     CustomDomainCreated = "custom domain created",
-    CustomDomainDeleted = "custom domain deleted"
+    CustomDomainDeleted = "custom domain deleted",
+    /** The tenant has turned on dynamic app (CIMD) client access. */
+    DynamicAppEnabled = "dynamic app enabled",
+    /** The tenant has turned off dynamic app (CIMD) client access. */
+    DynamicAppDisabled = "dynamic app disabled"
 }
 /** The PostHog groups for product events. */
 export declare enum EventGroup {

package/lib/consts/product-event.js

@@ -69,6 +69,10 @@ export var ProductEvent;
     ProductEvent["MfaDisabled"] = "mfa disabled";
     ProductEvent["CustomDomainCreated"] = "custom domain created";
     ProductEvent["CustomDomainDeleted"] = "custom domain deleted";
+    /** The tenant has turned on dynamic app (CIMD) client access. */
+    ProductEvent["DynamicAppEnabled"] = "dynamic app enabled";
+    /** The tenant has turned off dynamic app (CIMD) client access. */
+    ProductEvent["DynamicAppDisabled"] = "dynamic app disabled";
 })(ProductEvent || (ProductEvent = {}));
 /** The PostHog groups for product events. */
 export var EventGroup;

package/lib/consts/social-state.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Prefixes of the OAuth `state` parameter used by the first-party clients that share the
+ * `/callback/:connectorId` social callback URI.
+ *
+ * Logto Core routes an incoming callback by looking at the `state` prefix, so the prefixes must
+ * never be a prefix of each other. Keep them defined together to preserve that invariant.
+ *
+ * A `state` carrying no known prefix falls back to the Sign-in Experience, which keeps in-flight
+ * requests and custom sign-in UIs that build their own `state` working.
+ */
+export declare const accountCenterSocialStatePrefix = "ac_";
+export declare const experienceSocialStatePrefix = "se_";

package/lib/consts/social-state.js

@@ -0,0 +1,12 @@
+/**
+ * Prefixes of the OAuth `state` parameter used by the first-party clients that share the
+ * `/callback/:connectorId` social callback URI.
+ *
+ * Logto Core routes an incoming callback by looking at the `state` prefix, so the prefixes must
+ * never be a prefix of each other. Keep them defined together to preserve that invariant.
+ *
+ * A `state` carrying no known prefix falls back to the Sign-in Experience, which keeps in-flight
+ * requests and custom sign-in UIs that build their own `state` working.
+ */
+export const accountCenterSocialStatePrefix = 'ac_';
+export const experienceSocialStatePrefix = 'se_';

package/lib/db-entries/cimd-grant-client-snapshot.d.ts

@@ -0,0 +1,32 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The client identity a user approved at consent time for a client ID metadata document (CIMD) client, captured per Grant. CIMD clients are unregistered URL identities without an `applications` row, and an unvetted client can rewrite its hosted document at any time — so the grant list renders this snapshot instead of refetching the document.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link CimdGrantClientSnapshot} for the original type.
+ */
+export type CreateCimdGrantClientSnapshot = {
+    tenantId?: string;
+    /** The ID of the Grant row in `oidc_model_instances`. */
+    grantId: string;
+    /** Fixed discriminator so the composite foreign key can target Grant rows in the polymorphic `oidc_model_instances` table. */
+    grantModelName?: string;
+    clientId: string;
+    name?: string | null;
+    logoUri?: string | null;
+    createdAt?: number;
+};
+/** The client identity a user approved at consent time for a client ID metadata document (CIMD) client, captured per Grant. CIMD clients are unregistered URL identities without an `applications` row, and an unvetted client can rewrite its hosted document at any time — so the grant list renders this snapshot instead of refetching the document. */
+export type CimdGrantClientSnapshot = {
+    tenantId: string;
+    /** The ID of the Grant row in `oidc_model_instances`. */
+    grantId: string;
+    /** Fixed discriminator so the composite foreign key can target Grant rows in the polymorphic `oidc_model_instances` table. */
+    grantModelName: string;
+    clientId: string;
+    name: string | null;
+    logoUri: string | null;
+    createdAt: number;
+};
+export type CimdGrantClientSnapshotKeys = 'tenantId' | 'grantId' | 'grantModelName' | 'clientId' | 'name' | 'logoUri' | 'createdAt';
+export declare const CimdGrantClientSnapshots: GeneratedSchema<CimdGrantClientSnapshotKeys, CreateCimdGrantClientSnapshot, CimdGrantClientSnapshot, 'cimd_grant_client_snapshots', 'cimd_grant_client_snapshot'>;

package/lib/db-entries/cimd-grant-client-snapshot.js

@@ -0,0 +1,45 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    grantId: z.string().min(1).max(128),
+    grantModelName: z.string().min(1).max(64).optional(),
+    clientId: z.string().min(1).max(2048),
+    name: z.string().max(256).nullable().optional(),
+    logoUri: z.string().max(2048).nullable().optional(),
+    createdAt: z.number().optional(),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    grantId: z.string().min(1).max(128),
+    grantModelName: z.string().max(64),
+    clientId: z.string().min(1).max(2048),
+    name: z.string().max(256).nullable(),
+    logoUri: z.string().max(2048).nullable(),
+    createdAt: z.number(),
+});
+export const CimdGrantClientSnapshots = Object.freeze({
+    table: 'cimd_grant_client_snapshots',
+    tableSingular: 'cimd_grant_client_snapshot',
+    fields: {
+        tenantId: 'tenant_id',
+        grantId: 'grant_id',
+        grantModelName: 'grant_model_name',
+        clientId: 'client_id',
+        name: 'name',
+        logoUri: 'logo_uri',
+        createdAt: 'created_at',
+    },
+    fieldKeys: [
+        'tenantId',
+        'grantId',
+        'grantModelName',
+        'clientId',
+        'name',
+        'logoUri',
+        'createdAt',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/cimd-grant-organization.d.ts

@@ -0,0 +1,30 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The organization authorized on a single OIDC Grant for a client ID metadata document (CIMD) client. CIMD clients are unregistered URL identities with no deletion lifecycle and transferable ownership, so organization access follows the single authorization instead of a long-lived cross-grant relation: rows cascade away with the Grant row and with the user's organization membership.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link CimdGrantOrganization} for the original type.
+ */
+export type CreateCimdGrantOrganization = {
+    tenantId?: string;
+    /** The ID of the Grant row in `oidc_model_instances`. */
+    grantId: string;
+    /** Fixed discriminator so the composite foreign key can target Grant rows in the polymorphic `oidc_model_instances` table. */
+    grantModelName?: string;
+    organizationId: string;
+    /** The user the grant was issued to and the membership FK's target. Must match the Grant payload's `accountId` (unreachable by FK) — the consent write enforces the pairing. */
+    userId: string;
+};
+/** The organization authorized on a single OIDC Grant for a client ID metadata document (CIMD) client. CIMD clients are unregistered URL identities with no deletion lifecycle and transferable ownership, so organization access follows the single authorization instead of a long-lived cross-grant relation: rows cascade away with the Grant row and with the user's organization membership. */
+export type CimdGrantOrganization = {
+    tenantId: string;
+    /** The ID of the Grant row in `oidc_model_instances`. */
+    grantId: string;
+    /** Fixed discriminator so the composite foreign key can target Grant rows in the polymorphic `oidc_model_instances` table. */
+    grantModelName: string;
+    organizationId: string;
+    /** The user the grant was issued to and the membership FK's target. Must match the Grant payload's `accountId` (unreachable by FK) — the consent write enforces the pairing. */
+    userId: string;
+};
+export type CimdGrantOrganizationKeys = 'tenantId' | 'grantId' | 'grantModelName' | 'organizationId' | 'userId';
+export declare const CimdGrantOrganizations: GeneratedSchema<CimdGrantOrganizationKeys, CreateCimdGrantOrganization, CimdGrantOrganization, 'cimd_grant_organizations', 'cimd_grant_organization'>;

package/lib/db-entries/cimd-grant-organization.js

@@ -0,0 +1,37 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    grantId: z.string().min(1).max(128),
+    grantModelName: z.string().min(1).max(64).optional(),
+    organizationId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(21),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    grantId: z.string().min(1).max(128),
+    grantModelName: z.string().max(64),
+    organizationId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(21),
+});
+export const CimdGrantOrganizations = Object.freeze({
+    table: 'cimd_grant_organizations',
+    tableSingular: 'cimd_grant_organization',
+    fields: {
+        tenantId: 'tenant_id',
+        grantId: 'grant_id',
+        grantModelName: 'grant_model_name',
+        organizationId: 'organization_id',
+        userId: 'user_id',
+    },
+    fieldKeys: [
+        'tenantId',
+        'grantId',
+        'grantModelName',
+        'organizationId',
+        'userId',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/cimd-organization-resource-scope.d.ts

@@ -0,0 +1,20 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The organization API resource scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request. The scopes are granted to users through organization roles. Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link CimdOrganizationResourceScope} for the original type.
+ */
+export type CreateCimdOrganizationResourceScope = {
+    tenantId?: string;
+    /** The globally unique identifier of the API resource scope. */
+    scopeId: string;
+};
+/** The organization API resource scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request. The scopes are granted to users through organization roles. Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible. */
+export type CimdOrganizationResourceScope = {
+    tenantId: string;
+    /** The globally unique identifier of the API resource scope. */
+    scopeId: string;
+};
+export type CimdOrganizationResourceScopeKeys = 'tenantId' | 'scopeId';
+export declare const CimdOrganizationResourceScopes: GeneratedSchema<CimdOrganizationResourceScopeKeys, CreateCimdOrganizationResourceScope, CimdOrganizationResourceScope, 'cimd_organization_resource_scopes', 'cimd_organization_resource_scope'>;

package/lib/db-entries/cimd-organization-resource-scope.js

@@ -0,0 +1,25 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    scopeId: z.string().min(1).max(21),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    scopeId: z.string().min(1).max(21),
+});
+export const CimdOrganizationResourceScopes = Object.freeze({
+    table: 'cimd_organization_resource_scopes',
+    tableSingular: 'cimd_organization_resource_scope',
+    fields: {
+        tenantId: 'tenant_id',
+        scopeId: 'scope_id',
+    },
+    fieldKeys: [
+        'tenantId',
+        'scopeId',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/cimd-organization-scope.d.ts

@@ -0,0 +1,20 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The organization scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request. Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link CimdOrganizationScope} for the original type.
+ */
+export type CreateCimdOrganizationScope = {
+    tenantId?: string;
+    /** The globally unique identifier of the organization scope. */
+    organizationScopeId: string;
+};
+/** The organization scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request. Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible. */
+export type CimdOrganizationScope = {
+    tenantId: string;
+    /** The globally unique identifier of the organization scope. */
+    organizationScopeId: string;
+};
+export type CimdOrganizationScopeKeys = 'tenantId' | 'organizationScopeId';
+export declare const CimdOrganizationScopes: GeneratedSchema<CimdOrganizationScopeKeys, CreateCimdOrganizationScope, CimdOrganizationScope, 'cimd_organization_scopes', 'cimd_organization_scope'>;

package/lib/db-entries/cimd-organization-scope.js

@@ -0,0 +1,25 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    organizationScopeId: z.string().min(1).max(21),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    organizationScopeId: z.string().min(1).max(21),
+});
+export const CimdOrganizationScopes = Object.freeze({
+    table: 'cimd_organization_scopes',
+    tableSingular: 'cimd_organization_scope',
+    fields: {
+        tenantId: 'tenant_id',
+        organizationScopeId: 'organization_scope_id',
+    },
+    fieldKeys: [
+        'tenantId',
+        'organizationScopeId',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/cimd-resource-scope.d.ts

@@ -0,0 +1,20 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The API resource scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request. Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link CimdResourceScope} for the original type.
+ */
+export type CreateCimdResourceScope = {
+    tenantId?: string;
+    /** The globally unique identifier of the API resource scope. */
+    scopeId: string;
+};
+/** The API resource scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request. Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible. */
+export type CimdResourceScope = {
+    tenantId: string;
+    /** The globally unique identifier of the API resource scope. */
+    scopeId: string;
+};
+export type CimdResourceScopeKeys = 'tenantId' | 'scopeId';
+export declare const CimdResourceScopes: GeneratedSchema<CimdResourceScopeKeys, CreateCimdResourceScope, CimdResourceScope, 'cimd_resource_scopes', 'cimd_resource_scope'>;

package/lib/db-entries/cimd-resource-scope.js

@@ -0,0 +1,25 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    scopeId: z.string().min(1).max(21),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    scopeId: z.string().min(1).max(21),
+});
+export const CimdResourceScopes = Object.freeze({
+    table: 'cimd_resource_scopes',
+    tableSingular: 'cimd_resource_scope',
+    fields: {
+        tenantId: 'tenant_id',
+        scopeId: 'scope_id',
+    },
+    fieldKeys: [
+        'tenantId',
+        'scopeId',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/cimd-user-scope.d.ts

@@ -0,0 +1,20 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The user scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request. Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link CimdUserScope} for the original type.
+ */
+export type CreateCimdUserScope = {
+    tenantId?: string;
+    /** The unique UserScope enum value @see (@logto/core-kit/open-id.js) for more details */
+    userScope: string;
+};
+/** The user scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request. Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible. */
+export type CimdUserScope = {
+    tenantId: string;
+    /** The unique UserScope enum value @see (@logto/core-kit/open-id.js) for more details */
+    userScope: string;
+};
+export type CimdUserScopeKeys = 'tenantId' | 'userScope';
+export declare const CimdUserScopes: GeneratedSchema<CimdUserScopeKeys, CreateCimdUserScope, CimdUserScope, 'cimd_user_scopes', 'cimd_user_scope'>;

package/lib/db-entries/cimd-user-scope.js

@@ -0,0 +1,25 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    userScope: z.string().min(1).max(64),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    userScope: z.string().min(1).max(64),
+});
+export const CimdUserScopes = Object.freeze({
+    table: 'cimd_user_scopes',
+    tableSingular: 'cimd_user_scope',
+    fields: {
+        tenantId: 'tenant_id',
+        userScope: 'user_scope',
+    },
+    fieldKeys: [
+        'tenantId',
+        'userScope',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/index.d.ts

@@ -19,6 +19,12 @@ export * from './application-user-consent-user-scope.js';
 export * from './application.js';
 export * from './applications-role.js';
 export * from './captcha-provider.js';
+export * from './cimd-grant-client-snapshot.js';
+export * from './cimd-grant-organization.js';
+export * from './cimd-organization-resource-scope.js';
+export * from './cimd-organization-scope.js';
+export * from './cimd-resource-scope.js';
+export * from './cimd-user-scope.js';
 export * from './connector.js';
 export * from './custom-phrase.js';
 export * from './custom-profile-field.js';
@@ -67,6 +73,7 @@ export * from './sso-connector-idp-initiated-auth-config.js';
 export * from './sso-connector.js';
 export * from './subject-token.js';
 export * from './system.js';
+export * from './trusted-device.js';
 export * from './user-geo-location.js';
 export * from './user-sign-in-country.js';
 export * from './user-sso-identity.js';

package/lib/db-entries/index.js

@@ -20,6 +20,12 @@ export * from './application-user-consent-user-scope.js';
 export * from './application.js';
 export * from './applications-role.js';
 export * from './captcha-provider.js';
+export * from './cimd-grant-client-snapshot.js';
+export * from './cimd-grant-organization.js';
+export * from './cimd-organization-resource-scope.js';
+export * from './cimd-organization-scope.js';
+export * from './cimd-resource-scope.js';
+export * from './cimd-user-scope.js';
 export * from './connector.js';
 export * from './custom-phrase.js';
 export * from './custom-profile-field.js';
@@ -68,6 +74,7 @@ export * from './sso-connector-idp-initiated-auth-config.js';
 export * from './sso-connector.js';
 export * from './subject-token.js';
 export * from './system.js';
+export * from './trusted-device.js';
 export * from './user-geo-location.js';
 export * from './user-sign-in-country.js';
 export * from './user-sso-identity.js';

package/lib/db-entries/oidc-session-extension.d.ts

@@ -10,6 +10,7 @@ export type CreateOidcSessionExtension = {
     accountId: string;
     lastSubmission?: JsonObject;
     clientId?: string | null;
+    cimdClientId?: string | null;
     createdAt?: number;
     updatedAt?: number;
 };
@@ -19,8 +20,9 @@ export type OidcSessionExtension = {
     accountId: string;
     lastSubmission: JsonObject;
     clientId: string | null;
+    cimdClientId: string | null;
     createdAt: number;
     updatedAt: number;
 };
-export type OidcSessionExtensionKeys = 'tenantId' | 'sessionUid' | 'accountId' | 'lastSubmission' | 'clientId' | 'createdAt' | 'updatedAt';
+export type OidcSessionExtensionKeys = 'tenantId' | 'sessionUid' | 'accountId' | 'lastSubmission' | 'clientId' | 'cimdClientId' | 'createdAt' | 'updatedAt';
 export declare const OidcSessionExtensions: GeneratedSchema<OidcSessionExtensionKeys, CreateOidcSessionExtension, OidcSessionExtension, 'oidc_session_extensions', 'oidc_session_extension'>;

package/lib/db-entries/oidc-session-extension.js

@@ -7,6 +7,7 @@ const createGuard = z.object({
     accountId: z.string().min(1).max(12),
     lastSubmission: jsonObjectGuard.optional(),
     clientId: z.string().max(21).nullable().optional(),
+    cimdClientId: z.string().max(2048).nullable().optional(),
     createdAt: z.number().optional(),
     updatedAt: z.number().optional(),
 });
@@ -16,6 +17,7 @@ const guard = z.object({
     accountId: z.string().min(1).max(12),
     lastSubmission: jsonObjectGuard,
     clientId: z.string().max(21).nullable(),
+    cimdClientId: z.string().max(2048).nullable(),
     createdAt: z.number(),
     updatedAt: z.number(),
 });
@@ -28,6 +30,7 @@ export const OidcSessionExtensions = Object.freeze({
         accountId: 'account_id',
         lastSubmission: 'last_submission',
         clientId: 'client_id',
+        cimdClientId: 'cimd_client_id',
         createdAt: 'created_at',
         updatedAt: 'updated_at',
     },
@@ -37,6 +40,7 @@ export const OidcSessionExtensions = Object.freeze({
         'accountId',
         'lastSubmission',
         'clientId',
+        'cimdClientId',
         'createdAt',
         'updatedAt',
     ],