@logto/schemas 1.40.1 → 1.41.0

package/lib/types/logto-config/jwt-customizer.js

@@ -111,6 +111,19 @@ export const jwtCustomizerUserInteractionContextGuard = z.object({
 export const jwtCustomizerApplicationContextGuard = Applications.guard.omit({
     secret: true,
 });
+/**
+ * The target organization context for organization (API resource) access tokens.
+ *
+ * Only populated when the token is being issued for a specific organization (i.e. the
+ * `organization_id` request parameter is present), letting the customizer attach per-org
+ * claims without embedding every organization the user belongs to.
+ */
+export const jwtCustomizerOrganizationContextGuard = Organizations.guard.pick({
+    id: true,
+    name: true,
+    description: true,
+    customData: true,
+});
 export const accessTokenJwtCustomizerGuard = jwtCustomizerGuard
     .extend({
     // Use partial token guard since users customization may not rely on all fields.
@@ -121,6 +134,7 @@ export const accessTokenJwtCustomizerGuard = jwtCustomizerGuard
         grant: jwtCustomizerGrantContextGuard.partial().optional(),
         interaction: jwtCustomizerUserInteractionContextGuard.partial().optional(),
         application: jwtCustomizerApplicationContextGuard.partial().optional(),
+        organization: jwtCustomizerOrganizationContextGuard.partial().optional(),
     })
         .optional(),
 })

package/lib/types/saml-application.d.ts

@@ -50,6 +50,7 @@ export declare const samlApplicationPatchGuard: z.ZodObject<{
     name: z.ZodOptional<z.ZodType<string, z.ZodTypeDef, string>>;
     customData: z.ZodOptional<z.ZodOptional<z.ZodOptional<z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>>>>;
     description: z.ZodOptional<z.ZodOptional<z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>>>;
+    appLevelAccessControlEnabled: z.ZodOptional<z.ZodType<boolean, z.ZodTypeDef, boolean>>;
     attributeMapping: z.ZodOptional<z.ZodType<Partial<Record<"name" | "username" | "email" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "created_at" | "custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles", string>>, z.ZodTypeDef, Partial<Record<"name" | "username" | "email" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "created_at" | "custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles", string>>>>;
     entityId: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
     acsUrl: z.ZodOptional<z.ZodType<import("../foundations/index.js").SamlAcsUrl | null, z.ZodTypeDef, import("../foundations/index.js").SamlAcsUrl | null>>;
@@ -68,6 +69,7 @@ export declare const samlApplicationPatchGuard: z.ZodObject<{
     name?: string | undefined;
     customData?: import("@withtyped/server/lib/types.js").JsonObject;
     description?: string | null;
+    appLevelAccessControlEnabled?: boolean;
     attributeMapping?: Partial<Record<"name" | "username" | "email" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "created_at" | "custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles", string>> | undefined;
     entityId?: string | null | undefined;
     acsUrl?: import("../foundations/index.js").SamlAcsUrl | null | undefined;
@@ -81,6 +83,7 @@ export declare const samlApplicationPatchGuard: z.ZodObject<{
     name?: string | undefined;
     customData?: import("@withtyped/server/lib/types.js").JsonObject;
     description?: string | null;
+    appLevelAccessControlEnabled?: boolean;
     attributeMapping?: Partial<Record<"name" | "username" | "email" | "sub" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "created_at" | "custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles", string>> | undefined;
     entityId?: string | null | undefined;
     acsUrl?: import("../foundations/index.js").SamlAcsUrl | null | undefined;

package/lib/types/saml-application.js

@@ -26,6 +26,9 @@ export const samlApplicationPatchGuard = applicationPatchGuard
     description: true,
     customData: true,
 })
+    .merge(Applications.createGuard.pick({
+    appLevelAccessControlEnabled: true,
+}))
     // The reason for encapsulating attributeMapping and spMetadata into an object within the config field is that you cannot provide only one of `attributeMapping` or `spMetadata`. Due to the structure of the `saml_application_configs` table, both must be not null.
     .merge(samlAppConfigGuard.partial())
     .extend({ nameIdFormat: nameIdFormatGuard.optional() });

package/lib/types/sign-in-experience.d.ts

@@ -150,6 +150,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     }>;
     sentinelPolicy: z.ZodType<import("../foundations/jsonb-types/sign-in-experience.js").SentinelPolicy, z.ZodTypeDef, import("../foundations/jsonb-types/sign-in-experience.js").SentinelPolicy>;
     emailBlocklistPolicy: z.ZodType<import("../foundations/jsonb-types/sign-in-experience.js").EmailBlocklistPolicy, z.ZodTypeDef, import("../foundations/jsonb-types/sign-in-experience.js").EmailBlocklistPolicy>;
+    verificationCodePolicy: z.ZodType<import("../foundations/jsonb-types/sign-in-experience.js").VerificationCodePolicy, z.ZodTypeDef, import("../foundations/jsonb-types/sign-in-experience.js").VerificationCodePolicy>;
     forgotPasswordMethods: z.ZodType<import("../foundations/jsonb-types/sign-in-experience.js").ForgotPasswordMethod[] | null, z.ZodTypeDef, import("../foundations/jsonb-types/sign-in-experience.js").ForgotPasswordMethod[] | null>;
     passkeySignIn: z.ZodType<import("../foundations/jsonb-types/sign-in-experience.js").PasskeySignIn, z.ZodTypeDef, import("../foundations/jsonb-types/sign-in-experience.js").PasskeySignIn>;
     signUpProfileFields: z.ZodType<{
@@ -157,6 +158,8 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     }[] | null, z.ZodTypeDef, {
         name: string;
     }[] | null>;
+    passwordExpiration: z.ZodType<import("../foundations/jsonb-types/sign-in-experience.js").PasswordExpirationPolicy, z.ZodTypeDef, import("../foundations/jsonb-types/sign-in-experience.js").PasswordExpirationPolicy>;
+    usernamePolicy: z.ZodType<import("../foundations/jsonb-types/index.js").UsernamePolicy, z.ZodTypeDef, import("../foundations/jsonb-types/index.js").UsernamePolicy>;
 }, "forgotPasswordMethods"> & {
     socialConnectors: z.ZodArray<z.ZodObject<Omit<{
         id: z.ZodString;
@@ -738,8 +741,11 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     captchaPolicy: import("../foundations/jsonb-types/sign-in-experience.js").CaptchaPolicy;
     sentinelPolicy: import("../foundations/jsonb-types/sign-in-experience.js").SentinelPolicy;
     emailBlocklistPolicy: import("../foundations/jsonb-types/sign-in-experience.js").EmailBlocklistPolicy;
+    verificationCodePolicy: import("../foundations/jsonb-types/sign-in-experience.js").VerificationCodePolicy;
     passkeySignIn: import("../foundations/jsonb-types/sign-in-experience.js").PasskeySignIn;
     signUpProfileFields: import("../foundations/jsonb-types/sign-in-experience.js").SignUpProfileFields | null;
+    passwordExpiration: import("../foundations/jsonb-types/sign-in-experience.js").PasswordExpirationPolicy;
+    usernamePolicy: import("../foundations/jsonb-types/index.js").UsernamePolicy;
     socialConnectors: {
         name: {
             en: string;
@@ -938,8 +944,11 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     captchaPolicy: import("../foundations/jsonb-types/sign-in-experience.js").CaptchaPolicy;
     sentinelPolicy: import("../foundations/jsonb-types/sign-in-experience.js").SentinelPolicy;
     emailBlocklistPolicy: import("../foundations/jsonb-types/sign-in-experience.js").EmailBlocklistPolicy;
+    verificationCodePolicy: import("../foundations/jsonb-types/sign-in-experience.js").VerificationCodePolicy;
     passkeySignIn: import("../foundations/jsonb-types/sign-in-experience.js").PasskeySignIn;
     signUpProfileFields: import("../foundations/jsonb-types/sign-in-experience.js").SignUpProfileFields | null;
+    passwordExpiration: import("../foundations/jsonb-types/sign-in-experience.js").PasswordExpirationPolicy;
+    usernamePolicy: import("../foundations/jsonb-types/index.js").UsernamePolicy;
     socialConnectors: {
         name: {
             en: string;

package/lib/types/ssr.d.ts

@@ -1,4 +1,5 @@
 import { type LocalePhrase } from '@logto/phrases-experience';
+import { type SignInExperience } from '../db-entries/index.js';
 import { type FullSignInExperience } from './sign-in-experience.js';
 /**
  * The server-side rendering data type for **experience**.
@@ -15,6 +16,16 @@ export type SsrData = {
         data: LocalePhrase;
     };
 };
+/**
+ * The server-side rendering data type for **account center**. Only sign-in experience color/theme
+ * data is needed for theme flash prevention.
+ */
+export type AccountCenterSsrSignInExperience = Pick<SignInExperience, 'color'>;
+export type AccountCenterSsrData = {
+    signInExperience: {
+        data: AccountCenterSsrSignInExperience;
+    };
+};
 /**
  * Variable placeholder for **experience** server-side rendering. The value should be replaced by
  * the server.

package/lib/types/user-assets.d.ts

@@ -7,14 +7,18 @@ export declare const userAssetsServiceStatusGuard: z.ZodObject<{
     status: z.ZodUnion<[z.ZodLiteral<"ready">, z.ZodLiteral<"not_configured">]>;
     allowUploadMimeTypes: z.ZodOptional<z.ZodArray<z.ZodEnum<["image/jpeg", "image/png", "image/gif", "image/vnd.microsoft.icon", "image/x-icon", "image/svg+xml", "image/tiff", "image/webp", "image/bmp", "application/zip"]>, "many">>;
     maxUploadFileSize: z.ZodOptional<z.ZodNumber>;
+    /** Whether Experience avatar upload during sign-up is available on this server. */
+    isExperienceAvatarUploadEnabled: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     status: "ready" | "not_configured";
     allowUploadMimeTypes?: ("image/jpeg" | "image/png" | "image/gif" | "image/vnd.microsoft.icon" | "image/x-icon" | "image/svg+xml" | "image/tiff" | "image/webp" | "image/bmp" | "application/zip")[] | undefined;
     maxUploadFileSize?: number | undefined;
+    isExperienceAvatarUploadEnabled?: boolean | undefined;
 }, {
     status: "ready" | "not_configured";
     allowUploadMimeTypes?: ("image/jpeg" | "image/png" | "image/gif" | "image/vnd.microsoft.icon" | "image/x-icon" | "image/svg+xml" | "image/tiff" | "image/webp" | "image/bmp" | "application/zip")[] | undefined;
     maxUploadFileSize?: number | undefined;
+    isExperienceAvatarUploadEnabled?: boolean | undefined;
 }>;
 export type UserAssetsServiceStatus = z.infer<typeof userAssetsServiceStatusGuard>;
 export declare const userAssetsGuard: z.ZodObject<{
@@ -45,4 +49,10 @@ type MimeTypeToFileExtensionMappings = {
     [key in AllowedUploadMimeType]: readonly [string, ...string[]];
 };
 export declare const mimeTypeToFileExtensionMappings: MimeTypeToFileExtensionMappings;
+/** MIME types allowed for avatar uploads (Experience, Account Center, Console). */
+export declare const avatarMimeTypes: readonly ["image/jpeg", "image/png", "image/gif", "image/webp", "image/bmp"];
+export type AvatarMimeType = (typeof avatarMimeTypes)[number];
+export declare const isAvatarMimeType: (mimeType: string) => mimeType is AvatarMimeType;
+export declare const avatarFileAccept: string;
+export declare const avatarFileExtensionsLabel: string;
 export {};

package/lib/types/user-assets.js

@@ -18,6 +18,8 @@ export const userAssetsServiceStatusGuard = z.object({
     status: z.union([z.literal('ready'), z.literal('not_configured')]),
     allowUploadMimeTypes: z.array(allowUploadMimeTypeGuard).optional(),
     maxUploadFileSize: z.number().optional(),
+    /** Whether Experience avatar upload during sign-up is available on this server. */
+    isExperienceAvatarUploadEnabled: z.boolean().optional(),
 });
 export const userAssetsGuard = z.object({
     url: z.string(),
@@ -40,3 +42,18 @@ export const mimeTypeToFileExtensionMappings = Object.freeze({
     'image/bmp': ['bmp'],
     'application/zip': ['zip'],
 });
+/** MIME types allowed for avatar uploads (Experience, Account Center, Console). */
+export const avatarMimeTypes = [
+    'image/jpeg',
+    'image/png',
+    'image/gif',
+    'image/webp',
+    'image/bmp',
+];
+const avatarMimeTypeSet = new Set(avatarMimeTypes);
+export const isAvatarMimeType = (mimeType) => avatarMimeTypeSet.has(mimeType);
+export const avatarFileAccept = avatarMimeTypes.join(',');
+const formatAvatarExtensionLabel = (extension) => extension === 'webp' ? 'WebP' : extension.toUpperCase();
+export const avatarFileExtensionsLabel = avatarMimeTypes
+    .map((mimeType) => formatAvatarExtensionLabel(mimeTypeToFileExtensionMappings[mimeType][0]))
+    .join(', ');

package/lib/types/user-sessions.d.ts

@@ -621,7 +621,7 @@ export declare const userExtendedSessionGuard: z.ZodObject<{
                 type: import("../foundations/index.js").SignInIdentifier;
             }>;
             passwordEncrypted: z.ZodOptional<z.ZodString>;
-            passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../index.js").UsersPasswordEncryptionMethod.Argon2i>>;
+            passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../db-entries/custom-types.js").UsersPasswordEncryptionMethod.Argon2i>>;
         }, "passwordEncrypted" | "passwordEncryptionMethod">, "strip", z.ZodTypeAny, {
             type: import("./index.js").VerificationType.NewPasswordIdentity;
             id: string;
@@ -1725,7 +1725,7 @@ export declare const getUserSessionsResponseGuard: z.ZodObject<{
                     type: import("../foundations/index.js").SignInIdentifier;
                 }>;
                 passwordEncrypted: z.ZodOptional<z.ZodString>;
-                passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../index.js").UsersPasswordEncryptionMethod.Argon2i>>;
+                passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../db-entries/custom-types.js").UsersPasswordEncryptionMethod.Argon2i>>;
             }, "passwordEncrypted" | "passwordEncryptionMethod">, "strip", z.ZodTypeAny, {
                 type: import("./index.js").VerificationType.NewPasswordIdentity;
                 id: string;
@@ -3105,7 +3105,7 @@ export declare const getUserSessionResponseGuard: z.ZodObject<{
                 type: import("../foundations/index.js").SignInIdentifier;
             }>;
             passwordEncrypted: z.ZodOptional<z.ZodString>;
-            passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../index.js").UsersPasswordEncryptionMethod.Argon2i>>;
+            passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../db-entries/custom-types.js").UsersPasswordEncryptionMethod.Argon2i>>;
         }, "passwordEncrypted" | "passwordEncryptionMethod">, "strip", z.ZodTypeAny, {
             type: import("./index.js").VerificationType.NewPasswordIdentity;
             id: string;
@@ -4218,7 +4218,7 @@ export declare const accountUserExtendedSessionGuard: z.ZodObject<{
                 type: import("../foundations/index.js").SignInIdentifier;
             }>;
             passwordEncrypted: z.ZodOptional<z.ZodString>;
-            passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../index.js").UsersPasswordEncryptionMethod.Argon2i>>;
+            passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../db-entries/custom-types.js").UsersPasswordEncryptionMethod.Argon2i>>;
         }, "passwordEncrypted" | "passwordEncryptionMethod">, "strip", z.ZodTypeAny, {
             type: import("./index.js").VerificationType.NewPasswordIdentity;
             id: string;
@@ -5333,7 +5333,7 @@ export declare const getAccountUserSessionsResponseGuard: z.ZodObject<{
                     type: import("../foundations/index.js").SignInIdentifier;
                 }>;
                 passwordEncrypted: z.ZodOptional<z.ZodString>;
-                passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../index.js").UsersPasswordEncryptionMethod.Argon2i>>;
+                passwordEncryptionMethod: z.ZodOptional<z.ZodLiteral<import("../db-entries/custom-types.js").UsersPasswordEncryptionMethod.Argon2i>>;
             }, "passwordEncrypted" | "passwordEncryptionMethod">, "strip", z.ZodTypeAny, {
                 type: import("./index.js").VerificationType.NewPasswordIdentity;
                 id: string;
@@ -6203,9 +6203,114 @@ export declare const userApplicationGrantGuard: z.ZodObject<{
         accountId: z.ZodString;
     }, z.ZodUnknown, "strip">>;
     expiresAt: z.ZodNumber;
+    application: z.ZodObject<Pick<{
+        tenantId: z.ZodType<string, z.ZodTypeDef, string>;
+        id: z.ZodType<string, z.ZodTypeDef, string>;
+        name: z.ZodType<string, z.ZodTypeDef, string>;
+        secret: z.ZodType<string, z.ZodTypeDef, string>;
+        description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+        type: z.ZodType<import("../db-entries/custom-types.js").ApplicationType, z.ZodTypeDef, import("../db-entries/custom-types.js").ApplicationType>;
+        oidcClientMetadata: z.ZodType<import("../foundations/index.js").OidcClientMetadata, z.ZodTypeDef, import("../foundations/index.js").OidcClientMetadata>;
+        customClientMetadata: z.ZodType<{
+            corsAllowedOrigins?: string[] | undefined;
+            idTokenTtl?: number | undefined;
+            refreshTokenTtl?: number | undefined;
+            refreshTokenTtlInDays?: number | undefined;
+            tenantId?: string | undefined;
+            alwaysIssueRefreshToken?: boolean | undefined;
+            rotateRefreshToken?: boolean | undefined;
+            allowTokenExchange?: boolean | undefined;
+            isDeviceFlow?: boolean | undefined;
+            maxAllowedGrants?: number | undefined;
+        }, z.ZodTypeDef, {
+            corsAllowedOrigins?: string[] | undefined;
+            idTokenTtl?: number | undefined;
+            refreshTokenTtl?: number | undefined;
+            refreshTokenTtlInDays?: number | undefined;
+            tenantId?: string | undefined;
+            alwaysIssueRefreshToken?: boolean | undefined;
+            rotateRefreshToken?: boolean | undefined;
+            allowTokenExchange?: boolean | undefined;
+            isDeviceFlow?: boolean | undefined;
+            maxAllowedGrants?: number | undefined;
+        }>;
+        protectedAppMetadata: z.ZodType<{
+            host: string;
+            origin: string;
+            sessionDuration: number;
+            pageRules: {
+                path: string;
+            }[];
+            additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
+            customDomains?: {
+                status: import("../foundations/index.js").DomainStatus;
+                domain: string;
+                errorMessage: string | null;
+                dnsRecords: {
+                    value: string;
+                    type: string;
+                    name: string;
+                }[];
+                cloudflareData: {
+                    status: string;
+                    id: string;
+                    ssl: {
+                        status: string;
+                        validation_errors?: {
+                            message: string;
+                        }[] | undefined;
+                    };
+                    verification_errors?: string[] | undefined;
+                } | null;
+            }[] | undefined;
+        } | null, z.ZodTypeDef, {
+            host: string;
+            origin: string;
+            sessionDuration: number;
+            pageRules: {
+                path: string;
+            }[];
+            additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
+            customDomains?: {
+                status: import("../foundations/index.js").DomainStatus;
+                domain: string;
+                errorMessage: string | null;
+                dnsRecords: {
+                    value: string;
+                    type: string;
+                    name: string;
+                }[];
+                cloudflareData: {
+                    status: string;
+                    id: string;
+                    ssl: {
+                        status: string;
+                        validation_errors?: {
+                            message: string;
+                        }[] | undefined;
+                    };
+                    verification_errors?: string[] | undefined;
+                } | null;
+            }[] | undefined;
+        } | null>;
+        customData: z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
+        isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+        appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+        createdAt: z.ZodType<number, z.ZodTypeDef, number>;
+    }, "name" | "id">, "strip", z.ZodTypeAny, {
+        name: string;
+        id: string;
+    }, {
+        name: string;
+        id: string;
+    }>;
 }, "strip", z.ZodTypeAny, {
     id: string;
     expiresAt: number;
+    application: {
+        name: string;
+        id: string;
+    };
     payload: {
         exp: number;
         iat: number;
@@ -6219,6 +6324,10 @@ export declare const userApplicationGrantGuard: z.ZodObject<{
 }, {
     id: string;
     expiresAt: number;
+    application: {
+        name: string;
+        id: string;
+    };
     payload: {
         exp: number;
         iat: number;
@@ -6263,9 +6372,114 @@ export declare const getUserApplicationGrantsResponseGuard: z.ZodObject<{
             accountId: z.ZodString;
         }, z.ZodUnknown, "strip">>;
         expiresAt: z.ZodNumber;
+        application: z.ZodObject<Pick<{
+            tenantId: z.ZodType<string, z.ZodTypeDef, string>;
+            id: z.ZodType<string, z.ZodTypeDef, string>;
+            name: z.ZodType<string, z.ZodTypeDef, string>;
+            secret: z.ZodType<string, z.ZodTypeDef, string>;
+            description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+            type: z.ZodType<import("../db-entries/custom-types.js").ApplicationType, z.ZodTypeDef, import("../db-entries/custom-types.js").ApplicationType>;
+            oidcClientMetadata: z.ZodType<import("../foundations/index.js").OidcClientMetadata, z.ZodTypeDef, import("../foundations/index.js").OidcClientMetadata>;
+            customClientMetadata: z.ZodType<{
+                corsAllowedOrigins?: string[] | undefined;
+                idTokenTtl?: number | undefined;
+                refreshTokenTtl?: number | undefined;
+                refreshTokenTtlInDays?: number | undefined;
+                tenantId?: string | undefined;
+                alwaysIssueRefreshToken?: boolean | undefined;
+                rotateRefreshToken?: boolean | undefined;
+                allowTokenExchange?: boolean | undefined;
+                isDeviceFlow?: boolean | undefined;
+                maxAllowedGrants?: number | undefined;
+            }, z.ZodTypeDef, {
+                corsAllowedOrigins?: string[] | undefined;
+                idTokenTtl?: number | undefined;
+                refreshTokenTtl?: number | undefined;
+                refreshTokenTtlInDays?: number | undefined;
+                tenantId?: string | undefined;
+                alwaysIssueRefreshToken?: boolean | undefined;
+                rotateRefreshToken?: boolean | undefined;
+                allowTokenExchange?: boolean | undefined;
+                isDeviceFlow?: boolean | undefined;
+                maxAllowedGrants?: number | undefined;
+            }>;
+            protectedAppMetadata: z.ZodType<{
+                host: string;
+                origin: string;
+                sessionDuration: number;
+                pageRules: {
+                    path: string;
+                }[];
+                additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
+                customDomains?: {
+                    status: import("../foundations/index.js").DomainStatus;
+                    domain: string;
+                    errorMessage: string | null;
+                    dnsRecords: {
+                        value: string;
+                        type: string;
+                        name: string;
+                    }[];
+                    cloudflareData: {
+                        status: string;
+                        id: string;
+                        ssl: {
+                            status: string;
+                            validation_errors?: {
+                                message: string;
+                            }[] | undefined;
+                        };
+                        verification_errors?: string[] | undefined;
+                    } | null;
+                }[] | undefined;
+            } | null, z.ZodTypeDef, {
+                host: string;
+                origin: string;
+                sessionDuration: number;
+                pageRules: {
+                    path: string;
+                }[];
+                additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
+                customDomains?: {
+                    status: import("../foundations/index.js").DomainStatus;
+                    domain: string;
+                    errorMessage: string | null;
+                    dnsRecords: {
+                        value: string;
+                        type: string;
+                        name: string;
+                    }[];
+                    cloudflareData: {
+                        status: string;
+                        id: string;
+                        ssl: {
+                            status: string;
+                            validation_errors?: {
+                                message: string;
+                            }[] | undefined;
+                        };
+                        verification_errors?: string[] | undefined;
+                    } | null;
+                }[] | undefined;
+            } | null>;
+            customData: z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
+            isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+            appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+            createdAt: z.ZodType<number, z.ZodTypeDef, number>;
+        }, "name" | "id">, "strip", z.ZodTypeAny, {
+            name: string;
+            id: string;
+        }, {
+            name: string;
+            id: string;
+        }>;
     }, "strip", z.ZodTypeAny, {
         id: string;
         expiresAt: number;
+        application: {
+            name: string;
+            id: string;
+        };
         payload: {
             exp: number;
             iat: number;
@@ -6279,6 +6493,10 @@ export declare const getUserApplicationGrantsResponseGuard: z.ZodObject<{
     }, {
         id: string;
         expiresAt: number;
+        application: {
+            name: string;
+            id: string;
+        };
         payload: {
             exp: number;
             iat: number;
@@ -6294,6 +6512,10 @@ export declare const getUserApplicationGrantsResponseGuard: z.ZodObject<{
     grants: {
         id: string;
         expiresAt: number;
+        application: {
+            name: string;
+            id: string;
+        };
         payload: {
             exp: number;
             iat: number;
@@ -6309,6 +6531,10 @@ export declare const getUserApplicationGrantsResponseGuard: z.ZodObject<{
     grants: {
         id: string;
         expiresAt: number;
+        application: {
+            name: string;
+            id: string;
+        };
         payload: {
             exp: number;
             iat: number;

package/lib/types/user-sessions.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { Applications } from '../db-entries/index.js';
 import { oidcSessionInstancePayloadGuard } from '../foundations/index.js';
 import { jwtCustomizerUserInteractionContextGuard } from './logto-config/jwt-customizer.js';
 export const userSessionSignInContextGuard = z
@@ -72,6 +73,10 @@ export const userApplicationGrantGuard = z.object({
     id: z.string(),
     payload: userApplicationGrantPayloadGuard,
     expiresAt: z.number(),
+    application: Applications.guard.pick({
+        id: true,
+        name: true,
+    }),
 });
 export const getUserApplicationGrantsResponseGuard = z.object({
     grants: z.array(userApplicationGrantGuard),

package/lib/types/user.d.ts

@@ -68,6 +68,7 @@ export declare const userInfoGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: MfaFactor.WebAuthn;
@@ -95,6 +96,7 @@ export declare const userInfoGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: MfaFactor.WebAuthn;
@@ -119,7 +121,9 @@ export declare const userInfoGuard: z.ZodObject<Pick<{
         lastUsedAt?: string | undefined;
     })[]>;
     isSuspended: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    isPasswordExpired: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     lastSignInAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
+    passwordUpdatedAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
     createdAt: z.ZodType<number, z.ZodTypeDef, number>;
     updatedAt: z.ZodType<number, z.ZodTypeDef, number>;
 }, "name" | "id" | "applicationId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended">, "strip", z.ZodTypeAny, {
@@ -220,6 +224,7 @@ export declare const userProfileResponseGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: MfaFactor.WebAuthn;
@@ -247,6 +252,7 @@ export declare const userProfileResponseGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: MfaFactor.WebAuthn;
@@ -271,11 +277,14 @@ export declare const userProfileResponseGuard: z.ZodObject<Pick<{
         lastUsedAt?: string | undefined;
     })[]>;
     isSuspended: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    isPasswordExpired: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     lastSignInAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
+    passwordUpdatedAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
     createdAt: z.ZodType<number, z.ZodTypeDef, number>;
     updatedAt: z.ZodType<number, z.ZodTypeDef, number>;
 }, "name" | "id" | "applicationId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended"> & {
     hasPassword: z.ZodOptional<z.ZodBoolean>;
+    hasSecurityVerificationMethod: z.ZodOptional<z.ZodBoolean>;
     ssoIdentities: z.ZodOptional<z.ZodArray<import("../foundations/schemas.js").Guard<import("../db-entries/user-sso-identity.js").UserSsoIdentity>, "many">>;
 }, "strip", z.ZodTypeAny, {
     name: string | null;
@@ -293,6 +302,7 @@ export declare const userProfileResponseGuard: z.ZodObject<Pick<{
     primaryPhone: string | null;
     isSuspended: boolean;
     hasPassword?: boolean | undefined;
+    hasSecurityVerificationMethod?: boolean | undefined;
     ssoIdentities?: import("../db-entries/user-sso-identity.js").UserSsoIdentity[] | undefined;
 }, {
     name: string | null;
@@ -310,6 +320,7 @@ export declare const userProfileResponseGuard: z.ZodObject<Pick<{
     primaryPhone: string | null;
     isSuspended: boolean;
     hasPassword?: boolean | undefined;
+    hasSecurityVerificationMethod?: boolean | undefined;
     ssoIdentities?: import("../db-entries/user-sso-identity.js").UserSsoIdentity[] | undefined;
 }>;
 export type UserProfileResponse = z.infer<typeof userProfileResponseGuard>;
@@ -433,6 +444,7 @@ export declare const featuredUserGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: MfaFactor.WebAuthn;
@@ -460,6 +472,7 @@ export declare const featuredUserGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: MfaFactor.WebAuthn;
@@ -484,7 +497,9 @@ export declare const featuredUserGuard: z.ZodObject<Pick<{
         lastUsedAt?: string | undefined;
     })[]>;
     isSuspended: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    isPasswordExpired: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     lastSignInAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
+    passwordUpdatedAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
     createdAt: z.ZodType<number, z.ZodTypeDef, number>;
     updatedAt: z.ZodType<number, z.ZodTypeDef, number>;
 }, "name" | "id" | "avatar">, "strip", z.ZodTypeAny, {

package/lib/types/user.js

@@ -23,6 +23,7 @@ export const userInfoGuard = Users.guard.pick(
 Object.fromEntries(userInfoSelectFields.map((field) => [field, true])));
 export const userProfileResponseGuard = userInfoGuard.extend({
     hasPassword: z.boolean().optional(),
+    hasSecurityVerificationMethod: z.boolean().optional(),
     ssoIdentities: z.array(UserSsoIdentities.guard).optional(),
 });
 export const userMfaVerificationResponseGuard = z