@logto/schemas 1.34.0 → 1.35.0

package/alterations/1.35.0-1764580455-remove-daily-active-users-foreign-key.ts

@@ -0,0 +1,69 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+/**
+ * Remove foreign key constraint from daily_active_users table to allow
+ * historical billing data to persist even after tenant deletion.
+ * This supports the MAU-based billing system requirements.
+ *
+ * Index optimizations:
+ * 1. Removes redundant (tenant_id, id) index (id is already primary key)
+ * 2. Adds optimized index (tenant_id, date, user_id) for aggregation queries
+ * 3. Replaces problematic partial index with BRIN index
+ */
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    // Drop the existing foreign key constraint
+    await pool.query(sql`
+      alter table daily_active_users
+      drop constraint if exists daily_active_users_tenant_id_fkey
+    `);
+
+    // Remove the redundant (tenant_id, id) index since id is already primary key
+    await pool.query(sql`
+      drop index if exists daily_active_users__id
+    `);
+
+    // Add optimized index for aggregation queries with better write performance
+    await pool.query(sql`
+      create index daily_active_users__tenant_date_user
+      on daily_active_users (tenant_id, date, user_id)
+    `);
+
+    // Add BRIN index for time-series date range queries
+    // Optimized for sequential data insertion and range scans (date >= ?)
+    await pool.query(sql`
+      create index daily_active_users__date_brin
+      on daily_active_users using brin (date)
+    `);
+  },
+
+  down: async (pool) => {
+    // Drop the new indexes we created
+    await pool.query(sql`
+      drop index if exists daily_active_users__date_brin
+    `);
+
+    await pool.query(sql`
+      drop index if exists daily_active_users__tenant_date_user
+    `);
+
+    // Recreate the original redundant index
+    await pool.query(sql`
+      create index daily_active_users__id
+      on daily_active_users (tenant_id, id)
+    `);
+
+    // Recreate the foreign key constraint
+    await pool.query(sql`
+      alter table daily_active_users
+      add constraint daily_active_users_tenant_id_fkey
+      foreign key (tenant_id) references tenants(id)
+      on update cascade on delete cascade
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.35.0-1764580589-create-aggregated-daily-active-users-table.ts

@@ -0,0 +1,51 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+
+/**
+ * Create aggregated_daily_active_users table for MAU-based billing system.
+ * This table consolidates daily user activities for efficient billing calculations.
+ */
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    // Create the aggregated daily active users table
+    await pool.query(sql`
+      create table aggregated_daily_active_users (
+        tenant_id varchar(21) not null,
+        activity_date date not null,
+        user_id varchar(21) not null,
+        activity_count integer not null,
+        primary key (tenant_id, activity_date, user_id)
+      );
+    `);
+
+    // Index for billing cycle range queries
+    await pool.query(sql`
+      create index aggregated_daily_active_users__tenant_date
+        on aggregated_daily_active_users (tenant_id, activity_date);
+    `);
+
+    // Index for tenant-specific user activity queries
+    await pool.query(sql`
+      create index aggregated_daily_active_users__tenant_user_date
+        on aggregated_daily_active_users (tenant_id, user_id, activity_date desc);
+    `);
+
+    await applyTableRls(pool, 'aggregated_daily_active_users');
+  },
+
+  down: async (pool) => {
+    // Drop RLS policies first
+    await dropTableRls(pool, 'aggregated_daily_active_users');
+
+    // Drop the table and all its indexes
+    await pool.query(sql`
+      drop table aggregated_daily_active_users;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.35.0-1764653048-update-daily-token-usage-mau-support.ts

@@ -0,0 +1,37 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    // Add new columns for user and m2m token usage tracking
+    await pool.query(sql`
+      alter table daily_token_usage
+      add column user_token_usage bigint not null default 0,
+      add column m2m_token_usage bigint not null default 0;
+    `);
+
+    // Remove foreign key constraint to support enterprise tenant deletion requirements
+    await pool.query(sql`
+      alter table daily_token_usage
+      drop constraint if exists daily_token_usage_tenant_id_fkey;
+    `);
+  },
+  down: async (pool) => {
+    // Remove the new columns
+    await pool.query(sql`
+      alter table daily_token_usage
+      drop column if exists user_token_usage,
+      drop column if exists m2m_token_usage;
+    `);
+
+    // Re-add the foreign key constraint
+    await pool.query(sql`
+      alter table daily_token_usage
+      add constraint daily_token_usage_tenant_id_fkey
+      foreign key (tenant_id) references tenants (id) on update cascade on delete cascade;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.35.0-1765183934-add-logs-created-at-id-index.ts

@@ -0,0 +1,39 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  beforeUp: async (pool) => {
+    /**
+     * Use 'if not exists' to ensure idempotency.
+     * If the subsequent transaction in 'up' fails, the migration can be safely re-run without failing on an already created index.
+     */
+    await pool.query(sql`
+      create index concurrently if not exists logs__created_at_id
+      on logs (tenant_id, created_at, id);
+    `);
+  },
+  up: async () => {
+    /**
+     * The index on the logs table must be created outside of a transaction to avoid table locks.
+     * 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty.
+     */
+  },
+  beforeDown: async (pool) => {
+    /**
+     * Use 'if exists' to ensure idempotency. If the subsequent transaction in 'down' fails,
+     * the rollback can be safely re-run without failing on a non-existent index.
+     */
+    await pool.query(sql`
+      drop index concurrently if exists logs__created_at_id;
+    `);
+  },
+  down: async () => {
+    /**
+     * The index on the logs table must be dropped outside of a transaction to avoid table locks.
+     * 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty.
+     */
+  },
+};
+
+export default alteration;

package/alterations/1.35.0-1765255453-update-saml-session-relay-state-to-varchar-512.ts

@@ -0,0 +1,31 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+/**
+ * Update saml_application_sessions.relay_state column type from varchar(256) to text
+ * to support longer relay state values that may be used in SAML authentication flows.
+ *
+ * The relay state parameter in SAML can contain arbitrary data that needs to be
+ * preserved and returned to the service provider, and 256 characters may not be
+ * sufficient for all use cases.
+ */
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table saml_application_sessions
+      alter column relay_state type varchar(512)
+    `);
+  },
+
+  down: async (pool) => {
+    // The down migration may fail or cause data loss if any existing relay_state values exceed 256 characters. Consider adding a USING clause to safely truncate values during rollback, this ensures the rollback operation won't fail due to data that's too long for the varchar(256) constraint.
+    await pool.query(sql`
+      alter table saml_application_sessions
+      alter column relay_state type varchar(256) using left(relay_state, 256)
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.35.0-1765631949-drop-redundant-logs-id-index.ts

@@ -0,0 +1,47 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+/**
+ * The `logs__id` index on (tenant_id, id) is redundant because:
+ * 1. `id` is already the primary key, which can efficiently lookup by id
+ * 2. `logs__created_at_id` index on (tenant_id, created_at, id) already covers tenant_id queries
+ *
+ * Removing this index reduces write IOPS during log deletion operations,
+ * as each DELETE no longer needs to update this redundant index.
+ */
+const alteration: AlterationScript = {
+  beforeUp: async (pool) => {
+    /**
+     * Use 'if exists' to ensure idempotency.
+     * 'concurrently' avoids table locks during index drop.
+     */
+    await pool.query(sql`
+      drop index concurrently if exists logs__id;
+    `);
+  },
+  up: async () => {
+    /**
+     * The index must be dropped outside of a transaction to avoid table locks.
+     * 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty.
+     */
+  },
+  beforeDown: async (pool) => {
+    /**
+     * Recreate the index if rolling back.
+     * Use 'if not exists' to ensure idempotency.
+     */
+    await pool.query(sql`
+      create index concurrently if not exists logs__id
+      on logs (tenant_id, id);
+    `);
+  },
+  down: async () => {
+    /**
+     * The index must be created outside of a transaction to avoid table locks.
+     * 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty.
+     */
+  },
+};
+
+export default alteration;

package/alterations/1.35.0-1766028646-grant-tenants-table-tag-column-read-permission.ts

@@ -0,0 +1,39 @@
+import { type CommonQueryMethods, sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const getDatabaseName = async (pool: CommonQueryMethods) => {
+  const { currentDatabase } = await pool.one<{ currentDatabase: string }>(sql`
+    select current_database();
+  `);
+
+  return currentDatabase.replaceAll('-', '_');
+};
+
+/**
+ * Grant read permission to the tag column in the tenants table to the logto_tenant_<databaseName> role.
+ */
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    const databaseName = await getDatabaseName(pool);
+    const baseRoleId = sql.identifier([`logto_tenant_${databaseName}`]);
+
+    await pool.query(sql`
+      grant select (tag)
+        on table tenants
+        to ${baseRoleId}
+    `);
+  },
+  down: async (pool) => {
+    const databaseName = await getDatabaseName(pool);
+    const baseRoleId = sql.identifier([`logto_tenant_${databaseName}`]);
+
+    await pool.query(sql`
+      revoke select (tag)
+        on table tenants
+        from ${baseRoleId}
+    `);
+  },
+};
+
+export default alteration;

package/alterations-js/1.35.0-1764580455-remove-daily-active-users-foreign-key.js

@@ -0,0 +1,57 @@
+import { sql } from '@silverhand/slonik';
+/**
+ * Remove foreign key constraint from daily_active_users table to allow
+ * historical billing data to persist even after tenant deletion.
+ * This supports the MAU-based billing system requirements.
+ *
+ * Index optimizations:
+ * 1. Removes redundant (tenant_id, id) index (id is already primary key)
+ * 2. Adds optimized index (tenant_id, date, user_id) for aggregation queries
+ * 3. Replaces problematic partial index with BRIN index
+ */
+const alteration = {
+    up: async (pool) => {
+        // Drop the existing foreign key constraint
+        await pool.query(sql `
+      alter table daily_active_users
+      drop constraint if exists daily_active_users_tenant_id_fkey
+    `);
+        // Remove the redundant (tenant_id, id) index since id is already primary key
+        await pool.query(sql `
+      drop index if exists daily_active_users__id
+    `);
+        // Add optimized index for aggregation queries with better write performance
+        await pool.query(sql `
+      create index daily_active_users__tenant_date_user
+      on daily_active_users (tenant_id, date, user_id)
+    `);
+        // Add BRIN index for time-series date range queries
+        // Optimized for sequential data insertion and range scans (date >= ?)
+        await pool.query(sql `
+      create index daily_active_users__date_brin
+      on daily_active_users using brin (date)
+    `);
+    },
+    down: async (pool) => {
+        // Drop the new indexes we created
+        await pool.query(sql `
+      drop index if exists daily_active_users__date_brin
+    `);
+        await pool.query(sql `
+      drop index if exists daily_active_users__tenant_date_user
+    `);
+        // Recreate the original redundant index
+        await pool.query(sql `
+      create index daily_active_users__id
+      on daily_active_users (tenant_id, id)
+    `);
+        // Recreate the foreign key constraint
+        await pool.query(sql `
+      alter table daily_active_users
+      add constraint daily_active_users_tenant_id_fkey
+      foreign key (tenant_id) references tenants(id)
+      on update cascade on delete cascade
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.35.0-1764580589-create-aggregated-daily-active-users-table.js

@@ -0,0 +1,40 @@
+import { sql } from '@silverhand/slonik';
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+/**
+ * Create aggregated_daily_active_users table for MAU-based billing system.
+ * This table consolidates daily user activities for efficient billing calculations.
+ */
+const alteration = {
+    up: async (pool) => {
+        // Create the aggregated daily active users table
+        await pool.query(sql `
+      create table aggregated_daily_active_users (
+        tenant_id varchar(21) not null,
+        activity_date date not null,
+        user_id varchar(21) not null,
+        activity_count integer not null,
+        primary key (tenant_id, activity_date, user_id)
+      );
+    `);
+        // Index for billing cycle range queries
+        await pool.query(sql `
+      create index aggregated_daily_active_users__tenant_date
+        on aggregated_daily_active_users (tenant_id, activity_date);
+    `);
+        // Index for tenant-specific user activity queries
+        await pool.query(sql `
+      create index aggregated_daily_active_users__tenant_user_date
+        on aggregated_daily_active_users (tenant_id, user_id, activity_date desc);
+    `);
+        await applyTableRls(pool, 'aggregated_daily_active_users');
+    },
+    down: async (pool) => {
+        // Drop RLS policies first
+        await dropTableRls(pool, 'aggregated_daily_active_users');
+        // Drop the table and all its indexes
+        await pool.query(sql `
+      drop table aggregated_daily_active_users;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.35.0-1764653048-update-daily-token-usage-mau-support.js

@@ -0,0 +1,31 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    up: async (pool) => {
+        // Add new columns for user and m2m token usage tracking
+        await pool.query(sql `
+      alter table daily_token_usage
+      add column user_token_usage bigint not null default 0,
+      add column m2m_token_usage bigint not null default 0;
+    `);
+        // Remove foreign key constraint to support enterprise tenant deletion requirements
+        await pool.query(sql `
+      alter table daily_token_usage
+      drop constraint if exists daily_token_usage_tenant_id_fkey;
+    `);
+    },
+    down: async (pool) => {
+        // Remove the new columns
+        await pool.query(sql `
+      alter table daily_token_usage
+      drop column if exists user_token_usage,
+      drop column if exists m2m_token_usage;
+    `);
+        // Re-add the foreign key constraint
+        await pool.query(sql `
+      alter table daily_token_usage
+      add constraint daily_token_usage_tenant_id_fkey
+      foreign key (tenant_id) references tenants (id) on update cascade on delete cascade;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.35.0-1765183934-add-logs-created-at-id-index.js

@@ -0,0 +1,35 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    beforeUp: async (pool) => {
+        /**
+         * Use 'if not exists' to ensure idempotency.
+         * If the subsequent transaction in 'up' fails, the migration can be safely re-run without failing on an already created index.
+         */
+        await pool.query(sql `
+      create index concurrently if not exists logs__created_at_id
+      on logs (tenant_id, created_at, id);
+    `);
+    },
+    up: async () => {
+        /**
+         * The index on the logs table must be created outside of a transaction to avoid table locks.
+         * 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty.
+         */
+    },
+    beforeDown: async (pool) => {
+        /**
+         * Use 'if exists' to ensure idempotency. If the subsequent transaction in 'down' fails,
+         * the rollback can be safely re-run without failing on a non-existent index.
+         */
+        await pool.query(sql `
+      drop index concurrently if exists logs__created_at_id;
+    `);
+    },
+    down: async () => {
+        /**
+         * The index on the logs table must be dropped outside of a transaction to avoid table locks.
+         * 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty.
+         */
+    },
+};
+export default alteration;

package/alterations-js/1.35.0-1765255453-update-saml-session-relay-state-to-varchar-512.js

@@ -0,0 +1,25 @@
+import { sql } from '@silverhand/slonik';
+/**
+ * Update saml_application_sessions.relay_state column type from varchar(256) to text
+ * to support longer relay state values that may be used in SAML authentication flows.
+ *
+ * The relay state parameter in SAML can contain arbitrary data that needs to be
+ * preserved and returned to the service provider, and 256 characters may not be
+ * sufficient for all use cases.
+ */
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      alter table saml_application_sessions
+      alter column relay_state type varchar(512)
+    `);
+    },
+    down: async (pool) => {
+        // The down migration may fail or cause data loss if any existing relay_state values exceed 256 characters. Consider adding a USING clause to safely truncate values during rollback, this ensures the rollback operation won't fail due to data that's too long for the varchar(256) constraint.
+        await pool.query(sql `
+      alter table saml_application_sessions
+      alter column relay_state type varchar(256) using left(relay_state, 256)
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.35.0-1765631949-drop-redundant-logs-id-index.js

@@ -0,0 +1,43 @@
+import { sql } from '@silverhand/slonik';
+/**
+ * The `logs__id` index on (tenant_id, id) is redundant because:
+ * 1. `id` is already the primary key, which can efficiently lookup by id
+ * 2. `logs__created_at_id` index on (tenant_id, created_at, id) already covers tenant_id queries
+ *
+ * Removing this index reduces write IOPS during log deletion operations,
+ * as each DELETE no longer needs to update this redundant index.
+ */
+const alteration = {
+    beforeUp: async (pool) => {
+        /**
+         * Use 'if exists' to ensure idempotency.
+         * 'concurrently' avoids table locks during index drop.
+         */
+        await pool.query(sql `
+      drop index concurrently if exists logs__id;
+    `);
+    },
+    up: async () => {
+        /**
+         * The index must be dropped outside of a transaction to avoid table locks.
+         * 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty.
+         */
+    },
+    beforeDown: async (pool) => {
+        /**
+         * Recreate the index if rolling back.
+         * Use 'if not exists' to ensure idempotency.
+         */
+        await pool.query(sql `
+      create index concurrently if not exists logs__id
+      on logs (tenant_id, id);
+    `);
+    },
+    down: async () => {
+        /**
+         * The index must be created outside of a transaction to avoid table locks.
+         * 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty.
+         */
+    },
+};
+export default alteration;

package/alterations-js/1.35.0-1766028646-grant-tenants-table-tag-column-read-permission.js

@@ -0,0 +1,31 @@
+import { sql } from '@silverhand/slonik';
+const getDatabaseName = async (pool) => {
+    const { currentDatabase } = await pool.one(sql `
+    select current_database();
+  `);
+    return currentDatabase.replaceAll('-', '_');
+};
+/**
+ * Grant read permission to the tag column in the tenants table to the logto_tenant_<databaseName> role.
+ */
+const alteration = {
+    up: async (pool) => {
+        const databaseName = await getDatabaseName(pool);
+        const baseRoleId = sql.identifier([`logto_tenant_${databaseName}`]);
+        await pool.query(sql `
+      grant select (tag)
+        on table tenants
+        to ${baseRoleId}
+    `);
+    },
+    down: async (pool) => {
+        const databaseName = await getDatabaseName(pool);
+        const baseRoleId = sql.identifier([`logto_tenant_${databaseName}`]);
+        await pool.query(sql `
+      revoke select (tag)
+        on table tenants
+        from ${baseRoleId}
+    `);
+    },
+};
+export default alteration;

package/lib/consts/product-event.d.ts

@@ -46,7 +46,6 @@ export declare enum ProductEvent {
     DeveloperCreated = "developer created",
     /** A user has been deleted in the admin tenant. */
     DeveloperDeleted = "developer deleted",
-    AccessTokenIssued = "access token issued",
     AppCreated = "app created",
     AppDeleted = "app deleted",
     RoleCreated = "role created",
@@ -86,14 +85,3 @@ export declare const tenantEventDistinctId = "TENANT_EVENT";
  * identifying the user who initiated the Management API request proxied by the cloud service.
  */
 export declare const cloudUserIdHeader = "logto-cloud-user-id";
-/**
- * The types of access tokens issued by Logto.
- *
- * Note that this is for internal use only and is different from other technical definitions of
- * token types.
- */
-export declare enum ProductAccessTokenType {
-    Unknown = "unknown",
-    User = "user",
-    ClientCredentials = "client_credentials"
-}

package/lib/consts/product-event.js

@@ -47,7 +47,6 @@ export var ProductEvent;
     ProductEvent["DeveloperCreated"] = "developer created";
     /** A user has been deleted in the admin tenant. */
     ProductEvent["DeveloperDeleted"] = "developer deleted";
-    ProductEvent["AccessTokenIssued"] = "access token issued";
     ProductEvent["AppCreated"] = "app created";
     ProductEvent["AppDeleted"] = "app deleted";
     ProductEvent["RoleCreated"] = "role created";
@@ -88,15 +87,3 @@ export const tenantEventDistinctId = 'TENANT_EVENT';
  * identifying the user who initiated the Management API request proxied by the cloud service.
  */
 export const cloudUserIdHeader = 'logto-cloud-user-id';
-/**
- * The types of access tokens issued by Logto.
- *
- * Note that this is for internal use only and is different from other technical definitions of
- * token types.
- */
-export var ProductAccessTokenType;
-(function (ProductAccessTokenType) {
-    ProductAccessTokenType["Unknown"] = "unknown";
-    ProductAccessTokenType["User"] = "user";
-    ProductAccessTokenType["ClientCredentials"] = "client_credentials";
-})(ProductAccessTokenType || (ProductAccessTokenType = {}));

package/lib/db-entries/aggregated-daily-active-user.d.ts

@@ -0,0 +1,22 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * This table is used to store aggregated data of daily active users for each tenant. A daily job summarizes data from the daily active users table and inserts it into this table, or removes expired data. Therefore, we should not directly manipulate this table, except for "read" operations.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link AggregatedDailyActiveUser} for the original type.
+ */
+export type CreateAggregatedDailyActiveUser = {
+    tenantId?: string;
+    activityDate: number;
+    userId: string;
+    activityCount: number;
+};
+/** This table is used to store aggregated data of daily active users for each tenant. A daily job summarizes data from the daily active users table and inserts it into this table, or removes expired data. Therefore, we should not directly manipulate this table, except for "read" operations. */
+export type AggregatedDailyActiveUser = {
+    tenantId: string;
+    activityDate: number;
+    userId: string;
+    activityCount: number;
+};
+export type AggregatedDailyActiveUserKeys = 'tenantId' | 'activityDate' | 'userId' | 'activityCount';
+export declare const AggregatedDailyActiveUsers: GeneratedSchema<AggregatedDailyActiveUserKeys, CreateAggregatedDailyActiveUser, AggregatedDailyActiveUser, 'aggregated_daily_active_users', 'aggregated_daily_active_user'>;

package/lib/db-entries/aggregated-daily-active-user.js

@@ -0,0 +1,33 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    activityDate: z.number(),
+    userId: z.string().min(1).max(21),
+    activityCount: z.number(),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    activityDate: z.number(),
+    userId: z.string().min(1).max(21),
+    activityCount: z.number(),
+});
+export const AggregatedDailyActiveUsers = Object.freeze({
+    table: 'aggregated_daily_active_users',
+    tableSingular: 'aggregated_daily_active_user',
+    fields: {
+        tenantId: 'tenant_id',
+        activityDate: 'activity_date',
+        userId: 'user_id',
+        activityCount: 'activity_count',
+    },
+    fieldKeys: [
+        'tenantId',
+        'activityDate',
+        'userId',
+        'activityCount',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/daily-token-usage.d.ts

@@ -8,13 +8,17 @@ export type CreateDailyTokenUsage = {
     id: string;
     tenantId?: string;
     usage?: number;
+    userTokenUsage?: number;
+    m2mTokenUsage?: number;
     date: number;
 };
 export type DailyTokenUsage = {
     id: string;
     tenantId: string;
     usage: number;
+    userTokenUsage: number;
+    m2mTokenUsage: number;
     date: number;
 };
-export type DailyTokenUsageKeys = 'id' | 'tenantId' | 'usage' | 'date';
+export type DailyTokenUsageKeys = 'id' | 'tenantId' | 'usage' | 'userTokenUsage' | 'm2mTokenUsage' | 'date';
 export declare const DailyTokenUsage: GeneratedSchema<DailyTokenUsageKeys, CreateDailyTokenUsage, DailyTokenUsage, 'daily_token_usage', 'daily_token_usage'>;

package/lib/db-entries/daily-token-usage.js

@@ -4,12 +4,16 @@ const createGuard = z.object({
     id: z.string().min(1).max(21),
     tenantId: z.string().max(21).optional(),
     usage: z.number().optional(),
+    userTokenUsage: z.number().optional(),
+    m2mTokenUsage: z.number().optional(),
     date: z.number(),
 });
 const guard = z.object({
     id: z.string().min(1).max(21),
     tenantId: z.string().max(21),
     usage: z.number(),
+    userTokenUsage: z.number(),
+    m2mTokenUsage: z.number(),
     date: z.number(),
 });
 export const DailyTokenUsage = Object.freeze({
@@ -19,12 +23,16 @@ export const DailyTokenUsage = Object.freeze({
         id: 'id',
         tenantId: 'tenant_id',
         usage: 'usage',
+        userTokenUsage: 'user_token_usage',
+        m2mTokenUsage: 'm2m_token_usage',
         date: 'date',
     },
     fieldKeys: [
         'id',
         'tenantId',
         'usage',
+        'userTokenUsage',
+        'm2mTokenUsage',
         'date',
     ],
     createGuard,

package/lib/db-entries/index.d.ts

@@ -4,6 +4,7 @@ export * from './-after-each.js';
 export * from './-before-all.js';
 export * from './-function.js';
 export * from './account-center.js';
+export * from './aggregated-daily-active-user.js';
 export * from './application-secret.js';
 export * from './application-sign-in-experience.js';
 export * from './application-user-consent-organization-resource-scope.js';

package/lib/db-entries/index.js

@@ -5,6 +5,7 @@ export * from './-after-each.js';
 export * from './-before-all.js';
 export * from './-function.js';
 export * from './account-center.js';
+export * from './aggregated-daily-active-user.js';
 export * from './application-secret.js';
 export * from './application-sign-in-experience.js';
 export * from './application-user-consent-organization-resource-scope.js';

package/lib/db-entries/saml-application-session.js

@@ -6,7 +6,7 @@ const createGuard = z.object({
     applicationId: z.string().min(1).max(21),
     samlRequestId: z.string().min(1).max(128),
     oidcState: z.string().max(32).nullable().optional(),
-    relayState: z.string().max(256).nullable().optional(),
+    relayState: z.string().max(512).nullable().optional(),
     rawAuthRequest: z.string().min(1),
     createdAt: z.number().optional(),
     expiresAt: z.number(),
@@ -17,7 +17,7 @@ const guard = z.object({
     applicationId: z.string().min(1).max(21),
     samlRequestId: z.string().min(1).max(128),
     oidcState: z.string().max(32).nullable(),
-    relayState: z.string().max(256).nullable(),
+    relayState: z.string().max(512).nullable(),
     rawAuthRequest: z.string().min(1),
     createdAt: z.number(),
     expiresAt: z.number(),

package/lib/foundations/jsonb-types/captcha.d.ts

@@ -3,6 +3,10 @@ export declare enum CaptchaType {
     RecaptchaEnterprise = "RecaptchaEnterprise",
     Turnstile = "Turnstile"
 }
+export declare enum RecaptchaEnterpriseMode {
+    Invisible = "invisible",
+    Checkbox = "checkbox"
+}
 export declare const turnstileConfigGuard: z.ZodObject<{
     type: z.ZodLiteral<CaptchaType.Turnstile>;
     siteKey: z.ZodString;
@@ -22,16 +26,22 @@ export declare const recaptchaEnterpriseConfigGuard: z.ZodObject<{
     siteKey: z.ZodString;
     secretKey: z.ZodString;
     projectId: z.ZodString;
+    domain: z.ZodOptional<z.ZodString>;
+    mode: z.ZodOptional<z.ZodNativeEnum<typeof RecaptchaEnterpriseMode>>;
 }, "strip", z.ZodTypeAny, {
     type: CaptchaType.RecaptchaEnterprise;
     siteKey: string;
     secretKey: string;
     projectId: string;
+    domain?: string | undefined;
+    mode?: RecaptchaEnterpriseMode | undefined;
 }, {
     type: CaptchaType.RecaptchaEnterprise;
     siteKey: string;
     secretKey: string;
     projectId: string;
+    domain?: string | undefined;
+    mode?: RecaptchaEnterpriseMode | undefined;
 }>;
 export type RecaptchaEnterpriseConfig = z.infer<typeof recaptchaEnterpriseConfigGuard>;
 export declare const captchaConfigGuard: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
@@ -51,15 +61,21 @@ export declare const captchaConfigGuard: z.ZodDiscriminatedUnion<"type", [z.ZodO
     siteKey: z.ZodString;
     secretKey: z.ZodString;
     projectId: z.ZodString;
+    domain: z.ZodOptional<z.ZodString>;
+    mode: z.ZodOptional<z.ZodNativeEnum<typeof RecaptchaEnterpriseMode>>;
 }, "strip", z.ZodTypeAny, {
     type: CaptchaType.RecaptchaEnterprise;
     siteKey: string;
     secretKey: string;
     projectId: string;
+    domain?: string | undefined;
+    mode?: RecaptchaEnterpriseMode | undefined;
 }, {
     type: CaptchaType.RecaptchaEnterprise;
     siteKey: string;
     secretKey: string;
     projectId: string;
+    domain?: string | undefined;
+    mode?: RecaptchaEnterpriseMode | undefined;
 }>]>;
 export type CaptchaConfig = z.infer<typeof captchaConfigGuard>;

package/lib/foundations/jsonb-types/captcha.js

@@ -4,6 +4,11 @@ export var CaptchaType;
     CaptchaType["RecaptchaEnterprise"] = "RecaptchaEnterprise";
     CaptchaType["Turnstile"] = "Turnstile";
 })(CaptchaType || (CaptchaType = {}));
+export var RecaptchaEnterpriseMode;
+(function (RecaptchaEnterpriseMode) {
+    RecaptchaEnterpriseMode["Invisible"] = "invisible";
+    RecaptchaEnterpriseMode["Checkbox"] = "checkbox";
+})(RecaptchaEnterpriseMode || (RecaptchaEnterpriseMode = {}));
 export const turnstileConfigGuard = z.object({
     type: z.literal(CaptchaType.Turnstile),
     siteKey: z.string(),
@@ -14,6 +19,8 @@ export const recaptchaEnterpriseConfigGuard = z.object({
     siteKey: z.string(),
     secretKey: z.string(),
     projectId: z.string(),
+    domain: z.string().optional(),
+    mode: z.nativeEnum(RecaptchaEnterpriseMode).optional(),
 });
 export const captchaConfigGuard = z.discriminatedUnion('type', [
     turnstileConfigGuard,

package/lib/types/alteration.d.ts

@@ -1,5 +1,15 @@
-import type { DatabaseTransactionConnection } from '@silverhand/slonik';
+import type { CommonQueryMethods, DatabaseTransactionConnection } from '@silverhand/slonik';
 export type AlterationScript = {
+    /**
+     * Optional hook that runs before `up` outside of a transaction.
+     * Use for operations that cannot be wrapped in a transaction (e.g., CREATE INDEX CONCURRENTLY).
+     */
+    beforeUp?: (connection: CommonQueryMethods) => Promise<void>;
+    /**
+     * Optional hook that runs before `down` outside of a transaction.
+     * Use for operations that cannot be wrapped in a transaction (e.g., DROP INDEX CONCURRENTLY).
+     */
+    beforeDown?: (connection: CommonQueryMethods) => Promise<void>;
     up: (connection: DatabaseTransactionConnection) => Promise<void>;
     down: (connection: DatabaseTransactionConnection) => Promise<void>;
 };

package/lib/types/interactions.d.ts

@@ -45,16 +45,25 @@ export type VerificationCodeIdentifier<T extends VerificationCodeSignInIdentifie
     type: T;
     value: string;
 };
-export declare const verificationCodeIdentifierGuard: z.ZodObject<{
-    type: z.ZodEnum<[SignInIdentifier.Email, SignInIdentifier.Phone]>;
+export declare const verificationCodeIdentifierGuard: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+    type: z.ZodLiteral<SignInIdentifier.Email>;
     value: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     value: string;
-    type: SignInIdentifier.Email | SignInIdentifier.Phone;
+    type: SignInIdentifier.Email;
 }, {
     value: string;
-    type: SignInIdentifier.Email | SignInIdentifier.Phone;
-}>;
+    type: SignInIdentifier.Email;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<SignInIdentifier.Phone>;
+    value: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    value: string;
+    type: SignInIdentifier.Phone;
+}, {
+    value: string;
+    type: SignInIdentifier.Phone;
+}>]>;
 /** Payload type for `POST /api/experience/verification/{social|sso}/:connectorId/authorization-uri`. */
 export type SocialAuthorizationUrlPayload = {
     state: string;

package/lib/types/interactions.js

@@ -21,10 +21,16 @@ export const interactionIdentifierGuard = z.object({
     type: z.nativeEnum(SignInIdentifier),
     value: z.string(),
 });
-export const verificationCodeIdentifierGuard = z.object({
-    type: z.enum([SignInIdentifier.Email, SignInIdentifier.Phone]),
-    value: z.string(),
-});
+export const verificationCodeIdentifierGuard = z.discriminatedUnion('type', [
+    z.object({
+        type: z.literal(SignInIdentifier.Email),
+        value: z.string().regex(emailRegEx),
+    }),
+    z.object({
+        type: z.literal(SignInIdentifier.Phone),
+        value: z.string().regex(phoneRegEx),
+    }),
+]);
 export const socialAuthorizationUrlPayloadGuard = z.object({
     state: z.string(),
     redirectUri: z.string(),

package/lib/types/sign-in-experience.d.ts

@@ -1,7 +1,7 @@
 import { type ConnectorMetadata, type GoogleOneTapConfig } from '@logto/connector-kit';
 import { z } from 'zod';
 import { type CustomProfileField, type SignInExperience } from '../db-entries/index.js';
-import { CaptchaType } from '../foundations/jsonb-types/index.js';
+import { CaptchaType, RecaptchaEnterpriseMode } from '../foundations/jsonb-types/index.js';
 import { type SsoConnectorMetadata } from './sso-connector.js';
 type ForgotPassword = {
     phone: boolean;
@@ -32,6 +32,8 @@ export type FullSignInExperience = Omit<SignInExperience, 'forgotPasswordMethods
     captchaConfig?: {
         type: CaptchaType;
         siteKey: string;
+        domain?: string;
+        mode?: RecaptchaEnterpriseMode;
     };
     customProfileFields?: Readonly<CustomProfileField[]>;
 };
@@ -674,12 +676,18 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     captchaConfig: z.ZodOptional<z.ZodObject<{
         type: z.ZodNativeEnum<typeof CaptchaType>;
         siteKey: z.ZodString;
+        domain: z.ZodOptional<z.ZodString>;
+        mode: z.ZodOptional<z.ZodNativeEnum<typeof RecaptchaEnterpriseMode>>;
     }, "strip", z.ZodTypeAny, {
         type: CaptchaType;
         siteKey: string;
+        domain?: string | undefined;
+        mode?: RecaptchaEnterpriseMode | undefined;
     }, {
         type: CaptchaType;
         siteKey: string;
+        domain?: string | undefined;
+        mode?: RecaptchaEnterpriseMode | undefined;
     }>>;
     customProfileFields: z.ZodArray<import("../index.js").Guard<CustomProfileField>, "many">;
 }, "strip", z.ZodTypeAny, {
@@ -873,6 +881,8 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     captchaConfig?: {
         type: CaptchaType;
         siteKey: string;
+        domain?: string | undefined;
+        mode?: RecaptchaEnterpriseMode | undefined;
     } | undefined;
 }, {
     id: string;
@@ -1065,6 +1075,8 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     captchaConfig?: {
         type: CaptchaType;
         siteKey: string;
+        domain?: string | undefined;
+        mode?: RecaptchaEnterpriseMode | undefined;
     } | undefined;
 }>;
 export {};

package/lib/types/sign-in-experience.js

@@ -1,7 +1,7 @@
 import { connectorMetadataGuard, googleOneTapConfigGuard, } from '@logto/connector-kit';
 import { z } from 'zod';
 import { CustomProfileFields, SignInExperiences, } from '../db-entries/index.js';
-import { CaptchaType } from '../foundations/jsonb-types/index.js';
+import { CaptchaType, RecaptchaEnterpriseMode } from '../foundations/jsonb-types/index.js';
 import { ssoConnectorMetadataGuard } from './sso-connector.js';
 export const fullSignInExperienceGuard = SignInExperiences.guard
     .omit({ forgotPasswordMethods: true })
@@ -25,6 +25,8 @@ export const fullSignInExperienceGuard = SignInExperiences.guard
         .object({
         type: z.nativeEnum(CaptchaType),
         siteKey: z.string(),
+        domain: z.string().optional(),
+        mode: z.nativeEnum(RecaptchaEnterpriseMode).optional(),
     })
         .optional(),
     customProfileFields: CustomProfileFields.guard.array(),

package/lib/types/user.d.ts

@@ -316,6 +316,7 @@ export type UserProfileResponse = z.infer<typeof userProfileResponseGuard>;
 export declare const userMfaVerificationResponseGuard: z.ZodArray<z.ZodObject<{
     id: z.ZodString;
     createdAt: z.ZodString;
+    lastUsedAt: z.ZodOptional<z.ZodString>;
     type: z.ZodNativeEnum<typeof MfaFactor>;
     agent: z.ZodOptional<z.ZodString>;
     name: z.ZodOptional<z.ZodString>;
@@ -325,6 +326,7 @@ export declare const userMfaVerificationResponseGuard: z.ZodArray<z.ZodObject<{
     id: string;
     createdAt: string;
     name?: string | undefined;
+    lastUsedAt?: string | undefined;
     agent?: string | undefined;
     remainCodes?: number | undefined;
 }, {
@@ -332,6 +334,7 @@ export declare const userMfaVerificationResponseGuard: z.ZodArray<z.ZodObject<{
     id: string;
     createdAt: string;
     name?: string | undefined;
+    lastUsedAt?: string | undefined;
     agent?: string | undefined;
     remainCodes?: number | undefined;
 }>, "many">;

package/lib/types/user.js

@@ -29,6 +29,7 @@ export const userMfaVerificationResponseGuard = z
     .object({
     id: z.string(),
     createdAt: z.string(),
+    lastUsedAt: z.string().optional(),
     type: z.nativeEnum(MfaFactor),
     agent: z.string().optional(),
     name: z.string().optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/schemas",
-  "version": "1.34.0",
+  "version": "1.35.0",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "license": "MPL-2.0",
   "type": "module",
@@ -65,11 +65,11 @@
   "dependencies": {
     "@withtyped/server": "^0.14.0",
     "nanoid": "^5.0.9",
-    "@logto/connector-kit": "^4.6.0",
+    "@logto/connector-kit": "^4.7.0",
     "@logto/core-kit": "^2.6.1",
-    "@logto/language-kit": "^1.2.0",
-    "@logto/phrases": "^1.23.0",
+    "@logto/phrases": "^1.24.0",
     "@logto/phrases-experience": "^1.12.0",
+    "@logto/language-kit": "^1.2.0",
     "@logto/shared": "^3.3.0"
   },
   "peerDependencies": {

package/tables/_after_all.sql

@@ -13,7 +13,7 @@ revoke all privileges
   from logto_tenant_${database};
 
 -- Allow limited select to perform the RLS policy query in `after_each` (using select ... from tenants ...)
-grant select (id, db_user, is_suspended)
+grant select (id, db_user, is_suspended, tag)
   on table tenants
   to logto_tenant_${database};
 

package/tables/aggregated_daily_active_users.sql

@@ -0,0 +1,16 @@
+/** This table is used to store aggregated data of daily active users for each tenant. A daily job summarizes data from the daily active users table and inserts it into this table, or removes expired data. Therefore, we should not directly manipulate this table, except for "read" operations. */
+create table aggregated_daily_active_users (
+  tenant_id varchar(21) not null,
+  activity_date date not null,
+  user_id varchar(21) not null,
+  activity_count integer not null,
+  primary key (tenant_id, activity_date, user_id)
+);
+
+-- Index for billing cycle range queries
+create index aggregated_daily_active_users__tenant_date
+  on aggregated_daily_active_users (tenant_id, activity_date);
+
+-- Index for tenant-specific user activity queries
+create index aggregated_daily_active_users__tenant_user_date
+  on aggregated_daily_active_users (tenant_id, user_id, activity_date desc);

package/tables/daily_active_users.sql

@@ -1,7 +1,6 @@
 create table daily_active_users (
   id varchar(21) not null,
-  tenant_id varchar(21) not null
-    references tenants (id) on update cascade on delete cascade,
+  tenant_id varchar(21) not null,
   user_id varchar(21) not null,
   date timestamptz not null default (now()),
   primary key (id),
@@ -9,8 +8,14 @@ create table daily_active_users (
     unique (user_id, date)
 );
 
-create index daily_active_users__id
-  on daily_active_users (tenant_id, id);
+-- Optimized index for aggregation queries with better write performance
+create index daily_active_users__tenant_date_user
+  on daily_active_users (tenant_id, date, user_id);
+
+-- BRIN index for time-series date range queries
+-- Optimized for sequential data insertion and range scans (date >= ?)
+create index daily_active_users__date_brin
+  on daily_active_users using brin (date);
 
 create index daily_active_users__date
   on daily_active_users (tenant_id, date);

package/tables/daily_token_usage.sql

@@ -1,8 +1,9 @@
 create table daily_token_usage (
   id varchar(21) not null,
-  tenant_id varchar(21) not null
-    references tenants (id) on update cascade on delete cascade,
+  tenant_id varchar(21) not null,
   usage bigint not null default(0),
+  user_token_usage bigint not null default(0),
+  m2m_token_usage bigint not null default(0),
   date timestamptz not null,
   primary key (id)
 );

package/tables/logs.sql

@@ -10,9 +10,6 @@ create table logs (
   primary key (id)
 );
 
-create index logs__id
-  on logs (tenant_id, id);
-
 create index logs__key
   on logs (tenant_id, key);
 
@@ -24,3 +21,6 @@ create index logs__application_id
 
 create index logs__hook_id
   on logs (tenant_id, (payload->>'hookId'));
+
+create index logs__created_at_id
+  on logs (tenant_id, created_at, id);

package/tables/saml_application_sessions.sql

@@ -12,7 +12,7 @@ create table saml_application_sessions (
   /** The identifier of the OIDC auth request state. */
   oidc_state varchar(32),
   /** The relay state of the SAML auth request. */
-  relay_state varchar(256),
+  relay_state varchar(512),
   /** The raw request of the SAML auth request. */
   raw_auth_request text not null,
   created_at timestamptz not null default(now()),