@logto/schemas 1.41.0 → 1.42.0

package/lib/foundations/jsonb-types/sign-in-experience.d.ts

@@ -391,27 +391,42 @@ export type EmailBlocklistPolicy = {
     blockDisposableAddresses?: boolean;
     blockSubaddressing?: boolean;
     /**
-     * Custom blocklist of email addresses or domains.
+     * Custom allowlist of email addresses, domains, or wildcard email address patterns.
+     *
+     * The matching semantics are the same as {@link customBlocklist}.
+     */
+    customAllowlist?: string[];
+    /**
+     * Custom blocklist of email addresses, domains, or wildcard email address patterns.
      *
      * @example
      * Email address: abc@xyx.com
      *
      * @example
      * Domain name: @xyz.com
+     *
+     * @example
+     * Wildcard email address pattern: foo*@example.com
+     *
+     * @example
+     * Wildcard domain pattern: @*.example.com
      */
     customBlocklist?: string[];
 };
 export declare const emailBlocklistPolicyGuard: z.ZodObject<{
     blockDisposableAddresses: z.ZodOptional<z.ZodBoolean>;
     blockSubaddressing: z.ZodOptional<z.ZodBoolean>;
+    customAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     customBlocklist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
     blockDisposableAddresses?: boolean | undefined;
     blockSubaddressing?: boolean | undefined;
+    customAllowlist?: string[] | undefined;
     customBlocklist?: string[] | undefined;
 }, {
     blockDisposableAddresses?: boolean | undefined;
     blockSubaddressing?: boolean | undefined;
+    customAllowlist?: string[] | undefined;
     customBlocklist?: string[] | undefined;
 }>;
 export declare enum ForgotPasswordMethod {

package/lib/foundations/jsonb-types/sign-in-experience.js

@@ -130,6 +130,7 @@ export const verificationCodePolicyGuard = z.object({
 export const emailBlocklistPolicyGuard = z.object({
     blockDisposableAddresses: z.boolean().optional(),
     blockSubaddressing: z.boolean().optional(),
+    customAllowlist: z.string().array().optional(),
     customBlocklist: z.string().array().optional(),
 });
 export var ForgotPasswordMethod;

package/lib/types/application.d.ts

@@ -1,7 +1,137 @@
 import { UserScope } from '@logto/core-kit';
 import { z } from 'zod';
 import { type Application } from '../db-entries/index.js';
-export type ApplicationResponse = Application & {
+/**
+ * The application response returned by Management APIs.
+ *
+ * The legacy client secret is only present before it has been replaced by an internal secret.
+ */
+export declare const applicationResponseGuard: z.ZodObject<{
+    tenantId: z.ZodType<string, z.ZodTypeDef, string>;
+    id: z.ZodType<string, z.ZodTypeDef, string>;
+    name: z.ZodType<string, z.ZodTypeDef, string>;
+    description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    type: z.ZodType<import("../db-entries/custom-types.js").ApplicationType, z.ZodTypeDef, import("../db-entries/custom-types.js").ApplicationType>;
+    oidcClientMetadata: z.ZodType<import("../index.js").OidcClientMetadata, z.ZodTypeDef, import("../index.js").OidcClientMetadata>;
+    customClientMetadata: z.ZodType<{
+        corsAllowedOrigins?: string[] | undefined;
+        idTokenTtl?: number | undefined;
+        refreshTokenTtl?: number | undefined;
+        refreshTokenTtlInDays?: number | undefined;
+        tenantId?: string | undefined;
+        alwaysIssueRefreshToken?: boolean | undefined;
+        rotateRefreshToken?: boolean | undefined;
+        allowTokenExchange?: boolean | undefined;
+        isDeviceFlow?: boolean | undefined;
+        maxAllowedGrants?: number | undefined;
+    }, z.ZodTypeDef, {
+        corsAllowedOrigins?: string[] | undefined;
+        idTokenTtl?: number | undefined;
+        refreshTokenTtl?: number | undefined;
+        refreshTokenTtlInDays?: number | undefined;
+        tenantId?: string | undefined;
+        alwaysIssueRefreshToken?: boolean | undefined;
+        rotateRefreshToken?: boolean | undefined;
+        allowTokenExchange?: boolean | undefined;
+        isDeviceFlow?: boolean | undefined;
+        maxAllowedGrants?: number | undefined;
+    }>;
+    protectedAppMetadata: z.ZodType<{
+        host: string;
+        origin: string;
+        sessionDuration: number;
+        pageRules: {
+            path: string;
+        }[];
+        additionalScopes?: (UserScope.CustomData | UserScope.Identities | UserScope.Roles | UserScope.Organizations | UserScope.OrganizationRoles)[] | undefined;
+        customDomains?: {
+            status: import("../index.js").DomainStatus;
+            domain: string;
+            errorMessage: string | null;
+            dnsRecords: {
+                value: string;
+                type: string;
+                name: string;
+            }[];
+            cloudflareData: {
+                status: string;
+                id: string;
+                ssl: {
+                    status: string;
+                    validation_errors?: {
+                        message: string;
+                    }[] | undefined;
+                };
+                verification_errors?: string[] | undefined;
+            } | null;
+        }[] | undefined;
+    } | null, z.ZodTypeDef, {
+        host: string;
+        origin: string;
+        sessionDuration: number;
+        pageRules: {
+            path: string;
+        }[];
+        additionalScopes?: (UserScope.CustomData | UserScope.Identities | UserScope.Roles | UserScope.Organizations | UserScope.OrganizationRoles)[] | undefined;
+        customDomains?: {
+            status: import("../index.js").DomainStatus;
+            domain: string;
+            errorMessage: string | null;
+            dnsRecords: {
+                value: string;
+                type: string;
+                name: string;
+            }[];
+            cloudflareData: {
+                status: string;
+                id: string;
+                ssl: {
+                    status: string;
+                    validation_errors?: {
+                        message: string;
+                    }[] | undefined;
+                };
+                verification_errors?: string[] | undefined;
+            } | null;
+        }[] | undefined;
+    } | null>;
+    customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
+    isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
+} & {
+    secret: z.ZodOptional<z.ZodType<string, z.ZodTypeDef, string>>;
+}, "strip", z.ZodTypeAny, {
+    type: import("../db-entries/custom-types.js").ApplicationType;
+    name: string;
+    id: string;
+    tenantId: string;
+    createdAt: number;
+    customData: import("@withtyped/server").JsonObject;
+    description: string | null;
+    oidcClientMetadata: import("../index.js").OidcClientMetadata;
+    customClientMetadata: import("../index.js").CustomClientMetadata;
+    protectedAppMetadata: import("../index.js").ProtectedAppMetadata | null;
+    isThirdParty: boolean;
+    appLevelAccessControlEnabled: boolean;
+    secret?: string | undefined;
+}, {
+    type: import("../db-entries/custom-types.js").ApplicationType;
+    name: string;
+    id: string;
+    tenantId: string;
+    createdAt: number;
+    customData: import("@withtyped/server").JsonObject;
+    description: string | null;
+    oidcClientMetadata: import("../index.js").OidcClientMetadata;
+    customClientMetadata: import("../index.js").CustomClientMetadata;
+    protectedAppMetadata: import("../index.js").ProtectedAppMetadata | null;
+    isThirdParty: boolean;
+    appLevelAccessControlEnabled: boolean;
+    secret?: string | undefined;
+}>;
+export type ApplicationApiResponse = z.infer<typeof applicationResponseGuard>;
+export type ApplicationResponse = ApplicationApiResponse & {
     isAdmin: boolean;
 };
 /**

package/lib/types/application.js

@@ -1,6 +1,14 @@
 import { UserScope } from '@logto/core-kit';
 import { z } from 'zod';
 import { Applications, OrganizationScopes, Resources, Scopes, ApplicationSignInExperiences, } from '../db-entries/index.js';
+/**
+ * The application response returned by Management APIs.
+ *
+ * The legacy client secret is only present before it has been replaced by an internal secret.
+ */
+export const applicationResponseGuard = Applications.guard.extend({
+    secret: Applications.guard.shape.secret.optional(),
+});
 /** The guard for {@link FeaturedApplication}. */
 export const featuredApplicationGuard = Applications.guard.pick({
     id: true,

package/lib/types/custom-profile-fields.d.ts

@@ -2545,7 +2545,7 @@ export declare const signInIdentifierKeyGuard: z.ZodObject<Pick<{
     primaryEmail?: string | null;
     primaryPhone?: string | null;
 }>;
-export declare const reservedSignInIdentifierKeys: readonly ["username", "email", "phone", "primaryEmail", "primaryPhone"];
+export declare const reservedSignInIdentifierKeys: readonly ["username", "primaryEmail", "primaryPhone", "email", "phone"];
 /** Reserved user profile keys. Currently only `preferredUsername` is reserved for standard IdP usage. */
 export declare const reservedBuiltInProfileKeyGuard: z.ZodObject<Pick<{
     familyName: z.ZodOptional<z.ZodString>;

package/lib/types/domain.d.ts

@@ -15,6 +15,15 @@ export declare const domainResponseGuard: z.ZodObject<Pick<{
         type: string;
         name: string;
     }[]>;
+    verificationFiles: z.ZodType<{
+        path: string;
+        content: string;
+        contentType: import("../index.js").DomainVerificationFileContentType;
+    }[], z.ZodTypeDef, {
+        path: string;
+        content: string;
+        contentType: import("../index.js").DomainVerificationFileContentType;
+    }[]>;
     cloudflareData: z.ZodType<{
         status: string;
         id: string;

package/lib/types/hook.d.ts

@@ -18,8 +18,8 @@ export declare const hookResponseGuard: z.ZodObject<{
     tenantId: z.ZodType<string, z.ZodTypeDef, string>;
     id: z.ZodType<string, z.ZodTypeDef, string>;
     name: z.ZodType<string, z.ZodTypeDef, string>;
-    event: z.ZodType<"User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | InteractionHookEvent | null, z.ZodTypeDef, "User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | InteractionHookEvent | null>;
-    events: z.ZodType<("User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | InteractionHookEvent)[], z.ZodTypeDef, ("User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | InteractionHookEvent)[]>;
+    event: z.ZodType<"User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent | null, z.ZodTypeDef, "User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent | null>;
+    events: z.ZodType<("User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent)[], z.ZodTypeDef, ("User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent)[]>;
     config: z.ZodType<{
         url: string;
         headers?: Record<string, string> | undefined;
@@ -143,5 +143,12 @@ export type DataHookEventPayload = {
 export type ExceptionHookEventPayload = Omit<DataHookEventPayload, 'event'> & {
     event: ExceptionHookEvent;
 };
+export type GrantLimitExceededEventData = {
+    userId: string;
+    applicationId: string;
+    revokedGrantIds: string[];
+    maxAllowedGrants: number;
+    preRevocationActiveGrantCount: number;
+};
 export type HookEventPayload = InteractionHookEventPayload | DataHookEventPayload | ExceptionHookEventPayload;
 export {};

package/lib/types/interaction-event.d.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+/**
+ * User interaction events defined in Logto RFC 0004.
+ * @see {@link https://github.com/logto-io/rfcs | Logto RFCs} for more information.
+ */
+export declare enum InteractionEvent {
+    SignIn = "SignIn",
+    Register = "Register",
+    ForgotPassword = "ForgotPassword"
+}
+export declare const eventGuard: z.ZodNativeEnum<typeof InteractionEvent>;

package/lib/types/interaction-event.js

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+/**
+ * User interaction events defined in Logto RFC 0004.
+ * @see {@link https://github.com/logto-io/rfcs | Logto RFCs} for more information.
+ */
+export var InteractionEvent;
+(function (InteractionEvent) {
+    InteractionEvent["SignIn"] = "SignIn";
+    InteractionEvent["Register"] = "Register";
+    InteractionEvent["ForgotPassword"] = "ForgotPassword";
+})(InteractionEvent || (InteractionEvent = {}));
+export const eventGuard = z.nativeEnum(InteractionEvent);

package/lib/types/interactions.d.ts

@@ -1,15 +1,8 @@
 import { z } from 'zod';
 import { AdditionalIdentifier, MfaFactor, SignInIdentifier } from '../foundations/index.js';
+import { InteractionEvent } from './interaction-event.js';
 import type { EmailVerificationCodePayload, PhoneVerificationCodePayload } from './verification-code.js';
-/**
- * User interaction events defined in Logto RFC 0004.
- * @see {@link https://github.com/logto-io/rfcs | Logto RFCs} for more information.
- */
-export declare enum InteractionEvent {
-    SignIn = "SignIn",
-    Register = "Register",
-    ForgotPassword = "ForgotPassword"
-}
+export { eventGuard, InteractionEvent } from './interaction-event.js';
 export type VerificationIdentifier = {
     type: SignInIdentifier | AdditionalIdentifier;
     value: string;
@@ -377,7 +370,6 @@ export declare const socialPhonePayloadGuard: z.ZodObject<{
     connectorId: string;
 }>;
 export type SocialPhonePayload = z.infer<typeof socialPhonePayloadGuard>;
-export declare const eventGuard: z.ZodNativeEnum<typeof InteractionEvent>;
 export declare const identifierPayloadGuard: z.ZodUnion<[z.ZodObject<{
     username: z.ZodString;
     password: z.ZodString;
@@ -1181,4 +1173,3 @@ export declare const verifyMfaResultGuard: z.ZodObject<{
     id: string;
 }>;
 export type VerifyMfaResult = z.infer<typeof verifyMfaResultGuard>;
-export {};

package/lib/types/interactions.js

@@ -2,17 +2,9 @@
 import { emailRegEx, numberAndAlphabetRegEx, phoneRegEx, usernameRegEx } from '@logto/core-kit';
 import { z } from 'zod';
 import { AdditionalIdentifier, MfaFactor, SignInIdentifier, jsonObjectGuard, webAuthnTransportGuard, } from '../foundations/index.js';
+import { InteractionEvent } from './interaction-event.js';
 import { emailVerificationCodePayloadGuard, phoneVerificationCodePayloadGuard, } from './verification-code.js';
-/**
- * User interaction events defined in Logto RFC 0004.
- * @see {@link https://github.com/logto-io/rfcs | Logto RFCs} for more information.
- */
-export var InteractionEvent;
-(function (InteractionEvent) {
-    InteractionEvent["SignIn"] = "SignIn";
-    InteractionEvent["Register"] = "Register";
-    InteractionEvent["ForgotPassword"] = "ForgotPassword";
-})(InteractionEvent || (InteractionEvent = {}));
+export { eventGuard, InteractionEvent } from './interaction-event.js';
 export const verificationIdentifierGuard = z.object({
     type: z.union([z.nativeEnum(SignInIdentifier), z.nativeEnum(AdditionalIdentifier)]),
     value: z.string(),
@@ -131,7 +123,6 @@ export const socialPhonePayloadGuard = z.object({
     connectorId: z.string(),
     phone: z.string(),
 });
-export const eventGuard = z.nativeEnum(InteractionEvent);
 export const identifierPayloadGuard = z.union([
     usernamePasswordPayloadGuard,
     emailPasswordPayloadGuard,

package/lib/types/log/action.d.ts

@@ -0,0 +1,7 @@
+export type Prefix = 'Action';
+export declare const prefix: Prefix;
+export declare enum Type {
+    PostFirstFactorVerification = "PostFirstFactorVerification",
+    PostSignIn = "PostSignIn"
+}
+export type LogKey = `${Prefix}.${Type}`;

package/lib/types/log/action.js

@@ -0,0 +1,6 @@
+export const prefix = 'Action';
+export var Type;
+(function (Type) {
+    Type["PostFirstFactorVerification"] = "PostFirstFactorVerification";
+    Type["PostSignIn"] = "PostSignIn";
+})(Type || (Type = {}));

package/lib/types/log/index.d.ts

@@ -1,3 +1,4 @@
+import type * as action from './action.js';
 import type * as hook from './hook.js';
 import type * as interaction from './interaction.js';
 import type * as jwtCustomizer from './jwt-customizer.js';
@@ -6,6 +7,7 @@ import type * as token from './token.js';
 export * as interaction from './interaction.js';
 export * as token from './token.js';
 export * as hook from './hook.js';
+export * as action from './action.js';
 export * as jwtCustomizer from './jwt-customizer.js';
 export * as saml from './saml.js';
 /** Fallback for empty or unrecognized log keys. */
@@ -13,6 +15,7 @@ export declare const LogKeyUnknown = "Unknown";
 export type InteractionLogKey = interaction.LogKey;
 export type TokenLogKey = token.LogKey;
 export type WebhookLogKey = hook.LogKey;
+export type ActionLogKey = action.LogKey;
 export type JwtCustomizerLogKey = jwtCustomizer.LogKey;
 export type SamlLogKey = saml.LogKey;
 /**
@@ -21,11 +24,11 @@ export type SamlLogKey = saml.LogKey;
  * - All user-facing audit log keys should be included here.
  * - Webhook log keys are excluded.
  */
-export type AuditLogKey = typeof LogKeyUnknown | InteractionLogKey | TokenLogKey | SamlLogKey | JwtCustomizerLogKey;
+export type AuditLogKey = typeof LogKeyUnknown | InteractionLogKey | TokenLogKey | SamlLogKey | ActionLogKey | JwtCustomizerLogKey;
 /**
  * The union type of all available log keys.
  * Note duplicate keys are allowed but should be avoided.
  **/
 export type LogKey = AuditLogKey | WebhookLogKey;
-export type AuditLogPrefix = interaction.Prefix | token.Type | saml.Prefix | jwtCustomizer.Prefix | typeof LogKeyUnknown;
+export type AuditLogPrefix = interaction.Prefix | token.Type | saml.Prefix | action.Prefix | jwtCustomizer.Prefix | typeof LogKeyUnknown;
 export type WebhookLogPrefix = hook.Type;

package/lib/types/log/index.js

@@ -1,6 +1,7 @@
 export * as interaction from './interaction.js';
 export * as token from './token.js';
 export * as hook from './hook.js';
+export * as action from './action.js';
 export * as jwtCustomizer from './jwt-customizer.js';
 export * as saml from './saml.js';
 /** Fallback for empty or unrecognized log keys. */