@logto/schemas 1.40.1 → 1.42.0

package/lib/foundations/jsonb-types/custom-domain.js

@@ -1,4 +1,55 @@
 import { z } from 'zod';
+export var DomainVerificationFileContentType;
+(function (DomainVerificationFileContentType) {
+    DomainVerificationFileContentType["Text"] = "text/plain";
+    DomainVerificationFileContentType["Json"] = "application/json";
+})(DomainVerificationFileContentType || (DomainVerificationFileContentType = {}));
+export const domainVerificationFilePathGuard = z
+    .string()
+    .min(1)
+    .max(256)
+    .refine((value) => /^\/[\w-][\w.-]*\.[\w-][\w.-]*$/.test(value) ||
+    /^\/\.well-known(?:\/[\w-][\w.-]*)+$/.test(value), 'The path must point to a file with an extension at the domain root or to a path under /.well-known/.');
+export const domainVerificationFileGuard = z
+    .object({
+    path: domainVerificationFilePathGuard,
+    content: z
+        .string()
+        .min(1)
+        .max(16 * 1024),
+    contentType: z.nativeEnum(DomainVerificationFileContentType),
+})
+    .superRefine(({ content, contentType }, context) => {
+    if (contentType !== DomainVerificationFileContentType.Json) {
+        return;
+    }
+    try {
+        JSON.parse(content);
+    }
+    catch {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'The content must be valid JSON for the application/json content type.',
+            path: ['content'],
+        });
+    }
+});
+export const domainVerificationFilesGuard = domainVerificationFileGuard
+    .array()
+    .max(10)
+    .superRefine((files, context) => {
+    const paths = new Set();
+    for (const [index, file] of files.entries()) {
+        if (paths.has(file.path)) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'Verification file paths must be unique.',
+                path: [index, 'path'],
+            });
+        }
+        paths.add(file.path);
+    }
+});
 export const domainDnsRecordGuard = z.object({
     name: z.string(),
     type: z.string(),

package/lib/foundations/jsonb-types/custom-domain.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/foundations/jsonb-types/custom-domain.test.js

@@ -0,0 +1,38 @@
+import { describe, expect, it } from 'vitest';
+import { DomainVerificationFileContentType, domainVerificationFilesGuard, } from './custom-domain.js';
+describe('domainVerificationFilesGuard', () => {
+    it.each([
+        '/MP_verify_abc123.txt',
+        '/_domainconnect.txt',
+        '/-verification.txt',
+        '/google-site-verification.html',
+        '/.well-known/apple-developer-merchantid-domain-association',
+        '/.well-known/acme-challenge/token_123',
+        '/.well-known/acme-challenge/-token_123',
+        '/.well-known/acme-challenge/_token_123',
+    ])('accepts verification file path %s', (path) => {
+        expect(domainVerificationFilesGuard.safeParse([
+            { path, content: 'verification-content', contentType: 'text/plain' },
+        ]).success).toBe(true);
+    });
+    it.each(['/api/file.txt', '/../secret.txt', '/nested/file.txt', '/file', '/file%2Etxt'])('rejects verification file path %s', (path) => {
+        expect(domainVerificationFilesGuard.safeParse([
+            { path, content: 'verification-content', contentType: 'text/plain' },
+        ]).success).toBe(false);
+    });
+    it('requires valid JSON for JSON responses', () => {
+        expect(domainVerificationFilesGuard.safeParse([
+            {
+                path: '/.well-known/verification.json',
+                content: '{invalid-json}',
+                contentType: DomainVerificationFileContentType.Json,
+            },
+        ]).success).toBe(false);
+    });
+    it('rejects duplicate paths', () => {
+        expect(domainVerificationFilesGuard.safeParse([
+            { path: '/verify.txt', content: 'one', contentType: 'text/plain' },
+            { path: '/verify.txt', content: 'two', contentType: 'text/plain' },
+        ]).success).toBe(false);
+    });
+});

package/lib/foundations/jsonb-types/hooks.d.ts

@@ -30,14 +30,14 @@ declare enum DataHookDetailMutationType {
 type BasicDataHookEvent = `${DataHookSchema}.${DataHookBasicMutationType}`;
 type CustomDataHookMutableSchema = `${DataHookSchema}.Data` | `${DataHookSchema.User}.SuspensionStatus` | `${DataHookSchema.Role}.Scopes` | `${DataHookSchema.Organization}.Membership` | `${DataHookSchema.OrganizationRole}.Scopes`;
 type DataHookPropertyUpdateEvent = `${CustomDataHookMutableSchema}.${DataHookDetailMutationType.Updated}`;
-export type ExceptionHookEvent = 'Identifier.Lockout';
+export type ExceptionHookEvent = 'Identifier.Lockout' | 'Message.RateLimited' | 'Grant.LimitExceeded';
 export type DataHookEvent = BasicDataHookEvent | DataHookPropertyUpdateEvent;
 /** The hook event values that can be registered. */
-export declare const hookEvents: readonly [InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout"];
+export declare const hookEvents: readonly [InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"];
 /** The type of hook event values that can be registered. */
 export type HookEvent = (typeof hookEvents)[number];
-export declare const hookEventGuard: z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout"]>;
-export declare const hookEventsGuard: z.ZodArray<z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout"]>, "many">;
+export declare const hookEventGuard: z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"]>;
+export declare const hookEventsGuard: z.ZodArray<z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"]>, "many">;
 export type HookEvents = z.infer<typeof hookEventsGuard>;
 export declare const interactionHookEventGuard: z.ZodNativeEnum<typeof InteractionHookEvent>;
 /**

package/lib/foundations/jsonb-types/hooks.js

@@ -62,6 +62,8 @@ export const hookEvents = Object.freeze([
     'OrganizationScope.Deleted',
     'OrganizationScope.Data.Updated',
     'Identifier.Lockout',
+    'Message.RateLimited',
+    'Grant.LimitExceeded',
 ]);
 export const hookEventGuard = z.enum(hookEvents);
 export const hookEventsGuard = hookEventGuard.array();

package/lib/foundations/jsonb-types/one-time-tokens.d.ts

@@ -1,13 +1,18 @@
 import { z } from 'zod';
+import { type InteractionEvent } from '../../types/interaction-event.js';
 export type OneTimeTokenContext = {
     jitOrganizationIds?: string[];
+    interactionEvent?: InteractionEvent;
 };
 export declare const oneTimeTokenContextGuard: z.ZodObject<{
     jitOrganizationIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    interactionEvent: z.ZodOptional<z.ZodNativeEnum<typeof InteractionEvent>>;
 }, "strip", z.ZodTypeAny, {
     jitOrganizationIds?: string[] | undefined;
+    interactionEvent?: InteractionEvent | undefined;
 }, {
     jitOrganizationIds?: string[] | undefined;
+    interactionEvent?: InteractionEvent | undefined;
 }>;
 export declare enum OneTimeTokenStatus {
     Active = "active",

package/lib/foundations/jsonb-types/one-time-tokens.js

@@ -1,7 +1,9 @@
 import { z } from 'zod';
+import { eventGuard } from '../../types/interaction-event.js';
 export const oneTimeTokenContextGuard = z
     .object({
     jitOrganizationIds: z.string().array(),
+    interactionEvent: eventGuard,
 })
     .partial();
 export var OneTimeTokenStatus;

package/lib/foundations/jsonb-types/sentinel.d.ts

@@ -39,7 +39,22 @@ export declare enum SentinelActivityAction {
     /**
      * The subject tries to pass a backup code MFA verification.
      */
-    MfaBackupCode = "MfaBackupCode"
+    MfaBackupCode = "MfaBackupCode",
+    /**
+     * A verification code is sent to the target (email/phone), e.g. sign-in,
+     * register, forgot-password, or identifier-binding codes.
+     *
+     * Used by the message rate limit to throttle sends, distinct from the
+     * failure-based lockout actions above.
+     */
+    VerificationCodeSend = "VerificationCodeSend",
+    /**
+     * A non-verification-code message is sent to the target (email/phone),
+     * e.g. an organization invitation.
+     *
+     * Used by the message rate limit to throttle sends.
+     */
+    MessageSend = "MessageSend"
 }
 export declare const sentinelActivityActionGuard: z.ZodNativeEnum<typeof SentinelActivityAction>;
 export type SentinelActivityPayload = Record<string, unknown>;

package/lib/foundations/jsonb-types/sentinel.js

@@ -42,6 +42,21 @@ export var SentinelActivityAction;
      * The subject tries to pass a backup code MFA verification.
      */
     SentinelActivityAction["MfaBackupCode"] = "MfaBackupCode";
+    /**
+     * A verification code is sent to the target (email/phone), e.g. sign-in,
+     * register, forgot-password, or identifier-binding codes.
+     *
+     * Used by the message rate limit to throttle sends, distinct from the
+     * failure-based lockout actions above.
+     */
+    SentinelActivityAction["VerificationCodeSend"] = "VerificationCodeSend";
+    /**
+     * A non-verification-code message is sent to the target (email/phone),
+     * e.g. an organization invitation.
+     *
+     * Used by the message rate limit to throttle sends.
+     */
+    SentinelActivityAction["MessageSend"] = "MessageSend";
 })(SentinelActivityAction || (SentinelActivityAction = {}));
 export const sentinelActivityActionGuard = z.nativeEnum(SentinelActivityAction);
 export const sentinelActivityPayloadGuard = z.record(z.unknown());

package/lib/foundations/jsonb-types/sign-in-experience.d.ts

@@ -193,6 +193,7 @@ export declare const signInGuard: z.ZodObject<{
     }[];
 }>;
 export type SignIn = z.infer<typeof signInGuard>;
+export { defaultUsernamePolicy, usernamePolicyGuard, type UsernamePolicy } from '@logto/core-kit';
 export type SocialSignIn = {
     /**
      * If account linking should be performed when a user signs in with a social identity that is new
@@ -359,36 +360,73 @@ export declare const sentinelPolicyGuard: z.ZodObject<{
     lockoutDuration?: number | undefined;
 }>;
 /**
- * Email blocklist policy.
+ * Verification code policy.
  *
  * @remarks
- * This policy is used to block specific email addresses or domains from signing up.
+ * This policy controls the expiration duration and maximum retry attempts for verification codes.
  */
+export type VerificationCodePolicy = {
+    /**
+     * The duration in seconds that a verification code remains valid.
+     * @default 600 (10 minutes)
+     */
+    expirationDuration?: number;
+    /**
+     * Maximum number of failed verification attempts allowed before the code is invalidated.
+     * @default 10
+     */
+    maxRetryAttempts?: number;
+};
+export declare const verificationCodePolicyGuard: z.ZodObject<{
+    expirationDuration: z.ZodOptional<z.ZodNumber>;
+    maxRetryAttempts: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    expirationDuration?: number | undefined;
+    maxRetryAttempts?: number | undefined;
+}, {
+    expirationDuration?: number | undefined;
+    maxRetryAttempts?: number | undefined;
+}>;
 export type EmailBlocklistPolicy = {
     blockDisposableAddresses?: boolean;
     blockSubaddressing?: boolean;
     /**
-     * Custom blocklist of email addresses or domains.
+     * Custom allowlist of email addresses, domains, or wildcard email address patterns.
+     *
+     * The matching semantics are the same as {@link customBlocklist}.
+     */
+    customAllowlist?: string[];
+    /**
+     * Custom blocklist of email addresses, domains, or wildcard email address patterns.
      *
      * @example
      * Email address: abc@xyx.com
      *
      * @example
      * Domain name: @xyz.com
+     *
+     * @example
+     * Wildcard email address pattern: foo*@example.com
+     *
+     * @example
+     * Wildcard domain pattern: @*.example.com
      */
     customBlocklist?: string[];
 };
 export declare const emailBlocklistPolicyGuard: z.ZodObject<{
     blockDisposableAddresses: z.ZodOptional<z.ZodBoolean>;
     blockSubaddressing: z.ZodOptional<z.ZodBoolean>;
+    customAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     customBlocklist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
     blockDisposableAddresses?: boolean | undefined;
     blockSubaddressing?: boolean | undefined;
+    customAllowlist?: string[] | undefined;
     customBlocklist?: string[] | undefined;
 }, {
     blockDisposableAddresses?: boolean | undefined;
     blockSubaddressing?: boolean | undefined;
+    customAllowlist?: string[] | undefined;
     customBlocklist?: string[] | undefined;
 }>;
 export declare enum ForgotPasswordMethod {
@@ -441,4 +479,53 @@ export declare const signUpProfileFieldsGuard: z.ZodArray<z.ZodObject<{
     name: string;
 }>, "many">;
 export type SignUpProfileFields = z.infer<typeof signUpProfileFieldsGuard>;
+/**
+ * Password lifecycle policy for configuring password expiration and rotation.
+ *
+ * @remarks
+ * This policy is evaluated server-side during sign-in (after local password verification) to determine
+ * whether the user's password has expired.
+ *
+ * If the password age >= `validPeriodDays`, the sign-in is blocked and the user must reset their
+ * password before continuing.
+ */
+export type PasswordExpirationPolicy = {
+    /**
+     * Whether the password expiration policy is enabled.
+     * @default false
+     */
+    enabled?: false;
+} | {
+    enabled: true;
+    /**
+     * Number of days a password is valid before it expires and the user is
+     * forced to reset it on sign-in.
+     */
+    validPeriodDays: number;
+    /**
+     * Epoch milliseconds when the policy was enabled. Used as the expiry anchor for users
+     * that have no `passwordUpdatedAt` (e.g. legacy accounts), so enabling the policy grants
+     * them a full valid period instead of expiring them against their account creation date.
+     */
+    enabledAt?: number;
+};
+export declare const passwordExpirationPolicyGuard: z.ZodUnion<[z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodLiteral<false>>;
+}, "strip", z.ZodTypeAny, {
+    enabled?: false | undefined;
+}, {
+    enabled?: false | undefined;
+}>, z.ZodObject<{
+    enabled: z.ZodLiteral<true>;
+    validPeriodDays: z.ZodNumber;
+    enabledAt: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    enabled: true;
+    validPeriodDays: number;
+    enabledAt?: number | undefined;
+}, {
+    enabled: true;
+    validPeriodDays: number;
+    enabledAt?: number | undefined;
+}>]>;
 export { customUiCspGuard, type CustomUiCsp } from '@logto/core-kit';

package/lib/foundations/jsonb-types/sign-in-experience.js

@@ -62,6 +62,9 @@ export const signInGuard = z.object({
     })
         .array(),
 });
+// The username policy is owned by @logto/core-kit (like passwordPolicyGuard) so core, experience,
+// and console share one source of truth; re-exported here for the `@use UsernamePolicy` column.
+export { defaultUsernamePolicy, usernamePolicyGuard } from '@logto/core-kit';
 export const socialSignInGuard = z.object({
     automaticAccountLinking: z.boolean().optional(),
     skipRequiredIdentifiers: z.boolean().optional(),
@@ -120,9 +123,14 @@ export const sentinelPolicyGuard = z.object({
     maxAttempts: z.number().optional(),
     lockoutDuration: z.number().optional(),
 });
+export const verificationCodePolicyGuard = z.object({
+    expirationDuration: z.number().int().min(60).max(3600).optional(),
+    maxRetryAttempts: z.number().int().min(1).max(100).optional(),
+});
 export const emailBlocklistPolicyGuard = z.object({
     blockDisposableAddresses: z.boolean().optional(),
     blockSubaddressing: z.boolean().optional(),
+    customAllowlist: z.string().array().optional(),
     customBlocklist: z.string().array().optional(),
 });
 export var ForgotPasswordMethod;
@@ -142,4 +150,16 @@ export const signUpProfileFieldItemGuard = z.object({
     name: z.string(),
 });
 export const signUpProfileFieldsGuard = z.array(signUpProfileFieldItemGuard);
+// Intentionally not `.strict()` for backward compatibility: legacy rows may carry removed fields
+// (e.g. `reminderPeriodDays`), which are stripped on parse instead of rejected.
+export const passwordExpirationPolicyGuard = z.union([
+    z.object({
+        enabled: z.literal(false).optional(),
+    }),
+    z.object({
+        enabled: z.literal(true),
+        validPeriodDays: z.number().int().min(1),
+        enabledAt: z.number().int().nonnegative().optional(),
+    }),
+]);
 export { customUiCspGuard } from '@logto/core-kit';

package/lib/foundations/jsonb-types/sign-in-experience.test.js

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { customUiCspGuard } from './sign-in-experience.js';
+import { customUiCspGuard, passwordExpirationPolicyGuard } from './sign-in-experience.js';
 describe('customUiCspGuard', () => {
     it.each([
         {},
@@ -16,3 +16,51 @@ describe('customUiCspGuard', () => {
         expect(customUiCspGuard.safeParse({ imgSrc: ['https://example.com'] }).success).toBe(false);
     });
 });
+describe('passwordExpirationPolicyGuard', () => {
+    it.each([
+        [{}, {}],
+        [{ enabled: false }, { enabled: false }],
+    ])('accepts disabled policy %p', (value, expected) => {
+        expect(passwordExpirationPolicyGuard.parse(value)).toEqual(expected);
+    });
+    it('accepts enabled policy with a valid period', () => {
+        expect(passwordExpirationPolicyGuard.parse({
+            enabled: true,
+            validPeriodDays: 30,
+        })).toEqual({
+            enabled: true,
+            validPeriodDays: 30,
+        });
+    });
+    it('accepts enabled policy with an enabledAt timestamp', () => {
+        expect(passwordExpirationPolicyGuard.parse({
+            enabled: true,
+            validPeriodDays: 30,
+            enabledAt: 1_700_000_000_000,
+        })).toEqual({
+            enabled: true,
+            validPeriodDays: 30,
+            enabledAt: 1_700_000_000_000,
+        });
+    });
+    it('strips unknown keys from legacy rows (e.g. the removed reminderPeriodDays)', () => {
+        expect(passwordExpirationPolicyGuard.parse({
+            enabled: true,
+            validPeriodDays: 30,
+            reminderPeriodDays: 5,
+        })).toEqual({
+            enabled: true,
+            validPeriodDays: 30,
+        });
+    });
+    it.each([
+        { enabled: true },
+        { enabled: true, validPeriodDays: 0 },
+        { enabled: true, validPeriodDays: 1.5 },
+        { enabled: true, reminderPeriodDays: 5 },
+        { enabled: true, validPeriodDays: 30, enabledAt: -1 },
+        { enabled: true, validPeriodDays: 30, enabledAt: 1.5 },
+    ])('rejects invalid policy %p', (value) => {
+        expect(passwordExpirationPolicyGuard.safeParse(value).success).toBe(false);
+    });
+});

package/lib/foundations/jsonb-types/users.d.ts

@@ -150,6 +150,7 @@ export declare const baseMfaVerification: {
 };
 export declare const mfaVerificationTotp: z.ZodObject<{
     key: z.ZodString;
+    lastUsedTimeStep: z.ZodOptional<z.ZodNumber>;
     id: z.ZodString;
     createdAt: z.ZodString;
     lastUsedAt: z.ZodOptional<z.ZodString>;
@@ -159,12 +160,14 @@ export declare const mfaVerificationTotp: z.ZodObject<{
     id: string;
     key: string;
     createdAt: string;
+    lastUsedTimeStep?: number | undefined;
     lastUsedAt?: string | undefined;
 }, {
     type: MfaFactor.TOTP;
     id: string;
     key: string;
     createdAt: string;
+    lastUsedTimeStep?: number | undefined;
     lastUsedAt?: string | undefined;
 }>;
 export type MfaVerificationTotp = z.infer<typeof mfaVerificationTotp>;
@@ -244,6 +247,7 @@ export declare const mfaVerificationBackupCode: z.ZodObject<{
 export type MfaVerificationBackupCode = z.infer<typeof mfaVerificationBackupCode>;
 export declare const mfaVerificationGuard: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     key: z.ZodString;
+    lastUsedTimeStep: z.ZodOptional<z.ZodNumber>;
     id: z.ZodString;
     createdAt: z.ZodString;
     lastUsedAt: z.ZodOptional<z.ZodString>;
@@ -253,12 +257,14 @@ export declare const mfaVerificationGuard: z.ZodDiscriminatedUnion<"type", [z.Zo
     id: string;
     key: string;
     createdAt: string;
+    lastUsedTimeStep?: number | undefined;
     lastUsedAt?: string | undefined;
 }, {
     type: MfaFactor.TOTP;
     id: string;
     key: string;
     createdAt: string;
+    lastUsedTimeStep?: number | undefined;
     lastUsedAt?: string | undefined;
 }>, z.ZodObject<{
     rpId: z.ZodOptional<z.ZodString>;
@@ -333,6 +339,7 @@ export declare const mfaVerificationGuard: z.ZodDiscriminatedUnion<"type", [z.Zo
 export type MfaVerification = z.infer<typeof mfaVerificationGuard>;
 export declare const mfaVerificationsGuard: z.ZodArray<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     key: z.ZodString;
+    lastUsedTimeStep: z.ZodOptional<z.ZodNumber>;
     id: z.ZodString;
     createdAt: z.ZodString;
     lastUsedAt: z.ZodOptional<z.ZodString>;
@@ -342,12 +349,14 @@ export declare const mfaVerificationsGuard: z.ZodArray<z.ZodDiscriminatedUnion<"
     id: string;
     key: string;
     createdAt: string;
+    lastUsedTimeStep?: number | undefined;
     lastUsedAt?: string | undefined;
 }, {
     type: MfaFactor.TOTP;
     id: string;
     key: string;
     createdAt: string;
+    lastUsedTimeStep?: number | undefined;
     lastUsedAt?: string | undefined;
 }>, z.ZodObject<{
     rpId: z.ZodOptional<z.ZodString>;

package/lib/foundations/jsonb-types/users.js

@@ -40,6 +40,7 @@ export const mfaVerificationTotp = z.object({
     type: z.literal(MfaFactor.TOTP),
     ...baseMfaVerification,
     key: z.string(),
+    lastUsedTimeStep: z.number().int().nonnegative().optional(),
 });
 export const webAuthnTransportGuard = z.enum([
     'usb',

package/lib/seeds/account-center.js

@@ -27,4 +27,5 @@ export const createAdminTenantAccountCenter = () => Object.freeze({
         customData: AccountCenterControlValue.Edit,
         mfa: AccountCenterControlValue.Edit,
     },
+    profileFields: [{ name: 'name' }, { name: 'avatar' }],
 });

package/lib/seeds/sign-in-experience.js

@@ -42,6 +42,7 @@ export const createDefaultSignInExperience = (forTenantId, isCloud) => Object.fr
     customCss: null,
     customContent: {},
     customUiAssets: null,
+    signUpProfileFields: null,
     passwordPolicy: {},
     mfa: {
         factors: [],

package/lib/seeds/sign-in-experience.test.js

@@ -19,9 +19,13 @@ describe('createAdminTenantSignInExperience', () => {
         expect(row.tenantId).toBe(adminTenantId);
     });
 });
-describe('createDefaultSignInExperience (unchanged contract)', () => {
+describe('createDefaultSignInExperience', () => {
     it('still has a two-parameter signature and seeds an empty passwordPolicy', () => {
         const row = createDefaultSignInExperience('some-tenant-id', false);
         expect(row.passwordPolicy).toEqual({});
     });
+    it('keeps legacy null signUpProfileFields for seeded default tenants', () => {
+        const row = createDefaultSignInExperience('some-tenant-id', false);
+        expect(row.signUpProfileFields).toBeNull();
+    });
 });