AUTH4D-210 Flows: first sign-in and metadata conditions

AUTH4D-210 extends the AUTH4D-164 condition language. There are no new routes or migrations.

After-sign-in fact

The condition event for post_login includes is_first_sign_in:

The field is available only to post_login conditions. New guest accounts also count as first sign-ins. The user.signed_in Flows event carries the same boolean at data.is_first_sign_in. A sign-in paused for a hosted terms screen retains the original value.

Read-only metadata paths

Conditions for triggers with a user can read a single metadata value with a variable path such as user.metadata.level. The key must follow the existing user metadata key rules. Metadata is a flat object of at most 32 keys and 2,048 bytes; each value is a string, number, boolean or null. A missing key reads as null. pre_registration has no user and cannot read metadata.

Metadata paths are read-only. They do not add metadata to a token or change stored data. The evaluator loads metadata only when an expression references a metadata path, and reads it by both tenant_id and user_id. Existing condition expression limits still apply: depth 16, 600 nodes, 256 characters per string, 500 items per list and 10,000 work units.

Example condition expression:

{
  "and": [{ "var": "is_first_sign_in" }, { "==": [{ "var": "user.metadata.level" }, "gold"] }]
}

The expression compares a sign-in fact and one metadata value; it does not expose the full metadata object to the condition evaluator.