@logto/schemas 1.40.1 → 1.41.0

package/lib/db-entries/sign-in-experience.d.ts

@@ -1,4 +1,4 @@
-import { Color, Branding, LanguageInfo, SignIn, SignUp, SocialSignIn, ConnectorTargets, CustomContent, CustomUiAssets, CustomUiCsp, PartialPasswordPolicy, Mfa, AdaptiveMfa, CaptchaPolicy, SentinelPolicy, EmailBlocklistPolicy, ForgotPasswordMethods, PasskeySignIn, SignUpProfileFields, GeneratedSchema } from './../foundations/index.js';
+import { Color, Branding, LanguageInfo, SignIn, SignUp, SocialSignIn, ConnectorTargets, CustomContent, CustomUiAssets, CustomUiCsp, PartialPasswordPolicy, Mfa, AdaptiveMfa, CaptchaPolicy, SentinelPolicy, EmailBlocklistPolicy, VerificationCodePolicy, ForgotPasswordMethods, PasskeySignIn, SignUpProfileFields, PasswordExpirationPolicy, UsernamePolicy, GeneratedSchema } from './../foundations/index.js';
 import { AgreeToTermsPolicy, SignInMode } from './custom-types.js';
 /**
  *
@@ -35,10 +35,13 @@ export type CreateSignInExperience = {
     captchaPolicy?: CaptchaPolicy;
     sentinelPolicy?: SentinelPolicy;
     emailBlocklistPolicy?: EmailBlocklistPolicy;
+    verificationCodePolicy?: VerificationCodePolicy;
     forgotPasswordMethods?: ForgotPasswordMethods | null;
     passkeySignIn?: PasskeySignIn;
-    /** Nullable by design: null keeps legacy full-catalog behavior and [] collects no custom profile fields. */
+    /** Nullable by design: null keeps legacy full-catalog behavior, and new rows default to [] to collect no custom profile fields. */
     signUpProfileFields?: SignUpProfileFields | null;
+    passwordExpiration?: PasswordExpirationPolicy;
+    usernamePolicy?: UsernamePolicy;
 };
 export type SignInExperience = {
     tenantId: string;
@@ -70,10 +73,13 @@ export type SignInExperience = {
     captchaPolicy: CaptchaPolicy;
     sentinelPolicy: SentinelPolicy;
     emailBlocklistPolicy: EmailBlocklistPolicy;
+    verificationCodePolicy: VerificationCodePolicy;
     forgotPasswordMethods: ForgotPasswordMethods | null;
     passkeySignIn: PasskeySignIn;
-    /** Nullable by design: null keeps legacy full-catalog behavior and [] collects no custom profile fields. */
+    /** Nullable by design: null keeps legacy full-catalog behavior, and new rows default to [] to collect no custom profile fields. */
     signUpProfileFields: SignUpProfileFields | null;
+    passwordExpiration: PasswordExpirationPolicy;
+    usernamePolicy: UsernamePolicy;
 };
-export type SignInExperienceKeys = 'tenantId' | 'id' | 'color' | 'branding' | 'hideLogtoBranding' | 'languageInfo' | 'termsOfUseUrl' | 'privacyPolicyUrl' | 'agreeToTermsPolicy' | 'signIn' | 'signUp' | 'socialSignIn' | 'socialSignInConnectorTargets' | 'signInMode' | 'customCss' | 'customContent' | 'customUiAssets' | 'customUiCsp' | 'passwordPolicy' | 'mfa' | 'adaptiveMfa' | 'singleSignOnEnabled' | 'supportEmail' | 'supportWebsiteUrl' | 'unknownSessionRedirectUrl' | 'captchaPolicy' | 'sentinelPolicy' | 'emailBlocklistPolicy' | 'forgotPasswordMethods' | 'passkeySignIn' | 'signUpProfileFields';
+export type SignInExperienceKeys = 'tenantId' | 'id' | 'color' | 'branding' | 'hideLogtoBranding' | 'languageInfo' | 'termsOfUseUrl' | 'privacyPolicyUrl' | 'agreeToTermsPolicy' | 'signIn' | 'signUp' | 'socialSignIn' | 'socialSignInConnectorTargets' | 'signInMode' | 'customCss' | 'customContent' | 'customUiAssets' | 'customUiCsp' | 'passwordPolicy' | 'mfa' | 'adaptiveMfa' | 'singleSignOnEnabled' | 'supportEmail' | 'supportWebsiteUrl' | 'unknownSessionRedirectUrl' | 'captchaPolicy' | 'sentinelPolicy' | 'emailBlocklistPolicy' | 'verificationCodePolicy' | 'forgotPasswordMethods' | 'passkeySignIn' | 'signUpProfileFields' | 'passwordExpiration' | 'usernamePolicy';
 export declare const SignInExperiences: GeneratedSchema<SignInExperienceKeys, CreateSignInExperience, SignInExperience, 'sign_in_experiences', 'sign_in_experience'>;

package/lib/db-entries/sign-in-experience.js

@@ -1,6 +1,6 @@
 // THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
 import { z } from 'zod';
-import { colorGuard, brandingGuard, languageInfoGuard, signInGuard, signUpGuard, socialSignInGuard, connectorTargetsGuard, customContentGuard, customUiAssetsGuard, customUiCspGuard, partialPasswordPolicyGuard, mfaGuard, adaptiveMfaGuard, captchaPolicyGuard, sentinelPolicyGuard, emailBlocklistPolicyGuard, forgotPasswordMethodsGuard, passkeySignInGuard, signUpProfileFieldsGuard } from './../foundations/index.js';
+import { colorGuard, brandingGuard, languageInfoGuard, signInGuard, signUpGuard, socialSignInGuard, connectorTargetsGuard, customContentGuard, customUiAssetsGuard, customUiCspGuard, partialPasswordPolicyGuard, mfaGuard, adaptiveMfaGuard, captchaPolicyGuard, sentinelPolicyGuard, emailBlocklistPolicyGuard, verificationCodePolicyGuard, forgotPasswordMethodsGuard, passkeySignInGuard, signUpProfileFieldsGuard, passwordExpirationPolicyGuard, usernamePolicyGuard } from './../foundations/index.js';
 import { AgreeToTermsPolicy, SignInMode } from './custom-types.js';
 const createGuard = z.object({
     tenantId: z.string().max(21).optional(),
@@ -31,9 +31,12 @@ const createGuard = z.object({
     captchaPolicy: captchaPolicyGuard.optional(),
     sentinelPolicy: sentinelPolicyGuard.optional(),
     emailBlocklistPolicy: emailBlocklistPolicyGuard.optional(),
+    verificationCodePolicy: verificationCodePolicyGuard.optional(),
     forgotPasswordMethods: forgotPasswordMethodsGuard.nullable().optional(),
     passkeySignIn: passkeySignInGuard.optional(),
     signUpProfileFields: signUpProfileFieldsGuard.nullable().optional(),
+    passwordExpiration: passwordExpirationPolicyGuard.optional(),
+    usernamePolicy: usernamePolicyGuard.optional(),
 });
 const guard = z.object({
     tenantId: z.string().max(21),
@@ -64,9 +67,12 @@ const guard = z.object({
     captchaPolicy: captchaPolicyGuard,
     sentinelPolicy: sentinelPolicyGuard,
     emailBlocklistPolicy: emailBlocklistPolicyGuard,
+    verificationCodePolicy: verificationCodePolicyGuard,
     forgotPasswordMethods: forgotPasswordMethodsGuard.nullable(),
     passkeySignIn: passkeySignInGuard,
     signUpProfileFields: signUpProfileFieldsGuard.nullable(),
+    passwordExpiration: passwordExpirationPolicyGuard,
+    usernamePolicy: usernamePolicyGuard,
 });
 export const SignInExperiences = Object.freeze({
     table: 'sign_in_experiences',
@@ -100,9 +106,12 @@ export const SignInExperiences = Object.freeze({
         captchaPolicy: 'captcha_policy',
         sentinelPolicy: 'sentinel_policy',
         emailBlocklistPolicy: 'email_blocklist_policy',
+        verificationCodePolicy: 'verification_code_policy',
         forgotPasswordMethods: 'forgot_password_methods',
         passkeySignIn: 'passkey_sign_in',
         signUpProfileFields: 'sign_up_profile_fields',
+        passwordExpiration: 'password_expiration',
+        usernamePolicy: 'username_policy',
     },
     fieldKeys: [
         'tenantId',
@@ -133,9 +142,12 @@ export const SignInExperiences = Object.freeze({
         'captchaPolicy',
         'sentinelPolicy',
         'emailBlocklistPolicy',
+        'verificationCodePolicy',
         'forgotPasswordMethods',
         'passkeySignIn',
         'signUpProfileFields',
+        'passwordExpiration',
+        'usernamePolicy',
     ],
     createGuard,
     guard,

package/lib/db-entries/user.d.ts

@@ -24,7 +24,9 @@ export type CreateUser = {
     logtoConfig?: JsonObject;
     mfaVerifications?: MfaVerifications;
     isSuspended?: boolean;
+    isPasswordExpired?: boolean;
     lastSignInAt?: number | null;
+    passwordUpdatedAt?: number | null;
     createdAt?: number;
     updatedAt?: number;
 };
@@ -47,9 +49,11 @@ export type User = {
     logtoConfig: JsonObject;
     mfaVerifications: MfaVerifications;
     isSuspended: boolean;
+    isPasswordExpired: boolean;
     lastSignInAt: number | null;
+    passwordUpdatedAt: number | null;
     createdAt: number;
     updatedAt: number;
 };
-export type UserKeys = 'tenantId' | 'id' | 'username' | 'primaryEmail' | 'primaryPhone' | 'passwordEncrypted' | 'passwordEncryptionMethod' | 'name' | 'avatar' | 'profile' | 'applicationId' | 'identities' | 'customData' | 'logtoConfig' | 'mfaVerifications' | 'isSuspended' | 'lastSignInAt' | 'createdAt' | 'updatedAt';
+export type UserKeys = 'tenantId' | 'id' | 'username' | 'primaryEmail' | 'primaryPhone' | 'passwordEncrypted' | 'passwordEncryptionMethod' | 'name' | 'avatar' | 'profile' | 'applicationId' | 'identities' | 'customData' | 'logtoConfig' | 'mfaVerifications' | 'isSuspended' | 'isPasswordExpired' | 'lastSignInAt' | 'passwordUpdatedAt' | 'createdAt' | 'updatedAt';
 export declare const Users: GeneratedSchema<UserKeys, CreateUser, User, 'users', 'user'>;

package/lib/db-entries/user.js

@@ -19,7 +19,9 @@ const createGuard = z.object({
     logtoConfig: jsonObjectGuard.optional(),
     mfaVerifications: mfaVerificationsGuard.optional(),
     isSuspended: z.boolean().optional(),
+    isPasswordExpired: z.boolean().optional(),
     lastSignInAt: z.number().nullable().optional(),
+    passwordUpdatedAt: z.number().nullable().optional(),
     createdAt: z.number().optional(),
     updatedAt: z.number().optional(),
 });
@@ -40,7 +42,9 @@ const guard = z.object({
     logtoConfig: jsonObjectGuard,
     mfaVerifications: mfaVerificationsGuard,
     isSuspended: z.boolean(),
+    isPasswordExpired: z.boolean(),
     lastSignInAt: z.number().nullable(),
+    passwordUpdatedAt: z.number().nullable(),
     createdAt: z.number(),
     updatedAt: z.number(),
 });
@@ -64,7 +68,9 @@ export const Users = Object.freeze({
         logtoConfig: 'logto_config',
         mfaVerifications: 'mfa_verifications',
         isSuspended: 'is_suspended',
+        isPasswordExpired: 'is_password_expired',
         lastSignInAt: 'last_sign_in_at',
+        passwordUpdatedAt: 'password_updated_at',
         createdAt: 'created_at',
         updatedAt: 'updated_at',
     },
@@ -85,7 +91,9 @@ export const Users = Object.freeze({
         'logtoConfig',
         'mfaVerifications',
         'isSuspended',
+        'isPasswordExpired',
         'lastSignInAt',
+        'passwordUpdatedAt',
         'createdAt',
         'updatedAt',
     ],

package/lib/foundations/jsonb-types/account-centers.d.ts

@@ -20,6 +20,7 @@ export declare const accountCenterFieldControlGuard: z.ZodObject<{
     social: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
     customData: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
     mfa: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
+    passkey: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
     session: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
 }, "strip", z.ZodTypeAny, {
     name?: AccountCenterControlValue | undefined;
@@ -32,6 +33,7 @@ export declare const accountCenterFieldControlGuard: z.ZodObject<{
     social?: AccountCenterControlValue | undefined;
     customData?: AccountCenterControlValue | undefined;
     mfa?: AccountCenterControlValue | undefined;
+    passkey?: AccountCenterControlValue | undefined;
     session?: AccountCenterControlValue | undefined;
 }, {
     name?: AccountCenterControlValue | undefined;
@@ -44,6 +46,7 @@ export declare const accountCenterFieldControlGuard: z.ZodObject<{
     social?: AccountCenterControlValue | undefined;
     customData?: AccountCenterControlValue | undefined;
     mfa?: AccountCenterControlValue | undefined;
+    passkey?: AccountCenterControlValue | undefined;
     session?: AccountCenterControlValue | undefined;
 }>;
 export type AccountCenterFieldControl = z.infer<typeof accountCenterFieldControlGuard>;

package/lib/foundations/jsonb-types/account-centers.js

@@ -22,6 +22,7 @@ export const accountCenterFieldControlGuard = z
     social: z.nativeEnum(AccountCenterControlValue),
     customData: z.nativeEnum(AccountCenterControlValue),
     mfa: z.nativeEnum(AccountCenterControlValue),
+    passkey: z.nativeEnum(AccountCenterControlValue),
     session: z.nativeEnum(AccountCenterControlValue),
 })
     .partial();

package/lib/foundations/jsonb-types/hooks.d.ts

@@ -30,14 +30,14 @@ declare enum DataHookDetailMutationType {
 type BasicDataHookEvent = `${DataHookSchema}.${DataHookBasicMutationType}`;
 type CustomDataHookMutableSchema = `${DataHookSchema}.Data` | `${DataHookSchema.User}.SuspensionStatus` | `${DataHookSchema.Role}.Scopes` | `${DataHookSchema.Organization}.Membership` | `${DataHookSchema.OrganizationRole}.Scopes`;
 type DataHookPropertyUpdateEvent = `${CustomDataHookMutableSchema}.${DataHookDetailMutationType.Updated}`;
-export type ExceptionHookEvent = 'Identifier.Lockout';
+export type ExceptionHookEvent = 'Identifier.Lockout' | 'Message.RateLimited';
 export type DataHookEvent = BasicDataHookEvent | DataHookPropertyUpdateEvent;
 /** The hook event values that can be registered. */
-export declare const hookEvents: readonly [InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout"];
+export declare const hookEvents: readonly [InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited"];
 /** The type of hook event values that can be registered. */
 export type HookEvent = (typeof hookEvents)[number];
-export declare const hookEventGuard: z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout"]>;
-export declare const hookEventsGuard: z.ZodArray<z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout"]>, "many">;
+export declare const hookEventGuard: z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited"]>;
+export declare const hookEventsGuard: z.ZodArray<z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited"]>, "many">;
 export type HookEvents = z.infer<typeof hookEventsGuard>;
 export declare const interactionHookEventGuard: z.ZodNativeEnum<typeof InteractionHookEvent>;
 /**

package/lib/foundations/jsonb-types/hooks.js

@@ -62,6 +62,7 @@ export const hookEvents = Object.freeze([
     'OrganizationScope.Deleted',
     'OrganizationScope.Data.Updated',
     'Identifier.Lockout',
+    'Message.RateLimited',
 ]);
 export const hookEventGuard = z.enum(hookEvents);
 export const hookEventsGuard = hookEventGuard.array();

package/lib/foundations/jsonb-types/sentinel.d.ts

@@ -39,7 +39,22 @@ export declare enum SentinelActivityAction {
     /**
      * The subject tries to pass a backup code MFA verification.
      */
-    MfaBackupCode = "MfaBackupCode"
+    MfaBackupCode = "MfaBackupCode",
+    /**
+     * A verification code is sent to the target (email/phone), e.g. sign-in,
+     * register, forgot-password, or identifier-binding codes.
+     *
+     * Used by the message rate limit to throttle sends, distinct from the
+     * failure-based lockout actions above.
+     */
+    VerificationCodeSend = "VerificationCodeSend",
+    /**
+     * A non-verification-code message is sent to the target (email/phone),
+     * e.g. an organization invitation.
+     *
+     * Used by the message rate limit to throttle sends.
+     */
+    MessageSend = "MessageSend"
 }
 export declare const sentinelActivityActionGuard: z.ZodNativeEnum<typeof SentinelActivityAction>;
 export type SentinelActivityPayload = Record<string, unknown>;

package/lib/foundations/jsonb-types/sentinel.js

@@ -42,6 +42,21 @@ export var SentinelActivityAction;
      * The subject tries to pass a backup code MFA verification.
      */
     SentinelActivityAction["MfaBackupCode"] = "MfaBackupCode";
+    /**
+     * A verification code is sent to the target (email/phone), e.g. sign-in,
+     * register, forgot-password, or identifier-binding codes.
+     *
+     * Used by the message rate limit to throttle sends, distinct from the
+     * failure-based lockout actions above.
+     */
+    SentinelActivityAction["VerificationCodeSend"] = "VerificationCodeSend";
+    /**
+     * A non-verification-code message is sent to the target (email/phone),
+     * e.g. an organization invitation.
+     *
+     * Used by the message rate limit to throttle sends.
+     */
+    SentinelActivityAction["MessageSend"] = "MessageSend";
 })(SentinelActivityAction || (SentinelActivityAction = {}));
 export const sentinelActivityActionGuard = z.nativeEnum(SentinelActivityAction);
 export const sentinelActivityPayloadGuard = z.record(z.unknown());

package/lib/foundations/jsonb-types/sign-in-experience.d.ts

@@ -193,6 +193,7 @@ export declare const signInGuard: z.ZodObject<{
     }[];
 }>;
 export type SignIn = z.infer<typeof signInGuard>;
+export { defaultUsernamePolicy, usernamePolicyGuard, type UsernamePolicy } from '@logto/core-kit';
 export type SocialSignIn = {
     /**
      * If account linking should be performed when a user signs in with a social identity that is new
@@ -359,11 +360,33 @@ export declare const sentinelPolicyGuard: z.ZodObject<{
     lockoutDuration?: number | undefined;
 }>;
 /**
- * Email blocklist policy.
+ * Verification code policy.
  *
  * @remarks
- * This policy is used to block specific email addresses or domains from signing up.
+ * This policy controls the expiration duration and maximum retry attempts for verification codes.
  */
+export type VerificationCodePolicy = {
+    /**
+     * The duration in seconds that a verification code remains valid.
+     * @default 600 (10 minutes)
+     */
+    expirationDuration?: number;
+    /**
+     * Maximum number of failed verification attempts allowed before the code is invalidated.
+     * @default 10
+     */
+    maxRetryAttempts?: number;
+};
+export declare const verificationCodePolicyGuard: z.ZodObject<{
+    expirationDuration: z.ZodOptional<z.ZodNumber>;
+    maxRetryAttempts: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    expirationDuration?: number | undefined;
+    maxRetryAttempts?: number | undefined;
+}, {
+    expirationDuration?: number | undefined;
+    maxRetryAttempts?: number | undefined;
+}>;
 export type EmailBlocklistPolicy = {
     blockDisposableAddresses?: boolean;
     blockSubaddressing?: boolean;
@@ -441,4 +464,53 @@ export declare const signUpProfileFieldsGuard: z.ZodArray<z.ZodObject<{
     name: string;
 }>, "many">;
 export type SignUpProfileFields = z.infer<typeof signUpProfileFieldsGuard>;
+/**
+ * Password lifecycle policy for configuring password expiration and rotation.
+ *
+ * @remarks
+ * This policy is evaluated server-side during sign-in (after local password verification) to determine
+ * whether the user's password has expired.
+ *
+ * If the password age >= `validPeriodDays`, the sign-in is blocked and the user must reset their
+ * password before continuing.
+ */
+export type PasswordExpirationPolicy = {
+    /**
+     * Whether the password expiration policy is enabled.
+     * @default false
+     */
+    enabled?: false;
+} | {
+    enabled: true;
+    /**
+     * Number of days a password is valid before it expires and the user is
+     * forced to reset it on sign-in.
+     */
+    validPeriodDays: number;
+    /**
+     * Epoch milliseconds when the policy was enabled. Used as the expiry anchor for users
+     * that have no `passwordUpdatedAt` (e.g. legacy accounts), so enabling the policy grants
+     * them a full valid period instead of expiring them against their account creation date.
+     */
+    enabledAt?: number;
+};
+export declare const passwordExpirationPolicyGuard: z.ZodUnion<[z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodLiteral<false>>;
+}, "strip", z.ZodTypeAny, {
+    enabled?: false | undefined;
+}, {
+    enabled?: false | undefined;
+}>, z.ZodObject<{
+    enabled: z.ZodLiteral<true>;
+    validPeriodDays: z.ZodNumber;
+    enabledAt: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    enabled: true;
+    validPeriodDays: number;
+    enabledAt?: number | undefined;
+}, {
+    enabled: true;
+    validPeriodDays: number;
+    enabledAt?: number | undefined;
+}>]>;
 export { customUiCspGuard, type CustomUiCsp } from '@logto/core-kit';

package/lib/foundations/jsonb-types/sign-in-experience.js

@@ -62,6 +62,9 @@ export const signInGuard = z.object({
     })
         .array(),
 });
+// The username policy is owned by @logto/core-kit (like passwordPolicyGuard) so core, experience,
+// and console share one source of truth; re-exported here for the `@use UsernamePolicy` column.
+export { defaultUsernamePolicy, usernamePolicyGuard } from '@logto/core-kit';
 export const socialSignInGuard = z.object({
     automaticAccountLinking: z.boolean().optional(),
     skipRequiredIdentifiers: z.boolean().optional(),
@@ -120,6 +123,10 @@ export const sentinelPolicyGuard = z.object({
     maxAttempts: z.number().optional(),
     lockoutDuration: z.number().optional(),
 });
+export const verificationCodePolicyGuard = z.object({
+    expirationDuration: z.number().int().min(60).max(3600).optional(),
+    maxRetryAttempts: z.number().int().min(1).max(100).optional(),
+});
 export const emailBlocklistPolicyGuard = z.object({
     blockDisposableAddresses: z.boolean().optional(),
     blockSubaddressing: z.boolean().optional(),
@@ -142,4 +149,16 @@ export const signUpProfileFieldItemGuard = z.object({
     name: z.string(),
 });
 export const signUpProfileFieldsGuard = z.array(signUpProfileFieldItemGuard);
+// Intentionally not `.strict()` for backward compatibility: legacy rows may carry removed fields
+// (e.g. `reminderPeriodDays`), which are stripped on parse instead of rejected.
+export const passwordExpirationPolicyGuard = z.union([
+    z.object({
+        enabled: z.literal(false).optional(),
+    }),
+    z.object({
+        enabled: z.literal(true),
+        validPeriodDays: z.number().int().min(1),
+        enabledAt: z.number().int().nonnegative().optional(),
+    }),
+]);
 export { customUiCspGuard } from '@logto/core-kit';

package/lib/foundations/jsonb-types/sign-in-experience.test.js

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { customUiCspGuard } from './sign-in-experience.js';
+import { customUiCspGuard, passwordExpirationPolicyGuard } from './sign-in-experience.js';
 describe('customUiCspGuard', () => {
     it.each([
         {},
@@ -16,3 +16,51 @@ describe('customUiCspGuard', () => {
         expect(customUiCspGuard.safeParse({ imgSrc: ['https://example.com'] }).success).toBe(false);
     });
 });
+describe('passwordExpirationPolicyGuard', () => {
+    it.each([
+        [{}, {}],
+        [{ enabled: false }, { enabled: false }],
+    ])('accepts disabled policy %p', (value, expected) => {
+        expect(passwordExpirationPolicyGuard.parse(value)).toEqual(expected);
+    });
+    it('accepts enabled policy with a valid period', () => {
+        expect(passwordExpirationPolicyGuard.parse({
+            enabled: true,
+            validPeriodDays: 30,
+        })).toEqual({
+            enabled: true,
+            validPeriodDays: 30,
+        });
+    });
+    it('accepts enabled policy with an enabledAt timestamp', () => {
+        expect(passwordExpirationPolicyGuard.parse({
+            enabled: true,
+            validPeriodDays: 30,
+            enabledAt: 1_700_000_000_000,
+        })).toEqual({
+            enabled: true,
+            validPeriodDays: 30,
+            enabledAt: 1_700_000_000_000,
+        });
+    });
+    it('strips unknown keys from legacy rows (e.g. the removed reminderPeriodDays)', () => {
+        expect(passwordExpirationPolicyGuard.parse({
+            enabled: true,
+            validPeriodDays: 30,
+            reminderPeriodDays: 5,
+        })).toEqual({
+            enabled: true,
+            validPeriodDays: 30,
+        });
+    });
+    it.each([
+        { enabled: true },
+        { enabled: true, validPeriodDays: 0 },
+        { enabled: true, validPeriodDays: 1.5 },
+        { enabled: true, reminderPeriodDays: 5 },
+        { enabled: true, validPeriodDays: 30, enabledAt: -1 },
+        { enabled: true, validPeriodDays: 30, enabledAt: 1.5 },
+    ])('rejects invalid policy %p', (value) => {
+        expect(passwordExpirationPolicyGuard.safeParse(value).success).toBe(false);
+    });
+});

package/lib/foundations/jsonb-types/users.d.ts

@@ -150,6 +150,7 @@ export declare const baseMfaVerification: {
 };
 export declare const mfaVerificationTotp: z.ZodObject<{
     key: z.ZodString;
+    lastUsedTimeStep: z.ZodOptional<z.ZodNumber>;
     id: z.ZodString;
     createdAt: z.ZodString;
     lastUsedAt: z.ZodOptional<z.ZodString>;
@@ -159,12 +160,14 @@ export declare const mfaVerificationTotp: z.ZodObject<{
     id: string;
     key: string;
     createdAt: string;
+    lastUsedTimeStep?: number | undefined;
     lastUsedAt?: string | undefined;
 }, {
     type: MfaFactor.TOTP;
     id: string;
     key: string;
     createdAt: string;
+    lastUsedTimeStep?: number | undefined;
     lastUsedAt?: string | undefined;
 }>;
 export type MfaVerificationTotp = z.infer<typeof mfaVerificationTotp>;
@@ -244,6 +247,7 @@ export declare const mfaVerificationBackupCode: z.ZodObject<{
 export type MfaVerificationBackupCode = z.infer<typeof mfaVerificationBackupCode>;
 export declare const mfaVerificationGuard: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     key: z.ZodString;
+    lastUsedTimeStep: z.ZodOptional<z.ZodNumber>;
     id: z.ZodString;
     createdAt: z.ZodString;
     lastUsedAt: z.ZodOptional<z.ZodString>;
@@ -253,12 +257,14 @@ export declare const mfaVerificationGuard: z.ZodDiscriminatedUnion<"type", [z.Zo
     id: string;
     key: string;
     createdAt: string;
+    lastUsedTimeStep?: number | undefined;
     lastUsedAt?: string | undefined;
 }, {
     type: MfaFactor.TOTP;
     id: string;
     key: string;
     createdAt: string;
+    lastUsedTimeStep?: number | undefined;
     lastUsedAt?: string | undefined;
 }>, z.ZodObject<{
     rpId: z.ZodOptional<z.ZodString>;
@@ -333,6 +339,7 @@ export declare const mfaVerificationGuard: z.ZodDiscriminatedUnion<"type", [z.Zo
 export type MfaVerification = z.infer<typeof mfaVerificationGuard>;
 export declare const mfaVerificationsGuard: z.ZodArray<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     key: z.ZodString;
+    lastUsedTimeStep: z.ZodOptional<z.ZodNumber>;
     id: z.ZodString;
     createdAt: z.ZodString;
     lastUsedAt: z.ZodOptional<z.ZodString>;
@@ -342,12 +349,14 @@ export declare const mfaVerificationsGuard: z.ZodArray<z.ZodDiscriminatedUnion<"
     id: string;
     key: string;
     createdAt: string;
+    lastUsedTimeStep?: number | undefined;
     lastUsedAt?: string | undefined;
 }, {
     type: MfaFactor.TOTP;
     id: string;
     key: string;
     createdAt: string;
+    lastUsedTimeStep?: number | undefined;
     lastUsedAt?: string | undefined;
 }>, z.ZodObject<{
     rpId: z.ZodOptional<z.ZodString>;

package/lib/foundations/jsonb-types/users.js

@@ -40,6 +40,7 @@ export const mfaVerificationTotp = z.object({
     type: z.literal(MfaFactor.TOTP),
     ...baseMfaVerification,
     key: z.string(),
+    lastUsedTimeStep: z.number().int().nonnegative().optional(),
 });
 export const webAuthnTransportGuard = z.enum([
     'usb',

package/lib/seeds/account-center.js

@@ -27,4 +27,5 @@ export const createAdminTenantAccountCenter = () => Object.freeze({
         customData: AccountCenterControlValue.Edit,
         mfa: AccountCenterControlValue.Edit,
     },
+    profileFields: [{ name: 'name' }, { name: 'avatar' }],
 });

package/lib/seeds/sign-in-experience.js

@@ -42,6 +42,7 @@ export const createDefaultSignInExperience = (forTenantId, isCloud) => Object.fr
     customCss: null,
     customContent: {},
     customUiAssets: null,
+    signUpProfileFields: null,
     passwordPolicy: {},
     mfa: {
         factors: [],

package/lib/seeds/sign-in-experience.test.js

@@ -19,9 +19,13 @@ describe('createAdminTenantSignInExperience', () => {
         expect(row.tenantId).toBe(adminTenantId);
     });
 });
-describe('createDefaultSignInExperience (unchanged contract)', () => {
+describe('createDefaultSignInExperience', () => {
     it('still has a two-parameter signature and seeds an empty passwordPolicy', () => {
         const row = createDefaultSignInExperience('some-tenant-id', false);
         expect(row.passwordPolicy).toEqual({});
     });
+    it('keeps legacy null signUpProfileFields for seeded default tenants', () => {
+        const row = createDefaultSignInExperience('some-tenant-id', false);
+        expect(row.signUpProfileFields).toBeNull();
+    });
 });

package/lib/types/consent.d.ts

@@ -68,6 +68,7 @@ export declare const publicUserInfoGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: import("../index.js").MfaFactor.WebAuthn;
@@ -95,6 +96,7 @@ export declare const publicUserInfoGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: import("../index.js").MfaFactor.WebAuthn;
@@ -119,7 +121,9 @@ export declare const publicUserInfoGuard: z.ZodObject<Pick<{
         lastUsedAt?: string | undefined;
     })[]>;
     isSuspended: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    isPasswordExpired: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     lastSignInAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
+    passwordUpdatedAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
     createdAt: z.ZodType<number, z.ZodTypeDef, number>;
     updatedAt: z.ZodType<number, z.ZodTypeDef, number>;
 }, "name" | "id" | "username" | "avatar" | "primaryEmail" | "primaryPhone">, "strip", z.ZodTypeAny, {
@@ -667,6 +671,7 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
             id: string;
             key: string;
             createdAt: string;
+            lastUsedTimeStep?: number | undefined;
             lastUsedAt?: string | undefined;
         } | {
             type: import("../index.js").MfaFactor.WebAuthn;
@@ -694,6 +699,7 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
             id: string;
             key: string;
             createdAt: string;
+            lastUsedTimeStep?: number | undefined;
             lastUsedAt?: string | undefined;
         } | {
             type: import("../index.js").MfaFactor.WebAuthn;
@@ -718,7 +724,9 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
             lastUsedAt?: string | undefined;
         })[]>;
         isSuspended: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+        isPasswordExpired: z.ZodType<boolean, z.ZodTypeDef, boolean>;
         lastSignInAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
+        passwordUpdatedAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
         createdAt: z.ZodType<number, z.ZodTypeDef, number>;
         updatedAt: z.ZodType<number, z.ZodTypeDef, number>;
     }, "name" | "id" | "username" | "avatar" | "primaryEmail" | "primaryPhone">, "strip", z.ZodTypeAny, {