@logto/schemas 1.37.1 → 1.39.0

package/lib/foundations/jsonb-types/sign-in-experience.d.ts

@@ -51,13 +51,13 @@ export declare const brandingGuard: z.ZodObject<{
 export type Branding = z.infer<typeof brandingGuard>;
 export declare const languageInfoGuard: z.ZodObject<{
     autoDetect: z.ZodBoolean;
-    fallbackLanguage: z.ZodType<"af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR", z.ZodTypeDef, "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR">;
+    fallbackLanguage: z.ZodType<"af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR", z.ZodTypeDef, "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR">;
 }, "strip", z.ZodTypeAny, {
     autoDetect: boolean;
-    fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
+    fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
 }, {
     autoDetect: boolean;
-    fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
+    fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
 }>;
 export type LanguageInfo = z.infer<typeof languageInfoGuard>;
 export declare enum SignInIdentifier {
@@ -237,12 +237,16 @@ export declare enum MfaPolicy {
     UserControlled = "UserControlled",
     /** MFA is required for all users */
     Mandatory = "Mandatory",
-    /** Ask users to set up MFA on their sign-in after registration (skippable, one-time prompt) */
+    /** Ask users to set up MFA on their sign-in after registration (skippable, one-time prompt, Optional MFA only) */
     PromptOnlyAtSignIn = "PromptOnlyAtSignIn",
-    /** Ask users to set up MFA during registration (skippable, one-time prompt) */
+    /** Ask users to set up MFA during registration (skippable, one-time prompt, Optional MFA only) */
     PromptAtSignInAndSignUp = "PromptAtSignInAndSignUp",
     /** Do not ask users to set up MFA */
-    NoPrompt = "NoPrompt"
+    NoPrompt = "NoPrompt",
+    /** Ask users to set up MFA during registration or at next sign-in (no-skip, Adaptive MFA only) */
+    PromptAtSignInAndSignUpMandatory = "PromptAtSignInAndSignUpMandatory",
+    /** Ask users to set up MFA at next sign-in after registration (no-skip, Adaptive MFA only) */
+    PromptOnlyAtSignInMandatory = "PromptOnlyAtSignInMandatory"
 }
 export declare enum OrganizationRequiredMfaPolicy {
     /** Do not ask users to set up MFA */
@@ -411,4 +415,30 @@ export declare const passkeySignInGuard: z.ZodObject<{
     showPasskeyButton?: boolean | undefined;
     allowAutofill?: boolean | undefined;
 }>;
+/**
+ * Configuration for which custom profile fields are shown on the sign-up page and in which order.
+ *
+ * The list is a pure projection over the catalog in `custom_profile_fields` — each entry references
+ * an existing field by name. Fields in the catalog but not in this list are not collected during
+ * sign-up. This enables reusing the same catalog for other surfaces (e.g. account center) without
+ * affecting sign-up.
+ */
+export type SignUpProfileFieldItem = {
+    name: string;
+};
+export declare const signUpProfileFieldItemGuard: z.ZodObject<{
+    name: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+}, {
+    name: string;
+}>;
+export declare const signUpProfileFieldsGuard: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+}, {
+    name: string;
+}>, "many">;
+export type SignUpProfileFields = z.infer<typeof signUpProfileFieldsGuard>;
 export {};

package/lib/foundations/jsonb-types/sign-in-experience.js

@@ -83,12 +83,16 @@ export var MfaPolicy;
     MfaPolicy["UserControlled"] = "UserControlled";
     /** MFA is required for all users */
     MfaPolicy["Mandatory"] = "Mandatory";
-    /** Ask users to set up MFA on their sign-in after registration (skippable, one-time prompt) */
+    /** Ask users to set up MFA on their sign-in after registration (skippable, one-time prompt, Optional MFA only) */
     MfaPolicy["PromptOnlyAtSignIn"] = "PromptOnlyAtSignIn";
-    /** Ask users to set up MFA during registration (skippable, one-time prompt) */
+    /** Ask users to set up MFA during registration (skippable, one-time prompt, Optional MFA only) */
     MfaPolicy["PromptAtSignInAndSignUp"] = "PromptAtSignInAndSignUp";
     /** Do not ask users to set up MFA */
     MfaPolicy["NoPrompt"] = "NoPrompt";
+    /** Ask users to set up MFA during registration or at next sign-in (no-skip, Adaptive MFA only) */
+    MfaPolicy["PromptAtSignInAndSignUpMandatory"] = "PromptAtSignInAndSignUpMandatory";
+    /** Ask users to set up MFA at next sign-in after registration (no-skip, Adaptive MFA only) */
+    MfaPolicy["PromptOnlyAtSignInMandatory"] = "PromptOnlyAtSignInMandatory";
 })(MfaPolicy || (MfaPolicy = {}));
 export var OrganizationRequiredMfaPolicy;
 (function (OrganizationRequiredMfaPolicy) {
@@ -134,3 +138,7 @@ export const passkeySignInGuard = z
     allowAutofill: z.boolean(),
 })
     .partial();
+export const signUpProfileFieldItemGuard = z.object({
+    name: z.string(),
+});
+export const signUpProfileFieldsGuard = z.array(signUpProfileFieldItemGuard);

package/lib/seeds/application.d.ts

@@ -7,9 +7,11 @@ import type { Application, CreateApplication, CreateApplicationsRole } from '../
 export declare const adminConsoleApplicationId = "admin-console";
 export declare const demoAppApplicationId = "demo-app";
 export declare const accountCenterApplicationId = "account-center";
+export declare const deviceDemoAppApplicationId = "device-demo-app";
 export declare const buildDemoAppDataForTenant: (tenantId: string) => Application;
 export declare const buildAccountCenterAppDataForTenant: (tenantId: string) => Application;
-export type BuiltInApplicationId = typeof demoAppApplicationId | typeof accountCenterApplicationId;
+export declare const buildDeviceDemoAppDataForTenant: (tenantId: string) => Application;
+export type BuiltInApplicationId = typeof demoAppApplicationId | typeof accountCenterApplicationId | typeof deviceDemoAppApplicationId;
 export declare const isBuiltInApplicationId: (applicationId: string) => applicationId is BuiltInApplicationId;
 export declare const isBuiltInClientId: (applicationId: string) => applicationId is BuiltInApplicationId;
 export declare const buildBuiltInApplicationDataForTenant: (tenantId: string, applicationId: BuiltInApplicationId) => Application;

package/lib/seeds/application.js

@@ -9,6 +9,7 @@ import { adminTenantId } from './tenant.js';
 export const adminConsoleApplicationId = 'admin-console';
 export const demoAppApplicationId = 'demo-app';
 export const accountCenterApplicationId = 'account-center';
+export const deviceDemoAppApplicationId = 'device-demo-app';
 const buildSpaApplicationData = (tenantId, { id, name, description, }) => ({
     tenantId,
     id,
@@ -33,12 +34,36 @@ export const buildAccountCenterAppDataForTenant = (tenantId) => buildSpaApplicat
     name: 'Account Center',
     description: 'Placeholder application for Account Center.',
 });
-export const isBuiltInApplicationId = (applicationId) => applicationId === demoAppApplicationId || applicationId === accountCenterApplicationId;
+const buildNativeApplicationData = (tenantId, { id, name, description, }) => ({
+    tenantId,
+    id,
+    name,
+    secret: 'N/A',
+    description,
+    type: ApplicationType.Native,
+    oidcClientMetadata: { redirectUris: [], postLogoutRedirectUris: [] },
+    customClientMetadata: { isDeviceFlow: true },
+    protectedAppMetadata: null,
+    isThirdParty: false,
+    createdAt: 0,
+    customData: {},
+});
+export const buildDeviceDemoAppDataForTenant = (tenantId) => buildNativeApplicationData(tenantId, {
+    id: deviceDemoAppApplicationId,
+    name: 'Device Flow Preview',
+    description: 'Preview for Device Authorization Flow.',
+});
+export const isBuiltInApplicationId = (applicationId) => applicationId === demoAppApplicationId ||
+    applicationId === accountCenterApplicationId ||
+    applicationId === deviceDemoAppApplicationId;
 export const isBuiltInClientId = isBuiltInApplicationId;
 export const buildBuiltInApplicationDataForTenant = (tenantId, applicationId) => {
     if (applicationId === demoAppApplicationId) {
         return buildDemoAppDataForTenant(tenantId);
     }
+    if (applicationId === deviceDemoAppApplicationId) {
+        return buildDeviceDemoAppDataForTenant(tenantId);
+    }
     return buildAccountCenterAppDataForTenant(tenantId);
 };
 export const createDefaultAdminConsoleApplication = () => Object.freeze({

package/lib/types/alteration.d.ts

@@ -1,4 +1,9 @@
 import type { CommonQueryMethods, DatabaseTransactionConnection } from '@silverhand/slonik';
+/**
+ * IMPORTANT: Logto Cloud has a parallel `AlterationScript` type in `@logto/cloud-alterations`
+ * (logto-cloud repo: `packages/cloud-alterations/src/types.ts`).
+ * Any changes to this type must be synchronized with the Cloud type definition.
+ */
 export type AlterationScript = {
     /**
      * Optional hook that runs before `up` outside of a transaction.

package/lib/types/application.d.ts

@@ -27,6 +27,8 @@ export declare const featuredApplicationGuard: z.ZodObject<Pick<{
         alwaysIssueRefreshToken?: boolean | undefined;
         rotateRefreshToken?: boolean | undefined;
         allowTokenExchange?: boolean | undefined;
+        isDeviceFlow?: boolean | undefined;
+        maxAllowedGrants?: number | undefined;
     }, z.ZodTypeDef, {
         corsAllowedOrigins?: string[] | undefined;
         idTokenTtl?: number | undefined;
@@ -36,6 +38,8 @@ export declare const featuredApplicationGuard: z.ZodObject<Pick<{
         alwaysIssueRefreshToken?: boolean | undefined;
         rotateRefreshToken?: boolean | undefined;
         allowTokenExchange?: boolean | undefined;
+        isDeviceFlow?: boolean | undefined;
+        maxAllowedGrants?: number | undefined;
     }>;
     protectedAppMetadata: z.ZodType<{
         host: string;
@@ -119,6 +123,8 @@ export declare const applicationCreateGuard: z.ZodObject<{
         alwaysIssueRefreshToken?: boolean | undefined;
         rotateRefreshToken?: boolean | undefined;
         allowTokenExchange?: boolean | undefined;
+        isDeviceFlow?: boolean | undefined;
+        maxAllowedGrants?: number | undefined;
     }, z.ZodTypeDef, {
         corsAllowedOrigins?: string[] | undefined;
         idTokenTtl?: number | undefined;
@@ -128,6 +134,8 @@ export declare const applicationCreateGuard: z.ZodObject<{
         alwaysIssueRefreshToken?: boolean | undefined;
         rotateRefreshToken?: boolean | undefined;
         allowTokenExchange?: boolean | undefined;
+        isDeviceFlow?: boolean | undefined;
+        maxAllowedGrants?: number | undefined;
     }>>>;
     protectedAppMetadata: z.ZodOptional<z.ZodOptional<z.ZodType<{
         host: string;
@@ -222,6 +230,8 @@ export declare const applicationPatchGuard: z.ZodObject<Omit<{
         alwaysIssueRefreshToken?: boolean | undefined;
         rotateRefreshToken?: boolean | undefined;
         allowTokenExchange?: boolean | undefined;
+        isDeviceFlow?: boolean | undefined;
+        maxAllowedGrants?: number | undefined;
     }, z.ZodTypeDef, {
         corsAllowedOrigins?: string[] | undefined;
         idTokenTtl?: number | undefined;
@@ -231,6 +241,8 @@ export declare const applicationPatchGuard: z.ZodObject<Omit<{
         alwaysIssueRefreshToken?: boolean | undefined;
         rotateRefreshToken?: boolean | undefined;
         allowTokenExchange?: boolean | undefined;
+        isDeviceFlow?: boolean | undefined;
+        maxAllowedGrants?: number | undefined;
     }>>>>;
     protectedAppMetadata: z.ZodOptional<z.ZodOptional<z.ZodOptional<z.ZodType<{
         host: string;
@@ -537,16 +549,16 @@ export declare const applicationSignInExperienceCreateGuard: z.ZodObject<Omit<{
     privacyPolicyUrl: z.ZodUnion<[z.ZodNullable<z.ZodOptional<z.ZodString>>, z.ZodLiteral<"">]>;
 }, "strip", z.ZodTypeAny, {
     displayName?: string | null;
+    customCss?: string | null;
     color?: import("../index.js").PartialColor;
     branding?: import("../index.js").Branding;
-    customCss?: string | null;
     termsOfUseUrl?: string | null | undefined;
     privacyPolicyUrl?: string | null | undefined;
 }, {
     displayName?: string | null;
+    customCss?: string | null;
     color?: import("../index.js").PartialColor;
     branding?: import("../index.js").Branding;
-    customCss?: string | null;
     termsOfUseUrl?: string | null | undefined;
     privacyPolicyUrl?: string | null | undefined;
 }>;

package/lib/types/connector.d.ts

@@ -241,6 +241,7 @@ export declare const connectorResponseGuard: z.ZodObject<{
         "ca-ES"?: string | undefined;
         "cb-IQ"?: string | undefined;
         "co-FR"?: string | undefined;
+        cs?: string | undefined;
         "cs-CZ"?: string | undefined;
         "cx-PH"?: string | undefined;
         "cy-GB"?: string | undefined;
@@ -374,6 +375,7 @@ export declare const connectorResponseGuard: z.ZodObject<{
         "ca-ES"?: string | undefined;
         "cb-IQ"?: string | undefined;
         "co-FR"?: string | undefined;
+        cs?: string | undefined;
         "cs-CZ"?: string | undefined;
         "cx-PH"?: string | undefined;
         "cy-GB"?: string | undefined;
@@ -577,6 +579,7 @@ export declare const connectorResponseGuard: z.ZodObject<{
         "ca-ES"?: string | undefined;
         "cb-IQ"?: string | undefined;
         "co-FR"?: string | undefined;
+        cs?: string | undefined;
         "cs-CZ"?: string | undefined;
         "cx-PH"?: string | undefined;
         "cy-GB"?: string | undefined;
@@ -710,6 +713,7 @@ export declare const connectorResponseGuard: z.ZodObject<{
         "ca-ES"?: string | undefined;
         "cb-IQ"?: string | undefined;
         "co-FR"?: string | undefined;
+        cs?: string | undefined;
         "cs-CZ"?: string | undefined;
         "cx-PH"?: string | undefined;
         "cy-GB"?: string | undefined;
@@ -1118,6 +1122,7 @@ export declare const connectorFactoryResponseGuard: z.ZodObject<{
         "ca-ES"?: string | undefined;
         "cb-IQ"?: string | undefined;
         "co-FR"?: string | undefined;
+        cs?: string | undefined;
         "cs-CZ"?: string | undefined;
         "cx-PH"?: string | undefined;
         "cy-GB"?: string | undefined;
@@ -1251,6 +1256,7 @@ export declare const connectorFactoryResponseGuard: z.ZodObject<{
         "ca-ES"?: string | undefined;
         "cb-IQ"?: string | undefined;
         "co-FR"?: string | undefined;
+        cs?: string | undefined;
         "cs-CZ"?: string | undefined;
         "cx-PH"?: string | undefined;
         "cy-GB"?: string | undefined;
@@ -1447,6 +1453,7 @@ export declare const connectorFactoryResponseGuard: z.ZodObject<{
         "ca-ES"?: string | undefined;
         "cb-IQ"?: string | undefined;
         "co-FR"?: string | undefined;
+        cs?: string | undefined;
         "cs-CZ"?: string | undefined;
         "cx-PH"?: string | undefined;
         "cy-GB"?: string | undefined;
@@ -1580,6 +1587,7 @@ export declare const connectorFactoryResponseGuard: z.ZodObject<{
         "ca-ES"?: string | undefined;
         "cb-IQ"?: string | undefined;
         "co-FR"?: string | undefined;
+        cs?: string | undefined;
         "cs-CZ"?: string | undefined;
         "cx-PH"?: string | undefined;
         "cy-GB"?: string | undefined;

package/lib/types/consent.d.ts

@@ -158,6 +158,8 @@ export declare const publicApplicationGuard: z.ZodObject<Pick<{
         alwaysIssueRefreshToken?: boolean | undefined;
         rotateRefreshToken?: boolean | undefined;
         allowTokenExchange?: boolean | undefined;
+        isDeviceFlow?: boolean | undefined;
+        maxAllowedGrants?: number | undefined;
     }, z.ZodTypeDef, {
         corsAllowedOrigins?: string[] | undefined;
         idTokenTtl?: number | undefined;
@@ -167,6 +169,8 @@ export declare const publicApplicationGuard: z.ZodObject<Pick<{
         alwaysIssueRefreshToken?: boolean | undefined;
         rotateRefreshToken?: boolean | undefined;
         allowTokenExchange?: boolean | undefined;
+        isDeviceFlow?: boolean | undefined;
+        maxAllowedGrants?: number | undefined;
     }>;
     protectedAppMetadata: z.ZodType<{
         host: string;
@@ -477,6 +481,8 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
             alwaysIssueRefreshToken?: boolean | undefined;
             rotateRefreshToken?: boolean | undefined;
             allowTokenExchange?: boolean | undefined;
+            isDeviceFlow?: boolean | undefined;
+            maxAllowedGrants?: number | undefined;
         }, z.ZodTypeDef, {
             corsAllowedOrigins?: string[] | undefined;
             idTokenTtl?: number | undefined;
@@ -486,6 +492,8 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
             alwaysIssueRefreshToken?: boolean | undefined;
             rotateRefreshToken?: boolean | undefined;
             allowTokenExchange?: boolean | undefined;
+            isDeviceFlow?: boolean | undefined;
+            maxAllowedGrants?: number | undefined;
         }>;
         protectedAppMetadata: z.ZodType<{
             host: string;
@@ -900,7 +908,7 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
             description: string | null;
         }[];
     }>, "many">>;
-    redirectUri: z.ZodString;
+    redirectUri: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     application: {
         name: string;
@@ -915,7 +923,6 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
         termsOfUseUrl?: string | null | undefined;
         privacyPolicyUrl?: string | null | undefined;
     };
-    redirectUri: string;
     user: {
         name: string | null;
         id: string;
@@ -940,6 +947,7 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
             }[];
         }[] | undefined;
     }[] | undefined;
+    redirectUri?: string | undefined;
     missingResourceScopes?: {
         resource: {
             name: string;
@@ -967,7 +975,6 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
         termsOfUseUrl?: string | null | undefined;
         privacyPolicyUrl?: string | null | undefined;
     };
-    redirectUri: string;
     user: {
         name: string | null;
         id: string;
@@ -992,6 +999,7 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
             }[];
         }[] | undefined;
     }[] | undefined;
+    redirectUri?: string | undefined;
     missingResourceScopes?: {
         resource: {
             name: string;

package/lib/types/consent.js

@@ -47,5 +47,6 @@ export const consentInfoResponseGuard = z.object({
     organizations: publicOrganizationGuard.array().optional(),
     missingOIDCScope: z.string().array().optional(),
     missingResourceScopes: missingResourceScopesGuard.array().optional(),
-    redirectUri: z.string(),
+    // Device flow consent does not require a redirect_uri.
+    redirectUri: z.string().optional(),
 });

package/lib/types/custom-profile-fields.d.ts

@@ -2383,11 +2383,10 @@ export declare const updateCustomProfileFieldSieOrderGuard: z.ZodObject<{
     sieOrder: number;
 }>;
 export type UpdateCustomProfileFieldSieOrder = z.infer<typeof updateCustomProfileFieldSieOrderGuard>;
-/**
- * Reserved custom data keys, which are used by the system and should not be used by custom profile fields.
- */
+/** Reserved custom data keys, which are used by the system and should not be used by custom profile fields. */
 export declare const reservedCustomDataKeyGuard: z.ZodObject<{
     onboarding: z.ZodOptional<z.ZodString>;
+    ossOnboarding: z.ZodOptional<z.ZodString>;
     guideRequests: z.ZodOptional<z.ZodString>;
     adminConsolePreferences: z.ZodOptional<z.ZodString>;
     defaultTenantId: z.ZodOptional<z.ZodString>;
@@ -2396,17 +2395,16 @@ export declare const reservedCustomDataKeyGuard: z.ZodObject<{
     guideRequests?: string | undefined;
     defaultTenantId?: string | undefined;
     onboarding?: string | undefined;
+    ossOnboarding?: string | undefined;
 }, {
     adminConsolePreferences?: string | undefined;
     guideRequests?: string | undefined;
     defaultTenantId?: string | undefined;
     onboarding?: string | undefined;
+    ossOnboarding?: string | undefined;
 }>;
-export declare const reservedCustomDataKeys: readonly ["adminConsolePreferences", "guideRequests", "defaultTenantId", "onboarding"];
-/**
- * Disallow sign-in identifiers related field keys in custom profile fields, as this is conflicting
- * with the built-in sign-in/sign-up experience flows.
- */
+export declare const reservedCustomDataKeys: readonly ["adminConsolePreferences", "guideRequests", "defaultTenantId", "onboarding", "ossOnboarding"];
+/** Disallow sign-in identifier related field keys in custom profile fields to avoid conflicts with built-in sign-in/sign-up flows. */
 export declare const signInIdentifierKeyGuard: z.ZodObject<Pick<{
     tenantId: z.ZodOptional<z.ZodType<string, z.ZodTypeDef, string>>;
     id: z.ZodType<string, z.ZodTypeDef, string>;
@@ -2544,11 +2542,7 @@ export declare const signInIdentifierKeyGuard: z.ZodObject<Pick<{
     primaryPhone?: string | null;
 }>;
 export declare const reservedSignInIdentifierKeys: readonly ["username", "email", "phone", "primaryEmail", "primaryPhone"];
-/**
- * Reserved user profile keys.
- * Currently only `preferredUsername` is reserved since it is the standard username property used
- * by most identity providers. Should not allow user updating this field via profile related APIs.
- */
+/** Reserved user profile keys. Currently only `preferredUsername` is reserved for standard IdP usage. */
 export declare const reservedBuiltInProfileKeyGuard: z.ZodObject<Pick<{
     familyName: z.ZodOptional<z.ZodString>;
     givenName: z.ZodOptional<z.ZodString>;

package/lib/types/custom-profile-fields.js

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { Users } from '../db-entries/user.js';
 import { CustomProfileFieldType, customProfileFieldTypeGuard, fieldPartGuard, userProfileAddressKeys, userProfileGuard, } from '../foundations/index.js';
-import { userOnboardingDataKey } from './onboarding.js';
+import { ossUserOnboardingDataKey, userOnboardingDataKey } from './onboarding.js';
 import { defaultTenantIdKey } from './tenant.js';
 import { consoleUserPreferenceKey, guideRequestsKey } from './user.js';
 const baseProfileFieldGuard = z.object({
@@ -129,22 +129,18 @@ export const updateCustomProfileFieldSieOrderGuard = z.object({
     name: z.string(),
     sieOrder: z.number(),
 });
-/**
- * Reserved custom data keys, which are used by the system and should not be used by custom profile fields.
- */
+/** Reserved custom data keys, which are used by the system and should not be used by custom profile fields. */
 export const reservedCustomDataKeyGuard = z
     .object({
     [userOnboardingDataKey]: z.string(),
+    [ossUserOnboardingDataKey]: z.string(),
     [guideRequestsKey]: z.string(),
     [consoleUserPreferenceKey]: z.string(),
     [defaultTenantIdKey]: z.string(),
 })
     .partial();
 export const reservedCustomDataKeys = Object.freeze(reservedCustomDataKeyGuard.keyof().options);
-/**
- * Disallow sign-in identifiers related field keys in custom profile fields, as this is conflicting
- * with the built-in sign-in/sign-up experience flows.
- */
+/** Disallow sign-in identifier related field keys in custom profile fields to avoid conflicts with built-in sign-in/sign-up flows. */
 export const signInIdentifierKeyGuard = Users.createGuard
     .pick({
     username: true,
@@ -156,11 +152,7 @@ export const signInIdentifierKeyGuard = Users.createGuard
     phone: z.string().nullable().optional(),
 });
 export const reservedSignInIdentifierKeys = Object.freeze(signInIdentifierKeyGuard.keyof().options);
-/**
- * Reserved user profile keys.
- * Currently only `preferredUsername` is reserved since it is the standard username property used
- * by most identity providers. Should not allow user updating this field via profile related APIs.
- */
+/** Reserved user profile keys. Currently only `preferredUsername` is reserved for standard IdP usage. */
 export const reservedBuiltInProfileKeyGuard = userProfileGuard.pick({ preferredUsername: true });
 export const reservedBuiltInProfileKeys = Object.freeze(reservedBuiltInProfileKeyGuard.keyof().options);
 export var SupportedDateFormat;
@@ -176,3 +168,4 @@ export var Gender;
     Gender["Male"] = "male";
     Gender["Other"] = "prefer_not_to_say";
 })(Gender || (Gender = {}));
+/* eslint-enable max-lines */

package/lib/types/log/interaction.d.ts

@@ -9,9 +9,11 @@ export declare enum Field {
     Identifier = "Identifier",
     Profile = "Profile",
     BindMfa = "BindMfa",
+    /** @deprecated */
     Mfa = "Mfa",
     Verification = "Verification",
-    Captcha = "Captcha"
+    Captcha = "Captcha",
+    SignInPasskey = "SignInPasskey"
 }
 /** Method to verify the identifier */
 export declare enum Method {
@@ -73,4 +75,4 @@ export type DeprecatedInteractionLogKey = `${Prefix}.${InteractionEvent}.${Field
  *   - When {@link Method} is `VerificationCode`, {@link Action} can be `Create` (generate and send a code) or `Submit` (verify and submit to the identifiers);
  *   - Otherwise, {@link Action} is fixed to `Submit` (other methods can be verified on submitting).
  */
-export type LogKey = `${Prefix}.${Action.Create | Action.End}` | `${Prefix}.${Action.Create}.${Field.Captcha}` | `${Prefix}.${InteractionEvent}.${Action.Create | Action.Update | Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.Profile}.${Action.Update}` | `${Prefix}.${InteractionEvent}.${Field.BindMfa}.${MfaFactor}.${Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.Verification}.${VerificationType}.${Action}` | `${Prefix}.${InteractionEvent}.${Field.Identifier}.${Action.Submit}` | `${Prefix}.${InteractionEvent.SignIn}.${Field.Verification}.IdpInitiatedSso.${Action.Create}` | DeprecatedInteractionLogKey;
+export type LogKey = `${Prefix}.${Action.Create | Action.End}` | `${Prefix}.${Action.Create}.${Field.Captcha}` | `${Prefix}.${InteractionEvent}.${Action.Create | Action.Update | Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.Profile}.${Action.Update}` | `${Prefix}.${InteractionEvent}.${Field.BindMfa}.${MfaFactor}.${Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.SignInPasskey}.${Action.Submit}` | `${Prefix}.${InteractionEvent}.${Field.Verification}.${VerificationType}.${Action}` | `${Prefix}.${InteractionEvent}.${Field.Identifier}.${Action.Submit}` | `${Prefix}.${InteractionEvent.SignIn}.${Field.Verification}.IdpInitiatedSso.${Action.Create}` | DeprecatedInteractionLogKey;

package/lib/types/log/interaction.js

@@ -6,9 +6,11 @@ export var Field;
     Field["Identifier"] = "Identifier";
     Field["Profile"] = "Profile";
     Field["BindMfa"] = "BindMfa";
+    /** @deprecated */
     Field["Mfa"] = "Mfa";
     Field["Verification"] = "Verification";
     Field["Captcha"] = "Captcha";
+    Field["SignInPasskey"] = "SignInPasskey";
 })(Field || (Field = {}));
 /** Method to verify the identifier */
 export var Method;

package/lib/types/log/token.d.ts

@@ -1,7 +1,8 @@
 /** The type of a token event. */
 export declare enum Type {
     ExchangeTokenBy = "ExchangeTokenBy",
-    RevokeToken = "RevokeToken"
+    RevokeToken = "RevokeToken",
+    RevokeGrants = "RevokeGrants"
 }
 /** Available grant token types extracted from [oidc-provider](https://github.com/panva/node-oidc-provider/blob/564b1095ee869c89381d63dfdb5875c99f870f5f/lib/helpers/revoke.js#L13). */
 export declare enum TokenType {
@@ -18,6 +19,7 @@ export declare enum ExchangeByType {
     AuthorizationCode = "AuthorizationCode",
     RefreshToken = "RefreshToken",
     ClientCredentials = "ClientCredentials",
-    TokenExchange = "TokenExchange"
+    TokenExchange = "TokenExchange",
+    DeviceCode = "DeviceCode"
 }
-export type LogKey = `${Type.ExchangeTokenBy}.${ExchangeByType}` | `${Type.RevokeToken}`;
+export type LogKey = `${Type.ExchangeTokenBy}.${ExchangeByType}` | `${Type.RevokeToken}` | `${Type.RevokeGrants}`;

package/lib/types/log/token.js

@@ -3,6 +3,7 @@ export var Type;
 (function (Type) {
     Type["ExchangeTokenBy"] = "ExchangeTokenBy";
     Type["RevokeToken"] = "RevokeToken";
+    Type["RevokeGrants"] = "RevokeGrants";
 })(Type || (Type = {}));
 /** Available grant token types extracted from [oidc-provider](https://github.com/panva/node-oidc-provider/blob/564b1095ee869c89381d63dfdb5875c99f870f5f/lib/helpers/revoke.js#L13). */
 export var TokenType;
@@ -22,4 +23,5 @@ export var ExchangeByType;
     ExchangeByType["RefreshToken"] = "RefreshToken";
     ExchangeByType["ClientCredentials"] = "ClientCredentials";
     ExchangeByType["TokenExchange"] = "TokenExchange";
+    ExchangeByType["DeviceCode"] = "DeviceCode";
 })(ExchangeByType || (ExchangeByType = {}));