@logto/schemas 1.28.0 → 1.30.0

package/lib/types/user.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { Users, UserSsoIdentities } from '../db-entries/index.js';
-import { MfaFactor } from '../foundations/index.js';
+import { identityGuard, MfaFactor } from '../foundations/index.js';
+import { desensitizedEnterpriseSsoTokenSetSecretGuard, desensitizedSocialTokenSetSecretGuard, } from './secrets.js';
 export const userInfoSelectFields = Object.freeze([
     'id',
     'username',
@@ -30,6 +31,7 @@ export const userMfaVerificationResponseGuard = z
     createdAt: z.string(),
     type: z.nativeEnum(MfaFactor),
     agent: z.string().optional(),
+    name: z.string().optional(),
     remainCodes: z.number().optional(),
 })
     .array();
@@ -64,3 +66,17 @@ export const featuredUserGuard = Users.guard.pick({
     avatar: true,
     name: true,
 });
+export const consoleUserPreferenceKey = 'adminConsolePreferences';
+export const guideRequestsKey = 'guideRequests';
+export const getUserSocialIdentityResponseGuard = z.object({
+    identity: identityGuard,
+    tokenSecret: desensitizedSocialTokenSetSecretGuard.optional(),
+});
+export const getUserSsoIdentityResponseGuard = z.object({
+    ssoIdentity: UserSsoIdentities.guard,
+    tokenSecret: desensitizedEnterpriseSsoTokenSetSecretGuard.optional(),
+});
+export const getUserAllIdentitiesResponseGuard = z.object({
+    socialIdentities: getUserSocialIdentityResponseGuard.extend({ target: z.string() }).array(),
+    ssoIdentities: getUserSsoIdentityResponseGuard.extend({ ssoConnectorId: z.string() }).array(),
+});

package/lib/types/verification-records/backup-code-verification.d.ts

@@ -0,0 +1,47 @@
+import { z } from 'zod';
+import { VerificationType } from './verification-type.js';
+export type BackupCodeVerificationRecordData = {
+    id: string;
+    type: VerificationType.BackupCode;
+    /** UserId is required for backup code verification */
+    userId: string;
+    code?: string;
+    backupCodes?: string[];
+};
+export declare const backupCodeVerificationRecordDataGuard: z.ZodObject<{
+    id: z.ZodString;
+    type: z.ZodLiteral<VerificationType.BackupCode>;
+    userId: z.ZodString;
+    code: z.ZodOptional<z.ZodString>;
+    backupCodes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    type: VerificationType.BackupCode;
+    id: string;
+    userId: string;
+    code?: string | undefined;
+    backupCodes?: string[] | undefined;
+}, {
+    type: VerificationType.BackupCode;
+    id: string;
+    userId: string;
+    code?: string | undefined;
+    backupCodes?: string[] | undefined;
+}>;
+export type SanitizedBackupCodeVerificationRecordData = Omit<BackupCodeVerificationRecordData, 'backupCodes'>;
+export declare const sanitizedBackupCodeVerificationRecordDataGuard: z.ZodObject<Omit<{
+    id: z.ZodString;
+    type: z.ZodLiteral<VerificationType.BackupCode>;
+    userId: z.ZodString;
+    code: z.ZodOptional<z.ZodString>;
+    backupCodes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "backupCodes">, "strip", z.ZodTypeAny, {
+    type: VerificationType.BackupCode;
+    id: string;
+    userId: string;
+    code?: string | undefined;
+}, {
+    type: VerificationType.BackupCode;
+    id: string;
+    userId: string;
+    code?: string | undefined;
+}>;

package/lib/types/verification-records/backup-code-verification.js

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+import { VerificationType } from './verification-type.js';
+export const backupCodeVerificationRecordDataGuard = z.object({
+    id: z.string(),
+    type: z.literal(VerificationType.BackupCode),
+    userId: z.string(),
+    code: z.string().optional(),
+    backupCodes: z.string().array().optional(),
+});
+export const sanitizedBackupCodeVerificationRecordDataGuard = backupCodeVerificationRecordDataGuard.omit({
+    backupCodes: true,
+});

package/lib/types/verification-records/code-verification.d.ts

@@ -0,0 +1,89 @@
+import { z } from 'zod';
+import { SignInIdentifier, TemplateType } from '../../foundations/index.js';
+import { type VerificationCodeIdentifier } from '../interactions.js';
+import { VerificationType } from './verification-type.js';
+export type CodeVerificationType = VerificationType.EmailVerificationCode | VerificationType.PhoneVerificationCode;
+type SignInIdentifierTypeOf = {
+    [VerificationType.EmailVerificationCode]: SignInIdentifier.Email;
+    [VerificationType.PhoneVerificationCode]: SignInIdentifier.Phone;
+};
+export type VerificationCodeIdentifierOf<T extends CodeVerificationType> = VerificationCodeIdentifier<SignInIdentifierTypeOf[T]>;
+/** The JSON data type for the `CodeVerification` record */
+export type CodeVerificationRecordData<T extends CodeVerificationType = CodeVerificationType> = {
+    id: string;
+    type: T;
+    identifier: VerificationCodeIdentifierOf<T>;
+    templateType: TemplateType;
+    verified: boolean;
+};
+export declare const emailCodeVerificationRecordDataGuard: z.ZodObject<{
+    id: z.ZodString;
+    templateType: z.ZodNativeEnum<typeof TemplateType>;
+    verified: z.ZodBoolean;
+} & {
+    type: z.ZodLiteral<VerificationType.EmailVerificationCode>;
+    identifier: z.ZodObject<{
+        type: z.ZodLiteral<SignInIdentifier.Email>;
+        value: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        value: string;
+        type: SignInIdentifier.Email;
+    }, {
+        value: string;
+        type: SignInIdentifier.Email;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    type: VerificationType.EmailVerificationCode;
+    id: string;
+    identifier: {
+        value: string;
+        type: SignInIdentifier.Email;
+    };
+    templateType: TemplateType;
+    verified: boolean;
+}, {
+    type: VerificationType.EmailVerificationCode;
+    id: string;
+    identifier: {
+        value: string;
+        type: SignInIdentifier.Email;
+    };
+    templateType: TemplateType;
+    verified: boolean;
+}>;
+export declare const phoneCodeVerificationRecordDataGuard: z.ZodObject<{
+    id: z.ZodString;
+    templateType: z.ZodNativeEnum<typeof TemplateType>;
+    verified: z.ZodBoolean;
+} & {
+    type: z.ZodLiteral<VerificationType.PhoneVerificationCode>;
+    identifier: z.ZodObject<{
+        type: z.ZodLiteral<SignInIdentifier.Phone>;
+        value: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        value: string;
+        type: SignInIdentifier.Phone;
+    }, {
+        value: string;
+        type: SignInIdentifier.Phone;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    type: VerificationType.PhoneVerificationCode;
+    id: string;
+    identifier: {
+        value: string;
+        type: SignInIdentifier.Phone;
+    };
+    templateType: TemplateType;
+    verified: boolean;
+}, {
+    type: VerificationType.PhoneVerificationCode;
+    id: string;
+    identifier: {
+        value: string;
+        type: SignInIdentifier.Phone;
+    };
+    templateType: TemplateType;
+    verified: boolean;
+}>;
+export {};

package/lib/types/verification-records/code-verification.js

@@ -0,0 +1,22 @@
+import { z } from 'zod';
+import { SignInIdentifier, TemplateType } from '../../foundations/index.js';
+import { VerificationType } from './verification-type.js';
+const basicCodeVerificationRecordDataGuard = z.object({
+    id: z.string(),
+    templateType: z.nativeEnum(TemplateType),
+    verified: z.boolean(),
+});
+export const emailCodeVerificationRecordDataGuard = basicCodeVerificationRecordDataGuard.extend({
+    type: z.literal(VerificationType.EmailVerificationCode),
+    identifier: z.object({
+        type: z.literal(SignInIdentifier.Email),
+        value: z.string(),
+    }),
+});
+export const phoneCodeVerificationRecordDataGuard = basicCodeVerificationRecordDataGuard.extend({
+    type: z.literal(VerificationType.PhoneVerificationCode),
+    identifier: z.object({
+        type: z.literal(SignInIdentifier.Phone),
+        value: z.string(),
+    }),
+});

package/lib/types/verification-records/enterprise-sso-verification.d.ts

@@ -0,0 +1,213 @@
+import { z } from 'zod';
+import { type EncryptedTokenSet } from '../secrets.js';
+import { type ExtendedSocialUserInfo } from '../sso-connector.js';
+import { VerificationType } from './verification-type.js';
+/** The JSON data type for the EnterpriseSsoVerification record stored in the interaction storage */
+export type EnterpriseSsoVerificationRecordData = {
+    id: string;
+    connectorId: string;
+    type: VerificationType.EnterpriseSso;
+    /**
+     * The enterprise SSO identity returned by the connector.
+     */
+    enterpriseSsoUserInfo?: ExtendedSocialUserInfo;
+    encryptedTokenSet?: EncryptedTokenSet;
+    issuer?: string;
+};
+export declare const enterpriseSsoVerificationRecordDataGuard: z.ZodObject<{
+    id: z.ZodString;
+    connectorId: z.ZodString;
+    type: z.ZodLiteral<VerificationType.EnterpriseSso>;
+    enterpriseSsoUserInfo: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+        phone: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        avatar: z.ZodOptional<z.ZodString>;
+        rawData: z.ZodOptional<z.ZodType<import("@withtyped/server").Json, z.ZodTypeDef, import("@withtyped/server").Json>>;
+    }, "strip", z.ZodUnknown, z.objectOutputType<{
+        id: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+        phone: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        avatar: z.ZodOptional<z.ZodString>;
+        rawData: z.ZodOptional<z.ZodType<import("@withtyped/server").Json, z.ZodTypeDef, import("@withtyped/server").Json>>;
+    }, z.ZodUnknown, "strip">, z.objectInputType<{
+        id: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+        phone: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        avatar: z.ZodOptional<z.ZodString>;
+        rawData: z.ZodOptional<z.ZodType<import("@withtyped/server").Json, z.ZodTypeDef, import("@withtyped/server").Json>>;
+    }, z.ZodUnknown, "strip">>>;
+    encryptedTokenSet: z.ZodOptional<z.ZodObject<{
+        encryptedTokenSetBase64: z.ZodString;
+        metadata: z.ZodObject<{
+            scope: z.ZodOptional<z.ZodString>;
+            expiresAt: z.ZodOptional<z.ZodNumber>;
+            tokenType: z.ZodOptional<z.ZodString>;
+            hasRefreshToken: z.ZodBoolean;
+        }, "strip", z.ZodTypeAny, {
+            hasRefreshToken: boolean;
+            scope?: string | undefined;
+            expiresAt?: number | undefined;
+            tokenType?: string | undefined;
+        }, {
+            hasRefreshToken: boolean;
+            scope?: string | undefined;
+            expiresAt?: number | undefined;
+            tokenType?: string | undefined;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        metadata: {
+            hasRefreshToken: boolean;
+            scope?: string | undefined;
+            expiresAt?: number | undefined;
+            tokenType?: string | undefined;
+        };
+        encryptedTokenSetBase64: string;
+    }, {
+        metadata: {
+            hasRefreshToken: boolean;
+            scope?: string | undefined;
+            expiresAt?: number | undefined;
+            tokenType?: string | undefined;
+        };
+        encryptedTokenSetBase64: string;
+    }>>;
+    issuer: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: VerificationType.EnterpriseSso;
+    id: string;
+    connectorId: string;
+    issuer?: string | undefined;
+    enterpriseSsoUserInfo?: z.objectOutputType<{
+        id: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+        phone: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        avatar: z.ZodOptional<z.ZodString>;
+        rawData: z.ZodOptional<z.ZodType<import("@withtyped/server").Json, z.ZodTypeDef, import("@withtyped/server").Json>>;
+    }, z.ZodUnknown, "strip"> | undefined;
+    encryptedTokenSet?: {
+        metadata: {
+            hasRefreshToken: boolean;
+            scope?: string | undefined;
+            expiresAt?: number | undefined;
+            tokenType?: string | undefined;
+        };
+        encryptedTokenSetBase64: string;
+    } | undefined;
+}, {
+    type: VerificationType.EnterpriseSso;
+    id: string;
+    connectorId: string;
+    issuer?: string | undefined;
+    enterpriseSsoUserInfo?: z.objectInputType<{
+        id: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+        phone: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        avatar: z.ZodOptional<z.ZodString>;
+        rawData: z.ZodOptional<z.ZodType<import("@withtyped/server").Json, z.ZodTypeDef, import("@withtyped/server").Json>>;
+    }, z.ZodUnknown, "strip"> | undefined;
+    encryptedTokenSet?: {
+        metadata: {
+            hasRefreshToken: boolean;
+            scope?: string | undefined;
+            expiresAt?: number | undefined;
+            tokenType?: string | undefined;
+        };
+        encryptedTokenSetBase64: string;
+    } | undefined;
+}>;
+export type SanitizedEnterpriseSsoVerificationRecordData = Omit<EnterpriseSsoVerificationRecordData, 'encryptedTokenSet'>;
+export declare const sanitizedEnterpriseSsoVerificationRecordDataGuard: z.ZodObject<Omit<{
+    id: z.ZodString;
+    connectorId: z.ZodString;
+    type: z.ZodLiteral<VerificationType.EnterpriseSso>;
+    enterpriseSsoUserInfo: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+        phone: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        avatar: z.ZodOptional<z.ZodString>;
+        rawData: z.ZodOptional<z.ZodType<import("@withtyped/server").Json, z.ZodTypeDef, import("@withtyped/server").Json>>;
+    }, "strip", z.ZodUnknown, z.objectOutputType<{
+        id: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+        phone: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        avatar: z.ZodOptional<z.ZodString>;
+        rawData: z.ZodOptional<z.ZodType<import("@withtyped/server").Json, z.ZodTypeDef, import("@withtyped/server").Json>>;
+    }, z.ZodUnknown, "strip">, z.objectInputType<{
+        id: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+        phone: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        avatar: z.ZodOptional<z.ZodString>;
+        rawData: z.ZodOptional<z.ZodType<import("@withtyped/server").Json, z.ZodTypeDef, import("@withtyped/server").Json>>;
+    }, z.ZodUnknown, "strip">>>;
+    encryptedTokenSet: z.ZodOptional<z.ZodObject<{
+        encryptedTokenSetBase64: z.ZodString;
+        metadata: z.ZodObject<{
+            scope: z.ZodOptional<z.ZodString>;
+            expiresAt: z.ZodOptional<z.ZodNumber>;
+            tokenType: z.ZodOptional<z.ZodString>;
+            hasRefreshToken: z.ZodBoolean;
+        }, "strip", z.ZodTypeAny, {
+            hasRefreshToken: boolean;
+            scope?: string | undefined;
+            expiresAt?: number | undefined;
+            tokenType?: string | undefined;
+        }, {
+            hasRefreshToken: boolean;
+            scope?: string | undefined;
+            expiresAt?: number | undefined;
+            tokenType?: string | undefined;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        metadata: {
+            hasRefreshToken: boolean;
+            scope?: string | undefined;
+            expiresAt?: number | undefined;
+            tokenType?: string | undefined;
+        };
+        encryptedTokenSetBase64: string;
+    }, {
+        metadata: {
+            hasRefreshToken: boolean;
+            scope?: string | undefined;
+            expiresAt?: number | undefined;
+            tokenType?: string | undefined;
+        };
+        encryptedTokenSetBase64: string;
+    }>>;
+    issuer: z.ZodOptional<z.ZodString>;
+}, "encryptedTokenSet">, "strip", z.ZodTypeAny, {
+    type: VerificationType.EnterpriseSso;
+    id: string;
+    connectorId: string;
+    issuer?: string | undefined;
+    enterpriseSsoUserInfo?: z.objectOutputType<{
+        id: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+        phone: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        avatar: z.ZodOptional<z.ZodString>;
+        rawData: z.ZodOptional<z.ZodType<import("@withtyped/server").Json, z.ZodTypeDef, import("@withtyped/server").Json>>;
+    }, z.ZodUnknown, "strip"> | undefined;
+}, {
+    type: VerificationType.EnterpriseSso;
+    id: string;
+    connectorId: string;
+    issuer?: string | undefined;
+    enterpriseSsoUserInfo?: z.objectInputType<{
+        id: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+        phone: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        avatar: z.ZodOptional<z.ZodString>;
+        rawData: z.ZodOptional<z.ZodType<import("@withtyped/server").Json, z.ZodTypeDef, import("@withtyped/server").Json>>;
+    }, z.ZodUnknown, "strip"> | undefined;
+}>;

package/lib/types/verification-records/enterprise-sso-verification.js

@@ -0,0 +1,15 @@
+import { z } from 'zod';
+import { encryptedTokenSetGuard } from '../secrets.js';
+import { extendedSocialUserInfoGuard } from '../sso-connector.js';
+import { VerificationType } from './verification-type.js';
+export const enterpriseSsoVerificationRecordDataGuard = z.object({
+    id: z.string(),
+    connectorId: z.string(),
+    type: z.literal(VerificationType.EnterpriseSso),
+    enterpriseSsoUserInfo: extendedSocialUserInfoGuard.optional(),
+    encryptedTokenSet: encryptedTokenSetGuard.optional(),
+    issuer: z.string().optional(),
+});
+export const sanitizedEnterpriseSsoVerificationRecordDataGuard = enterpriseSsoVerificationRecordDataGuard.omit({
+    encryptedTokenSet: true,
+});

package/lib/types/verification-records/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * This file defines the data types and guards for verification records in Logto.
+ * We keep these definitions in @logto/schemas to ensure it can be shared accross different packages.
+ *
+ * Check {@link @logto/core/src/routes/experience/classes/verifications} for the implementation of verification records.
+ */
+export * from './verification-type.js';
+export * from './backup-code-verification.js';
+export * from './code-verification.js';
+export * from './enterprise-sso-verification.js';
+export * from './new-password-identity-verification.js';
+export * from './one-time-token-verification.js';
+export * from './password-verification.js';
+export * from './social-verification.js';
+export * from './totp-verification.js';
+export * from './web-authn-verification.js';

package/lib/types/verification-records/index.js

@@ -0,0 +1,16 @@
+/**
+ * This file defines the data types and guards for verification records in Logto.
+ * We keep these definitions in @logto/schemas to ensure it can be shared accross different packages.
+ *
+ * Check {@link @logto/core/src/routes/experience/classes/verifications} for the implementation of verification records.
+ */
+export * from './verification-type.js';
+export * from './backup-code-verification.js';
+export * from './code-verification.js';
+export * from './enterprise-sso-verification.js';
+export * from './new-password-identity-verification.js';
+export * from './one-time-token-verification.js';
+export * from './password-verification.js';
+export * from './social-verification.js';
+export * from './totp-verification.js';
+export * from './web-authn-verification.js';

package/lib/types/verification-records/new-password-identity-verification.d.ts

@@ -0,0 +1,85 @@
+/**
+ * @deprecated
+ * This verification record type is deprecated.
+ * DO NOT use this verification record type in new code.
+ */
+import { z } from 'zod';
+import { UsersPasswordEncryptionMethod } from '../../db-entries/custom-types.js';
+import { type InteractionIdentifier } from '../interactions.js';
+import { VerificationType } from './verification-type.js';
+export type NewPasswordIdentityVerificationRecordData = {
+    id: string;
+    type: VerificationType.NewPasswordIdentity;
+    /**
+     * For now we only support username identifier for new password identity registration.
+     * For email and phone new identity registration, a `CodeVerification` record is required.
+     */
+    identifier: InteractionIdentifier;
+    passwordEncrypted?: string;
+    passwordEncryptionMethod?: UsersPasswordEncryptionMethod.Argon2i;
+};
+export declare const newPasswordIdentityVerificationRecordDataGuard: z.ZodObject<{
+    id: z.ZodString;
+    type: z.ZodLiteral<VerificationType.NewPasswordIdentity>;
+    identifier: z.ZodObject<{
+        type: z.ZodNativeEnum<typeof import("../../index.js").SignInIdentifier>;
+        value: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        value: string;
+        type: import("../../index.js").SignInIdentifier;
+    }, {
+        value: string;
+        type: import("../../index.js").SignInIdentifier;
+    }>;
+    passwordEncrypted: z.ZodOptional<z.ZodString>;
+    passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<UsersPasswordEncryptionMethod.Argon2i>>;
+}, "strip", z.ZodTypeAny, {
+    type: VerificationType.NewPasswordIdentity;
+    id: string;
+    identifier: {
+        value: string;
+        type: import("../../index.js").SignInIdentifier;
+    };
+    passwordEncrypted?: string | undefined;
+    passwordEncryptionMethod?: UsersPasswordEncryptionMethod.Argon2i | undefined;
+}, {
+    type: VerificationType.NewPasswordIdentity;
+    id: string;
+    identifier: {
+        value: string;
+        type: import("../../index.js").SignInIdentifier;
+    };
+    passwordEncrypted?: string | undefined;
+    passwordEncryptionMethod?: UsersPasswordEncryptionMethod.Argon2i | undefined;
+}>;
+export type SanitizedNewPasswordIdentityVerificationRecordData = Omit<NewPasswordIdentityVerificationRecordData, 'passwordEncrypted' | 'passwordEncryptionMethod'>;
+export declare const sanitizedNewPasswordIdentityVerificationRecordDataGuard: z.ZodObject<Omit<{
+    id: z.ZodString;
+    type: z.ZodLiteral<VerificationType.NewPasswordIdentity>;
+    identifier: z.ZodObject<{
+        type: z.ZodNativeEnum<typeof import("../../index.js").SignInIdentifier>;
+        value: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        value: string;
+        type: import("../../index.js").SignInIdentifier;
+    }, {
+        value: string;
+        type: import("../../index.js").SignInIdentifier;
+    }>;
+    passwordEncrypted: z.ZodOptional<z.ZodString>;
+    passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<UsersPasswordEncryptionMethod.Argon2i>>;
+}, "passwordEncrypted" | "passwordEncryptionMethod">, "strip", z.ZodTypeAny, {
+    type: VerificationType.NewPasswordIdentity;
+    id: string;
+    identifier: {
+        value: string;
+        type: import("../../index.js").SignInIdentifier;
+    };
+}, {
+    type: VerificationType.NewPasswordIdentity;
+    id: string;
+    identifier: {
+        value: string;
+        type: import("../../index.js").SignInIdentifier;
+    };
+}>;

package/lib/types/verification-records/new-password-identity-verification.js

@@ -0,0 +1,20 @@
+/**
+ * @deprecated
+ * This verification record type is deprecated.
+ * DO NOT use this verification record type in new code.
+ */
+import { z } from 'zod';
+import { UsersPasswordEncryptionMethod } from '../../db-entries/custom-types.js';
+import { interactionIdentifierGuard } from '../interactions.js';
+import { VerificationType } from './verification-type.js';
+export const newPasswordIdentityVerificationRecordDataGuard = z.object({
+    id: z.string(),
+    type: z.literal(VerificationType.NewPasswordIdentity),
+    identifier: interactionIdentifierGuard,
+    passwordEncrypted: z.string().optional(),
+    passwordEncryptionMethod: z.literal(UsersPasswordEncryptionMethod.Argon2i).optional(),
+});
+export const sanitizedNewPasswordIdentityVerificationRecordDataGuard = newPasswordIdentityVerificationRecordDataGuard.omit({
+    passwordEncrypted: true,
+    passwordEncryptionMethod: true,
+});

package/lib/types/verification-records/one-time-token-verification.d.ts

@@ -0,0 +1,55 @@
+import { z } from 'zod';
+import { type OneTimeTokenContext, SignInIdentifier } from '../../foundations/index.js';
+import { type InteractionIdentifier } from '../interactions.js';
+import { VerificationType } from './verification-type.js';
+export type OneTimeTokenVerificationRecordData = {
+    id: string;
+    type: VerificationType.OneTimeToken;
+    identifier: InteractionIdentifier<SignInIdentifier.Email>;
+    verified: boolean;
+    oneTimeTokenContext?: OneTimeTokenContext;
+};
+export declare const oneTimeTokenVerificationRecordDataGuard: z.ZodObject<{
+    id: z.ZodString;
+    type: z.ZodLiteral<VerificationType.OneTimeToken>;
+    verified: z.ZodBoolean;
+    identifier: z.ZodObject<{
+        type: z.ZodLiteral<SignInIdentifier.Email>;
+        value: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        value: string;
+        type: SignInIdentifier.Email;
+    }, {
+        value: string;
+        type: SignInIdentifier.Email;
+    }>;
+    oneTimeTokenContext: z.ZodOptional<z.ZodObject<{
+        jitOrganizationIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        jitOrganizationIds?: string[] | undefined;
+    }, {
+        jitOrganizationIds?: string[] | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    type: VerificationType.OneTimeToken;
+    id: string;
+    identifier: {
+        value: string;
+        type: SignInIdentifier.Email;
+    };
+    verified: boolean;
+    oneTimeTokenContext?: {
+        jitOrganizationIds?: string[] | undefined;
+    } | undefined;
+}, {
+    type: VerificationType.OneTimeToken;
+    id: string;
+    identifier: {
+        value: string;
+        type: SignInIdentifier.Email;
+    };
+    verified: boolean;
+    oneTimeTokenContext?: {
+        jitOrganizationIds?: string[] | undefined;
+    } | undefined;
+}>;

package/lib/types/verification-records/one-time-token-verification.js

@@ -0,0 +1,13 @@
+import { z } from 'zod';
+import { oneTimeTokenContextGuard, SignInIdentifier, } from '../../foundations/index.js';
+import { VerificationType } from './verification-type.js';
+export const oneTimeTokenVerificationRecordDataGuard = z.object({
+    id: z.string(),
+    type: z.literal(VerificationType.OneTimeToken),
+    verified: z.boolean(),
+    identifier: z.object({
+        type: z.literal(SignInIdentifier.Email),
+        value: z.string(),
+    }),
+    oneTimeTokenContext: oneTimeTokenContextGuard.optional(),
+});