@logto/schemas 1.42.0 → 1.44.0

package/lib/consts/license.test.js

@@ -0,0 +1,96 @@
+import { describe, expect, it } from 'vitest';
+import { LicenseEnv, licensePayloadGuard, ossDefaultQuota, resolveLicenseQuota, } from './license.js';
+import { ReservedPlanId } from './subscriptions.js';
+const validPayload = Object.freeze({
+    plan: ReservedPlanId.SelfHostedPro,
+    env: LicenseEnv.Production,
+    customerId: 'cus_1234567890',
+    licenseId: 'lic_1234567890',
+    iat: 1_760_000_000,
+    exp: 1_791_536_000,
+    quota: {
+        hideLogtoBranding: true,
+        bringYourUi: true,
+        idpInitiatedSso: true,
+        consoleCollaboration: true,
+        mandatoryMfa: true,
+        hostedEmail: false,
+        samlApplicationsLimit: null,
+    },
+});
+describe('licensePayloadGuard', () => {
+    it('parses a production Pro license payload', () => {
+        expect(licensePayloadGuard.parse(validPayload)).toEqual(validPayload);
+    });
+    it('parses a non-production Enterprise license payload', () => {
+        const payload = {
+            ...validPayload,
+            plan: ReservedPlanId.SelfHostedEnterprise,
+            env: LicenseEnv.NonProduction,
+        };
+        expect(licensePayloadGuard.parse(payload)).toEqual(payload);
+    });
+    it('parses a payload carrying only the entitlements it changes', () => {
+        const payload = { ...validPayload, quota: { hideLogtoBranding: true } };
+        expect(licensePayloadGuard.parse(payload)).toEqual(payload);
+    });
+    it.each([ReservedPlanId.Free, ReservedPlanId.Pro202509, ReservedPlanId.Development])('rejects the Cloud-only plan %s', (plan) => {
+        expect(licensePayloadGuard.safeParse({ ...validPayload, plan }).success).toBe(false);
+    });
+    it('rejects an unknown environment', () => {
+        expect(licensePayloadGuard.safeParse({ ...validPayload, env: 'staging' }).success).toBe(false);
+    });
+    it.each([-1, 1.5, '3'])('rejects the SAML application limit %j', (samlApplicationsLimit) => {
+        expect(licensePayloadGuard.safeParse({
+            ...validPayload,
+            quota: { ...validPayload.quota, samlApplicationsLimit },
+        }).success).toBe(false);
+    });
+    it('strips unknown claims instead of rejecting them', () => {
+        expect(licensePayloadGuard.parse({ ...validPayload, iss: 'https://logto.io' })).toEqual(validPayload);
+    });
+});
+describe('ossDefaultQuota', () => {
+    it('locks every feature and caps SAML applications at 3', () => {
+        expect(ossDefaultQuota).toStrictEqual({
+            hideLogtoBranding: false,
+            bringYourUi: false,
+            idpInitiatedSso: false,
+            consoleCollaboration: false,
+            mandatoryMfa: false,
+            hostedEmail: false,
+            samlApplicationsLimit: 3,
+        });
+    });
+});
+describe('resolveLicenseQuota', () => {
+    it('falls back to the OSS defaults without a license', () => {
+        expect(resolveLicenseQuota()).toStrictEqual(ossDefaultQuota);
+    });
+    it('applies every entitlement a license grants', () => {
+        expect(resolveLicenseQuota(validPayload.quota)).toStrictEqual({
+            hideLogtoBranding: true,
+            bringYourUi: true,
+            idpInitiatedSso: true,
+            consoleCollaboration: true,
+            mandatoryMfa: true,
+            hostedEmail: false,
+            samlApplicationsLimit: null,
+        });
+    });
+    it('keeps the OSS default for an entitlement the license does not carry', () => {
+        expect(resolveLicenseQuota({ hideLogtoBranding: true })).toStrictEqual({
+            ...ossDefaultQuota,
+            hideLogtoBranding: true,
+        });
+    });
+    it('keeps an unlimited SAML application quota instead of falling back to the cap', () => {
+        expect(resolveLicenseQuota({ samlApplicationsLimit: null }).samlApplicationsLimit).toBeNull();
+    });
+    it('applies a SAML application quota of 0', () => {
+        expect(resolveLicenseQuota({ samlApplicationsLimit: 0 }).samlApplicationsLimit).toBe(0);
+    });
+    it('applies an explicitly disabled entitlement', () => {
+        expect(resolveLicenseQuota({ hostedEmail: false }).hostedEmail).toBe(false);
+    });
+});

package/lib/consts/oidc.d.ts

@@ -67,7 +67,17 @@ export declare enum ExtraParamsKey {
     /**
      * The Google One Tap credential JWT token for external website integration.
      */
-    GoogleOneTapCredential = "google_one_tap_credential"
+    GoogleOneTapCredential = "google_one_tap_credential",
+    /**
+     * Overrides the theme that the sign-in experience would otherwise resolve from the end-user's
+     * OS settings, so an application with its own light / dark toggle can keep Logto in sync.
+     *
+     * The parameter is ignored when dark mode is disabled in the sign-in experience configuration,
+     * and an unrecognized value is ignored without affecting the other parameters.
+     *
+     * The available values are `light` and `dark`.
+     */
+    Theme = "theme"
 }
 /** @deprecated Use {@link FirstScreen} instead. */
 export declare enum InteractionMode {
@@ -94,6 +104,7 @@ export declare const extraParamsObjectGuard: z.ZodObject<{
     identifier: z.ZodOptional<z.ZodString>;
     one_time_token: z.ZodOptional<z.ZodString>;
     google_one_tap_credential: z.ZodOptional<z.ZodString>;
+    theme: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     interaction_mode?: InteractionMode | undefined;
     first_screen?: FirstScreen | undefined;
@@ -104,6 +115,7 @@ export declare const extraParamsObjectGuard: z.ZodObject<{
     identifier?: string | undefined;
     one_time_token?: string | undefined;
     google_one_tap_credential?: string | undefined;
+    theme?: string | undefined;
 }, {
     interaction_mode?: InteractionMode | undefined;
     first_screen?: FirstScreen | undefined;
@@ -114,6 +126,7 @@ export declare const extraParamsObjectGuard: z.ZodObject<{
     identifier?: string | undefined;
     one_time_token?: string | undefined;
     google_one_tap_credential?: string | undefined;
+    theme?: string | undefined;
 }>;
 export type ExtraParamsObject = Partial<{
     [ExtraParamsKey.InteractionMode]: InteractionMode;
@@ -125,4 +138,5 @@ export type ExtraParamsObject = Partial<{
     [ExtraParamsKey.Identifier]: string;
     [ExtraParamsKey.OneTimeToken]: string;
     [ExtraParamsKey.GoogleOneTapCredential]: string;
+    [ExtraParamsKey.Theme]: string;
 }>;

package/lib/consts/oidc.js

@@ -70,6 +70,16 @@ export var ExtraParamsKey;
      * The Google One Tap credential JWT token for external website integration.
      */
     ExtraParamsKey["GoogleOneTapCredential"] = "google_one_tap_credential";
+    /**
+     * Overrides the theme that the sign-in experience would otherwise resolve from the end-user's
+     * OS settings, so an application with its own light / dark toggle can keep Logto in sync.
+     *
+     * The parameter is ignored when dark mode is disabled in the sign-in experience configuration,
+     * and an unrecognized value is ignored without affecting the other parameters.
+     *
+     * The available values are `light` and `dark`.
+     */
+    ExtraParamsKey["Theme"] = "theme";
 })(ExtraParamsKey || (ExtraParamsKey = {}));
 /** @deprecated Use {@link FirstScreen} instead. */
 export var InteractionMode;
@@ -99,5 +109,6 @@ export const extraParamsObjectGuard = z
     [ExtraParamsKey.Identifier]: z.string(),
     [ExtraParamsKey.OneTimeToken]: z.string(),
     [ExtraParamsKey.GoogleOneTapCredential]: z.string(),
+    [ExtraParamsKey.Theme]: z.string(),
 })
     .partial();

package/lib/consts/oidc.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/consts/oidc.test.js

@@ -0,0 +1,15 @@
+import { describe, expect, it } from 'vitest';
+import { ExtraParamsKey, FirstScreen, extraParamsObjectGuard } from './oidc.js';
+describe('extraParamsObjectGuard', () => {
+    it('should keep the other parameters when the theme is not a supported value', () => {
+        // Core parses every extra param in one call and falls back to an empty object when the
+        // parse throws, so a loose value here must never discard the parameters next to it.
+        const params = extraParamsObjectGuard.parse({
+            [ExtraParamsKey.Theme]: 'sepia',
+            [ExtraParamsKey.FirstScreen]: FirstScreen.Register,
+            [ExtraParamsKey.LoginHint]: 'foo@logto.io',
+        });
+        expect(params[ExtraParamsKey.FirstScreen]).toBe(FirstScreen.Register);
+        expect(params[ExtraParamsKey.LoginHint]).toBe('foo@logto.io');
+    });
+});

package/lib/consts/product-event.d.ts

@@ -67,7 +67,11 @@ export declare enum ProductEvent {
     MfaEnabled = "mfa enabled",
     MfaDisabled = "mfa disabled",
     CustomDomainCreated = "custom domain created",
-    CustomDomainDeleted = "custom domain deleted"
+    CustomDomainDeleted = "custom domain deleted",
+    /** The tenant has turned on dynamic app (CIMD) client access. */
+    DynamicAppEnabled = "dynamic app enabled",
+    /** The tenant has turned off dynamic app (CIMD) client access. */
+    DynamicAppDisabled = "dynamic app disabled"
 }
 /** The PostHog groups for product events. */
 export declare enum EventGroup {

package/lib/consts/product-event.js

@@ -69,6 +69,10 @@ export var ProductEvent;
     ProductEvent["MfaDisabled"] = "mfa disabled";
     ProductEvent["CustomDomainCreated"] = "custom domain created";
     ProductEvent["CustomDomainDeleted"] = "custom domain deleted";
+    /** The tenant has turned on dynamic app (CIMD) client access. */
+    ProductEvent["DynamicAppEnabled"] = "dynamic app enabled";
+    /** The tenant has turned off dynamic app (CIMD) client access. */
+    ProductEvent["DynamicAppDisabled"] = "dynamic app disabled";
 })(ProductEvent || (ProductEvent = {}));
 /** The PostHog groups for product events. */
 export var EventGroup;

package/lib/consts/social-state.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Prefixes of the OAuth `state` parameter used by the first-party clients that share the
+ * `/callback/:connectorId` social callback URI.
+ *
+ * Logto Core routes an incoming callback by looking at the `state` prefix, so the prefixes must
+ * never be a prefix of each other. Keep them defined together to preserve that invariant.
+ *
+ * A `state` carrying no known prefix falls back to the Sign-in Experience, which keeps in-flight
+ * requests and custom sign-in UIs that build their own `state` working.
+ */
+export declare const accountCenterSocialStatePrefix = "ac_";
+export declare const experienceSocialStatePrefix = "se_";

package/lib/consts/social-state.js

@@ -0,0 +1,12 @@
+/**
+ * Prefixes of the OAuth `state` parameter used by the first-party clients that share the
+ * `/callback/:connectorId` social callback URI.
+ *
+ * Logto Core routes an incoming callback by looking at the `state` prefix, so the prefixes must
+ * never be a prefix of each other. Keep them defined together to preserve that invariant.
+ *
+ * A `state` carrying no known prefix falls back to the Sign-in Experience, which keeps in-flight
+ * requests and custom sign-in UIs that build their own `state` working.
+ */
+export const accountCenterSocialStatePrefix = 'ac_';
+export const experienceSocialStatePrefix = 'se_';

package/lib/consts/subscriptions.d.ts

@@ -27,7 +27,19 @@ export declare enum ReservedPlanId {
     /**
      * Latest Pro plan ID applied from 2025-09.
      */
-    Pro202509 = "pro-202509"
+    Pro202509 = "pro-202509",
+    /**
+     * Self-hosted Pro plan, unlocked by installing a license key on a self-hosted instance.
+     *
+     * Unlike the plans above, this one is never returned by the Cloud subscription API: it is carried
+     * in the signed license payload and resolved locally. See `licensePayloadGuard`.
+     */
+    SelfHostedPro = "self-hosted-pro",
+    /**
+     * Self-hosted Enterprise plan, unlocked by installing a license key on a self-hosted instance.
+     * See {@link SelfHostedPro}.
+     */
+    SelfHostedEnterprise = "self-hosted-enterprise"
 }
 /**
  * Tenant subscription related Redis cache keys.

package/lib/consts/subscriptions.js

@@ -29,6 +29,18 @@ export var ReservedPlanId;
      * Latest Pro plan ID applied from 2025-09.
      */
     ReservedPlanId["Pro202509"] = "pro-202509";
+    /**
+     * Self-hosted Pro plan, unlocked by installing a license key on a self-hosted instance.
+     *
+     * Unlike the plans above, this one is never returned by the Cloud subscription API: it is carried
+     * in the signed license payload and resolved locally. See `licensePayloadGuard`.
+     */
+    ReservedPlanId["SelfHostedPro"] = "self-hosted-pro";
+    /**
+     * Self-hosted Enterprise plan, unlocked by installing a license key on a self-hosted instance.
+     * See {@link SelfHostedPro}.
+     */
+    ReservedPlanId["SelfHostedEnterprise"] = "self-hosted-enterprise";
 })(ReservedPlanId || (ReservedPlanId = {}));
 /**
  * Tenant subscription related Redis cache keys.

package/lib/db-entries/aggregated-daily-active-user.js

@@ -3,13 +3,13 @@ import { z } from 'zod';
 const createGuard = z.object({
     tenantId: z.string().max(21).optional(),
     activityDate: z.number(),
-    userId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(128),
     activityCount: z.number(),
 });
 const guard = z.object({
     tenantId: z.string().max(21),
     activityDate: z.number(),
-    userId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(128),
     activityCount: z.number(),
 });
 export const AggregatedDailyActiveUsers = Object.freeze({

package/lib/db-entries/application-access-control-user-relation.js

@@ -3,12 +3,12 @@ import { z } from 'zod';
 const createGuard = z.object({
     tenantId: z.string().max(21).optional(),
     applicationId: z.string().min(1).max(21),
-    userId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(128),
 });
 const guard = z.object({
     tenantId: z.string().max(21),
     applicationId: z.string().min(1).max(21),
-    userId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(128),
 });
 export const ApplicationAccessControlUserRelations = Object.freeze({
     table: 'application_access_control_user_relations',

package/lib/db-entries/application-user-consent-organization.js

@@ -4,13 +4,13 @@ const createGuard = z.object({
     tenantId: z.string().max(21).optional(),
     applicationId: z.string().min(1).max(21),
     organizationId: z.string().min(1).max(21),
-    userId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(128),
 });
 const guard = z.object({
     tenantId: z.string().max(21),
     applicationId: z.string().min(1).max(21),
     organizationId: z.string().min(1).max(21),
-    userId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(128),
 });
 export const ApplicationUserConsentOrganizations = Object.freeze({
     table: 'application_user_consent_organizations',

package/lib/db-entries/cimd-grant-client-snapshot.d.ts

@@ -0,0 +1,32 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The client identity a user approved at consent time for a client ID metadata document (CIMD) client, captured per Grant. CIMD clients are unregistered URL identities without an `applications` row, and an unvetted client can rewrite its hosted document at any time — so the grant list renders this snapshot instead of refetching the document.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link CimdGrantClientSnapshot} for the original type.
+ */
+export type CreateCimdGrantClientSnapshot = {
+    tenantId?: string;
+    /** The ID of the Grant row in `oidc_model_instances`. */
+    grantId: string;
+    /** Fixed discriminator so the composite foreign key can target Grant rows in the polymorphic `oidc_model_instances` table. */
+    grantModelName?: string;
+    clientId: string;
+    name?: string | null;
+    logoUri?: string | null;
+    createdAt?: number;
+};
+/** The client identity a user approved at consent time for a client ID metadata document (CIMD) client, captured per Grant. CIMD clients are unregistered URL identities without an `applications` row, and an unvetted client can rewrite its hosted document at any time — so the grant list renders this snapshot instead of refetching the document. */
+export type CimdGrantClientSnapshot = {
+    tenantId: string;
+    /** The ID of the Grant row in `oidc_model_instances`. */
+    grantId: string;
+    /** Fixed discriminator so the composite foreign key can target Grant rows in the polymorphic `oidc_model_instances` table. */
+    grantModelName: string;
+    clientId: string;
+    name: string | null;
+    logoUri: string | null;
+    createdAt: number;
+};
+export type CimdGrantClientSnapshotKeys = 'tenantId' | 'grantId' | 'grantModelName' | 'clientId' | 'name' | 'logoUri' | 'createdAt';
+export declare const CimdGrantClientSnapshots: GeneratedSchema<CimdGrantClientSnapshotKeys, CreateCimdGrantClientSnapshot, CimdGrantClientSnapshot, 'cimd_grant_client_snapshots', 'cimd_grant_client_snapshot'>;

package/lib/db-entries/cimd-grant-client-snapshot.js

@@ -0,0 +1,45 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    grantId: z.string().min(1).max(128),
+    grantModelName: z.string().min(1).max(64).optional(),
+    clientId: z.string().min(1).max(2048),
+    name: z.string().max(256).nullable().optional(),
+    logoUri: z.string().max(2048).nullable().optional(),
+    createdAt: z.number().optional(),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    grantId: z.string().min(1).max(128),
+    grantModelName: z.string().max(64),
+    clientId: z.string().min(1).max(2048),
+    name: z.string().max(256).nullable(),
+    logoUri: z.string().max(2048).nullable(),
+    createdAt: z.number(),
+});
+export const CimdGrantClientSnapshots = Object.freeze({
+    table: 'cimd_grant_client_snapshots',
+    tableSingular: 'cimd_grant_client_snapshot',
+    fields: {
+        tenantId: 'tenant_id',
+        grantId: 'grant_id',
+        grantModelName: 'grant_model_name',
+        clientId: 'client_id',
+        name: 'name',
+        logoUri: 'logo_uri',
+        createdAt: 'created_at',
+    },
+    fieldKeys: [
+        'tenantId',
+        'grantId',
+        'grantModelName',
+        'clientId',
+        'name',
+        'logoUri',
+        'createdAt',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/cimd-grant-organization.d.ts

@@ -0,0 +1,30 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The organization authorized on a single OIDC Grant for a client ID metadata document (CIMD) client. CIMD clients are unregistered URL identities with no deletion lifecycle and transferable ownership, so organization access follows the single authorization instead of a long-lived cross-grant relation: rows cascade away with the Grant row and with the user's organization membership.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link CimdGrantOrganization} for the original type.
+ */
+export type CreateCimdGrantOrganization = {
+    tenantId?: string;
+    /** The ID of the Grant row in `oidc_model_instances`. */
+    grantId: string;
+    /** Fixed discriminator so the composite foreign key can target Grant rows in the polymorphic `oidc_model_instances` table. */
+    grantModelName?: string;
+    organizationId: string;
+    /** The user the grant was issued to and the membership FK's target. Must match the Grant payload's `accountId` (unreachable by FK) — the consent write enforces the pairing. */
+    userId: string;
+};
+/** The organization authorized on a single OIDC Grant for a client ID metadata document (CIMD) client. CIMD clients are unregistered URL identities with no deletion lifecycle and transferable ownership, so organization access follows the single authorization instead of a long-lived cross-grant relation: rows cascade away with the Grant row and with the user's organization membership. */
+export type CimdGrantOrganization = {
+    tenantId: string;
+    /** The ID of the Grant row in `oidc_model_instances`. */
+    grantId: string;
+    /** Fixed discriminator so the composite foreign key can target Grant rows in the polymorphic `oidc_model_instances` table. */
+    grantModelName: string;
+    organizationId: string;
+    /** The user the grant was issued to and the membership FK's target. Must match the Grant payload's `accountId` (unreachable by FK) — the consent write enforces the pairing. */
+    userId: string;
+};
+export type CimdGrantOrganizationKeys = 'tenantId' | 'grantId' | 'grantModelName' | 'organizationId' | 'userId';
+export declare const CimdGrantOrganizations: GeneratedSchema<CimdGrantOrganizationKeys, CreateCimdGrantOrganization, CimdGrantOrganization, 'cimd_grant_organizations', 'cimd_grant_organization'>;

package/lib/db-entries/cimd-grant-organization.js

@@ -0,0 +1,37 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    grantId: z.string().min(1).max(128),
+    grantModelName: z.string().min(1).max(64).optional(),
+    organizationId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(128),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    grantId: z.string().min(1).max(128),
+    grantModelName: z.string().max(64),
+    organizationId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(128),
+});
+export const CimdGrantOrganizations = Object.freeze({
+    table: 'cimd_grant_organizations',
+    tableSingular: 'cimd_grant_organization',
+    fields: {
+        tenantId: 'tenant_id',
+        grantId: 'grant_id',
+        grantModelName: 'grant_model_name',
+        organizationId: 'organization_id',
+        userId: 'user_id',
+    },
+    fieldKeys: [
+        'tenantId',
+        'grantId',
+        'grantModelName',
+        'organizationId',
+        'userId',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/cimd-organization-resource-scope.d.ts

@@ -0,0 +1,20 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The organization API resource scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request. The scopes are granted to users through organization roles. Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link CimdOrganizationResourceScope} for the original type.
+ */
+export type CreateCimdOrganizationResourceScope = {
+    tenantId?: string;
+    /** The globally unique identifier of the API resource scope. */
+    scopeId: string;
+};
+/** The organization API resource scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request. The scopes are granted to users through organization roles. Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible. */
+export type CimdOrganizationResourceScope = {
+    tenantId: string;
+    /** The globally unique identifier of the API resource scope. */
+    scopeId: string;
+};
+export type CimdOrganizationResourceScopeKeys = 'tenantId' | 'scopeId';
+export declare const CimdOrganizationResourceScopes: GeneratedSchema<CimdOrganizationResourceScopeKeys, CreateCimdOrganizationResourceScope, CimdOrganizationResourceScope, 'cimd_organization_resource_scopes', 'cimd_organization_resource_scope'>;

package/lib/db-entries/cimd-organization-resource-scope.js

@@ -0,0 +1,25 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    scopeId: z.string().min(1).max(21),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    scopeId: z.string().min(1).max(21),
+});
+export const CimdOrganizationResourceScopes = Object.freeze({
+    table: 'cimd_organization_resource_scopes',
+    tableSingular: 'cimd_organization_resource_scope',
+    fields: {
+        tenantId: 'tenant_id',
+        scopeId: 'scope_id',
+    },
+    fieldKeys: [
+        'tenantId',
+        'scopeId',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/cimd-organization-scope.d.ts

@@ -0,0 +1,20 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The organization scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request. Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link CimdOrganizationScope} for the original type.
+ */
+export type CreateCimdOrganizationScope = {
+    tenantId?: string;
+    /** The globally unique identifier of the organization scope. */
+    organizationScopeId: string;
+};
+/** The organization scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request. Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible. */
+export type CimdOrganizationScope = {
+    tenantId: string;
+    /** The globally unique identifier of the organization scope. */
+    organizationScopeId: string;
+};
+export type CimdOrganizationScopeKeys = 'tenantId' | 'organizationScopeId';
+export declare const CimdOrganizationScopes: GeneratedSchema<CimdOrganizationScopeKeys, CreateCimdOrganizationScope, CimdOrganizationScope, 'cimd_organization_scopes', 'cimd_organization_scope'>;

package/lib/db-entries/cimd-organization-scope.js

@@ -0,0 +1,25 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    organizationScopeId: z.string().min(1).max(21),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    organizationScopeId: z.string().min(1).max(21),
+});
+export const CimdOrganizationScopes = Object.freeze({
+    table: 'cimd_organization_scopes',
+    tableSingular: 'cimd_organization_scope',
+    fields: {
+        tenantId: 'tenant_id',
+        organizationScopeId: 'organization_scope_id',
+    },
+    fieldKeys: [
+        'tenantId',
+        'organizationScopeId',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/cimd-resource-scope.d.ts

@@ -0,0 +1,20 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The API resource scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request. Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link CimdResourceScope} for the original type.
+ */
+export type CreateCimdResourceScope = {
+    tenantId?: string;
+    /** The globally unique identifier of the API resource scope. */
+    scopeId: string;
+};
+/** The API resource scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request. Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible. */
+export type CimdResourceScope = {
+    tenantId: string;
+    /** The globally unique identifier of the API resource scope. */
+    scopeId: string;
+};
+export type CimdResourceScopeKeys = 'tenantId' | 'scopeId';
+export declare const CimdResourceScopes: GeneratedSchema<CimdResourceScopeKeys, CreateCimdResourceScope, CimdResourceScope, 'cimd_resource_scopes', 'cimd_resource_scope'>;

package/lib/db-entries/cimd-resource-scope.js

@@ -0,0 +1,25 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    scopeId: z.string().min(1).max(21),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    scopeId: z.string().min(1).max(21),
+});
+export const CimdResourceScopes = Object.freeze({
+    table: 'cimd_resource_scopes',
+    tableSingular: 'cimd_resource_scope',
+    fields: {
+        tenantId: 'tenant_id',
+        scopeId: 'scope_id',
+    },
+    fieldKeys: [
+        'tenantId',
+        'scopeId',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/cimd-user-scope.d.ts

@@ -0,0 +1,20 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The user scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request. Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link CimdUserScope} for the original type.
+ */
+export type CreateCimdUserScope = {
+    tenantId?: string;
+    /** The unique UserScope enum value @see (@logto/core-kit/open-id.js) for more details */
+    userScope: string;
+};
+/** The user scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request. Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible. */
+export type CimdUserScope = {
+    tenantId: string;
+    /** The unique UserScope enum value @see (@logto/core-kit/open-id.js) for more details */
+    userScope: string;
+};
+export type CimdUserScopeKeys = 'tenantId' | 'userScope';
+export declare const CimdUserScopes: GeneratedSchema<CimdUserScopeKeys, CreateCimdUserScope, CimdUserScope, 'cimd_user_scopes', 'cimd_user_scope'>;