@logto/schemas 1.26.0 → 1.27.0

package/alterations/1.27.0-1744013256-add-sentinel-policy-column-to-sie-table.ts

@@ -0,0 +1,20 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table sign_in_experiences
+        add column sentinel_policy jsonb not null default '{}'::jsonb;
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table sign_in_experiences
+        drop column sentinel_policy;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.27.0-1744357867-add-sentinel-activities-hash-index.ts

@@ -0,0 +1,19 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      create index sentinel_activities__target_type_target_hash
+        on sentinel_activities (tenant_id, target_type, target_hash);
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      drop index sentinel_activities__target_type_target_hash;
+    `);
+  },
+};
+
+export default alteration;

package/alterations-js/1.27.0-1744013256-add-sentinel-policy-column-to-sie-table.js

@@ -0,0 +1,16 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      alter table sign_in_experiences
+        add column sentinel_policy jsonb not null default '{}'::jsonb;
+    `);
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      alter table sign_in_experiences
+        drop column sentinel_policy;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.27.0-1744357867-add-sentinel-activities-hash-index.js

@@ -0,0 +1,15 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      create index sentinel_activities__target_type_target_hash
+        on sentinel_activities (tenant_id, target_type, target_hash);
+    `);
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      drop index sentinel_activities__target_type_target_hash;
+    `);
+    },
+};
+export default alteration;

package/lib/consts/experience.d.ts

@@ -8,6 +8,6 @@ export declare const experience: Readonly<{
         readonly identifierSignIn: "identifier-sign-in";
         readonly identifierRegister: "identifier-register";
         readonly switchAccount: "switch-account";
-        readonly error: "error";
+        readonly oneTimeToken: "one-time-token";
     }>;
 }>;

package/lib/consts/experience.js

@@ -7,7 +7,7 @@ const routes = Object.freeze({
     identifierSignIn: 'identifier-sign-in',
     identifierRegister: 'identifier-register',
     switchAccount: 'switch-account',
-    error: 'error',
+    oneTimeToken: 'one-time-token',
 });
 export const experience = Object.freeze({
     routes,

package/lib/consts/index.d.ts

@@ -5,3 +5,4 @@ export * from './date.js';
 export * from './tenant.js';
 export * from './subscriptions.js';
 export * from './experience.js';
+export * from './sentinel.js';

package/lib/consts/index.js

@@ -5,3 +5,4 @@ export * from './date.js';
 export * from './tenant.js';
 export * from './subscriptions.js';
 export * from './experience.js';
+export * from './sentinel.js';

package/lib/consts/sentinel.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The default policy for this sentinel.
+ *
+ * - `maxAttempts`: 100
+ * - `lockoutDuration`: 60 minutes
+ */
+export declare const defaultSentinelPolicy: Readonly<{
+    maxAttempts: number;
+    lockoutDuration: number;
+}>;

package/lib/consts/sentinel.js

@@ -0,0 +1,10 @@
+/**
+ * The default policy for this sentinel.
+ *
+ * - `maxAttempts`: 100
+ * - `lockoutDuration`: 60 minutes
+ */
+export const defaultSentinelPolicy = Object.freeze({
+    maxAttempts: 100,
+    lockoutDuration: 60,
+});

package/lib/db-entries/sign-in-experience.d.ts

@@ -1,4 +1,4 @@
-import { Color, Branding, LanguageInfo, SignIn, SignUp, SocialSignIn, ConnectorTargets, CustomContent, CustomUiAssets, PartialPasswordPolicy, Mfa, CaptchaPolicy, GeneratedSchema } from './../foundations/index.js';
+import { Color, Branding, LanguageInfo, SignIn, SignUp, SocialSignIn, ConnectorTargets, CustomContent, CustomUiAssets, PartialPasswordPolicy, Mfa, CaptchaPolicy, SentinelPolicy, GeneratedSchema } from './../foundations/index.js';
 import { AgreeToTermsPolicy, SignInMode } from './custom-types.js';
 /**
  *
@@ -30,6 +30,7 @@ export type CreateSignInExperience = {
     supportWebsiteUrl?: string | null;
     unknownSessionRedirectUrl?: string | null;
     captchaPolicy?: CaptchaPolicy;
+    sentinelPolicy?: SentinelPolicy;
 };
 export type SignInExperience = {
     tenantId: string;
@@ -56,6 +57,7 @@ export type SignInExperience = {
     supportWebsiteUrl: string | null;
     unknownSessionRedirectUrl: string | null;
     captchaPolicy: CaptchaPolicy;
+    sentinelPolicy: SentinelPolicy;
 };
-export type SignInExperienceKeys = 'tenantId' | 'id' | 'color' | 'branding' | 'languageInfo' | 'termsOfUseUrl' | 'privacyPolicyUrl' | 'agreeToTermsPolicy' | 'signIn' | 'signUp' | 'socialSignIn' | 'socialSignInConnectorTargets' | 'signInMode' | 'customCss' | 'customContent' | 'customUiAssets' | 'passwordPolicy' | 'mfa' | 'singleSignOnEnabled' | 'supportEmail' | 'supportWebsiteUrl' | 'unknownSessionRedirectUrl' | 'captchaPolicy';
+export type SignInExperienceKeys = 'tenantId' | 'id' | 'color' | 'branding' | 'languageInfo' | 'termsOfUseUrl' | 'privacyPolicyUrl' | 'agreeToTermsPolicy' | 'signIn' | 'signUp' | 'socialSignIn' | 'socialSignInConnectorTargets' | 'signInMode' | 'customCss' | 'customContent' | 'customUiAssets' | 'passwordPolicy' | 'mfa' | 'singleSignOnEnabled' | 'supportEmail' | 'supportWebsiteUrl' | 'unknownSessionRedirectUrl' | 'captchaPolicy' | 'sentinelPolicy';
 export declare const SignInExperiences: GeneratedSchema<SignInExperienceKeys, CreateSignInExperience, SignInExperience, 'sign_in_experiences', 'sign_in_experience'>;

package/lib/db-entries/sign-in-experience.js

@@ -1,6 +1,6 @@
 // THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
 import { z } from 'zod';
-import { colorGuard, brandingGuard, languageInfoGuard, signInGuard, signUpGuard, socialSignInGuard, connectorTargetsGuard, customContentGuard, customUiAssetsGuard, partialPasswordPolicyGuard, mfaGuard, captchaPolicyGuard } from './../foundations/index.js';
+import { colorGuard, brandingGuard, languageInfoGuard, signInGuard, signUpGuard, socialSignInGuard, connectorTargetsGuard, customContentGuard, customUiAssetsGuard, partialPasswordPolicyGuard, mfaGuard, captchaPolicyGuard, sentinelPolicyGuard } from './../foundations/index.js';
 import { AgreeToTermsPolicy, SignInMode } from './custom-types.js';
 const createGuard = z.object({
     tenantId: z.string().max(21).optional(),
@@ -26,6 +26,7 @@ const createGuard = z.object({
     supportWebsiteUrl: z.string().nullable().optional(),
     unknownSessionRedirectUrl: z.string().nullable().optional(),
     captchaPolicy: captchaPolicyGuard.optional(),
+    sentinelPolicy: sentinelPolicyGuard.optional(),
 });
 const guard = z.object({
     tenantId: z.string().max(21),
@@ -51,6 +52,7 @@ const guard = z.object({
     supportWebsiteUrl: z.string().nullable(),
     unknownSessionRedirectUrl: z.string().nullable(),
     captchaPolicy: captchaPolicyGuard,
+    sentinelPolicy: sentinelPolicyGuard,
 });
 export const SignInExperiences = Object.freeze({
     table: 'sign_in_experiences',
@@ -79,6 +81,7 @@ export const SignInExperiences = Object.freeze({
         supportWebsiteUrl: 'support_website_url',
         unknownSessionRedirectUrl: 'unknown_session_redirect_url',
         captchaPolicy: 'captcha_policy',
+        sentinelPolicy: 'sentinel_policy',
     },
     fieldKeys: [
         'tenantId',
@@ -104,6 +107,7 @@ export const SignInExperiences = Object.freeze({
         'supportWebsiteUrl',
         'unknownSessionRedirectUrl',
         'captchaPolicy',
+        'sentinelPolicy',
     ],
     createGuard,
     guard,

package/lib/foundations/jsonb-types/applications.d.ts

@@ -8,12 +8,12 @@ export declare const customDomainGuard: z.ZodObject<{
         type: z.ZodString;
         value: z.ZodString;
     }, "strip", z.ZodTypeAny, {
-        type: string;
         value: string;
+        type: string;
         name: string;
     }, {
-        type: string;
         value: string;
+        type: string;
         name: string;
     }>, "many">;
     cloudflareData: z.ZodNullable<z.ZodObject<{
@@ -66,8 +66,8 @@ export declare const customDomainGuard: z.ZodObject<{
     domain: string;
     errorMessage: string | null;
     dnsRecords: {
-        type: string;
         value: string;
+        type: string;
         name: string;
     }[];
     cloudflareData: {
@@ -86,8 +86,8 @@ export declare const customDomainGuard: z.ZodObject<{
     domain: string;
     errorMessage: string | null;
     dnsRecords: {
-        type: string;
         value: string;
+        type: string;
         name: string;
     }[];
     cloudflareData: {
@@ -111,12 +111,12 @@ export declare const customDomainsGuard: z.ZodArray<z.ZodObject<{
         type: z.ZodString;
         value: z.ZodString;
     }, "strip", z.ZodTypeAny, {
-        type: string;
         value: string;
+        type: string;
         name: string;
     }, {
-        type: string;
         value: string;
+        type: string;
         name: string;
     }>, "many">;
     cloudflareData: z.ZodNullable<z.ZodObject<{
@@ -169,8 +169,8 @@ export declare const customDomainsGuard: z.ZodArray<z.ZodObject<{
     domain: string;
     errorMessage: string | null;
     dnsRecords: {
-        type: string;
         value: string;
+        type: string;
         name: string;
     }[];
     cloudflareData: {
@@ -189,8 +189,8 @@ export declare const customDomainsGuard: z.ZodArray<z.ZodObject<{
     domain: string;
     errorMessage: string | null;
     dnsRecords: {
-        type: string;
         value: string;
+        type: string;
         name: string;
     }[];
     cloudflareData: {
@@ -226,12 +226,12 @@ export declare const protectedAppMetadataGuard: z.ZodObject<{
             type: z.ZodString;
             value: z.ZodString;
         }, "strip", z.ZodTypeAny, {
-            type: string;
             value: string;
+            type: string;
             name: string;
         }, {
-            type: string;
             value: string;
+            type: string;
             name: string;
         }>, "many">;
         cloudflareData: z.ZodNullable<z.ZodObject<{
@@ -284,8 +284,8 @@ export declare const protectedAppMetadataGuard: z.ZodObject<{
         domain: string;
         errorMessage: string | null;
         dnsRecords: {
-            type: string;
             value: string;
+            type: string;
             name: string;
         }[];
         cloudflareData: {
@@ -304,8 +304,8 @@ export declare const protectedAppMetadataGuard: z.ZodObject<{
         domain: string;
         errorMessage: string | null;
         dnsRecords: {
-            type: string;
             value: string;
+            type: string;
             name: string;
         }[];
         cloudflareData: {
@@ -332,8 +332,8 @@ export declare const protectedAppMetadataGuard: z.ZodObject<{
         domain: string;
         errorMessage: string | null;
         dnsRecords: {
-            type: string;
             value: string;
+            type: string;
             name: string;
         }[];
         cloudflareData: {
@@ -360,8 +360,8 @@ export declare const protectedAppMetadataGuard: z.ZodObject<{
         domain: string;
         errorMessage: string | null;
         dnsRecords: {
-            type: string;
             value: string;
+            type: string;
             name: string;
         }[];
         cloudflareData: {

package/lib/foundations/jsonb-types/captcha.d.ts

@@ -16,6 +16,7 @@ export declare const turnstileConfigGuard: z.ZodObject<{
     siteKey: string;
     secretKey: string;
 }>;
+export type TurnstileConfig = z.infer<typeof turnstileConfigGuard>;
 export declare const recaptchaEnterpriseConfigGuard: z.ZodObject<{
     type: z.ZodLiteral<CaptchaType.RecaptchaEnterprise>;
     siteKey: z.ZodString;
@@ -32,6 +33,7 @@ export declare const recaptchaEnterpriseConfigGuard: z.ZodObject<{
     secretKey: string;
     projectId: string;
 }>;
+export type RecaptchaEnterpriseConfig = z.infer<typeof recaptchaEnterpriseConfigGuard>;
 export declare const captchaConfigGuard: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     type: z.ZodLiteral<CaptchaType.Turnstile>;
     siteKey: z.ZodString;

package/lib/foundations/jsonb-types/custom-domain.d.ts

@@ -4,12 +4,12 @@ export declare const domainDnsRecordGuard: z.ZodObject<{
     type: z.ZodString;
     value: z.ZodString;
 }, "strip", z.ZodTypeAny, {
-    type: string;
     value: string;
+    type: string;
     name: string;
 }, {
-    type: string;
     value: string;
+    type: string;
     name: string;
 }>;
 export type DomainDnsRecord = z.infer<typeof domainDnsRecordGuard>;
@@ -18,12 +18,12 @@ export declare const domainDnsRecordsGuard: z.ZodArray<z.ZodObject<{
     type: z.ZodString;
     value: z.ZodString;
 }, "strip", z.ZodTypeAny, {
-    type: string;
     value: string;
+    type: string;
     name: string;
 }, {
-    type: string;
     value: string;
+    type: string;
     name: string;
 }>, "many">;
 export type DomainDnsRecords = z.infer<typeof domainDnsRecordsGuard>;

package/lib/foundations/jsonb-types/sign-in-experience.d.ts

@@ -291,4 +291,24 @@ export declare const captchaPolicyGuard: z.ZodObject<{
     enabled?: boolean | undefined;
 }>;
 export type CaptchaPolicy = z.infer<typeof captchaPolicyGuard>;
+export type SentinelPolicy = {
+    /**
+     * Maximum failed attempts allowed in one hour before blocking the user.
+     */
+    maxAttempts?: number;
+    /**
+     * Lockout duration in minutes after exceeding the maximum failed attempts.
+     */
+    lockoutDuration?: number;
+};
+export declare const sentinelPolicyGuard: z.ZodObject<{
+    maxAttempts: z.ZodOptional<z.ZodNumber>;
+    lockoutDuration: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    maxAttempts?: number | undefined;
+    lockoutDuration?: number | undefined;
+}, {
+    maxAttempts?: number | undefined;
+    lockoutDuration?: number | undefined;
+}>;
 export {};

package/lib/foundations/jsonb-types/sign-in-experience.js

@@ -106,3 +106,7 @@ export const customUiAssetsGuard = z.object({
 export const captchaPolicyGuard = z.object({
     enabled: z.boolean().optional(),
 });
+export const sentinelPolicyGuard = z.object({
+    maxAttempts: z.number().optional(),
+    lockoutDuration: z.number().optional(),
+});

package/lib/types/application.d.ts

@@ -47,8 +47,8 @@ export declare const featuredApplicationGuard: z.ZodObject<Pick<{
             domain: string;
             errorMessage: string | null;
             dnsRecords: {
-                type: string;
                 value: string;
+                type: string;
                 name: string;
             }[];
             cloudflareData: {
@@ -75,8 +75,8 @@ export declare const featuredApplicationGuard: z.ZodObject<Pick<{
             domain: string;
             errorMessage: string | null;
             dnsRecords: {
-                type: string;
                 value: string;
+                type: string;
                 name: string;
             }[];
             cloudflareData: {
@@ -139,8 +139,8 @@ export declare const applicationCreateGuard: z.ZodObject<z.objectUtil.extendShap
             domain: string;
             errorMessage: string | null;
             dnsRecords: {
-                type: string;
                 value: string;
+                type: string;
                 name: string;
             }[];
             cloudflareData: {
@@ -167,8 +167,8 @@ export declare const applicationCreateGuard: z.ZodObject<z.objectUtil.extendShap
             domain: string;
             errorMessage: string | null;
             dnsRecords: {
-                type: string;
                 value: string;
+                type: string;
                 name: string;
             }[];
             cloudflareData: {
@@ -222,8 +222,8 @@ export declare const applicationCreateGuard: z.ZodObject<z.objectUtil.extendShap
             domain: string;
             errorMessage: string | null;
             dnsRecords: {
-                type: string;
                 value: string;
+                type: string;
                 name: string;
             }[];
             cloudflareData: {
@@ -250,8 +250,8 @@ export declare const applicationCreateGuard: z.ZodObject<z.objectUtil.extendShap
             domain: string;
             errorMessage: string | null;
             dnsRecords: {
-                type: string;
                 value: string;
+                type: string;
                 name: string;
             }[];
             cloudflareData: {
@@ -322,8 +322,8 @@ export declare const applicationPatchGuard: z.ZodObject<Omit<{
             domain: string;
             errorMessage: string | null;
             dnsRecords: {
-                type: string;
                 value: string;
+                type: string;
                 name: string;
             }[];
             cloudflareData: {
@@ -350,8 +350,8 @@ export declare const applicationPatchGuard: z.ZodObject<Omit<{
             domain: string;
             errorMessage: string | null;
             dnsRecords: {
-                type: string;
                 value: string;
+                type: string;
                 name: string;
             }[];
             cloudflareData: {

package/lib/types/consent.d.ts

@@ -174,8 +174,8 @@ export declare const publicApplicationGuard: z.ZodObject<Pick<{
             domain: string;
             errorMessage: string | null;
             dnsRecords: {
-                type: string;
                 value: string;
+                type: string;
                 name: string;
             }[];
             cloudflareData: {
@@ -202,8 +202,8 @@ export declare const publicApplicationGuard: z.ZodObject<Pick<{
             domain: string;
             errorMessage: string | null;
             dnsRecords: {
-                type: string;
                 value: string;
+                type: string;
                 name: string;
             }[];
             cloudflareData: {
@@ -480,8 +480,8 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
                 domain: string;
                 errorMessage: string | null;
                 dnsRecords: {
-                    type: string;
                     value: string;
+                    type: string;
                     name: string;
                 }[];
                 cloudflareData: {
@@ -508,8 +508,8 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
                 domain: string;
                 errorMessage: string | null;
                 dnsRecords: {
-                    type: string;
                     value: string;
+                    type: string;
                     name: string;
                 }[];
                 cloudflareData: {

package/lib/types/domain.d.ts

@@ -7,12 +7,12 @@ export declare const domainResponseGuard: z.ZodObject<Pick<{
     status: z.ZodType<import("../index.js").DomainStatus, z.ZodTypeDef, import("../index.js").DomainStatus>;
     errorMessage: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     dnsRecords: z.ZodType<{
-        type: string;
         value: string;
+        type: string;
         name: string;
     }[], z.ZodTypeDef, {
-        type: string;
         value: string;
+        type: string;
         name: string;
     }[]>;
     cloudflareData: z.ZodType<{

package/lib/types/interactions.d.ts

@@ -18,11 +18,11 @@ export declare const verificationIdentifierGuard: z.ZodObject<{
     type: z.ZodUnion<[z.ZodNativeEnum<typeof SignInIdentifier>, z.ZodNativeEnum<typeof AdditionalIdentifier>]>;
     value: z.ZodString;
 }, "strip", z.ZodTypeAny, {
-    type: SignInIdentifier | AdditionalIdentifier;
     value: string;
-}, {
     type: SignInIdentifier | AdditionalIdentifier;
+}, {
     value: string;
+    type: SignInIdentifier | AdditionalIdentifier;
 }>;
 /** Identifiers that can be used to uniquely identify a user. */
 export type InteractionIdentifier<T extends SignInIdentifier = SignInIdentifier> = {
@@ -33,11 +33,11 @@ export declare const interactionIdentifierGuard: z.ZodObject<{
     type: z.ZodNativeEnum<typeof SignInIdentifier>;
     value: z.ZodString;
 }, "strip", z.ZodTypeAny, {
-    type: SignInIdentifier;
     value: string;
-}, {
     type: SignInIdentifier;
+}, {
     value: string;
+    type: SignInIdentifier;
 }>;
 export type VerificationCodeSignInIdentifier = SignInIdentifier.Email | SignInIdentifier.Phone;
 /** Currently only email and phone are supported for verification code validation. */
@@ -49,11 +49,11 @@ export declare const verificationCodeIdentifierGuard: z.ZodObject<{
     type: z.ZodEnum<[SignInIdentifier.Email, SignInIdentifier.Phone]>;
     value: z.ZodString;
 }, "strip", z.ZodTypeAny, {
-    type: SignInIdentifier.Email | SignInIdentifier.Phone;
     value: string;
-}, {
     type: SignInIdentifier.Email | SignInIdentifier.Phone;
+}, {
     value: string;
+    type: SignInIdentifier.Email | SignInIdentifier.Phone;
 }>;
 /** Payload type for `POST /api/experience/verification/{social|sso}/:connectorId/authorization-uri`. */
 export type SocialAuthorizationUrlPayload = {
@@ -102,24 +102,24 @@ export declare const passwordVerificationPayloadGuard: z.ZodObject<{
         type: z.ZodNativeEnum<typeof SignInIdentifier>;
         value: z.ZodString;
     }, "strip", z.ZodTypeAny, {
-        type: SignInIdentifier;
         value: string;
-    }, {
         type: SignInIdentifier;
+    }, {
         value: string;
+        type: SignInIdentifier;
     }>;
     password: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     password: string;
     identifier: {
-        type: SignInIdentifier;
         value: string;
+        type: SignInIdentifier;
     };
 }, {
     password: string;
     identifier: {
-        type: SignInIdentifier;
         value: string;
+        type: SignInIdentifier;
     };
 }>;
 /** Payload type for `POST /api/experience/verification/totp/verify`. */
@@ -168,23 +168,23 @@ export declare const oneTimeTokenVerificationVerifyPayloadGuard: z.ZodObject<{
         type: z.ZodLiteral<SignInIdentifier.Email>;
         value: z.ZodString;
     }, "strip", z.ZodTypeAny, {
-        type: SignInIdentifier.Email;
         value: string;
-    }, {
         type: SignInIdentifier.Email;
+    }, {
         value: string;
+        type: SignInIdentifier.Email;
     }>;
     token: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     identifier: {
-        type: SignInIdentifier.Email;
         value: string;
+        type: SignInIdentifier.Email;
     };
     token: string;
 }, {
     identifier: {
-        type: SignInIdentifier.Email;
         value: string;
+        type: SignInIdentifier.Email;
     };
     token: string;
 }>;
@@ -235,20 +235,20 @@ export declare const updateProfileApiPayloadGuard: z.ZodDiscriminatedUnion<"type
     type: z.ZodLiteral<SignInIdentifier.Username>;
     value: z.ZodString;
 }, "strip", z.ZodTypeAny, {
-    type: SignInIdentifier.Username;
     value: string;
-}, {
     type: SignInIdentifier.Username;
+}, {
     value: string;
+    type: SignInIdentifier.Username;
 }>, z.ZodObject<{
     type: z.ZodLiteral<"password">;
     value: z.ZodString;
 }, "strip", z.ZodTypeAny, {
-    type: "password";
     value: string;
-}, {
     type: "password";
+}, {
     value: string;
+    type: "password";
 }>, z.ZodObject<{
     type: z.ZodLiteral<SignInIdentifier.Email>;
     verificationId: z.ZodString;

package/lib/types/log/interaction.d.ts

@@ -9,7 +9,8 @@ export declare enum Field {
     Profile = "Profile",
     BindMfa = "BindMfa",
     Mfa = "Mfa",
-    Verification = "Verification"
+    Verification = "Verification",
+    Captcha = "Captcha"
 }
 /** Method to verify the identifier */
 export declare enum Method {
@@ -67,4 +68,4 @@ export declare enum Action {
  *   - When {@link Method} is `VerificationCode`, {@link Action} can be `Create` (generate and send a code) or `Submit` (verify and submit to the identifiers);
  *   - Otherwise, {@link Action} is fixed to `Submit` (other methods can be verified on submitting).
  */
-export type LogKey = `${Prefix}.${Action.Create | Action.End}` | `${Prefix}.${InteractionEvent}.${Action.Create | Action.Update | Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.Profile}.${Action.Update | Action.Create | Action.Delete}` | `${Prefix}.${Exclude<InteractionEvent, InteractionEvent.ForgotPassword>}.${Field.Identifier}.${Exclude<Method, Method.Password>}.${Action.Create | Action.Submit}` | `${Prefix}.${Exclude<InteractionEvent, InteractionEvent.ForgotPassword>}.${Field.Identifier}.${Method.Password}.${Action.Submit}` | `${Prefix}.${InteractionEvent.ForgotPassword}.${Field.Identifier}.${Method.VerificationCode}.${Action.Create | Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.BindMfa}.${MfaFactor}.${Action.Submit | Action.Create}` | `${Prefix}.${InteractionEvent.SignIn}.${Field.Mfa}.${MfaFactor}.${Action.Submit | Action.Create}` | `${Prefix}.${InteractionEvent}.${Field.Verification}.${VerificationType}.${Action}` | `${Prefix}.${InteractionEvent}.${Field.Identifier}.${Action.Submit}` | `${Prefix}.${InteractionEvent.SignIn}.${Field.Verification}.IdpInitiatedSso.${Action.Create}`;
+export type LogKey = `${Prefix}.${Action.Create | Action.End}` | `${Prefix}.${Action.Create}.${Field.Captcha}` | `${Prefix}.${InteractionEvent}.${Action.Create | Action.Update | Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.Profile}.${Action.Update | Action.Create | Action.Delete}` | `${Prefix}.${Exclude<InteractionEvent, InteractionEvent.ForgotPassword>}.${Field.Identifier}.${Exclude<Method, Method.Password>}.${Action.Create | Action.Submit}` | `${Prefix}.${Exclude<InteractionEvent, InteractionEvent.ForgotPassword>}.${Field.Identifier}.${Method.Password}.${Action.Submit}` | `${Prefix}.${InteractionEvent.ForgotPassword}.${Field.Identifier}.${Method.VerificationCode}.${Action.Create | Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.BindMfa}.${MfaFactor}.${Action.Submit | Action.Create}` | `${Prefix}.${InteractionEvent.SignIn}.${Field.Mfa}.${MfaFactor}.${Action.Submit | Action.Create}` | `${Prefix}.${InteractionEvent}.${Field.Verification}.${VerificationType}.${Action}` | `${Prefix}.${InteractionEvent}.${Field.Identifier}.${Action.Submit}` | `${Prefix}.${InteractionEvent.SignIn}.${Field.Verification}.IdpInitiatedSso.${Action.Create}`;

package/lib/types/log/interaction.js

@@ -8,6 +8,7 @@ export var Field;
     Field["BindMfa"] = "BindMfa";
     Field["Mfa"] = "Mfa";
     Field["Verification"] = "Verification";
+    Field["Captcha"] = "Captcha";
 })(Field || (Field = {}));
 /** Method to verify the identifier */
 export var Method;

package/lib/types/saml-application.d.ts

@@ -35,8 +35,8 @@ export declare const samlApplicationCreateGuard: z.ZodObject<z.objectUtil.extend
             domain: string;
             errorMessage: string | null;
             dnsRecords: {
-                type: string;
                 value: string;
+                type: string;
                 name: string;
             }[];
             cloudflareData: {
@@ -63,8 +63,8 @@ export declare const samlApplicationCreateGuard: z.ZodObject<z.objectUtil.extend
             domain: string;
             errorMessage: string | null;
             dnsRecords: {
-                type: string;
                 value: string;
+                type: string;
                 name: string;
             }[];
             cloudflareData: {
@@ -118,8 +118,8 @@ export declare const samlApplicationCreateGuard: z.ZodObject<z.objectUtil.extend
             domain: string;
             errorMessage: string | null;
             dnsRecords: {
-                type: string;
                 value: string;
+                type: string;
                 name: string;
             }[];
             cloudflareData: {
@@ -146,8 +146,8 @@ export declare const samlApplicationCreateGuard: z.ZodObject<z.objectUtil.extend
             domain: string;
             errorMessage: string | null;
             dnsRecords: {
-                type: string;
                 value: string;
+                type: string;
                 name: string;
             }[];
             cloudflareData: {
@@ -243,8 +243,8 @@ export declare const samlApplicationPatchGuard: z.ZodObject<z.objectUtil.extendS
             domain: string;
             errorMessage: string | null;
             dnsRecords: {
-                type: string;
                 value: string;
+                type: string;
                 name: string;
             }[];
             cloudflareData: {
@@ -271,8 +271,8 @@ export declare const samlApplicationPatchGuard: z.ZodObject<z.objectUtil.extendS
             domain: string;
             errorMessage: string | null;
             dnsRecords: {
-                type: string;
                 value: string;
+                type: string;
                 name: string;
             }[];
             cloudflareData: {
@@ -372,8 +372,8 @@ export declare const samlApplicationResponseGuard: z.ZodObject<z.objectUtil.exte
             domain: string;
             errorMessage: string | null;
             dnsRecords: {
-                type: string;
                 value: string;
+                type: string;
                 name: string;
             }[];
             cloudflareData: {
@@ -400,8 +400,8 @@ export declare const samlApplicationResponseGuard: z.ZodObject<z.objectUtil.exte
             domain: string;
             errorMessage: string | null;
             dnsRecords: {
-                type: string;
                 value: string;
+                type: string;
                 name: string;
             }[];
             cloudflareData: {

package/lib/types/sign-in-experience.d.ts

@@ -134,6 +134,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<z.objectUtil.extendS
     }, z.ZodTypeDef, {
         enabled?: boolean | undefined;
     }>;
+    sentinelPolicy: z.ZodType<import("../foundations/jsonb-types/sign-in-experience.js").SentinelPolicy, z.ZodTypeDef, import("../foundations/jsonb-types/sign-in-experience.js").SentinelPolicy>;
 }, {
     socialConnectors: z.ZodArray<z.ZodObject<Omit<z.objectUtil.extendShape<{
         id: z.ZodString;
@@ -688,6 +689,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<z.objectUtil.extendS
     supportWebsiteUrl: string | null;
     unknownSessionRedirectUrl: string | null;
     captchaPolicy: import("../foundations/jsonb-types/sign-in-experience.js").CaptchaPolicy;
+    sentinelPolicy: import("../foundations/jsonb-types/sign-in-experience.js").SentinelPolicy;
     socialConnectors: {
         name: {
             en: string;
@@ -875,6 +877,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<z.objectUtil.extendS
     supportWebsiteUrl: string | null;
     unknownSessionRedirectUrl: string | null;
     captchaPolicy: import("../foundations/jsonb-types/sign-in-experience.js").CaptchaPolicy;
+    sentinelPolicy: import("../foundations/jsonb-types/sign-in-experience.js").SentinelPolicy;
     socialConnectors: {
         name: {
             en: string;

package/lib/types/system.d.ts

@@ -253,25 +253,8 @@ export type CloudflareType = {
 export declare const cloudflareGuard: Readonly<{
     [key in CloudflareKey]: ZodType<CloudflareType[key]>;
 }>;
-export declare enum FeatureFlagConfigKey {
-    NewExperienceFeatureFlag = "newExperienceFeatureFlag"
-}
-export declare const featureFlagConfigGuard: z.ZodObject<{
-    percentage: z.ZodNumber;
-}, "strip", z.ZodTypeAny, {
-    percentage: number;
-}, {
-    percentage: number;
-}>;
-export type FeatureFlagConfig = z.infer<typeof featureFlagConfigGuard>;
-export type FeatureFlagConfigType = {
-    [FeatureFlagConfigKey.NewExperienceFeatureFlag]: FeatureFlagConfig;
-};
-export declare const featureFlagConfigsGuard: Readonly<{
-    [key in FeatureFlagConfigKey]: ZodType<FeatureFlagConfigType[key]>;
-}>;
-export type SystemKey = AlterationStateKey | StorageProviderKey | DemoSocialKey | CloudflareKey | EmailServiceProviderKey | FeatureFlagConfigKey;
-export type SystemType = AlterationStateType | StorageProviderType | DemoSocialType | CloudflareType | EmailServiceProviderType | FeatureFlagConfigType;
-export type SystemGuard = typeof alterationStateGuard & typeof storageProviderGuard & typeof demoSocialGuard & typeof cloudflareGuard & typeof emailServiceProviderGuard & typeof featureFlagConfigsGuard;
+export type SystemKey = AlterationStateKey | StorageProviderKey | DemoSocialKey | CloudflareKey | EmailServiceProviderKey;
+export type SystemType = AlterationStateType | StorageProviderType | DemoSocialType | CloudflareType | EmailServiceProviderType;
+export type SystemGuard = typeof alterationStateGuard & typeof storageProviderGuard & typeof demoSocialGuard & typeof cloudflareGuard & typeof emailServiceProviderGuard;
 export declare const systemKeys: readonly SystemKey[];
 export declare const systemGuards: SystemGuard;

package/lib/types/system.js

@@ -146,24 +146,12 @@ export const cloudflareGuard = Object.freeze({
     [CloudflareKey.ProtectedAppHostnameProvider]: hostnameProviderDataGuard,
     [CloudflareKey.CustomJwtWorkerConfig]: customJwtWorkerConfigGuard,
 });
-// A/B Test settings
-export var FeatureFlagConfigKey;
-(function (FeatureFlagConfigKey) {
-    FeatureFlagConfigKey["NewExperienceFeatureFlag"] = "newExperienceFeatureFlag";
-})(FeatureFlagConfigKey || (FeatureFlagConfigKey = {}));
-export const featureFlagConfigGuard = z.object({
-    percentage: z.number().min(0).max(1),
-});
-export const featureFlagConfigsGuard = Object.freeze({
-    [FeatureFlagConfigKey.NewExperienceFeatureFlag]: featureFlagConfigGuard,
-});
 export const systemKeys = Object.freeze([
     ...Object.values(AlterationStateKey),
     ...Object.values(StorageProviderKey),
     ...Object.values(DemoSocialKey),
     ...Object.values(CloudflareKey),
     ...Object.values(EmailServiceProviderKey),
-    ...Object.values(FeatureFlagConfigKey),
 ]);
 export const systemGuards = Object.freeze({
     ...alterationStateGuard,
@@ -171,5 +159,4 @@ export const systemGuards = Object.freeze({
     ...demoSocialGuard,
     ...cloudflareGuard,
     ...emailServiceProviderGuard,
-    ...featureFlagConfigsGuard,
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/schemas",
-  "version": "1.26.0",
+  "version": "1.27.0",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "license": "MPL-2.0",
   "type": "module",
@@ -21,7 +21,7 @@
     "access": "public"
   },
   "engines": {
-    "node": "^20.9.0"
+    "node": "^22.14.0"
   },
   "devDependencies": {
     "@silverhand/eslint-config": "6.0.1",
@@ -29,18 +29,18 @@
     "@silverhand/slonik": "31.0.0-beta.2",
     "@silverhand/ts-config": "6.0.0",
     "@types/inquirer": "^9.0.0",
-    "@types/node": "^20.9.5",
+    "@types/node": "^22.14.0",
     "@types/pluralize": "^0.0.33",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^3.1.1",
     "camelcase": "^8.0.0",
     "chalk": "^5.3.0",
     "eslint": "^8.56.0",
     "lint-staged": "^15.0.0",
     "pluralize": "^8.0.0",
-    "prettier": "^3.0.0",
+    "prettier": "^3.5.3",
     "roarr": "^7.11.0",
     "typescript": "^5.5.3",
-    "vitest": "^2.1.9"
+    "vitest": "^3.1.1"
   },
   "eslintConfig": {
     "extends": "@silverhand",
@@ -63,17 +63,17 @@
   },
   "prettier": "@silverhand/eslint-config/.prettierrc",
   "dependencies": {
-    "@logto/connector-kit": "^4.2.0",
-    "@logto/core-kit": "^2.5.4",
-    "@logto/language-kit": "^1.1.3",
-    "@logto/phrases": "^1.18.0",
-    "@logto/phrases-experience": "^1.9.1",
-    "@logto/shared": "^3.1.4",
+    "@logto/connector-kit": "^4.3.0",
+    "@logto/core-kit": "^2.6.0",
+    "@logto/language-kit": "^1.2.0",
+    "@logto/phrases": "^1.19.0",
+    "@logto/phrases-experience": "^1.10.0",
+    "@logto/shared": "^3.2.0",
     "@withtyped/server": "^0.14.0",
     "nanoid": "^5.0.9"
   },
   "peerDependencies": {
-    "zod": "^3.23.8"
+    "zod": "^3.24.2"
   },
   "scripts": {
     "precommit": "lint-staged",

package/tables/sentinel_activities.sql

@@ -28,5 +28,8 @@ create table sentinel_activities (
 create index sentinel_activities__id
   on sentinel_activities (tenant_id, id);
 
+create index sentinel_activities__target_type_target_hash
+  on sentinel_activities (tenant_id, target_type, target_hash);
+
 create index sentinel_activities__target_type_target_hash_action_action_result_decision
   on sentinel_activities (tenant_id, target_type, target_hash, action, action_result, decision);

package/tables/sign_in_experiences.sql

@@ -27,5 +27,6 @@ create table sign_in_experiences (
   support_website_url text,
   unknown_session_redirect_url text,
   captcha_policy jsonb /* @use CaptchaPolicy */ not null default '{}'::jsonb,
+  sentinel_policy jsonb /* @use SentinelPolicy */ not null default '{}'::jsonb,
   primary key (tenant_id, id)
 );