@logto/schemas 1.40.1 → 1.42.0

package/alterations-js/utils/1704934999-tables.js

@@ -1,10 +1,28 @@
 import { sql } from '@silverhand/slonik';
 const getId = (value) => sql.identifier([value]);
+/**
+ * Returns the suffix used in the base Logto role name for the current database
+ * (`logto_tenant_<suffix>`).
+ *
+ * Historically the suffix was the raw database name (which may contain hyphens). A later
+ * convention normalised it by replacing hyphens with underscores. To remain compatible with
+ * both conventions we probe `pg_roles` for the normalised name first and fall back to the
+ * raw database name for legacy installations.
+ */
 const getDatabaseName = async (pool) => {
     const { currentDatabase } = await pool.one(sql `
     select current_database();
   `);
-    return currentDatabase.replaceAll('-', '_');
+    const normalized = currentDatabase.replaceAll('-', '_');
+    if (normalized === currentDatabase) {
+        return currentDatabase;
+    }
+    const { exists } = await pool.one(sql `
+    select exists(
+      select 1 from pg_roles where rolname = ${'logto_tenant_' + normalized}
+    ) as exists;
+  `);
+    return exists ? normalized : currentDatabase;
 };
 /**
  * A function to call after the table is created. It will apply the necessary row-level security

package/lib/consts/experience.d.ts

@@ -10,5 +10,8 @@ export declare const experience: Readonly<{
         readonly identifierRegister: "identifier-register";
         readonly switchAccount: "switch-account";
         readonly oneTimeToken: "one-time-token";
+        readonly accountSuspended: "account-suspended";
     }>;
 }>;
+/** `postMessage` sender tag from admin Console sign-in experience live preview. */
+export declare const signInExperiencePreviewMessageSender = "ac_preview";

package/lib/consts/experience.js

@@ -9,7 +9,10 @@ const routes = Object.freeze({
     identifierRegister: 'identifier-register',
     switchAccount: 'switch-account',
     oneTimeToken: 'one-time-token',
+    accountSuspended: 'account-suspended',
 });
 export const experience = Object.freeze({
     routes,
 });
+/** `postMessage` sender tag from admin Console sign-in experience live preview. */
+export const signInExperiencePreviewMessageSender = 'ac_preview';

package/lib/consts/index.d.ts

@@ -6,5 +6,7 @@ export * from './tenant.js';
 export * from './subscriptions.js';
 export * from './experience.js';
 export * from './sentinel.js';
+export * from './message-rate-limit.js';
+export * from './verification-code.js';
 export * from './product-event.js';
 export * from './application.js';

package/lib/consts/index.js

@@ -6,5 +6,7 @@ export * from './tenant.js';
 export * from './subscriptions.js';
 export * from './experience.js';
 export * from './sentinel.js';
+export * from './message-rate-limit.js';
+export * from './verification-code.js';
 export * from './product-event.js';
 export * from './application.js';

package/lib/consts/message-rate-limit.d.ts

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+/**
+ * System-level rate-limit policy for outbound messages (verification codes and
+ * other notifications) over email/SMS.
+ *
+ * This is intentionally separate from `SentinelPolicy`: the sentinel throttles
+ * *failed verification attempts* and is tenant-configurable (a paid security
+ * feature), whereas this throttles *successful sends* and is mandatory and
+ * system-level — it is not exposed for tenant editing.
+ *
+ * Note: a per-send cooldown is intentionally omitted here. The experience app
+ * already enforces a client-side resend cooldown, and the windowed per-recipient
+ * cap below bounds abuse for non-UI callers without risking a server/client
+ * cooldown mismatch that could reject a legitimate resend.
+ */
+export type MessageRateLimitPolicy = {
+    /** Rolling window, in seconds, over which the per-recipient cap is counted. */
+    sendWindow: number;
+    /** Maximum number of sends to the same recipient within `sendWindow`. */
+    maxSendsPerRecipient: number;
+};
+export declare const messageRateLimitPolicyGuard: z.ZodObject<{
+    sendWindow: z.ZodNumber;
+    maxSendsPerRecipient: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    sendWindow: number;
+    maxSendsPerRecipient: number;
+}, {
+    sendWindow: number;
+    maxSendsPerRecipient: number;
+}>;
+/**
+ * The default message rate limit policy. Applied to every tenant and not
+ * tenant-configurable.
+ *
+ * - `sendWindow`: 600 seconds (10 minutes)
+ * - `maxSendsPerRecipient`: 10 per window
+ *
+ * The window is short and rolling on purpose: a falsely-throttled recipient
+ * regains capacity within ~10 minutes rather than being unable to receive a
+ * message for up to an hour.
+ */
+export declare const defaultMessageRateLimitPolicy: Readonly<{
+    sendWindow: number;
+    maxSendsPerRecipient: number;
+}>;
+/**
+ * Internal, ops-only per-tenant override of {@link defaultMessageRateLimitPolicy}. Stored under the
+ * `messageRateLimitOverride` key in `logto_configs` and not exposed by any API — it exists solely
+ * as a relief valve for a legitimately high-volume tenant that trips the system cap.
+ *
+ * Every field is optional: the effective policy is resolved per field as `override ?? system
+ * default`, so a partial override only changes the fields it sets.
+ */
+export declare const messageRateLimitOverrideGuard: z.ZodObject<{
+    sendWindow: z.ZodOptional<z.ZodNumber>;
+    maxSendsPerRecipient: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    sendWindow?: number | undefined;
+    maxSendsPerRecipient?: number | undefined;
+}, {
+    sendWindow?: number | undefined;
+    maxSendsPerRecipient?: number | undefined;
+}>;
+export type MessageRateLimitOverride = z.infer<typeof messageRateLimitOverrideGuard>;

package/lib/consts/message-rate-limit.js

@@ -0,0 +1,29 @@
+import { z } from 'zod';
+export const messageRateLimitPolicyGuard = z.object({
+    sendWindow: z.number().int().positive(),
+    maxSendsPerRecipient: z.number().int().positive(),
+});
+/**
+ * The default message rate limit policy. Applied to every tenant and not
+ * tenant-configurable.
+ *
+ * - `sendWindow`: 600 seconds (10 minutes)
+ * - `maxSendsPerRecipient`: 10 per window
+ *
+ * The window is short and rolling on purpose: a falsely-throttled recipient
+ * regains capacity within ~10 minutes rather than being unable to receive a
+ * message for up to an hour.
+ */
+export const defaultMessageRateLimitPolicy = Object.freeze({
+    sendWindow: 600,
+    maxSendsPerRecipient: 10,
+});
+/**
+ * Internal, ops-only per-tenant override of {@link defaultMessageRateLimitPolicy}. Stored under the
+ * `messageRateLimitOverride` key in `logto_configs` and not exposed by any API — it exists solely
+ * as a relief valve for a legitimately high-volume tenant that trips the system cap.
+ *
+ * Every field is optional: the effective policy is resolved per field as `override ?? system
+ * default`, so a partial override only changes the fields it sets.
+ */
+export const messageRateLimitOverrideGuard = messageRateLimitPolicyGuard.partial();

package/lib/consts/message-rate-limit.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/consts/message-rate-limit.test.js

@@ -0,0 +1,20 @@
+import { describe, expect, it } from 'vitest';
+import { defaultMessageRateLimitPolicy, messageRateLimitPolicyGuard, } from './message-rate-limit.js';
+describe('messageRateLimitPolicyGuard', () => {
+    it('parses a valid policy', () => {
+        expect(messageRateLimitPolicyGuard.parse({ sendWindow: 3600, maxSendsPerRecipient: 5 })).toEqual({ sendWindow: 3600, maxSendsPerRecipient: 5 });
+    });
+    it('rejects a non-numeric value', () => {
+        expect(messageRateLimitPolicyGuard.safeParse({ sendWindow: '3600', maxSendsPerRecipient: 5 }).success).toBe(false);
+    });
+    it.each([
+        { sendWindow: 0, maxSendsPerRecipient: 5 },
+        { sendWindow: 3600, maxSendsPerRecipient: 0 },
+        { sendWindow: 3600.5, maxSendsPerRecipient: 5 },
+    ])('rejects out-of-range or fractional values %o', (policy) => {
+        expect(messageRateLimitPolicyGuard.safeParse(policy).success).toBe(false);
+    });
+    it('accepts the default policy', () => {
+        expect(messageRateLimitPolicyGuard.parse(defaultMessageRateLimitPolicy)).toEqual(defaultMessageRateLimitPolicy);
+    });
+});

package/lib/consts/verification-code.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The default verification code policy.
+ *
+ * - `expirationDuration`: 600 seconds (10 minutes)
+ * - `maxRetryAttempts`: 10
+ */
+export declare const defaultVerificationCodePolicy: Readonly<{
+    expirationDuration: number;
+    maxRetryAttempts: number;
+}>;

package/lib/consts/verification-code.js

@@ -0,0 +1,10 @@
+/**
+ * The default verification code policy.
+ *
+ * - `expirationDuration`: 600 seconds (10 minutes)
+ * - `maxRetryAttempts`: 10
+ */
+export const defaultVerificationCodePolicy = Object.freeze({
+    expirationDuration: 600,
+    maxRetryAttempts: 10,
+});

package/lib/db-entries/domain.d.ts

@@ -1,4 +1,4 @@
-import { DomainStatus, DomainDnsRecords, CloudflareData, GeneratedSchema } from './../foundations/index.js';
+import { DomainStatus, DomainDnsRecords, DomainVerificationFiles, CloudflareData, GeneratedSchema } from './../foundations/index.js';
 /**
  *
  * @remarks This is a type for database creation.
@@ -11,6 +11,7 @@ export type CreateDomain = {
     status?: DomainStatus;
     errorMessage?: string | null;
     dnsRecords?: DomainDnsRecords;
+    verificationFiles?: DomainVerificationFiles;
     cloudflareData?: CloudflareData | null;
     updatedAt?: number;
     createdAt?: number;
@@ -22,9 +23,10 @@ export type Domain = {
     status: DomainStatus;
     errorMessage: string | null;
     dnsRecords: DomainDnsRecords;
+    verificationFiles: DomainVerificationFiles;
     cloudflareData: CloudflareData | null;
     updatedAt: number;
     createdAt: number;
 };
-export type DomainKeys = 'tenantId' | 'id' | 'domain' | 'status' | 'errorMessage' | 'dnsRecords' | 'cloudflareData' | 'updatedAt' | 'createdAt';
+export type DomainKeys = 'tenantId' | 'id' | 'domain' | 'status' | 'errorMessage' | 'dnsRecords' | 'verificationFiles' | 'cloudflareData' | 'updatedAt' | 'createdAt';
 export declare const Domains: GeneratedSchema<DomainKeys, CreateDomain, Domain, 'domains', 'domain'>;

package/lib/db-entries/domain.js

@@ -1,6 +1,6 @@
 // THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
 import { z } from 'zod';
-import { domainStatusGuard, domainDnsRecordsGuard, cloudflareDataGuard } from './../foundations/index.js';
+import { domainStatusGuard, domainDnsRecordsGuard, domainVerificationFilesGuard, cloudflareDataGuard } from './../foundations/index.js';
 const createGuard = z.object({
     tenantId: z.string().max(21).optional(),
     id: z.string().min(1).max(21),
@@ -8,6 +8,7 @@ const createGuard = z.object({
     status: domainStatusGuard.optional(),
     errorMessage: z.string().max(1024).nullable().optional(),
     dnsRecords: domainDnsRecordsGuard.optional(),
+    verificationFiles: domainVerificationFilesGuard.optional(),
     cloudflareData: cloudflareDataGuard.nullable().optional(),
     updatedAt: z.number().optional(),
     createdAt: z.number().optional(),
@@ -19,6 +20,7 @@ const guard = z.object({
     status: domainStatusGuard,
     errorMessage: z.string().max(1024).nullable(),
     dnsRecords: domainDnsRecordsGuard,
+    verificationFiles: domainVerificationFilesGuard,
     cloudflareData: cloudflareDataGuard.nullable(),
     updatedAt: z.number(),
     createdAt: z.number(),
@@ -33,6 +35,7 @@ export const Domains = Object.freeze({
         status: 'status',
         errorMessage: 'error_message',
         dnsRecords: 'dns_records',
+        verificationFiles: 'verification_files',
         cloudflareData: 'cloudflare_data',
         updatedAt: 'updated_at',
         createdAt: 'created_at',
@@ -44,6 +47,7 @@ export const Domains = Object.freeze({
         'status',
         'errorMessage',
         'dnsRecords',
+        'verificationFiles',
         'cloudflareData',
         'updatedAt',
         'createdAt',

package/lib/db-entries/index.d.ts

@@ -55,6 +55,7 @@ export * from './roles-scope.js';
 export * from './saml-application-config.js';
 export * from './saml-application-secret.js';
 export * from './saml-application-session.js';
+export * from './saml-sso-connector-signing-key.js';
 export * from './scope.js';
 export * from './secret-enterprise-sso-connector-relation.js';
 export * from './secret-social-connector-relation.js';

package/lib/db-entries/index.js

@@ -56,6 +56,7 @@ export * from './roles-scope.js';
 export * from './saml-application-config.js';
 export * from './saml-application-secret.js';
 export * from './saml-application-session.js';
+export * from './saml-sso-connector-signing-key.js';
 export * from './scope.js';
 export * from './secret-enterprise-sso-connector-relation.js';
 export * from './secret-social-connector-relation.js';

package/lib/db-entries/saml-sso-connector-signing-key.d.ts

@@ -0,0 +1,32 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link SamlSsoConnectorSigningKey} for the original type.
+ */
+export type CreateSamlSsoConnectorSigningKey = {
+    id: string;
+    tenantId?: string;
+    ssoConnectorId: string;
+    /** The SP private key (plaintext PEM) used to sign the SAML AuthnRequest. Tenant-isolated by RLS and never returned by the API. */
+    privateKey: string;
+    /** The PEM-encoded self-signed SP certificate matching the private key. Public and safe to expose. */
+    certificate: string;
+    createdAt?: number;
+    expiresAt: number;
+    active: boolean;
+};
+export type SamlSsoConnectorSigningKey = {
+    id: string;
+    tenantId: string;
+    ssoConnectorId: string;
+    /** The SP private key (plaintext PEM) used to sign the SAML AuthnRequest. Tenant-isolated by RLS and never returned by the API. */
+    privateKey: string;
+    /** The PEM-encoded self-signed SP certificate matching the private key. Public and safe to expose. */
+    certificate: string;
+    createdAt: number;
+    expiresAt: number;
+    active: boolean;
+};
+export type SamlSsoConnectorSigningKeyKeys = 'id' | 'tenantId' | 'ssoConnectorId' | 'privateKey' | 'certificate' | 'createdAt' | 'expiresAt' | 'active';
+export declare const SamlSsoConnectorSigningKeys: GeneratedSchema<SamlSsoConnectorSigningKeyKeys, CreateSamlSsoConnectorSigningKey, SamlSsoConnectorSigningKey, 'saml_sso_connector_signing_keys', 'saml_sso_connector_signing_key'>;

package/lib/db-entries/saml-sso-connector-signing-key.js

@@ -0,0 +1,49 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    id: z.string().min(1).max(21),
+    tenantId: z.string().max(21).optional(),
+    ssoConnectorId: z.string().min(1).max(128),
+    privateKey: z.string().min(1),
+    certificate: z.string().min(1),
+    createdAt: z.number().optional(),
+    expiresAt: z.number(),
+    active: z.boolean(),
+});
+const guard = z.object({
+    id: z.string().min(1).max(21),
+    tenantId: z.string().max(21),
+    ssoConnectorId: z.string().min(1).max(128),
+    privateKey: z.string().min(1),
+    certificate: z.string().min(1),
+    createdAt: z.number(),
+    expiresAt: z.number(),
+    active: z.boolean(),
+});
+export const SamlSsoConnectorSigningKeys = Object.freeze({
+    table: 'saml_sso_connector_signing_keys',
+    tableSingular: 'saml_sso_connector_signing_key',
+    fields: {
+        id: 'id',
+        tenantId: 'tenant_id',
+        ssoConnectorId: 'sso_connector_id',
+        privateKey: 'private_key',
+        certificate: 'certificate',
+        createdAt: 'created_at',
+        expiresAt: 'expires_at',
+        active: 'active',
+    },
+    fieldKeys: [
+        'id',
+        'tenantId',
+        'ssoConnectorId',
+        'privateKey',
+        'certificate',
+        'createdAt',
+        'expiresAt',
+        'active',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/sign-in-experience.d.ts

@@ -1,4 +1,4 @@
-import { Color, Branding, LanguageInfo, SignIn, SignUp, SocialSignIn, ConnectorTargets, CustomContent, CustomUiAssets, CustomUiCsp, PartialPasswordPolicy, Mfa, AdaptiveMfa, CaptchaPolicy, SentinelPolicy, EmailBlocklistPolicy, ForgotPasswordMethods, PasskeySignIn, SignUpProfileFields, GeneratedSchema } from './../foundations/index.js';
+import { Color, Branding, LanguageInfo, SignIn, SignUp, SocialSignIn, ConnectorTargets, CustomContent, CustomUiAssets, CustomUiCsp, PartialPasswordPolicy, Mfa, AdaptiveMfa, CaptchaPolicy, SentinelPolicy, EmailBlocklistPolicy, VerificationCodePolicy, ForgotPasswordMethods, PasskeySignIn, SignUpProfileFields, PasswordExpirationPolicy, UsernamePolicy, GeneratedSchema } from './../foundations/index.js';
 import { AgreeToTermsPolicy, SignInMode } from './custom-types.js';
 /**
  *
@@ -35,10 +35,13 @@ export type CreateSignInExperience = {
     captchaPolicy?: CaptchaPolicy;
     sentinelPolicy?: SentinelPolicy;
     emailBlocklistPolicy?: EmailBlocklistPolicy;
+    verificationCodePolicy?: VerificationCodePolicy;
     forgotPasswordMethods?: ForgotPasswordMethods | null;
     passkeySignIn?: PasskeySignIn;
-    /** Nullable by design: null keeps legacy full-catalog behavior and [] collects no custom profile fields. */
+    /** Nullable by design: null keeps legacy full-catalog behavior, and new rows default to [] to collect no custom profile fields. */
     signUpProfileFields?: SignUpProfileFields | null;
+    passwordExpiration?: PasswordExpirationPolicy;
+    usernamePolicy?: UsernamePolicy;
 };
 export type SignInExperience = {
     tenantId: string;
@@ -70,10 +73,13 @@ export type SignInExperience = {
     captchaPolicy: CaptchaPolicy;
     sentinelPolicy: SentinelPolicy;
     emailBlocklistPolicy: EmailBlocklistPolicy;
+    verificationCodePolicy: VerificationCodePolicy;
     forgotPasswordMethods: ForgotPasswordMethods | null;
     passkeySignIn: PasskeySignIn;
-    /** Nullable by design: null keeps legacy full-catalog behavior and [] collects no custom profile fields. */
+    /** Nullable by design: null keeps legacy full-catalog behavior, and new rows default to [] to collect no custom profile fields. */
     signUpProfileFields: SignUpProfileFields | null;
+    passwordExpiration: PasswordExpirationPolicy;
+    usernamePolicy: UsernamePolicy;
 };
-export type SignInExperienceKeys = 'tenantId' | 'id' | 'color' | 'branding' | 'hideLogtoBranding' | 'languageInfo' | 'termsOfUseUrl' | 'privacyPolicyUrl' | 'agreeToTermsPolicy' | 'signIn' | 'signUp' | 'socialSignIn' | 'socialSignInConnectorTargets' | 'signInMode' | 'customCss' | 'customContent' | 'customUiAssets' | 'customUiCsp' | 'passwordPolicy' | 'mfa' | 'adaptiveMfa' | 'singleSignOnEnabled' | 'supportEmail' | 'supportWebsiteUrl' | 'unknownSessionRedirectUrl' | 'captchaPolicy' | 'sentinelPolicy' | 'emailBlocklistPolicy' | 'forgotPasswordMethods' | 'passkeySignIn' | 'signUpProfileFields';
+export type SignInExperienceKeys = 'tenantId' | 'id' | 'color' | 'branding' | 'hideLogtoBranding' | 'languageInfo' | 'termsOfUseUrl' | 'privacyPolicyUrl' | 'agreeToTermsPolicy' | 'signIn' | 'signUp' | 'socialSignIn' | 'socialSignInConnectorTargets' | 'signInMode' | 'customCss' | 'customContent' | 'customUiAssets' | 'customUiCsp' | 'passwordPolicy' | 'mfa' | 'adaptiveMfa' | 'singleSignOnEnabled' | 'supportEmail' | 'supportWebsiteUrl' | 'unknownSessionRedirectUrl' | 'captchaPolicy' | 'sentinelPolicy' | 'emailBlocklistPolicy' | 'verificationCodePolicy' | 'forgotPasswordMethods' | 'passkeySignIn' | 'signUpProfileFields' | 'passwordExpiration' | 'usernamePolicy';
 export declare const SignInExperiences: GeneratedSchema<SignInExperienceKeys, CreateSignInExperience, SignInExperience, 'sign_in_experiences', 'sign_in_experience'>;

package/lib/db-entries/sign-in-experience.js

@@ -1,6 +1,6 @@
 // THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
 import { z } from 'zod';
-import { colorGuard, brandingGuard, languageInfoGuard, signInGuard, signUpGuard, socialSignInGuard, connectorTargetsGuard, customContentGuard, customUiAssetsGuard, customUiCspGuard, partialPasswordPolicyGuard, mfaGuard, adaptiveMfaGuard, captchaPolicyGuard, sentinelPolicyGuard, emailBlocklistPolicyGuard, forgotPasswordMethodsGuard, passkeySignInGuard, signUpProfileFieldsGuard } from './../foundations/index.js';
+import { colorGuard, brandingGuard, languageInfoGuard, signInGuard, signUpGuard, socialSignInGuard, connectorTargetsGuard, customContentGuard, customUiAssetsGuard, customUiCspGuard, partialPasswordPolicyGuard, mfaGuard, adaptiveMfaGuard, captchaPolicyGuard, sentinelPolicyGuard, emailBlocklistPolicyGuard, verificationCodePolicyGuard, forgotPasswordMethodsGuard, passkeySignInGuard, signUpProfileFieldsGuard, passwordExpirationPolicyGuard, usernamePolicyGuard } from './../foundations/index.js';
 import { AgreeToTermsPolicy, SignInMode } from './custom-types.js';
 const createGuard = z.object({
     tenantId: z.string().max(21).optional(),
@@ -31,9 +31,12 @@ const createGuard = z.object({
     captchaPolicy: captchaPolicyGuard.optional(),
     sentinelPolicy: sentinelPolicyGuard.optional(),
     emailBlocklistPolicy: emailBlocklistPolicyGuard.optional(),
+    verificationCodePolicy: verificationCodePolicyGuard.optional(),
     forgotPasswordMethods: forgotPasswordMethodsGuard.nullable().optional(),
     passkeySignIn: passkeySignInGuard.optional(),
     signUpProfileFields: signUpProfileFieldsGuard.nullable().optional(),
+    passwordExpiration: passwordExpirationPolicyGuard.optional(),
+    usernamePolicy: usernamePolicyGuard.optional(),
 });
 const guard = z.object({
     tenantId: z.string().max(21),
@@ -64,9 +67,12 @@ const guard = z.object({
     captchaPolicy: captchaPolicyGuard,
     sentinelPolicy: sentinelPolicyGuard,
     emailBlocklistPolicy: emailBlocklistPolicyGuard,
+    verificationCodePolicy: verificationCodePolicyGuard,
     forgotPasswordMethods: forgotPasswordMethodsGuard.nullable(),
     passkeySignIn: passkeySignInGuard,
     signUpProfileFields: signUpProfileFieldsGuard.nullable(),
+    passwordExpiration: passwordExpirationPolicyGuard,
+    usernamePolicy: usernamePolicyGuard,
 });
 export const SignInExperiences = Object.freeze({
     table: 'sign_in_experiences',
@@ -100,9 +106,12 @@ export const SignInExperiences = Object.freeze({
         captchaPolicy: 'captcha_policy',
         sentinelPolicy: 'sentinel_policy',
         emailBlocklistPolicy: 'email_blocklist_policy',
+        verificationCodePolicy: 'verification_code_policy',
         forgotPasswordMethods: 'forgot_password_methods',
         passkeySignIn: 'passkey_sign_in',
         signUpProfileFields: 'sign_up_profile_fields',
+        passwordExpiration: 'password_expiration',
+        usernamePolicy: 'username_policy',
     },
     fieldKeys: [
         'tenantId',
@@ -133,9 +142,12 @@ export const SignInExperiences = Object.freeze({
         'captchaPolicy',
         'sentinelPolicy',
         'emailBlocklistPolicy',
+        'verificationCodePolicy',
         'forgotPasswordMethods',
         'passkeySignIn',
         'signUpProfileFields',
+        'passwordExpiration',
+        'usernamePolicy',
     ],
     createGuard,
     guard,

package/lib/db-entries/user.d.ts

@@ -24,7 +24,9 @@ export type CreateUser = {
     logtoConfig?: JsonObject;
     mfaVerifications?: MfaVerifications;
     isSuspended?: boolean;
+    isPasswordExpired?: boolean;
     lastSignInAt?: number | null;
+    passwordUpdatedAt?: number | null;
     createdAt?: number;
     updatedAt?: number;
 };
@@ -47,9 +49,11 @@ export type User = {
     logtoConfig: JsonObject;
     mfaVerifications: MfaVerifications;
     isSuspended: boolean;
+    isPasswordExpired: boolean;
     lastSignInAt: number | null;
+    passwordUpdatedAt: number | null;
     createdAt: number;
     updatedAt: number;
 };
-export type UserKeys = 'tenantId' | 'id' | 'username' | 'primaryEmail' | 'primaryPhone' | 'passwordEncrypted' | 'passwordEncryptionMethod' | 'name' | 'avatar' | 'profile' | 'applicationId' | 'identities' | 'customData' | 'logtoConfig' | 'mfaVerifications' | 'isSuspended' | 'lastSignInAt' | 'createdAt' | 'updatedAt';
+export type UserKeys = 'tenantId' | 'id' | 'username' | 'primaryEmail' | 'primaryPhone' | 'passwordEncrypted' | 'passwordEncryptionMethod' | 'name' | 'avatar' | 'profile' | 'applicationId' | 'identities' | 'customData' | 'logtoConfig' | 'mfaVerifications' | 'isSuspended' | 'isPasswordExpired' | 'lastSignInAt' | 'passwordUpdatedAt' | 'createdAt' | 'updatedAt';
 export declare const Users: GeneratedSchema<UserKeys, CreateUser, User, 'users', 'user'>;

package/lib/db-entries/user.js

@@ -19,7 +19,9 @@ const createGuard = z.object({
     logtoConfig: jsonObjectGuard.optional(),
     mfaVerifications: mfaVerificationsGuard.optional(),
     isSuspended: z.boolean().optional(),
+    isPasswordExpired: z.boolean().optional(),
     lastSignInAt: z.number().nullable().optional(),
+    passwordUpdatedAt: z.number().nullable().optional(),
     createdAt: z.number().optional(),
     updatedAt: z.number().optional(),
 });
@@ -40,7 +42,9 @@ const guard = z.object({
     logtoConfig: jsonObjectGuard,
     mfaVerifications: mfaVerificationsGuard,
     isSuspended: z.boolean(),
+    isPasswordExpired: z.boolean(),
     lastSignInAt: z.number().nullable(),
+    passwordUpdatedAt: z.number().nullable(),
     createdAt: z.number(),
     updatedAt: z.number(),
 });
@@ -64,7 +68,9 @@ export const Users = Object.freeze({
         logtoConfig: 'logto_config',
         mfaVerifications: 'mfa_verifications',
         isSuspended: 'is_suspended',
+        isPasswordExpired: 'is_password_expired',
         lastSignInAt: 'last_sign_in_at',
+        passwordUpdatedAt: 'password_updated_at',
         createdAt: 'created_at',
         updatedAt: 'updated_at',
     },
@@ -85,7 +91,9 @@ export const Users = Object.freeze({
         'logtoConfig',
         'mfaVerifications',
         'isSuspended',
+        'isPasswordExpired',
         'lastSignInAt',
+        'passwordUpdatedAt',
         'createdAt',
         'updatedAt',
     ],

package/lib/foundations/jsonb-types/account-centers.d.ts

@@ -20,6 +20,7 @@ export declare const accountCenterFieldControlGuard: z.ZodObject<{
     social: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
     customData: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
     mfa: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
+    passkey: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
     session: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
 }, "strip", z.ZodTypeAny, {
     name?: AccountCenterControlValue | undefined;
@@ -32,6 +33,7 @@ export declare const accountCenterFieldControlGuard: z.ZodObject<{
     social?: AccountCenterControlValue | undefined;
     customData?: AccountCenterControlValue | undefined;
     mfa?: AccountCenterControlValue | undefined;
+    passkey?: AccountCenterControlValue | undefined;
     session?: AccountCenterControlValue | undefined;
 }, {
     name?: AccountCenterControlValue | undefined;
@@ -44,6 +46,7 @@ export declare const accountCenterFieldControlGuard: z.ZodObject<{
     social?: AccountCenterControlValue | undefined;
     customData?: AccountCenterControlValue | undefined;
     mfa?: AccountCenterControlValue | undefined;
+    passkey?: AccountCenterControlValue | undefined;
     session?: AccountCenterControlValue | undefined;
 }>;
 export type AccountCenterFieldControl = z.infer<typeof accountCenterFieldControlGuard>;

package/lib/foundations/jsonb-types/account-centers.js

@@ -22,6 +22,7 @@ export const accountCenterFieldControlGuard = z
     social: z.nativeEnum(AccountCenterControlValue),
     customData: z.nativeEnum(AccountCenterControlValue),
     mfa: z.nativeEnum(AccountCenterControlValue),
+    passkey: z.nativeEnum(AccountCenterControlValue),
     session: z.nativeEnum(AccountCenterControlValue),
 })
     .partial();

package/lib/foundations/jsonb-types/custom-domain.d.ts

@@ -1,4 +1,61 @@
 import { z } from 'zod';
+export declare enum DomainVerificationFileContentType {
+    Text = "text/plain",
+    Json = "application/json"
+}
+export declare const domainVerificationFilePathGuard: z.ZodEffects<z.ZodString, string, string>;
+export declare const domainVerificationFileGuard: z.ZodEffects<z.ZodObject<{
+    path: z.ZodEffects<z.ZodString, string, string>;
+    content: z.ZodString;
+    contentType: z.ZodNativeEnum<typeof DomainVerificationFileContentType>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}>, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}>;
+export type DomainVerificationFile = z.infer<typeof domainVerificationFileGuard>;
+export declare const domainVerificationFilesGuard: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodObject<{
+    path: z.ZodEffects<z.ZodString, string, string>;
+    content: z.ZodString;
+    contentType: z.ZodNativeEnum<typeof DomainVerificationFileContentType>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}>, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}>, "many">, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}[], {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}[]>;
+export type DomainVerificationFiles = z.infer<typeof domainVerificationFilesGuard>;
 export declare const domainDnsRecordGuard: z.ZodObject<{
     name: z.ZodString;
     type: z.ZodString;