@logto/schemas 1.43.0 → 1.45.0

package/lib/types/saml-application.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { NameIdFormat } from '../foundations/index.js';
+import { NameIdFormat, type SamlAuthnRequestConfig } from '../foundations/index.js';
 export declare const samlApplicationCreateGuard: z.ZodObject<{
     name: z.ZodType<string, z.ZodTypeDef, string>;
     customData: z.ZodOptional<z.ZodOptional<z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>>>;
@@ -16,6 +16,15 @@ export declare const samlApplicationCreateGuard: z.ZodObject<{
         encryptThenSign?: boolean | undefined;
         certificate?: string | undefined;
     } | null>>;
+    authnRequestConfig: z.ZodOptional<z.ZodType<{
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null, z.ZodTypeDef, {
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null>>;
 } & {
     nameIdFormat: z.ZodDefault<z.ZodOptional<z.ZodNativeEnum<typeof NameIdFormat>>>;
 }, "strip", z.ZodTypeAny, {
@@ -31,6 +40,11 @@ export declare const samlApplicationCreateGuard: z.ZodObject<{
         encryptThenSign?: boolean | undefined;
         certificate?: string | undefined;
     } | null | undefined;
+    authnRequestConfig?: {
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null | undefined;
 }, {
     name: string;
     customData?: import("@withtyped/server/lib/types.js").JsonObject;
@@ -43,6 +57,11 @@ export declare const samlApplicationCreateGuard: z.ZodObject<{
         encryptThenSign?: boolean | undefined;
         certificate?: string | undefined;
     } | null | undefined;
+    authnRequestConfig?: {
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null | undefined;
     nameIdFormat?: NameIdFormat | undefined;
 }>;
 export type CreateSamlApplication = z.input<typeof samlApplicationCreateGuard>;
@@ -63,6 +82,15 @@ export declare const samlApplicationPatchGuard: z.ZodObject<{
         encryptThenSign?: boolean | undefined;
         certificate?: string | undefined;
     } | null>>;
+    authnRequestConfig: z.ZodOptional<z.ZodType<{
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null, z.ZodTypeDef, {
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null>>;
 } & {
     nameIdFormat: z.ZodOptional<z.ZodNativeEnum<typeof NameIdFormat>>;
 }, "strip", z.ZodTypeAny, {
@@ -78,6 +106,11 @@ export declare const samlApplicationPatchGuard: z.ZodObject<{
         encryptThenSign?: boolean | undefined;
         certificate?: string | undefined;
     } | null | undefined;
+    authnRequestConfig?: {
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null | undefined;
     nameIdFormat?: NameIdFormat | undefined;
 }, {
     name?: string | undefined;
@@ -92,6 +125,11 @@ export declare const samlApplicationPatchGuard: z.ZodObject<{
         encryptThenSign?: boolean | undefined;
         certificate?: string | undefined;
     } | null | undefined;
+    authnRequestConfig?: {
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null | undefined;
     nameIdFormat?: NameIdFormat | undefined;
 }>;
 export type PatchSamlApplication = z.infer<typeof samlApplicationPatchGuard>;
@@ -117,6 +155,15 @@ export declare const samlApplicationResponseGuard: z.ZodObject<{
         encryptThenSign?: boolean | undefined;
         certificate?: string | undefined;
     } | null>;
+    authnRequestConfig: z.ZodType<{
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null, z.ZodTypeDef, {
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null>;
 } & {
     nameIdFormat: z.ZodNativeEnum<typeof NameIdFormat>;
 }, "strip", z.ZodTypeAny, {
@@ -133,6 +180,7 @@ export declare const samlApplicationResponseGuard: z.ZodObject<{
     entityId: string | null;
     acsUrl: import("../foundations/index.js").SamlAcsUrl | null;
     encryption: import("../foundations/index.js").SamlEncryption | null;
+    authnRequestConfig: SamlAuthnRequestConfig | null;
     nameIdFormat: NameIdFormat;
 }, {
     type: import("../index.js").ApplicationType;
@@ -148,6 +196,7 @@ export declare const samlApplicationResponseGuard: z.ZodObject<{
     entityId: string | null;
     acsUrl: import("../foundations/index.js").SamlAcsUrl | null;
     encryption: import("../foundations/index.js").SamlEncryption | null;
+    authnRequestConfig: SamlAuthnRequestConfig | null;
     nameIdFormat: NameIdFormat;
 }>;
 export type SamlApplicationResponse = z.infer<typeof samlApplicationResponseGuard>;
@@ -238,4 +287,9 @@ export declare const samlApplicationSecretResponseGuard: z.ZodObject<Omit<{
     };
 }>;
 export type SamlApplicationSecretResponse = z.infer<typeof samlApplicationSecretResponseGuard>;
+/**
+ * Whether a SAML application forces fresh authentication. Forcing is the default; only an explicit
+ * `forceAuthn: false` lets the application reuse an existing session.
+ */
+export declare const isSamlForceAuthnEnabled: (config?: SamlAuthnRequestConfig | null) => boolean;
 export {};

package/lib/types/saml-application.js

@@ -2,13 +2,14 @@ import { z } from 'zod';
 import { Applications } from '../db-entries/application.js';
 import { SamlApplicationConfigs } from '../db-entries/saml-application-config.js';
 import { SamlApplicationSecrets } from '../db-entries/saml-application-secret.js';
-import { nameIdFormatGuard, NameIdFormat } from '../foundations/index.js';
+import { nameIdFormatGuard, NameIdFormat, } from '../foundations/index.js';
 import { applicationCreateGuard, applicationPatchGuard } from './application.js';
 const samlAppConfigGuard = SamlApplicationConfigs.guard.pick({
     attributeMapping: true,
     entityId: true,
     acsUrl: true,
     encryption: true,
+    authnRequestConfig: true,
     nameIdFormat: true,
 });
 export const samlApplicationCreateGuard = applicationCreateGuard
@@ -61,3 +62,8 @@ export const samlApplicationSecretResponseGuard = SamlApplicationSecrets.guard
     .extend({
     fingerprints: certificateFingerprintsGuard,
 });
+/**
+ * Whether a SAML application forces fresh authentication. Forcing is the default; only an explicit
+ * `forceAuthn: false` lets the application reuse an existing session.
+ */
+export const isSamlForceAuthnEnabled = (config) => config?.forceAuthn !== false;

package/lib/types/sign-in-experience.d.ts

@@ -12,9 +12,7 @@ type ForgotPassword = {
  * the need to load the full connector metadata that is not needed for rendering.
  */
 export type ExperienceSocialConnector = Omit<ConnectorMetadata, 'description' | 'configTemplate' | 'formItems' | 'readme' | 'customData'>;
-export type FullSignInExperience = Omit<SignInExperience, 'emailBlocklistPolicy' | 'forgotPasswordMethods' | 'trustedDevice'> & {
-    /** Available while the MFA trusted-device feature is under development. */
-    trustedDevice?: SignInExperience['trustedDevice'];
+export type FullSignInExperience = Omit<SignInExperience, 'emailBlocklistPolicy' | 'forgotPasswordMethods'> & {
     socialConnectors: ExperienceSocialConnector[];
     ssoConnectors: SsoConnectorMetadata[];
     forgotPassword: ForgotPassword;
@@ -34,6 +32,8 @@ export type FullSignInExperience = Omit<SignInExperience, 'emailBlocklistPolicy'
     captchaConfig?: {
         type: CaptchaType;
         siteKey: string;
+        /** The Cap Standalone instance URL, only available for {@link CaptchaType.Cap}. */
+        endpoint?: string;
         domain?: string;
         mode?: RecaptchaEnterpriseMode;
     };
@@ -163,8 +163,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     }[] | null>;
     passwordExpiration: z.ZodType<import("../foundations/jsonb-types/sign-in-experience.js").PasswordExpirationPolicy, z.ZodTypeDef, import("../foundations/jsonb-types/sign-in-experience.js").PasswordExpirationPolicy>;
     usernamePolicy: z.ZodType<import("../foundations/jsonb-types/index.js").UsernamePolicy, z.ZodTypeDef, import("../foundations/jsonb-types/index.js").UsernamePolicy>;
-}, "trustedDevice" | "emailBlocklistPolicy" | "forgotPasswordMethods"> & {
-    trustedDevice: z.ZodOptional<z.ZodType<import("../foundations/jsonb-types/sign-in-experience.js").TrustedDevicePolicy, z.ZodTypeDef, import("../foundations/jsonb-types/sign-in-experience.js").TrustedDevicePolicy>>;
+}, "emailBlocklistPolicy" | "forgotPasswordMethods"> & {
     socialConnectors: z.ZodArray<z.ZodObject<Omit<{
         id: z.ZodString;
         target: z.ZodString;
@@ -703,6 +702,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     captchaConfig: z.ZodOptional<z.ZodObject<{
         type: z.ZodNativeEnum<typeof CaptchaType>;
         siteKey: z.ZodString;
+        endpoint: z.ZodOptional<z.ZodString>;
         domain: z.ZodOptional<z.ZodString>;
         mode: z.ZodOptional<z.ZodNativeEnum<typeof RecaptchaEnterpriseMode>>;
     }, "strip", z.ZodTypeAny, {
@@ -710,11 +710,13 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
         siteKey: string;
         domain?: string | undefined;
         mode?: RecaptchaEnterpriseMode | undefined;
+        endpoint?: string | undefined;
     }, {
         type: CaptchaType;
         siteKey: string;
         domain?: string | undefined;
         mode?: RecaptchaEnterpriseMode | undefined;
+        endpoint?: string | undefined;
     }>>;
     customProfileFields: z.ZodArray<import("../index.js").Guard<CustomProfileField>, "many">;
     customProfileFieldCatalog: z.ZodOptional<z.ZodArray<import("../index.js").Guard<CustomProfileField>, "many">>;
@@ -722,6 +724,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     id: string;
     tenantId: string;
     mfa: import("../foundations/jsonb-types/sign-in-experience.js").Mfa;
+    trustedDevice: import("../foundations/jsonb-types/sign-in-experience.js").TrustedDevicePolicy;
     customCss: string | null;
     color: import("../foundations/jsonb-types/sign-in-experience.js").Color;
     branding: import("../foundations/jsonb-types/sign-in-experience.js").Branding;
@@ -906,7 +909,6 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     };
     isDevelopmentTenant: boolean;
     customProfileFields: CustomProfileField[];
-    trustedDevice?: import("../foundations/jsonb-types/sign-in-experience.js").TrustedDevicePolicy | undefined;
     googleOneTap?: {
         clientId: string;
         connectorId: string;
@@ -920,12 +922,14 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
         siteKey: string;
         domain?: string | undefined;
         mode?: RecaptchaEnterpriseMode | undefined;
+        endpoint?: string | undefined;
     } | undefined;
     customProfileFieldCatalog?: CustomProfileField[] | undefined;
 }, {
     id: string;
     tenantId: string;
     mfa: import("../foundations/jsonb-types/sign-in-experience.js").Mfa;
+    trustedDevice: import("../foundations/jsonb-types/sign-in-experience.js").TrustedDevicePolicy;
     customCss: string | null;
     color: import("../foundations/jsonb-types/sign-in-experience.js").Color;
     branding: import("../foundations/jsonb-types/sign-in-experience.js").Branding;
@@ -1110,7 +1114,6 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     };
     isDevelopmentTenant: boolean;
     customProfileFields: CustomProfileField[];
-    trustedDevice?: import("../foundations/jsonb-types/sign-in-experience.js").TrustedDevicePolicy | undefined;
     googleOneTap?: {
         clientId: string;
         connectorId: string;
@@ -1124,6 +1127,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
         siteKey: string;
         domain?: string | undefined;
         mode?: RecaptchaEnterpriseMode | undefined;
+        endpoint?: string | undefined;
     } | undefined;
     customProfileFieldCatalog?: CustomProfileField[] | undefined;
 }>;

package/lib/types/sign-in-experience.js

@@ -4,9 +4,8 @@ import { CustomProfileFields, SignInExperiences, } from '../db-entries/index.js'
 import { CaptchaType, RecaptchaEnterpriseMode } from '../foundations/jsonb-types/index.js';
 import { ssoConnectorMetadataGuard } from './sso-connector.js';
 export const fullSignInExperienceGuard = SignInExperiences.guard
-    .omit({ emailBlocklistPolicy: true, forgotPasswordMethods: true, trustedDevice: true })
+    .omit({ emailBlocklistPolicy: true, forgotPasswordMethods: true })
     .extend({
-    trustedDevice: SignInExperiences.guard.shape.trustedDevice.optional(),
     socialConnectors: connectorMetadataGuard
         .omit({
         description: true,
@@ -26,6 +25,7 @@ export const fullSignInExperienceGuard = SignInExperiences.guard
         .object({
         type: z.nativeEnum(CaptchaType),
         siteKey: z.string(),
+        endpoint: z.string().optional(),
         domain: z.string().optional(),
         mode: z.nativeEnum(RecaptchaEnterpriseMode).optional(),
     })

package/lib/types/ssr.d.ts

@@ -1,6 +1,7 @@
 import { type LocalePhrase } from '@logto/phrases-experience';
 import { type SignInExperience } from '../db-entries/index.js';
 import { type FullSignInExperience } from './sign-in-experience.js';
+import { type Theme } from './theme.js';
 /**
  * The server-side rendering data type for **experience**.
  */
@@ -9,6 +10,7 @@ export type SsrData = {
         appId?: string;
         organizationId?: string;
         uiLocales?: string;
+        theme?: Theme;
         data: FullSignInExperience;
     };
     phrases: {

package/lib/types/system.d.ts

@@ -48,8 +48,8 @@ export declare const storageProviderDataGuard: z.ZodDiscriminatedUnion<"provider
     accessKeyId: string;
     accessSecretKey: string;
     region?: string | undefined;
-    publicUrl?: string | undefined;
     endpoint?: string | undefined;
+    publicUrl?: string | undefined;
     forcePathStyle?: boolean | undefined;
 }, {
     provider: StorageProvider.S3Storage;
@@ -57,8 +57,8 @@ export declare const storageProviderDataGuard: z.ZodDiscriminatedUnion<"provider
     accessKeyId: string;
     accessSecretKey: string;
     region?: string | undefined;
-    publicUrl?: string | undefined;
     endpoint?: string | undefined;
+    publicUrl?: string | undefined;
     forcePathStyle?: boolean | undefined;
 }>, z.ZodObject<{
     publicUrl: z.ZodOptional<z.ZodString>;
@@ -292,8 +292,60 @@ export type CloudflareType = {
 export declare const cloudflareGuard: Readonly<{
     [key in CloudflareKey]: ZodType<CloudflareType[key]>;
 }>;
-export type SystemKey = AlterationStateKey | StorageProviderKey | DemoSocialKey | CloudflareKey | EmailServiceProviderKey;
-export type SystemType = AlterationStateType | StorageProviderType | DemoSocialType | CloudflareType | EmailServiceProviderType;
-export type SystemGuard = typeof alterationStateGuard & typeof storageProviderGuard & typeof demoSocialGuard & typeof cloudflareGuard & typeof emailServiceProviderGuard;
+/**
+ * The license key installed on a self-hosted instance, stored verbatim so it can be re-verified on
+ * every read and re-signed on refresh. The `systems` table is global, so one deployment installs
+ * one license no matter how many instances share the database.
+ */
+export declare const installedLicenseGuard: z.ZodObject<{
+    /** The raw ES256-signed license key JWT, exactly as it was installed. */
+    jwt: z.ZodString;
+    /** When the key was installed, as an ISO 8601 timestamp. */
+    installedAt: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    jwt: string;
+    installedAt: string;
+}, {
+    jwt: string;
+    installedAt: string;
+}>;
+export type InstalledLicense = z.infer<typeof installedLicenseGuard>;
+export declare enum LicenseKey {
+    License = "license",
+    LicenseRefreshState = "licenseRefreshState",
+    LicenseDeploymentId = "licenseDeploymentId"
+}
+export type LicenseType = {
+    [LicenseKey.License]: InstalledLicense;
+    [LicenseKey.LicenseRefreshState]: LicenseRefreshState;
+    [LicenseKey.LicenseDeploymentId]: LicenseDeploymentId;
+};
+/** The state shared by all instances while they lazily refresh the installed license. */
+export declare const licenseRefreshStateGuard: z.ZodObject<{
+    /** The last successful refresh, or the `iat` of the installed key. */
+    lastRefreshedAt: z.ZodString;
+    /** The last refresh attempt. Absent before the first read after installation. */
+    lastAttemptAt: z.ZodOptional<z.ZodString>;
+    /** The refusal reason returned by the license service, if the last attempt was refused. */
+    refusalReason: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    lastRefreshedAt: string;
+    lastAttemptAt?: string | undefined;
+    refusalReason?: string | undefined;
+}, {
+    lastRefreshedAt: string;
+    lastAttemptAt?: string | undefined;
+    refusalReason?: string | undefined;
+}>;
+export type LicenseRefreshState = z.infer<typeof licenseRefreshStateGuard>;
+/** The stable identifier shared by every Core instance using this `systems` table. */
+export declare const licenseDeploymentIdGuard: z.ZodString;
+export type LicenseDeploymentId = z.infer<typeof licenseDeploymentIdGuard>;
+export declare const licenseGuard: Readonly<{
+    [key in LicenseKey]: ZodType<LicenseType[key]>;
+}>;
+export type SystemKey = AlterationStateKey | StorageProviderKey | DemoSocialKey | CloudflareKey | EmailServiceProviderKey | LicenseKey;
+export type SystemType = AlterationStateType | StorageProviderType | DemoSocialType | CloudflareType | EmailServiceProviderType | LicenseType;
+export type SystemGuard = typeof alterationStateGuard & typeof storageProviderGuard & typeof demoSocialGuard & typeof cloudflareGuard & typeof emailServiceProviderGuard & typeof licenseGuard;
 export declare const systemKeys: readonly SystemKey[];
 export declare const systemGuards: SystemGuard;

package/lib/types/system.js

@@ -155,12 +155,47 @@ export const cloudflareGuard = Object.freeze({
     [CloudflareKey.ProtectedAppHostnameProvider]: hostnameProviderDataGuard,
     [CloudflareKey.CustomJwtWorkerConfig]: customJwtWorkerConfigGuard,
 });
+// Self-hosted license
+/**
+ * The license key installed on a self-hosted instance, stored verbatim so it can be re-verified on
+ * every read and re-signed on refresh. The `systems` table is global, so one deployment installs
+ * one license no matter how many instances share the database.
+ */
+export const installedLicenseGuard = z.object({
+    /** The raw ES256-signed license key JWT, exactly as it was installed. */
+    jwt: z.string(),
+    /** When the key was installed, as an ISO 8601 timestamp. */
+    installedAt: z.string(),
+});
+export var LicenseKey;
+(function (LicenseKey) {
+    LicenseKey["License"] = "license";
+    LicenseKey["LicenseRefreshState"] = "licenseRefreshState";
+    LicenseKey["LicenseDeploymentId"] = "licenseDeploymentId";
+})(LicenseKey || (LicenseKey = {}));
+/** The state shared by all instances while they lazily refresh the installed license. */
+export const licenseRefreshStateGuard = z.object({
+    /** The last successful refresh, or the `iat` of the installed key. */
+    lastRefreshedAt: z.string(),
+    /** The last refresh attempt. Absent before the first read after installation. */
+    lastAttemptAt: z.string().optional(),
+    /** The refusal reason returned by the license service, if the last attempt was refused. */
+    refusalReason: z.string().optional(),
+});
+/** The stable identifier shared by every Core instance using this `systems` table. */
+export const licenseDeploymentIdGuard = z.string().min(1);
+export const licenseGuard = Object.freeze({
+    [LicenseKey.License]: installedLicenseGuard,
+    [LicenseKey.LicenseRefreshState]: licenseRefreshStateGuard,
+    [LicenseKey.LicenseDeploymentId]: licenseDeploymentIdGuard,
+});
 export const systemKeys = Object.freeze([
     ...Object.values(AlterationStateKey),
     ...Object.values(StorageProviderKey),
     ...Object.values(DemoSocialKey),
     ...Object.values(CloudflareKey),
     ...Object.values(EmailServiceProviderKey),
+    ...Object.values(LicenseKey),
 ]);
 export const systemGuards = Object.freeze({
     ...alterationStateGuard,
@@ -168,4 +203,5 @@ export const systemGuards = Object.freeze({
     ...demoSocialGuard,
     ...cloudflareGuard,
     ...emailServiceProviderGuard,
+    ...licenseGuard,
 });

package/lib/types/system.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/types/system.test.js

@@ -0,0 +1,26 @@
+import { describe, expect, it } from 'vitest';
+import { LicenseKey, systemGuards, systemKeys } from './system.js';
+describe('license system entries', () => {
+    it('registers the license key, so the CLI accepts it', () => {
+        expect(systemKeys).toContain(LicenseKey.License);
+        expect(systemKeys).toContain(LicenseKey.LicenseRefreshState);
+        expect(systemKeys).toContain(LicenseKey.LicenseDeploymentId);
+    });
+    it('parses an installed license row', () => {
+        const value = { jwt: 'header.payload.signature', installedAt: '2026-01-01T00:00:00.000Z' };
+        expect(systemGuards[LicenseKey.License].parse(value)).toEqual(value);
+    });
+    it('rejects an installed license row without a key', () => {
+        expect(systemGuards[LicenseKey.License].safeParse({ installedAt: '2026-01-01T00:00:00.000Z' })
+            .success).toBe(false);
+    });
+    it('parses refresh state and a deployment ID', () => {
+        const state = {
+            lastRefreshedAt: '2026-01-01T00:00:00.000Z',
+            lastAttemptAt: '2026-01-02T00:00:00.000Z',
+            refusalReason: 'canceled',
+        };
+        expect(systemGuards[LicenseKey.LicenseRefreshState].parse(state)).toEqual(state);
+        expect(systemGuards[LicenseKey.LicenseDeploymentId].parse('deployment_123')).toBe('deployment_123');
+    });
+});

package/lib/types/tenant-organization.d.ts

@@ -39,7 +39,7 @@ export declare const getTenantOrganizationCreateData: (tenantId: string) => Read
 export declare enum TenantScope {
     /** Read the tenant data. */
     ReadData = "read:data",
-    /** Write the tenant data, including creating and updating the tenant. */
+    /** Write the tenant data. */
     WriteData = "write:data",
     /** Delete data of the tenant. */
     DeleteData = "delete:data",
@@ -83,7 +83,9 @@ export declare enum TenantRole {
     /** Admin of the tenant, who has all permissions. */
     Admin = "admin",
     /** Collaborator of the tenant, who has permissions to operate the tenant data, but not the tenant settings. */
-    Collaborator = "collaborator"
+    Collaborator = "collaborator",
+    /** Viewer of the tenant, who can read the tenant data and members but cannot change anything. */
+    Viewer = "viewer"
 }
 /**
  * Given a tenant role, return the corresponding organization role data in the admin tenant.

package/lib/types/tenant-organization.js

@@ -50,7 +50,7 @@ export var TenantScope;
 (function (TenantScope) {
     /** Read the tenant data. */
     TenantScope["ReadData"] = "read:data";
-    /** Write the tenant data, including creating and updating the tenant. */
+    /** Write the tenant data. */
     TenantScope["WriteData"] = "write:data";
     /** Delete data of the tenant. */
     TenantScope["DeleteData"] = "delete:data";
@@ -92,7 +92,7 @@ export const getTenantScope = (scope) => Object.freeze({
 });
 const tenantScopeDescriptions = Object.freeze({
     [TenantScope.ReadData]: 'Read the tenant data.',
-    [TenantScope.WriteData]: 'Write the tenant data, including creating and updating the tenant.',
+    [TenantScope.WriteData]: 'Write the tenant data.',
     [TenantScope.DeleteData]: 'Delete data of the tenant.',
     [TenantScope.ReadMember]: 'Read members of the tenant.',
     [TenantScope.InviteMember]: 'Invite members to the tenant.',
@@ -112,10 +112,13 @@ export var TenantRole;
     TenantRole["Admin"] = "admin";
     /** Collaborator of the tenant, who has permissions to operate the tenant data, but not the tenant settings. */
     TenantRole["Collaborator"] = "collaborator";
+    /** Viewer of the tenant, who can read the tenant data and members but cannot change anything. */
+    TenantRole["Viewer"] = "viewer";
 })(TenantRole || (TenantRole = {}));
 const tenantRoleDescriptions = Object.freeze({
     [TenantRole.Admin]: 'Admin of the tenant, who has all permissions.',
     [TenantRole.Collaborator]: 'Collaborator of the tenant, who has permissions to operate the tenant data, but not the tenant settings.',
+    [TenantRole.Viewer]: 'Viewer of the tenant, who can read the tenant data and members but cannot change anything.',
 });
 /**
  * Given a tenant role, return the corresponding organization role data in the admin tenant.
@@ -155,4 +158,5 @@ export const tenantRoleScopes = Object.freeze({
         TenantScope.DeleteData,
         TenantScope.ReadMember,
     ],
+    [TenantRole.Viewer]: [TenantScope.ReadData, TenantScope.ReadMember],
 });

package/lib/types/tenant-organization.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/types/tenant-organization.test.js

@@ -0,0 +1,16 @@
+import { describe, expect, it } from 'vitest';
+import { TenantRole, TenantScope, tenantRoleScopes } from './tenant-organization.js';
+describe('tenantRoleScopes', () => {
+    it('grants each tenant role its scopes', () => {
+        expect(tenantRoleScopes).toEqual({
+            [TenantRole.Admin]: Object.values(TenantScope),
+            [TenantRole.Collaborator]: [
+                TenantScope.ReadData,
+                TenantScope.WriteData,
+                TenantScope.DeleteData,
+                TenantScope.ReadMember,
+            ],
+            [TenantRole.Viewer]: [TenantScope.ReadData, TenantScope.ReadMember],
+        });
+    });
+});