@logto/schemas 1.41.0 → 1.42.0

package/alterations/1.42.0-1783916980-add-domain-verification-files.ts

@@ -0,0 +1,20 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table domains
+        add column verification_files jsonb not null default '[]'::jsonb;
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table domains
+        drop column verification_files;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.42.0-1784619793-add-service-logs-created-at-index.ts

@@ -0,0 +1,33 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  beforeUp: async (pool) => {
+    // Support the age-based `service_logs` retention prune's global oldest-first scan
+    // (`where created_at < ? order by created_at asc limit ?`). The existing
+    // `(tenant_id, type, created_at)` index leads with `tenant_id`, so it can't drive a
+    // tenant-agnostic time-range scan. `concurrently` keeps the write path unlocked — this
+    // unbounded table is written on every send.
+    //
+    // No `if not exists`: fail loud if the index already exists (e.g. a leftover invalid build from a
+    // prior failed concurrent creation) instead of silently skipping.
+    await pool.query(sql`
+      create index concurrently service_logs__created_at
+        on service_logs (created_at);
+    `);
+  },
+  up: async () => {
+    /** `concurrently` cannot be used inside a transaction. */
+  },
+  beforeDown: async (pool) => {
+    await pool.query(sql`
+      drop index concurrently if exists service_logs__created_at;
+    `);
+  },
+  down: async () => {
+    /** `concurrently` cannot be used inside a transaction. */
+  },
+};
+
+export default alteration;

package/alterations/1.42.0-1784620000-add-saml-sso-connector-signing-keys-table.ts

@@ -0,0 +1,38 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      create table saml_sso_connector_signing_keys (
+        id varchar(21) not null,
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        sso_connector_id varchar(128) not null
+          references sso_connectors (id) on update cascade on delete cascade,
+        private_key text not null,
+        certificate text not null,
+        created_at timestamptz not null default now(),
+        expires_at timestamptz not null,
+        active boolean not null,
+        primary key (tenant_id, sso_connector_id, id)
+      );
+
+      create unique index saml_sso_connector_signing_keys__unique_active
+        on saml_sso_connector_signing_keys (tenant_id, sso_connector_id, active)
+        where active;
+    `);
+    await applyTableRls(pool, 'saml_sso_connector_signing_keys');
+  },
+  down: async (pool) => {
+    await dropTableRls(pool, 'saml_sso_connector_signing_keys');
+    await pool.query(sql`
+      drop table saml_sso_connector_signing_keys;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/utils/1704934999-tables.ts

@@ -2,12 +2,33 @@ import { type CommonQueryMethods, sql } from '@silverhand/slonik';
 
 const getId = (value: string) => sql.identifier([value]);
 
+/**
+ * Returns the suffix used in the base Logto role name for the current database
+ * (`logto_tenant_<suffix>`).
+ *
+ * Historically the suffix was the raw database name (which may contain hyphens). A later
+ * convention normalised it by replacing hyphens with underscores. To remain compatible with
+ * both conventions we probe `pg_roles` for the normalised name first and fall back to the
+ * raw database name for legacy installations.
+ */
 const getDatabaseName = async (pool: CommonQueryMethods) => {
   const { currentDatabase } = await pool.one<{ currentDatabase: string }>(sql`
     select current_database();
   `);
 
-  return currentDatabase.replaceAll('-', '_');
+  const normalized = currentDatabase.replaceAll('-', '_');
+
+  if (normalized === currentDatabase) {
+    return currentDatabase;
+  }
+
+  const { exists } = await pool.one<{ exists: boolean }>(sql`
+    select exists(
+      select 1 from pg_roles where rolname = ${'logto_tenant_' + normalized}
+    ) as exists;
+  `);
+
+  return exists ? normalized : currentDatabase;
 };
 
 /**

package/alterations-js/1.42.0-1783916980-add-domain-verification-files.js

@@ -0,0 +1,16 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      alter table domains
+        add column verification_files jsonb not null default '[]'::jsonb;
+    `);
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      alter table domains
+        drop column verification_files;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.42.0-1784619793-add-service-logs-created-at-index.js

@@ -0,0 +1,29 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    beforeUp: async (pool) => {
+        // Support the age-based `service_logs` retention prune's global oldest-first scan
+        // (`where created_at < ? order by created_at asc limit ?`). The existing
+        // `(tenant_id, type, created_at)` index leads with `tenant_id`, so it can't drive a
+        // tenant-agnostic time-range scan. `concurrently` keeps the write path unlocked — this
+        // unbounded table is written on every send.
+        //
+        // No `if not exists`: fail loud if the index already exists (e.g. a leftover invalid build from a
+        // prior failed concurrent creation) instead of silently skipping.
+        await pool.query(sql `
+      create index concurrently service_logs__created_at
+        on service_logs (created_at);
+    `);
+    },
+    up: async () => {
+        /** `concurrently` cannot be used inside a transaction. */
+    },
+    beforeDown: async (pool) => {
+        await pool.query(sql `
+      drop index concurrently if exists service_logs__created_at;
+    `);
+    },
+    down: async () => {
+        /** `concurrently` cannot be used inside a transaction. */
+    },
+};
+export default alteration;

package/alterations-js/1.42.0-1784620000-add-saml-sso-connector-signing-keys-table.js

@@ -0,0 +1,33 @@
+import { sql } from '@silverhand/slonik';
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      create table saml_sso_connector_signing_keys (
+        id varchar(21) not null,
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        sso_connector_id varchar(128) not null
+          references sso_connectors (id) on update cascade on delete cascade,
+        private_key text not null,
+        certificate text not null,
+        created_at timestamptz not null default now(),
+        expires_at timestamptz not null,
+        active boolean not null,
+        primary key (tenant_id, sso_connector_id, id)
+      );
+
+      create unique index saml_sso_connector_signing_keys__unique_active
+        on saml_sso_connector_signing_keys (tenant_id, sso_connector_id, active)
+        where active;
+    `);
+        await applyTableRls(pool, 'saml_sso_connector_signing_keys');
+    },
+    down: async (pool) => {
+        await dropTableRls(pool, 'saml_sso_connector_signing_keys');
+        await pool.query(sql `
+      drop table saml_sso_connector_signing_keys;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/utils/1704934999-tables.js

@@ -1,10 +1,28 @@
 import { sql } from '@silverhand/slonik';
 const getId = (value) => sql.identifier([value]);
+/**
+ * Returns the suffix used in the base Logto role name for the current database
+ * (`logto_tenant_<suffix>`).
+ *
+ * Historically the suffix was the raw database name (which may contain hyphens). A later
+ * convention normalised it by replacing hyphens with underscores. To remain compatible with
+ * both conventions we probe `pg_roles` for the normalised name first and fall back to the
+ * raw database name for legacy installations.
+ */
 const getDatabaseName = async (pool) => {
     const { currentDatabase } = await pool.one(sql `
     select current_database();
   `);
-    return currentDatabase.replaceAll('-', '_');
+    const normalized = currentDatabase.replaceAll('-', '_');
+    if (normalized === currentDatabase) {
+        return currentDatabase;
+    }
+    const { exists } = await pool.one(sql `
+    select exists(
+      select 1 from pg_roles where rolname = ${'logto_tenant_' + normalized}
+    ) as exists;
+  `);
+    return exists ? normalized : currentDatabase;
 };
 /**
  * A function to call after the table is created. It will apply the necessary row-level security

package/lib/consts/experience.d.ts

@@ -10,6 +10,7 @@ export declare const experience: Readonly<{
         readonly identifierRegister: "identifier-register";
         readonly switchAccount: "switch-account";
         readonly oneTimeToken: "one-time-token";
+        readonly accountSuspended: "account-suspended";
     }>;
 }>;
 /** `postMessage` sender tag from admin Console sign-in experience live preview. */

package/lib/consts/experience.js

@@ -9,6 +9,7 @@ const routes = Object.freeze({
     identifierRegister: 'identifier-register',
     switchAccount: 'switch-account',
     oneTimeToken: 'one-time-token',
+    accountSuspended: 'account-suspended',
 });
 export const experience = Object.freeze({
     routes,

package/lib/db-entries/domain.d.ts

@@ -1,4 +1,4 @@
-import { DomainStatus, DomainDnsRecords, CloudflareData, GeneratedSchema } from './../foundations/index.js';
+import { DomainStatus, DomainDnsRecords, DomainVerificationFiles, CloudflareData, GeneratedSchema } from './../foundations/index.js';
 /**
  *
  * @remarks This is a type for database creation.
@@ -11,6 +11,7 @@ export type CreateDomain = {
     status?: DomainStatus;
     errorMessage?: string | null;
     dnsRecords?: DomainDnsRecords;
+    verificationFiles?: DomainVerificationFiles;
     cloudflareData?: CloudflareData | null;
     updatedAt?: number;
     createdAt?: number;
@@ -22,9 +23,10 @@ export type Domain = {
     status: DomainStatus;
     errorMessage: string | null;
     dnsRecords: DomainDnsRecords;
+    verificationFiles: DomainVerificationFiles;
     cloudflareData: CloudflareData | null;
     updatedAt: number;
     createdAt: number;
 };
-export type DomainKeys = 'tenantId' | 'id' | 'domain' | 'status' | 'errorMessage' | 'dnsRecords' | 'cloudflareData' | 'updatedAt' | 'createdAt';
+export type DomainKeys = 'tenantId' | 'id' | 'domain' | 'status' | 'errorMessage' | 'dnsRecords' | 'verificationFiles' | 'cloudflareData' | 'updatedAt' | 'createdAt';
 export declare const Domains: GeneratedSchema<DomainKeys, CreateDomain, Domain, 'domains', 'domain'>;

package/lib/db-entries/domain.js

@@ -1,6 +1,6 @@
 // THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
 import { z } from 'zod';
-import { domainStatusGuard, domainDnsRecordsGuard, cloudflareDataGuard } from './../foundations/index.js';
+import { domainStatusGuard, domainDnsRecordsGuard, domainVerificationFilesGuard, cloudflareDataGuard } from './../foundations/index.js';
 const createGuard = z.object({
     tenantId: z.string().max(21).optional(),
     id: z.string().min(1).max(21),
@@ -8,6 +8,7 @@ const createGuard = z.object({
     status: domainStatusGuard.optional(),
     errorMessage: z.string().max(1024).nullable().optional(),
     dnsRecords: domainDnsRecordsGuard.optional(),
+    verificationFiles: domainVerificationFilesGuard.optional(),
     cloudflareData: cloudflareDataGuard.nullable().optional(),
     updatedAt: z.number().optional(),
     createdAt: z.number().optional(),
@@ -19,6 +20,7 @@ const guard = z.object({
     status: domainStatusGuard,
     errorMessage: z.string().max(1024).nullable(),
     dnsRecords: domainDnsRecordsGuard,
+    verificationFiles: domainVerificationFilesGuard,
     cloudflareData: cloudflareDataGuard.nullable(),
     updatedAt: z.number(),
     createdAt: z.number(),
@@ -33,6 +35,7 @@ export const Domains = Object.freeze({
         status: 'status',
         errorMessage: 'error_message',
         dnsRecords: 'dns_records',
+        verificationFiles: 'verification_files',
         cloudflareData: 'cloudflare_data',
         updatedAt: 'updated_at',
         createdAt: 'created_at',
@@ -44,6 +47,7 @@ export const Domains = Object.freeze({
         'status',
         'errorMessage',
         'dnsRecords',
+        'verificationFiles',
         'cloudflareData',
         'updatedAt',
         'createdAt',

package/lib/db-entries/index.d.ts

@@ -55,6 +55,7 @@ export * from './roles-scope.js';
 export * from './saml-application-config.js';
 export * from './saml-application-secret.js';
 export * from './saml-application-session.js';
+export * from './saml-sso-connector-signing-key.js';
 export * from './scope.js';
 export * from './secret-enterprise-sso-connector-relation.js';
 export * from './secret-social-connector-relation.js';

package/lib/db-entries/index.js

@@ -56,6 +56,7 @@ export * from './roles-scope.js';
 export * from './saml-application-config.js';
 export * from './saml-application-secret.js';
 export * from './saml-application-session.js';
+export * from './saml-sso-connector-signing-key.js';
 export * from './scope.js';
 export * from './secret-enterprise-sso-connector-relation.js';
 export * from './secret-social-connector-relation.js';

package/lib/db-entries/saml-sso-connector-signing-key.d.ts

@@ -0,0 +1,32 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link SamlSsoConnectorSigningKey} for the original type.
+ */
+export type CreateSamlSsoConnectorSigningKey = {
+    id: string;
+    tenantId?: string;
+    ssoConnectorId: string;
+    /** The SP private key (plaintext PEM) used to sign the SAML AuthnRequest. Tenant-isolated by RLS and never returned by the API. */
+    privateKey: string;
+    /** The PEM-encoded self-signed SP certificate matching the private key. Public and safe to expose. */
+    certificate: string;
+    createdAt?: number;
+    expiresAt: number;
+    active: boolean;
+};
+export type SamlSsoConnectorSigningKey = {
+    id: string;
+    tenantId: string;
+    ssoConnectorId: string;
+    /** The SP private key (plaintext PEM) used to sign the SAML AuthnRequest. Tenant-isolated by RLS and never returned by the API. */
+    privateKey: string;
+    /** The PEM-encoded self-signed SP certificate matching the private key. Public and safe to expose. */
+    certificate: string;
+    createdAt: number;
+    expiresAt: number;
+    active: boolean;
+};
+export type SamlSsoConnectorSigningKeyKeys = 'id' | 'tenantId' | 'ssoConnectorId' | 'privateKey' | 'certificate' | 'createdAt' | 'expiresAt' | 'active';
+export declare const SamlSsoConnectorSigningKeys: GeneratedSchema<SamlSsoConnectorSigningKeyKeys, CreateSamlSsoConnectorSigningKey, SamlSsoConnectorSigningKey, 'saml_sso_connector_signing_keys', 'saml_sso_connector_signing_key'>;

package/lib/db-entries/saml-sso-connector-signing-key.js

@@ -0,0 +1,49 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    id: z.string().min(1).max(21),
+    tenantId: z.string().max(21).optional(),
+    ssoConnectorId: z.string().min(1).max(128),
+    privateKey: z.string().min(1),
+    certificate: z.string().min(1),
+    createdAt: z.number().optional(),
+    expiresAt: z.number(),
+    active: z.boolean(),
+});
+const guard = z.object({
+    id: z.string().min(1).max(21),
+    tenantId: z.string().max(21),
+    ssoConnectorId: z.string().min(1).max(128),
+    privateKey: z.string().min(1),
+    certificate: z.string().min(1),
+    createdAt: z.number(),
+    expiresAt: z.number(),
+    active: z.boolean(),
+});
+export const SamlSsoConnectorSigningKeys = Object.freeze({
+    table: 'saml_sso_connector_signing_keys',
+    tableSingular: 'saml_sso_connector_signing_key',
+    fields: {
+        id: 'id',
+        tenantId: 'tenant_id',
+        ssoConnectorId: 'sso_connector_id',
+        privateKey: 'private_key',
+        certificate: 'certificate',
+        createdAt: 'created_at',
+        expiresAt: 'expires_at',
+        active: 'active',
+    },
+    fieldKeys: [
+        'id',
+        'tenantId',
+        'ssoConnectorId',
+        'privateKey',
+        'certificate',
+        'createdAt',
+        'expiresAt',
+        'active',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/foundations/jsonb-types/custom-domain.d.ts

@@ -1,4 +1,61 @@
 import { z } from 'zod';
+export declare enum DomainVerificationFileContentType {
+    Text = "text/plain",
+    Json = "application/json"
+}
+export declare const domainVerificationFilePathGuard: z.ZodEffects<z.ZodString, string, string>;
+export declare const domainVerificationFileGuard: z.ZodEffects<z.ZodObject<{
+    path: z.ZodEffects<z.ZodString, string, string>;
+    content: z.ZodString;
+    contentType: z.ZodNativeEnum<typeof DomainVerificationFileContentType>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}>, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}>;
+export type DomainVerificationFile = z.infer<typeof domainVerificationFileGuard>;
+export declare const domainVerificationFilesGuard: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodObject<{
+    path: z.ZodEffects<z.ZodString, string, string>;
+    content: z.ZodString;
+    contentType: z.ZodNativeEnum<typeof DomainVerificationFileContentType>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}>, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}>, "many">, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}[], {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}[]>;
+export type DomainVerificationFiles = z.infer<typeof domainVerificationFilesGuard>;
 export declare const domainDnsRecordGuard: z.ZodObject<{
     name: z.ZodString;
     type: z.ZodString;

package/lib/foundations/jsonb-types/custom-domain.js

@@ -1,4 +1,55 @@
 import { z } from 'zod';
+export var DomainVerificationFileContentType;
+(function (DomainVerificationFileContentType) {
+    DomainVerificationFileContentType["Text"] = "text/plain";
+    DomainVerificationFileContentType["Json"] = "application/json";
+})(DomainVerificationFileContentType || (DomainVerificationFileContentType = {}));
+export const domainVerificationFilePathGuard = z
+    .string()
+    .min(1)
+    .max(256)
+    .refine((value) => /^\/[\w-][\w.-]*\.[\w-][\w.-]*$/.test(value) ||
+    /^\/\.well-known(?:\/[\w-][\w.-]*)+$/.test(value), 'The path must point to a file with an extension at the domain root or to a path under /.well-known/.');
+export const domainVerificationFileGuard = z
+    .object({
+    path: domainVerificationFilePathGuard,
+    content: z
+        .string()
+        .min(1)
+        .max(16 * 1024),
+    contentType: z.nativeEnum(DomainVerificationFileContentType),
+})
+    .superRefine(({ content, contentType }, context) => {
+    if (contentType !== DomainVerificationFileContentType.Json) {
+        return;
+    }
+    try {
+        JSON.parse(content);
+    }
+    catch {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'The content must be valid JSON for the application/json content type.',
+            path: ['content'],
+        });
+    }
+});
+export const domainVerificationFilesGuard = domainVerificationFileGuard
+    .array()
+    .max(10)
+    .superRefine((files, context) => {
+    const paths = new Set();
+    for (const [index, file] of files.entries()) {
+        if (paths.has(file.path)) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'Verification file paths must be unique.',
+                path: [index, 'path'],
+            });
+        }
+        paths.add(file.path);
+    }
+});
 export const domainDnsRecordGuard = z.object({
     name: z.string(),
     type: z.string(),

package/lib/foundations/jsonb-types/custom-domain.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/foundations/jsonb-types/custom-domain.test.js

@@ -0,0 +1,38 @@
+import { describe, expect, it } from 'vitest';
+import { DomainVerificationFileContentType, domainVerificationFilesGuard, } from './custom-domain.js';
+describe('domainVerificationFilesGuard', () => {
+    it.each([
+        '/MP_verify_abc123.txt',
+        '/_domainconnect.txt',
+        '/-verification.txt',
+        '/google-site-verification.html',
+        '/.well-known/apple-developer-merchantid-domain-association',
+        '/.well-known/acme-challenge/token_123',
+        '/.well-known/acme-challenge/-token_123',
+        '/.well-known/acme-challenge/_token_123',
+    ])('accepts verification file path %s', (path) => {
+        expect(domainVerificationFilesGuard.safeParse([
+            { path, content: 'verification-content', contentType: 'text/plain' },
+        ]).success).toBe(true);
+    });
+    it.each(['/api/file.txt', '/../secret.txt', '/nested/file.txt', '/file', '/file%2Etxt'])('rejects verification file path %s', (path) => {
+        expect(domainVerificationFilesGuard.safeParse([
+            { path, content: 'verification-content', contentType: 'text/plain' },
+        ]).success).toBe(false);
+    });
+    it('requires valid JSON for JSON responses', () => {
+        expect(domainVerificationFilesGuard.safeParse([
+            {
+                path: '/.well-known/verification.json',
+                content: '{invalid-json}',
+                contentType: DomainVerificationFileContentType.Json,
+            },
+        ]).success).toBe(false);
+    });
+    it('rejects duplicate paths', () => {
+        expect(domainVerificationFilesGuard.safeParse([
+            { path: '/verify.txt', content: 'one', contentType: 'text/plain' },
+            { path: '/verify.txt', content: 'two', contentType: 'text/plain' },
+        ]).success).toBe(false);
+    });
+});

package/lib/foundations/jsonb-types/hooks.d.ts

@@ -30,14 +30,14 @@ declare enum DataHookDetailMutationType {
 type BasicDataHookEvent = `${DataHookSchema}.${DataHookBasicMutationType}`;
 type CustomDataHookMutableSchema = `${DataHookSchema}.Data` | `${DataHookSchema.User}.SuspensionStatus` | `${DataHookSchema.Role}.Scopes` | `${DataHookSchema.Organization}.Membership` | `${DataHookSchema.OrganizationRole}.Scopes`;
 type DataHookPropertyUpdateEvent = `${CustomDataHookMutableSchema}.${DataHookDetailMutationType.Updated}`;
-export type ExceptionHookEvent = 'Identifier.Lockout' | 'Message.RateLimited';
+export type ExceptionHookEvent = 'Identifier.Lockout' | 'Message.RateLimited' | 'Grant.LimitExceeded';
 export type DataHookEvent = BasicDataHookEvent | DataHookPropertyUpdateEvent;
 /** The hook event values that can be registered. */
-export declare const hookEvents: readonly [InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited"];
+export declare const hookEvents: readonly [InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"];
 /** The type of hook event values that can be registered. */
 export type HookEvent = (typeof hookEvents)[number];
-export declare const hookEventGuard: z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited"]>;
-export declare const hookEventsGuard: z.ZodArray<z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited"]>, "many">;
+export declare const hookEventGuard: z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"]>;
+export declare const hookEventsGuard: z.ZodArray<z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"]>, "many">;
 export type HookEvents = z.infer<typeof hookEventsGuard>;
 export declare const interactionHookEventGuard: z.ZodNativeEnum<typeof InteractionHookEvent>;
 /**

package/lib/foundations/jsonb-types/hooks.js

@@ -63,6 +63,7 @@ export const hookEvents = Object.freeze([
     'OrganizationScope.Data.Updated',
     'Identifier.Lockout',
     'Message.RateLimited',
+    'Grant.LimitExceeded',
 ]);
 export const hookEventGuard = z.enum(hookEvents);
 export const hookEventsGuard = hookEventGuard.array();

package/lib/foundations/jsonb-types/one-time-tokens.d.ts

@@ -1,13 +1,18 @@
 import { z } from 'zod';
+import { type InteractionEvent } from '../../types/interaction-event.js';
 export type OneTimeTokenContext = {
     jitOrganizationIds?: string[];
+    interactionEvent?: InteractionEvent;
 };
 export declare const oneTimeTokenContextGuard: z.ZodObject<{
     jitOrganizationIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    interactionEvent: z.ZodOptional<z.ZodNativeEnum<typeof InteractionEvent>>;
 }, "strip", z.ZodTypeAny, {
     jitOrganizationIds?: string[] | undefined;
+    interactionEvent?: InteractionEvent | undefined;
 }, {
     jitOrganizationIds?: string[] | undefined;
+    interactionEvent?: InteractionEvent | undefined;
 }>;
 export declare enum OneTimeTokenStatus {
     Active = "active",

package/lib/foundations/jsonb-types/one-time-tokens.js

@@ -1,7 +1,9 @@
 import { z } from 'zod';
+import { eventGuard } from '../../types/interaction-event.js';
 export const oneTimeTokenContextGuard = z
     .object({
     jitOrganizationIds: z.string().array(),
+    interactionEvent: eventGuard,
 })
     .partial();
 export var OneTimeTokenStatus;