@logto/schemas 1.42.0 → 1.43.0

package/lib/types/user-sessions.d.ts

@@ -626,7 +626,7 @@ export declare const userExtendedSessionGuard: z.ZodObject<{
                 type: import("../foundations/index.js").SignInIdentifier;
             }>;
             passwordEncrypted: z.ZodOptional<z.ZodString>;
-            passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../db-entries/custom-types.js").UsersPasswordEncryptionMethod.Argon2i>>;
+            passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../index.js").UsersPasswordEncryptionMethod.Argon2i>>;
         }, "passwordEncrypted" | "passwordEncryptionMethod">, "strip", z.ZodTypeAny, {
             type: import("./index.js").VerificationType.NewPasswordIdentity;
             id: string;
@@ -880,6 +880,7 @@ export declare const userExtendedSessionGuard: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     accountId: string | null;
     expiresAt: number;
+    clientId: string | null;
     payload: {
         uid: string;
         exp: number;
@@ -1012,10 +1013,10 @@ export declare const userExtendedSessionGuard: z.ZodObject<{
         })[];
         signInContext?: Record<string, string> | undefined;
     } | null;
-    clientId: string | null;
 }, {
     accountId: string | null;
     expiresAt: number;
+    clientId: string | null;
     payload: {
         uid: string;
         exp: number;
@@ -1148,7 +1149,6 @@ export declare const userExtendedSessionGuard: z.ZodObject<{
         })[];
         signInContext?: Record<string, string> | undefined;
     } | null;
-    clientId: string | null;
 }>;
 export declare const getUserSessionsResponseGuard: z.ZodObject<{
     sessions: z.ZodArray<z.ZodObject<{
@@ -1739,7 +1739,7 @@ export declare const getUserSessionsResponseGuard: z.ZodObject<{
                     type: import("../foundations/index.js").SignInIdentifier;
                 }>;
                 passwordEncrypted: z.ZodOptional<z.ZodString>;
-                passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../db-entries/custom-types.js").UsersPasswordEncryptionMethod.Argon2i>>;
+                passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../index.js").UsersPasswordEncryptionMethod.Argon2i>>;
             }, "passwordEncrypted" | "passwordEncryptionMethod">, "strip", z.ZodTypeAny, {
                 type: import("./index.js").VerificationType.NewPasswordIdentity;
                 id: string;
@@ -1993,6 +1993,7 @@ export declare const getUserSessionsResponseGuard: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         accountId: string | null;
         expiresAt: number;
+        clientId: string | null;
         payload: {
             uid: string;
             exp: number;
@@ -2125,10 +2126,10 @@ export declare const getUserSessionsResponseGuard: z.ZodObject<{
             })[];
             signInContext?: Record<string, string> | undefined;
         } | null;
-        clientId: string | null;
     }, {
         accountId: string | null;
         expiresAt: number;
+        clientId: string | null;
         payload: {
             uid: string;
             exp: number;
@@ -2261,12 +2262,12 @@ export declare const getUserSessionsResponseGuard: z.ZodObject<{
             })[];
             signInContext?: Record<string, string> | undefined;
         } | null;
-        clientId: string | null;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
     sessions: {
         accountId: string | null;
         expiresAt: number;
+        clientId: string | null;
         payload: {
             uid: string;
             exp: number;
@@ -2399,12 +2400,12 @@ export declare const getUserSessionsResponseGuard: z.ZodObject<{
             })[];
             signInContext?: Record<string, string> | undefined;
         } | null;
-        clientId: string | null;
     }[];
 }, {
     sessions: {
         accountId: string | null;
         expiresAt: number;
+        clientId: string | null;
         payload: {
             uid: string;
             exp: number;
@@ -2537,7 +2538,6 @@ export declare const getUserSessionsResponseGuard: z.ZodObject<{
             })[];
             signInContext?: Record<string, string> | undefined;
         } | null;
-        clientId: string | null;
     }[];
 }>;
 /** Response type for `GET /users/:userId/sessions`. */
@@ -3130,7 +3130,7 @@ export declare const getUserSessionResponseGuard: z.ZodObject<{
                 type: import("../foundations/index.js").SignInIdentifier;
             }>;
             passwordEncrypted: z.ZodOptional<z.ZodString>;
-            passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../db-entries/custom-types.js").UsersPasswordEncryptionMethod.Argon2i>>;
+            passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../index.js").UsersPasswordEncryptionMethod.Argon2i>>;
         }, "passwordEncrypted" | "passwordEncryptionMethod">, "strip", z.ZodTypeAny, {
             type: import("./index.js").VerificationType.NewPasswordIdentity;
             id: string;
@@ -3384,6 +3384,7 @@ export declare const getUserSessionResponseGuard: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     accountId: string | null;
     expiresAt: number;
+    clientId: string | null;
     payload: {
         uid: string;
         exp: number;
@@ -3516,10 +3517,10 @@ export declare const getUserSessionResponseGuard: z.ZodObject<{
         })[];
         signInContext?: Record<string, string> | undefined;
     } | null;
-    clientId: string | null;
 }, {
     accountId: string | null;
     expiresAt: number;
+    clientId: string | null;
     payload: {
         uid: string;
         exp: number;
@@ -3652,7 +3653,6 @@ export declare const getUserSessionResponseGuard: z.ZodObject<{
         })[];
         signInContext?: Record<string, string> | undefined;
     } | null;
-    clientId: string | null;
 }>;
 /** Response type for `GET /users/:userId/sessions/:sessionId`. */
 export type GetUserSessionResponse = z.infer<typeof getUserSessionResponseGuard>;
@@ -4252,7 +4252,7 @@ export declare const accountUserExtendedSessionGuard: z.ZodObject<{
                 type: import("../foundations/index.js").SignInIdentifier;
             }>;
             passwordEncrypted: z.ZodOptional<z.ZodString>;
-            passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../db-entries/custom-types.js").UsersPasswordEncryptionMethod.Argon2i>>;
+            passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../index.js").UsersPasswordEncryptionMethod.Argon2i>>;
         }, "passwordEncrypted" | "passwordEncryptionMethod">, "strip", z.ZodTypeAny, {
             type: import("./index.js").VerificationType.NewPasswordIdentity;
             id: string;
@@ -4515,6 +4515,7 @@ export declare const accountUserExtendedSessionGuard: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     accountId: string | null;
     expiresAt: number;
+    clientId: string | null;
     payload: {
         uid: string;
         exp: number;
@@ -4647,11 +4648,11 @@ export declare const accountUserExtendedSessionGuard: z.ZodObject<{
         })[];
         signInContext?: Record<string, string> | undefined;
     } | null;
-    clientId: string | null;
     isCurrent: boolean;
 }, {
     accountId: string | null;
     expiresAt: number;
+    clientId: string | null;
     payload: {
         uid: string;
         exp: number;
@@ -4784,7 +4785,6 @@ export declare const accountUserExtendedSessionGuard: z.ZodObject<{
         })[];
         signInContext?: Record<string, string> | undefined;
     } | null;
-    clientId: string | null;
     isCurrent: boolean;
 }>;
 export declare const getAccountUserSessionsResponseGuard: z.ZodObject<{
@@ -5376,7 +5376,7 @@ export declare const getAccountUserSessionsResponseGuard: z.ZodObject<{
                     type: import("../foundations/index.js").SignInIdentifier;
                 }>;
                 passwordEncrypted: z.ZodOptional<z.ZodString>;
-                passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../db-entries/custom-types.js").UsersPasswordEncryptionMethod.Argon2i>>;
+                passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../index.js").UsersPasswordEncryptionMethod.Argon2i>>;
             }, "passwordEncrypted" | "passwordEncryptionMethod">, "strip", z.ZodTypeAny, {
                 type: import("./index.js").VerificationType.NewPasswordIdentity;
                 id: string;
@@ -5639,6 +5639,7 @@ export declare const getAccountUserSessionsResponseGuard: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         accountId: string | null;
         expiresAt: number;
+        clientId: string | null;
         payload: {
             uid: string;
             exp: number;
@@ -5771,11 +5772,11 @@ export declare const getAccountUserSessionsResponseGuard: z.ZodObject<{
             })[];
             signInContext?: Record<string, string> | undefined;
         } | null;
-        clientId: string | null;
         isCurrent: boolean;
     }, {
         accountId: string | null;
         expiresAt: number;
+        clientId: string | null;
         payload: {
             uid: string;
             exp: number;
@@ -5908,13 +5909,13 @@ export declare const getAccountUserSessionsResponseGuard: z.ZodObject<{
             })[];
             signInContext?: Record<string, string> | undefined;
         } | null;
-        clientId: string | null;
         isCurrent: boolean;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
     sessions: {
         accountId: string | null;
         expiresAt: number;
+        clientId: string | null;
         payload: {
             uid: string;
             exp: number;
@@ -6047,13 +6048,13 @@ export declare const getAccountUserSessionsResponseGuard: z.ZodObject<{
             })[];
             signInContext?: Record<string, string> | undefined;
         } | null;
-        clientId: string | null;
         isCurrent: boolean;
     }[];
 }, {
     sessions: {
         accountId: string | null;
         expiresAt: number;
+        clientId: string | null;
         payload: {
             uid: string;
             exp: number;
@@ -6186,7 +6187,6 @@ export declare const getAccountUserSessionsResponseGuard: z.ZodObject<{
             })[];
             signInContext?: Record<string, string> | undefined;
         } | null;
-        clientId: string | null;
         isCurrent: boolean;
     }[];
 }>;
@@ -6252,101 +6252,16 @@ export declare const userApplicationGrantGuard: z.ZodObject<{
         accountId: z.ZodString;
     }, z.ZodUnknown, "strip">>;
     expiresAt: z.ZodNumber;
-    application: z.ZodObject<Pick<{
-        tenantId: z.ZodType<string, z.ZodTypeDef, string>;
-        id: z.ZodType<string, z.ZodTypeDef, string>;
-        name: z.ZodType<string, z.ZodTypeDef, string>;
-        secret: z.ZodType<string, z.ZodTypeDef, string>;
-        description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-        type: z.ZodType<import("../db-entries/custom-types.js").ApplicationType, z.ZodTypeDef, import("../db-entries/custom-types.js").ApplicationType>;
-        oidcClientMetadata: z.ZodType<import("../foundations/index.js").OidcClientMetadata, z.ZodTypeDef, import("../foundations/index.js").OidcClientMetadata>;
-        customClientMetadata: z.ZodType<{
-            corsAllowedOrigins?: string[] | undefined;
-            idTokenTtl?: number | undefined;
-            refreshTokenTtl?: number | undefined;
-            refreshTokenTtlInDays?: number | undefined;
-            tenantId?: string | undefined;
-            alwaysIssueRefreshToken?: boolean | undefined;
-            rotateRefreshToken?: boolean | undefined;
-            allowTokenExchange?: boolean | undefined;
-            isDeviceFlow?: boolean | undefined;
-            maxAllowedGrants?: number | undefined;
-        }, z.ZodTypeDef, {
-            corsAllowedOrigins?: string[] | undefined;
-            idTokenTtl?: number | undefined;
-            refreshTokenTtl?: number | undefined;
-            refreshTokenTtlInDays?: number | undefined;
-            tenantId?: string | undefined;
-            alwaysIssueRefreshToken?: boolean | undefined;
-            rotateRefreshToken?: boolean | undefined;
-            allowTokenExchange?: boolean | undefined;
-            isDeviceFlow?: boolean | undefined;
-            maxAllowedGrants?: number | undefined;
-        }>;
-        protectedAppMetadata: z.ZodType<{
-            host: string;
-            origin: string;
-            sessionDuration: number;
-            pageRules: {
-                path: string;
-            }[];
-            additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
-            customDomains?: {
-                status: import("../foundations/index.js").DomainStatus;
-                domain: string;
-                errorMessage: string | null;
-                dnsRecords: {
-                    value: string;
-                    type: string;
-                    name: string;
-                }[];
-                cloudflareData: {
-                    status: string;
-                    id: string;
-                    ssl: {
-                        status: string;
-                        validation_errors?: {
-                            message: string;
-                        }[] | undefined;
-                    };
-                    verification_errors?: string[] | undefined;
-                } | null;
-            }[] | undefined;
-        } | null, z.ZodTypeDef, {
-            host: string;
-            origin: string;
-            sessionDuration: number;
-            pageRules: {
-                path: string;
-            }[];
-            additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
-            customDomains?: {
-                status: import("../foundations/index.js").DomainStatus;
-                domain: string;
-                errorMessage: string | null;
-                dnsRecords: {
-                    value: string;
-                    type: string;
-                    name: string;
-                }[];
-                cloudflareData: {
-                    status: string;
-                    id: string;
-                    ssl: {
-                        status: string;
-                        validation_errors?: {
-                            message: string;
-                        }[] | undefined;
-                    };
-                    verification_errors?: string[] | undefined;
-                } | null;
-            }[] | undefined;
-        } | null>;
-        customData: z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
-        isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
-        appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
-        createdAt: z.ZodType<number, z.ZodTypeDef, number>;
-    }, "name" | "id">, "strip", z.ZodTypeAny, {
+    /**
+     * A CIMD (client ID metadata document) grant fills this slot with a URL identity that has no
+     * `applications` row: the identifier URL lands in `id` and `name` comes from the consent-time
+     * snapshot, so neither field can keep the applications table varchar bounds. Consumers tell
+     * the kinds apart by the id shape.
+     */
+    application: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
         name: string;
         id: string;
     }, {
@@ -6421,101 +6336,16 @@ export declare const getUserApplicationGrantsResponseGuard: z.ZodObject<{
             accountId: z.ZodString;
         }, z.ZodUnknown, "strip">>;
         expiresAt: z.ZodNumber;
-        application: z.ZodObject<Pick<{
-            tenantId: z.ZodType<string, z.ZodTypeDef, string>;
-            id: z.ZodType<string, z.ZodTypeDef, string>;
-            name: z.ZodType<string, z.ZodTypeDef, string>;
-            secret: z.ZodType<string, z.ZodTypeDef, string>;
-            description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-            type: z.ZodType<import("../db-entries/custom-types.js").ApplicationType, z.ZodTypeDef, import("../db-entries/custom-types.js").ApplicationType>;
-            oidcClientMetadata: z.ZodType<import("../foundations/index.js").OidcClientMetadata, z.ZodTypeDef, import("../foundations/index.js").OidcClientMetadata>;
-            customClientMetadata: z.ZodType<{
-                corsAllowedOrigins?: string[] | undefined;
-                idTokenTtl?: number | undefined;
-                refreshTokenTtl?: number | undefined;
-                refreshTokenTtlInDays?: number | undefined;
-                tenantId?: string | undefined;
-                alwaysIssueRefreshToken?: boolean | undefined;
-                rotateRefreshToken?: boolean | undefined;
-                allowTokenExchange?: boolean | undefined;
-                isDeviceFlow?: boolean | undefined;
-                maxAllowedGrants?: number | undefined;
-            }, z.ZodTypeDef, {
-                corsAllowedOrigins?: string[] | undefined;
-                idTokenTtl?: number | undefined;
-                refreshTokenTtl?: number | undefined;
-                refreshTokenTtlInDays?: number | undefined;
-                tenantId?: string | undefined;
-                alwaysIssueRefreshToken?: boolean | undefined;
-                rotateRefreshToken?: boolean | undefined;
-                allowTokenExchange?: boolean | undefined;
-                isDeviceFlow?: boolean | undefined;
-                maxAllowedGrants?: number | undefined;
-            }>;
-            protectedAppMetadata: z.ZodType<{
-                host: string;
-                origin: string;
-                sessionDuration: number;
-                pageRules: {
-                    path: string;
-                }[];
-                additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
-                customDomains?: {
-                    status: import("../foundations/index.js").DomainStatus;
-                    domain: string;
-                    errorMessage: string | null;
-                    dnsRecords: {
-                        value: string;
-                        type: string;
-                        name: string;
-                    }[];
-                    cloudflareData: {
-                        status: string;
-                        id: string;
-                        ssl: {
-                            status: string;
-                            validation_errors?: {
-                                message: string;
-                            }[] | undefined;
-                        };
-                        verification_errors?: string[] | undefined;
-                    } | null;
-                }[] | undefined;
-            } | null, z.ZodTypeDef, {
-                host: string;
-                origin: string;
-                sessionDuration: number;
-                pageRules: {
-                    path: string;
-                }[];
-                additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
-                customDomains?: {
-                    status: import("../foundations/index.js").DomainStatus;
-                    domain: string;
-                    errorMessage: string | null;
-                    dnsRecords: {
-                        value: string;
-                        type: string;
-                        name: string;
-                    }[];
-                    cloudflareData: {
-                        status: string;
-                        id: string;
-                        ssl: {
-                            status: string;
-                            validation_errors?: {
-                                message: string;
-                            }[] | undefined;
-                        };
-                        verification_errors?: string[] | undefined;
-                    } | null;
-                }[] | undefined;
-            } | null>;
-            customData: z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
-            isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
-            appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
-            createdAt: z.ZodType<number, z.ZodTypeDef, number>;
-        }, "name" | "id">, "strip", z.ZodTypeAny, {
+        /**
+         * A CIMD (client ID metadata document) grant fills this slot with a URL identity that has no
+         * `applications` row: the identifier URL lands in `id` and `name` comes from the consent-time
+         * snapshot, so neither field can keep the applications table varchar bounds. Consumers tell
+         * the kinds apart by the id shape.
+         */
+        application: z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
             name: string;
             id: string;
         }, {

package/lib/types/user-sessions.js

@@ -1,5 +1,4 @@
 import { z } from 'zod';
-import { Applications } from '../db-entries/index.js';
 import { oidcSessionInstancePayloadGuard } from '../foundations/index.js';
 import { jwtCustomizerUserInteractionContextGuard } from './logto-config/jwt-customizer.js';
 export const userSessionSignInContextGuard = z
@@ -73,9 +72,15 @@ export const userApplicationGrantGuard = z.object({
     id: z.string(),
     payload: userApplicationGrantPayloadGuard,
     expiresAt: z.number(),
-    application: Applications.guard.pick({
-        id: true,
-        name: true,
+    /**
+     * A CIMD (client ID metadata document) grant fills this slot with a URL identity that has no
+     * `applications` row: the identifier URL lands in `id` and `name` comes from the consent-time
+     * snapshot, so neither field can keep the applications table varchar bounds. Consumers tell
+     * the kinds apart by the id shape.
+     */
+    application: z.object({
+        id: z.string(),
+        name: z.string(),
     }),
 });
 export const getUserApplicationGrantsResponseGuard = z.object({

package/lib/types/user.d.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { type User } from '../db-entries/index.js';
 import { MfaFactor } from '../foundations/index.js';
-export declare const userInfoSelectFields: readonly ("name" | "id" | "applicationId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended")[];
+export declare const userInfoSelectFields: readonly ("name" | "id" | "applicationId" | "cimdClientId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended")[];
 export declare const userInfoGuard: z.ZodObject<Pick<{
     tenantId: z.ZodType<string, z.ZodTypeDef, string>;
     id: z.ZodType<string, z.ZodTypeDef, string>;
@@ -54,6 +54,7 @@ export declare const userInfoGuard: z.ZodObject<Pick<{
         }>;
     }>>;
     applicationId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    cimdClientId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     identities: z.ZodType<Record<string, {
         userId: string;
         details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -126,10 +127,11 @@ export declare const userInfoGuard: z.ZodObject<Pick<{
     passwordUpdatedAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
     createdAt: z.ZodType<number, z.ZodTypeDef, number>;
     updatedAt: z.ZodType<number, z.ZodTypeDef, number>;
-}, "name" | "id" | "applicationId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended">, "strip", z.ZodTypeAny, {
+}, "name" | "id" | "applicationId" | "cimdClientId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended">, "strip", z.ZodTypeAny, {
     name: string | null;
     id: string;
     applicationId: string | null;
+    cimdClientId: string | null;
     username: string | null;
     createdAt: number;
     profile: import("../foundations/index.js").UserProfile;
@@ -145,6 +147,7 @@ export declare const userInfoGuard: z.ZodObject<Pick<{
     name: string | null;
     id: string;
     applicationId: string | null;
+    cimdClientId: string | null;
     username: string | null;
     createdAt: number;
     profile: import("../foundations/index.js").UserProfile;
@@ -210,6 +213,7 @@ export declare const userProfileResponseGuard: z.ZodObject<Pick<{
         }>;
     }>>;
     applicationId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    cimdClientId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     identities: z.ZodType<Record<string, {
         userId: string;
         details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -282,7 +286,7 @@ export declare const userProfileResponseGuard: z.ZodObject<Pick<{
     passwordUpdatedAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
     createdAt: z.ZodType<number, z.ZodTypeDef, number>;
     updatedAt: z.ZodType<number, z.ZodTypeDef, number>;
-}, "name" | "id" | "applicationId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended"> & {
+}, "name" | "id" | "applicationId" | "cimdClientId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended"> & {
     hasPassword: z.ZodOptional<z.ZodBoolean>;
     hasSecurityVerificationMethod: z.ZodOptional<z.ZodBoolean>;
     ssoIdentities: z.ZodOptional<z.ZodArray<import("../foundations/schemas.js").Guard<import("../db-entries/user-sso-identity.js").UserSsoIdentity>, "many">>;
@@ -290,6 +294,7 @@ export declare const userProfileResponseGuard: z.ZodObject<Pick<{
     name: string | null;
     id: string;
     applicationId: string | null;
+    cimdClientId: string | null;
     username: string | null;
     createdAt: number;
     profile: import("../foundations/index.js").UserProfile;
@@ -308,6 +313,7 @@ export declare const userProfileResponseGuard: z.ZodObject<Pick<{
     name: string | null;
     id: string;
     applicationId: string | null;
+    cimdClientId: string | null;
     username: string | null;
     createdAt: number;
     profile: import("../foundations/index.js").UserProfile;
@@ -430,6 +436,7 @@ export declare const featuredUserGuard: z.ZodObject<Pick<{
         }>;
     }>>;
     applicationId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    cimdClientId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     identities: z.ZodType<Record<string, {
         userId: string;
         details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;

package/lib/types/user.js

@@ -16,6 +16,7 @@ export const userInfoSelectFields = Object.freeze([
     'updatedAt',
     'profile',
     'applicationId',
+    'cimdClientId',
     'isSuspended',
 ]);
 export const userInfoGuard = Users.guard.pick(

package/lib/utils/cimd.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @overview The CIMD (OAuth Client ID Metadata Document) client identifier namespace predicate.
+ *
+ * Lives in `@logto/schemas` because both runtimes classify the same identifier: core wires the
+ * feature configuration and request-time matching, while the experience client recognizes a CIMD
+ * identifier carried over from the authorization request (e.g. to accept SSR settings rendered
+ * without an `appId`).
+ */
+/**
+ * Whether the identifier is in the CIMD namespace. Mirrors the scheme test of the fork's
+ * `isValidClientIdUrl` (case-insensitive); registered application ids never take the URL shape,
+ * so the shape safely routes — the resolved client stays the authority on what a client is.
+ */
+export declare const isCimdClientId: (clientId: string) => boolean;

package/lib/utils/cimd.js

@@ -0,0 +1,14 @@
+/**
+ * @overview The CIMD (OAuth Client ID Metadata Document) client identifier namespace predicate.
+ *
+ * Lives in `@logto/schemas` because both runtimes classify the same identifier: core wires the
+ * feature configuration and request-time matching, while the experience client recognizes a CIMD
+ * identifier carried over from the authorization request (e.g. to accept SSR settings rendered
+ * without an `appId`).
+ */
+/**
+ * Whether the identifier is in the CIMD namespace. Mirrors the scheme test of the fork's
+ * `isValidClientIdUrl` (case-insensitive); registered application ids never take the URL shape,
+ * so the shape safely routes — the resolved client stays the authority on what a client is.
+ */
+export const isCimdClientId = (clientId) => /^https:\/\//iu.test(clientId);

package/lib/utils/cimd.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/utils/cimd.test.js

@@ -0,0 +1,9 @@
+import { describe, expect, it } from 'vitest';
+import { isCimdClientId } from './cimd.js';
+describe('isCimdClientId', () => {
+    it('matches the fork scheme test case-insensitively and never matches registered ids', () => {
+        expect(isCimdClientId('https://client.example.com/metadata.json')).toBe(true);
+        expect(isCimdClientId('HTTPS://client.example.com/metadata.json')).toBe(true);
+        expect(isCimdClientId('registered_client_id')).toBe(false);
+    });
+});

package/lib/utils/index.d.ts

@@ -3,3 +3,4 @@ export * from './role.js';
 export * from './management-api.js';
 export * from './domain.js';
 export * from './oidc-private-key.js';
+export * from './cimd.js';

package/lib/utils/index.js

@@ -3,3 +3,4 @@ export * from './role.js';
 export * from './management-api.js';
 export * from './domain.js';
 export * from './oidc-private-key.js';
+export * from './cimd.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/schemas",
-  "version": "1.42.0",
+  "version": "1.43.0",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "license": "MPL-2.0",
   "type": "module",
@@ -65,12 +65,12 @@
   "dependencies": {
     "@withtyped/server": "^0.14.0",
     "nanoid": "^5.0.9",
-    "@logto/connector-kit": "^5.1.0",
-    "@logto/language-kit": "^1.3.0",
-    "@logto/phrases": "^1.30.0",
-    "@logto/core-kit": "^2.12.0",
-    "@logto/shared": "^3.4.2",
-    "@logto/phrases-experience": "^1.14.1"
+    "@logto/core-kit": "^2.13.0",
+    "@logto/connector-kit": "^5.1.1",
+    "@logto/language-kit": "^1.4.0",
+    "@logto/phrases": "^1.31.0",
+    "@logto/phrases-experience": "^1.15.0",
+    "@logto/shared": "^3.4.3"
   },
   "peerDependencies": {
     "zod": "3.24.3"