@logto/schemas 1.41.0 → 1.43.0

package/lib/types/service-log.js

@@ -1,6 +1,19 @@
+/**
+ * Types of `service_logs` rows. The rows are written by the Logto Cloud service; some members
+ * are cloud-only concepts kept here so every type shares this single definition.
+ */
 export var ServiceLogType;
 (function (ServiceLogType) {
     ServiceLogType["SendEmail"] = "sendEmail";
     ServiceLogType["SendSms"] = "sendSms";
+    /** Cloud-only: custom JWT worker invocations. */
     ServiceLogType["FetchCustomJwt"] = "fetchCustomJwt";
+    /**
+     * Cloud-only: a hosted-email send that failed at the provider; the payload carries the
+     * normalized provider error. Deliberately distinct from {@link ServiceLogType.SendEmail}:
+     * usage counting matches on that exact type, so failed sends never count toward email usage.
+     */
+    ServiceLogType["SendEmailFailed"] = "sendEmailFailed";
+    /** Cloud-only: an Actions script run on the script runner. Mirrors the `runAction` entry. */
+    ServiceLogType["RunAction"] = "runAction";
 })(ServiceLogType || (ServiceLogType = {}));

package/lib/types/sign-in-experience.d.ts

@@ -12,7 +12,9 @@ type ForgotPassword = {
  * the need to load the full connector metadata that is not needed for rendering.
  */
 export type ExperienceSocialConnector = Omit<ConnectorMetadata, 'description' | 'configTemplate' | 'formItems' | 'readme' | 'customData'>;
-export type FullSignInExperience = Omit<SignInExperience, 'forgotPasswordMethods'> & {
+export type FullSignInExperience = Omit<SignInExperience, 'emailBlocklistPolicy' | 'forgotPasswordMethods' | 'trustedDevice'> & {
+    /** Available while the MFA trusted-device feature is under development. */
+    trustedDevice?: SignInExperience['trustedDevice'];
     socialConnectors: ExperienceSocialConnector[];
     ssoConnectors: SsoConnectorMetadata[];
     forgotPassword: ForgotPassword;
@@ -71,10 +73,10 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     hideLogtoBranding: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     languageInfo: z.ZodType<{
         autoDetect: boolean;
-        fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
+        fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "es-MX" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
     }, z.ZodTypeDef, {
         autoDetect: boolean;
-        fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
+        fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "es-MX" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
     }>;
     termsOfUseUrl: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     privacyPolicyUrl: z.ZodType<string | null, z.ZodTypeDef, string | null>;
@@ -139,6 +141,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     }>;
     mfa: z.ZodType<import("../foundations/jsonb-types/sign-in-experience.js").Mfa, z.ZodTypeDef, import("../foundations/jsonb-types/sign-in-experience.js").Mfa>;
     adaptiveMfa: z.ZodType<import("../foundations/jsonb-types/sign-in-experience.js").AdaptiveMfa, z.ZodTypeDef, import("../foundations/jsonb-types/sign-in-experience.js").AdaptiveMfa>;
+    trustedDevice: z.ZodType<import("../foundations/jsonb-types/sign-in-experience.js").TrustedDevicePolicy, z.ZodTypeDef, import("../foundations/jsonb-types/sign-in-experience.js").TrustedDevicePolicy>;
     singleSignOnEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     supportEmail: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     supportWebsiteUrl: z.ZodType<string | null, z.ZodTypeDef, string | null>;
@@ -160,7 +163,8 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     }[] | null>;
     passwordExpiration: z.ZodType<import("../foundations/jsonb-types/sign-in-experience.js").PasswordExpirationPolicy, z.ZodTypeDef, import("../foundations/jsonb-types/sign-in-experience.js").PasswordExpirationPolicy>;
     usernamePolicy: z.ZodType<import("../foundations/jsonb-types/index.js").UsernamePolicy, z.ZodTypeDef, import("../foundations/jsonb-types/index.js").UsernamePolicy>;
-}, "forgotPasswordMethods"> & {
+}, "trustedDevice" | "emailBlocklistPolicy" | "forgotPasswordMethods"> & {
+    trustedDevice: z.ZodOptional<z.ZodType<import("../foundations/jsonb-types/sign-in-experience.js").TrustedDevicePolicy, z.ZodTypeDef, import("../foundations/jsonb-types/sign-in-experience.js").TrustedDevicePolicy>>;
     socialConnectors: z.ZodArray<z.ZodObject<Omit<{
         id: z.ZodString;
         target: z.ZodString;
@@ -393,6 +397,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
             es?: string | undefined;
             "es-ES"?: string | undefined;
             "es-419"?: string | undefined;
+            "es-MX"?: string | undefined;
             "et-EE"?: string | undefined;
             "eu-ES"?: string | undefined;
             "fa-IR"?: string | undefined;
@@ -534,6 +539,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
             es?: string | undefined;
             "es-ES"?: string | undefined;
             "es-419"?: string | undefined;
+            "es-MX"?: string | undefined;
             "et-EE"?: string | undefined;
             "eu-ES"?: string | undefined;
             "fa-IR"?: string | undefined;
@@ -680,15 +686,15 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
         clientId: z.ZodString;
         connectorId: z.ZodString;
     }, "strip", z.ZodTypeAny, {
-        connectorId: string;
         clientId: string;
+        connectorId: string;
         isEnabled?: boolean | undefined;
         autoSelect?: boolean | undefined;
         closeOnTapOutside?: boolean | undefined;
         itpSupport?: boolean | undefined;
     }, {
-        connectorId: string;
         clientId: string;
+        connectorId: string;
         isEnabled?: boolean | undefined;
         autoSelect?: boolean | undefined;
         closeOnTapOutside?: boolean | undefined;
@@ -740,7 +746,6 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     unknownSessionRedirectUrl: string | null;
     captchaPolicy: import("../foundations/jsonb-types/sign-in-experience.js").CaptchaPolicy;
     sentinelPolicy: import("../foundations/jsonb-types/sign-in-experience.js").SentinelPolicy;
-    emailBlocklistPolicy: import("../foundations/jsonb-types/sign-in-experience.js").EmailBlocklistPolicy;
     verificationCodePolicy: import("../foundations/jsonb-types/sign-in-experience.js").VerificationCodePolicy;
     passkeySignIn: import("../foundations/jsonb-types/sign-in-experience.js").PasskeySignIn;
     signUpProfileFields: import("../foundations/jsonb-types/sign-in-experience.js").SignUpProfileFields | null;
@@ -778,6 +783,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
             es?: string | undefined;
             "es-ES"?: string | undefined;
             "es-419"?: string | undefined;
+            "es-MX"?: string | undefined;
             "et-EE"?: string | undefined;
             "eu-ES"?: string | undefined;
             "fa-IR"?: string | undefined;
@@ -900,9 +906,10 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     };
     isDevelopmentTenant: boolean;
     customProfileFields: CustomProfileField[];
+    trustedDevice?: import("../foundations/jsonb-types/sign-in-experience.js").TrustedDevicePolicy | undefined;
     googleOneTap?: {
-        connectorId: string;
         clientId: string;
+        connectorId: string;
         isEnabled?: boolean | undefined;
         autoSelect?: boolean | undefined;
         closeOnTapOutside?: boolean | undefined;
@@ -943,7 +950,6 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     unknownSessionRedirectUrl: string | null;
     captchaPolicy: import("../foundations/jsonb-types/sign-in-experience.js").CaptchaPolicy;
     sentinelPolicy: import("../foundations/jsonb-types/sign-in-experience.js").SentinelPolicy;
-    emailBlocklistPolicy: import("../foundations/jsonb-types/sign-in-experience.js").EmailBlocklistPolicy;
     verificationCodePolicy: import("../foundations/jsonb-types/sign-in-experience.js").VerificationCodePolicy;
     passkeySignIn: import("../foundations/jsonb-types/sign-in-experience.js").PasskeySignIn;
     signUpProfileFields: import("../foundations/jsonb-types/sign-in-experience.js").SignUpProfileFields | null;
@@ -981,6 +987,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
             es?: string | undefined;
             "es-ES"?: string | undefined;
             "es-419"?: string | undefined;
+            "es-MX"?: string | undefined;
             "et-EE"?: string | undefined;
             "eu-ES"?: string | undefined;
             "fa-IR"?: string | undefined;
@@ -1103,9 +1110,10 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     };
     isDevelopmentTenant: boolean;
     customProfileFields: CustomProfileField[];
+    trustedDevice?: import("../foundations/jsonb-types/sign-in-experience.js").TrustedDevicePolicy | undefined;
     googleOneTap?: {
-        connectorId: string;
         clientId: string;
+        connectorId: string;
         isEnabled?: boolean | undefined;
         autoSelect?: boolean | undefined;
         closeOnTapOutside?: boolean | undefined;

package/lib/types/sign-in-experience.js

@@ -4,8 +4,9 @@ import { CustomProfileFields, SignInExperiences, } from '../db-entries/index.js'
 import { CaptchaType, RecaptchaEnterpriseMode } from '../foundations/jsonb-types/index.js';
 import { ssoConnectorMetadataGuard } from './sso-connector.js';
 export const fullSignInExperienceGuard = SignInExperiences.guard
-    .omit({ forgotPasswordMethods: true })
+    .omit({ emailBlocklistPolicy: true, forgotPasswordMethods: true, trustedDevice: true })
     .extend({
+    trustedDevice: SignInExperiences.guard.shape.trustedDevice.optional(),
     socialConnectors: connectorMetadataGuard
         .omit({
         description: true,

package/lib/types/sso-connector.d.ts

@@ -168,4 +168,62 @@ export declare const extendedSocialUserInfoGuard: z.ZodObject<{
     rawData: z.ZodOptional<z.ZodType<import("@withtyped/server").Json, z.ZodTypeDef, import("@withtyped/server").Json>>;
 }, z.ZodUnknown, "strip">>;
 export type ExtendedSocialUserInfo = z.infer<typeof extendedSocialUserInfoGuard>;
+export declare const samlSsoConnectorSigningKeyResponseGuard: z.ZodObject<Omit<{
+    id: z.ZodType<string, z.ZodTypeDef, string>;
+    tenantId: z.ZodType<string, z.ZodTypeDef, string>;
+    ssoConnectorId: z.ZodType<string, z.ZodTypeDef, string>;
+    privateKey: z.ZodType<string, z.ZodTypeDef, string>;
+    certificate: z.ZodType<string, z.ZodTypeDef, string>;
+    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
+    expiresAt: z.ZodType<number, z.ZodTypeDef, number>;
+    active: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+}, "tenantId" | "ssoConnectorId" | "privateKey"> & {
+    fingerprints: z.ZodObject<{
+        sha256: z.ZodObject<{
+            formatted: z.ZodString;
+            unformatted: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            formatted: string;
+            unformatted: string;
+        }, {
+            formatted: string;
+            unformatted: string;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        sha256: {
+            formatted: string;
+            unformatted: string;
+        };
+    }, {
+        sha256: {
+            formatted: string;
+            unformatted: string;
+        };
+    }>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    createdAt: number;
+    certificate: string;
+    active: boolean;
+    expiresAt: number;
+    fingerprints: {
+        sha256: {
+            formatted: string;
+            unformatted: string;
+        };
+    };
+}, {
+    id: string;
+    createdAt: number;
+    certificate: string;
+    active: boolean;
+    expiresAt: number;
+    fingerprints: {
+        sha256: {
+            formatted: string;
+            unformatted: string;
+        };
+    };
+}>;
+export type SamlSsoConnectorSigningKeyResponse = z.infer<typeof samlSsoConnectorSigningKeyResponseGuard>;
 export {};

package/lib/types/sso-connector.js

@@ -1,6 +1,8 @@
 import { socialUserInfoGuard } from '@logto/connector-kit';
 import { z } from 'zod';
+import { SamlSsoConnectorSigningKeys } from '../db-entries/saml-sso-connector-signing-key.js';
 import { SsoConnectors } from '../db-entries/sso-connector.js';
+import { certificateFingerprintsGuard } from './saml-application.js';
 /**
  * SSO Connector data type that are returned to the experience client for sign-in use.
  */
@@ -76,3 +78,13 @@ export var SsoAuthenticationQueryKey;
 })(SsoAuthenticationQueryKey || (SsoAuthenticationQueryKey = {}));
 // Saml assertion returned user attribute value
 export const extendedSocialUserInfoGuard = socialUserInfoGuard.catchall(z.unknown());
+// Make sure the `privateKey` is not exposed in the response.
+export const samlSsoConnectorSigningKeyResponseGuard = SamlSsoConnectorSigningKeys.guard
+    .omit({
+    tenantId: true,
+    ssoConnectorId: true,
+    privateKey: true,
+})
+    .extend({
+    fingerprints: certificateFingerprintsGuard,
+});

package/lib/types/system.d.ts

@@ -198,14 +198,14 @@ export declare const demoSocialDataGuard: z.ZodArray<z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     name: string;
     logo: string;
-    logoDark: string;
     clientId: string;
+    logoDark: string;
     provider: DemoSocialProvider;
 }, {
     name: string;
     logo: string;
-    logoDark: string;
     clientId: string;
+    logoDark: string;
     provider: DemoSocialProvider;
 }>, "many">;
 export type DemoSocialData = z.infer<typeof demoSocialDataGuard>;

package/lib/types/trusted-device.d.ts

@@ -0,0 +1,67 @@
+import { z } from 'zod';
+/** Public trusted-device metadata returned by user management APIs. */
+export declare const trustedDeviceResponseGuard: z.ZodObject<Pick<{
+    tenantId: z.ZodType<string, z.ZodTypeDef, string>;
+    id: z.ZodType<string, z.ZodTypeDef, string>;
+    userId: z.ZodType<string, z.ZodTypeDef, string>;
+    secretHash: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    userAgent: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    ip: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    country: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    city: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
+    lastUsedAt: z.ZodType<number, z.ZodTypeDef, number>;
+    expiresAt: z.ZodType<number, z.ZodTypeDef, number>;
+}, "id" | "userAgent" | "createdAt" | "country" | "lastUsedAt" | "expiresAt" | "city">, "strip", z.ZodTypeAny, {
+    id: string;
+    userAgent: string | null;
+    createdAt: number;
+    country: string | null;
+    lastUsedAt: number;
+    expiresAt: number;
+    city: string | null;
+}, {
+    id: string;
+    userAgent: string | null;
+    createdAt: number;
+    country: string | null;
+    lastUsedAt: number;
+    expiresAt: number;
+    city: string | null;
+}>;
+export type TrustedDeviceResponse = z.infer<typeof trustedDeviceResponseGuard>;
+/** Account API trusted-device metadata with current-browser state. */
+export declare const accountTrustedDeviceResponseGuard: z.ZodObject<Pick<{
+    tenantId: z.ZodType<string, z.ZodTypeDef, string>;
+    id: z.ZodType<string, z.ZodTypeDef, string>;
+    userId: z.ZodType<string, z.ZodTypeDef, string>;
+    secretHash: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    userAgent: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    ip: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    country: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    city: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
+    lastUsedAt: z.ZodType<number, z.ZodTypeDef, number>;
+    expiresAt: z.ZodType<number, z.ZodTypeDef, number>;
+}, "id" | "userAgent" | "createdAt" | "country" | "lastUsedAt" | "expiresAt" | "city"> & {
+    isCurrent: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    userAgent: string | null;
+    createdAt: number;
+    country: string | null;
+    lastUsedAt: number;
+    expiresAt: number;
+    city: string | null;
+    isCurrent: boolean;
+}, {
+    id: string;
+    userAgent: string | null;
+    createdAt: number;
+    country: string | null;
+    lastUsedAt: number;
+    expiresAt: number;
+    city: string | null;
+    isCurrent: boolean;
+}>;
+export type AccountTrustedDeviceResponse = z.infer<typeof accountTrustedDeviceResponseGuard>;

package/lib/types/trusted-device.js

@@ -0,0 +1,16 @@
+import { z } from 'zod';
+import { TrustedDevices } from '../db-entries/index.js';
+/** Public trusted-device metadata returned by user management APIs. */
+export const trustedDeviceResponseGuard = TrustedDevices.guard.pick({
+    id: true,
+    userAgent: true,
+    country: true,
+    city: true,
+    createdAt: true,
+    lastUsedAt: true,
+    expiresAt: true,
+});
+/** Account API trusted-device metadata with current-browser state. */
+export const accountTrustedDeviceResponseGuard = trustedDeviceResponseGuard.extend({
+    isCurrent: z.boolean(),
+});