@logto/schemas 1.41.0 → 1.43.0

package/lib/db-entries/user.js

@@ -14,6 +14,7 @@ const createGuard = z.object({
     avatar: z.string().max(2048).nullable().optional(),
     profile: userProfileGuard.optional(),
     applicationId: z.string().max(21).nullable().optional(),
+    cimdClientId: z.string().max(2048).nullable().optional(),
     identities: identitiesGuard.optional(),
     customData: jsonObjectGuard.optional(),
     logtoConfig: jsonObjectGuard.optional(),
@@ -37,6 +38,7 @@ const guard = z.object({
     avatar: z.string().max(2048).nullable(),
     profile: userProfileGuard,
     applicationId: z.string().max(21).nullable(),
+    cimdClientId: z.string().max(2048).nullable(),
     identities: identitiesGuard,
     customData: jsonObjectGuard,
     logtoConfig: jsonObjectGuard,
@@ -63,6 +65,7 @@ export const Users = Object.freeze({
         avatar: 'avatar',
         profile: 'profile',
         applicationId: 'application_id',
+        cimdClientId: 'cimd_client_id',
         identities: 'identities',
         customData: 'custom_data',
         logtoConfig: 'logto_config',
@@ -86,6 +89,7 @@ export const Users = Object.freeze({
         'avatar',
         'profile',
         'applicationId',
+        'cimdClientId',
         'identities',
         'customData',
         'logtoConfig',

package/lib/foundations/jsonb-types/account-centers.d.ts

@@ -22,6 +22,7 @@ export declare const accountCenterFieldControlGuard: z.ZodObject<{
     mfa: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
     passkey: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
     session: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
+    trustedDevice: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
 }, "strip", z.ZodTypeAny, {
     name?: AccountCenterControlValue | undefined;
     username?: AccountCenterControlValue | undefined;
@@ -35,6 +36,7 @@ export declare const accountCenterFieldControlGuard: z.ZodObject<{
     mfa?: AccountCenterControlValue | undefined;
     passkey?: AccountCenterControlValue | undefined;
     session?: AccountCenterControlValue | undefined;
+    trustedDevice?: AccountCenterControlValue | undefined;
 }, {
     name?: AccountCenterControlValue | undefined;
     username?: AccountCenterControlValue | undefined;
@@ -48,6 +50,7 @@ export declare const accountCenterFieldControlGuard: z.ZodObject<{
     mfa?: AccountCenterControlValue | undefined;
     passkey?: AccountCenterControlValue | undefined;
     session?: AccountCenterControlValue | undefined;
+    trustedDevice?: AccountCenterControlValue | undefined;
 }>;
 export type AccountCenterFieldControl = z.infer<typeof accountCenterFieldControlGuard>;
 export declare const webauthnRelatedOriginsGuard: z.ZodArray<z.ZodString, "many">;

package/lib/foundations/jsonb-types/account-centers.js

@@ -24,6 +24,7 @@ export const accountCenterFieldControlGuard = z
     mfa: z.nativeEnum(AccountCenterControlValue),
     passkey: z.nativeEnum(AccountCenterControlValue),
     session: z.nativeEnum(AccountCenterControlValue),
+    trustedDevice: z.nativeEnum(AccountCenterControlValue),
 })
     .partial();
 export const webauthnRelatedOriginsGuard = z.array(z.string());

package/lib/foundations/jsonb-types/account-centers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/foundations/jsonb-types/account-centers.test.js

@@ -0,0 +1,13 @@
+import { describe, expect, it } from 'vitest';
+import { AccountCenterControlValue, accountCenterFieldControlGuard } from './account-centers.js';
+describe('accountCenterFieldControlGuard', () => {
+    it('allows trusted device control to be omitted', () => {
+        expect(accountCenterFieldControlGuard.parse({})).toEqual({});
+    });
+    it.each(Object.values(AccountCenterControlValue))('accepts trusted device control value %s', (trustedDevice) => {
+        expect(accountCenterFieldControlGuard.parse({ trustedDevice })).toEqual({ trustedDevice });
+    });
+    it('rejects an invalid trusted device control value', () => {
+        expect(accountCenterFieldControlGuard.safeParse({ trustedDevice: 'Invalid' }).success).toBe(false);
+    });
+});

package/lib/foundations/jsonb-types/custom-domain.d.ts

@@ -1,4 +1,61 @@
 import { z } from 'zod';
+export declare enum DomainVerificationFileContentType {
+    Text = "text/plain",
+    Json = "application/json"
+}
+export declare const domainVerificationFilePathGuard: z.ZodEffects<z.ZodString, string, string>;
+export declare const domainVerificationFileGuard: z.ZodEffects<z.ZodObject<{
+    path: z.ZodEffects<z.ZodString, string, string>;
+    content: z.ZodString;
+    contentType: z.ZodNativeEnum<typeof DomainVerificationFileContentType>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}>, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}>;
+export type DomainVerificationFile = z.infer<typeof domainVerificationFileGuard>;
+export declare const domainVerificationFilesGuard: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodObject<{
+    path: z.ZodEffects<z.ZodString, string, string>;
+    content: z.ZodString;
+    contentType: z.ZodNativeEnum<typeof DomainVerificationFileContentType>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}>, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}>, "many">, {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}[], {
+    path: string;
+    content: string;
+    contentType: DomainVerificationFileContentType;
+}[]>;
+export type DomainVerificationFiles = z.infer<typeof domainVerificationFilesGuard>;
 export declare const domainDnsRecordGuard: z.ZodObject<{
     name: z.ZodString;
     type: z.ZodString;

package/lib/foundations/jsonb-types/custom-domain.js

@@ -1,4 +1,55 @@
 import { z } from 'zod';
+export var DomainVerificationFileContentType;
+(function (DomainVerificationFileContentType) {
+    DomainVerificationFileContentType["Text"] = "text/plain";
+    DomainVerificationFileContentType["Json"] = "application/json";
+})(DomainVerificationFileContentType || (DomainVerificationFileContentType = {}));
+export const domainVerificationFilePathGuard = z
+    .string()
+    .min(1)
+    .max(256)
+    .refine((value) => /^\/[\w-][\w.-]*\.[\w-][\w.-]*$/.test(value) ||
+    /^\/\.well-known(?:\/[\w-][\w.-]*)+$/.test(value), 'The path must point to a file with an extension at the domain root or to a path under /.well-known/.');
+export const domainVerificationFileGuard = z
+    .object({
+    path: domainVerificationFilePathGuard,
+    content: z
+        .string()
+        .min(1)
+        .max(16 * 1024),
+    contentType: z.nativeEnum(DomainVerificationFileContentType),
+})
+    .superRefine(({ content, contentType }, context) => {
+    if (contentType !== DomainVerificationFileContentType.Json) {
+        return;
+    }
+    try {
+        JSON.parse(content);
+    }
+    catch {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'The content must be valid JSON for the application/json content type.',
+            path: ['content'],
+        });
+    }
+});
+export const domainVerificationFilesGuard = domainVerificationFileGuard
+    .array()
+    .max(10)
+    .superRefine((files, context) => {
+    const paths = new Set();
+    for (const [index, file] of files.entries()) {
+        if (paths.has(file.path)) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'Verification file paths must be unique.',
+                path: [index, 'path'],
+            });
+        }
+        paths.add(file.path);
+    }
+});
 export const domainDnsRecordGuard = z.object({
     name: z.string(),
     type: z.string(),

package/lib/foundations/jsonb-types/custom-domain.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/foundations/jsonb-types/custom-domain.test.js

@@ -0,0 +1,38 @@
+import { describe, expect, it } from 'vitest';
+import { DomainVerificationFileContentType, domainVerificationFilesGuard, } from './custom-domain.js';
+describe('domainVerificationFilesGuard', () => {
+    it.each([
+        '/MP_verify_abc123.txt',
+        '/_domainconnect.txt',
+        '/-verification.txt',
+        '/google-site-verification.html',
+        '/.well-known/apple-developer-merchantid-domain-association',
+        '/.well-known/acme-challenge/token_123',
+        '/.well-known/acme-challenge/-token_123',
+        '/.well-known/acme-challenge/_token_123',
+    ])('accepts verification file path %s', (path) => {
+        expect(domainVerificationFilesGuard.safeParse([
+            { path, content: 'verification-content', contentType: 'text/plain' },
+        ]).success).toBe(true);
+    });
+    it.each(['/api/file.txt', '/../secret.txt', '/nested/file.txt', '/file', '/file%2Etxt'])('rejects verification file path %s', (path) => {
+        expect(domainVerificationFilesGuard.safeParse([
+            { path, content: 'verification-content', contentType: 'text/plain' },
+        ]).success).toBe(false);
+    });
+    it('requires valid JSON for JSON responses', () => {
+        expect(domainVerificationFilesGuard.safeParse([
+            {
+                path: '/.well-known/verification.json',
+                content: '{invalid-json}',
+                contentType: DomainVerificationFileContentType.Json,
+            },
+        ]).success).toBe(false);
+    });
+    it('rejects duplicate paths', () => {
+        expect(domainVerificationFilesGuard.safeParse([
+            { path: '/verify.txt', content: 'one', contentType: 'text/plain' },
+            { path: '/verify.txt', content: 'two', contentType: 'text/plain' },
+        ]).success).toBe(false);
+    });
+});

package/lib/foundations/jsonb-types/hooks.d.ts

@@ -14,6 +14,7 @@ export declare enum InteractionHookEvent {
 }
 export declare enum DataHookSchema {
     User = "User",
+    TrustedDevice = "TrustedDevice",
     Role = "Role",
     Scope = "Scope",
     Organization = "Organization",
@@ -28,16 +29,19 @@ declare enum DataHookDetailMutationType {
     Updated = "Updated"
 }
 type BasicDataHookEvent = `${DataHookSchema}.${DataHookBasicMutationType}`;
-type CustomDataHookMutableSchema = `${DataHookSchema}.Data` | `${DataHookSchema.User}.SuspensionStatus` | `${DataHookSchema.Role}.Scopes` | `${DataHookSchema.Organization}.Membership` | `${DataHookSchema.OrganizationRole}.Scopes`;
+type CustomDataHookMutableSchema = `${Exclude<DataHookSchema, DataHookSchema.TrustedDevice>}.Data` | `${DataHookSchema.User}.SuspensionStatus` | `${DataHookSchema.Role}.Scopes` | `${DataHookSchema.Organization}.Membership` | `${DataHookSchema.OrganizationRole}.Scopes`;
 type DataHookPropertyUpdateEvent = `${CustomDataHookMutableSchema}.${DataHookDetailMutationType.Updated}`;
-export type ExceptionHookEvent = 'Identifier.Lockout' | 'Message.RateLimited';
+export type ExceptionHookEvent = 'Identifier.Lockout' | 'Message.RateLimited' | 'Grant.LimitExceeded';
 export type DataHookEvent = BasicDataHookEvent | DataHookPropertyUpdateEvent;
+/** Data hook events that are available only while their feature is under development. */
+export declare const devFeatureHookEvents: readonly ["TrustedDevice.Created", "TrustedDevice.Deleted"];
+export type DevFeatureHookEvent = (typeof devFeatureHookEvents)[number];
 /** The hook event values that can be registered. */
-export declare const hookEvents: readonly [InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited"];
+export declare const hookEvents: readonly [InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "TrustedDevice.Created", "TrustedDevice.Deleted", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"];
 /** The type of hook event values that can be registered. */
 export type HookEvent = (typeof hookEvents)[number];
-export declare const hookEventGuard: z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited"]>;
-export declare const hookEventsGuard: z.ZodArray<z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited"]>, "many">;
+export declare const hookEventGuard: z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "TrustedDevice.Created", "TrustedDevice.Deleted", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"]>;
+export declare const hookEventsGuard: z.ZodArray<z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "TrustedDevice.Created", "TrustedDevice.Deleted", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"]>, "many">;
 export type HookEvents = z.infer<typeof hookEventsGuard>;
 export declare const interactionHookEventGuard: z.ZodNativeEnum<typeof InteractionHookEvent>;
 /**

package/lib/foundations/jsonb-types/hooks.js

@@ -18,6 +18,7 @@ export var InteractionHookEvent;
 export var DataHookSchema;
 (function (DataHookSchema) {
     DataHookSchema["User"] = "User";
+    DataHookSchema["TrustedDevice"] = "TrustedDevice";
     DataHookSchema["Role"] = "Role";
     DataHookSchema["Scope"] = "Scope";
     DataHookSchema["Organization"] = "Organization";
@@ -33,6 +34,11 @@ var DataHookDetailMutationType;
 (function (DataHookDetailMutationType) {
     DataHookDetailMutationType["Updated"] = "Updated";
 })(DataHookDetailMutationType || (DataHookDetailMutationType = {}));
+/** Data hook events that are available only while their feature is under development. */
+export const devFeatureHookEvents = Object.freeze([
+    'TrustedDevice.Created',
+    'TrustedDevice.Deleted',
+]);
 /** The hook event values that can be registered. */
 export const hookEvents = Object.freeze([
     InteractionHookEvent.PostRegister,
@@ -43,6 +49,7 @@ export const hookEvents = Object.freeze([
     'User.Deleted',
     'User.Data.Updated',
     'User.SuspensionStatus.Updated',
+    ...devFeatureHookEvents,
     'Role.Created',
     'Role.Deleted',
     'Role.Data.Updated',
@@ -63,6 +70,7 @@ export const hookEvents = Object.freeze([
     'OrganizationScope.Data.Updated',
     'Identifier.Lockout',
     'Message.RateLimited',
+    'Grant.LimitExceeded',
 ]);
 export const hookEventGuard = z.enum(hookEvents);
 export const hookEventsGuard = hookEventGuard.array();

package/lib/foundations/jsonb-types/logs.d.ts

@@ -362,7 +362,13 @@ export declare const logContextPayloadGuard: z.ZodObject<{
         }, z.ZodUnknown, "strip">>>;
     }, z.ZodUnknown, "strip">>>;
     userId: z.ZodOptional<z.ZodString>;
+    /** Registered application ids only; a CIMD client identifier goes under {@link cimdClientId}. */
     applicationId: z.ZodOptional<z.ZodString>;
+    /**
+     * The CIMD client identifier URL, kept apart from `applicationId` so payload consumers
+     * branch on key presence instead of URL shape.
+     */
+    cimdClientId: z.ZodOptional<z.ZodString>;
     sessionId: z.ZodOptional<z.ZodString>;
     params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, "strip", z.ZodUnknown, z.objectOutputType<{
@@ -547,7 +553,13 @@ export declare const logContextPayloadGuard: z.ZodObject<{
         }, z.ZodUnknown, "strip">>>;
     }, z.ZodUnknown, "strip">>>;
     userId: z.ZodOptional<z.ZodString>;
+    /** Registered application ids only; a CIMD client identifier goes under {@link cimdClientId}. */
     applicationId: z.ZodOptional<z.ZodString>;
+    /**
+     * The CIMD client identifier URL, kept apart from `applicationId` so payload consumers
+     * branch on key presence instead of URL shape.
+     */
+    cimdClientId: z.ZodOptional<z.ZodString>;
     sessionId: z.ZodOptional<z.ZodString>;
     params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.ZodUnknown, "strip">, z.objectInputType<{
@@ -732,7 +744,13 @@ export declare const logContextPayloadGuard: z.ZodObject<{
         }, z.ZodUnknown, "strip">>>;
     }, z.ZodUnknown, "strip">>>;
     userId: z.ZodOptional<z.ZodString>;
+    /** Registered application ids only; a CIMD client identifier goes under {@link cimdClientId}. */
     applicationId: z.ZodOptional<z.ZodString>;
+    /**
+     * The CIMD client identifier URL, kept apart from `applicationId` so payload consumers
+     * branch on key presence instead of URL shape.
+     */
+    cimdClientId: z.ZodOptional<z.ZodString>;
     sessionId: z.ZodOptional<z.ZodString>;
     params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.ZodUnknown, "strip">>;

package/lib/foundations/jsonb-types/logs.js

@@ -64,7 +64,13 @@ export const logContextPayloadGuard = z
     userAgent: z.string().optional(),
     userAgentParsed: userAgentParsedGuard.optional(),
     userId: z.string().optional(),
+    /** Registered application ids only; a CIMD client identifier goes under {@link cimdClientId}. */
     applicationId: z.string().optional(),
+    /**
+     * The CIMD client identifier URL, kept apart from `applicationId` so payload consumers
+     * branch on key presence instead of URL shape.
+     */
+    cimdClientId: z.string().optional(),
     sessionId: z.string().optional(),
     params: z.record(z.string(), z.unknown()).optional(),
 })

package/lib/foundations/jsonb-types/one-time-tokens.d.ts

@@ -1,13 +1,18 @@
 import { z } from 'zod';
+import { type InteractionEvent } from '../../types/interaction-event.js';
 export type OneTimeTokenContext = {
     jitOrganizationIds?: string[];
+    interactionEvent?: InteractionEvent;
 };
 export declare const oneTimeTokenContextGuard: z.ZodObject<{
     jitOrganizationIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    interactionEvent: z.ZodOptional<z.ZodNativeEnum<typeof InteractionEvent>>;
 }, "strip", z.ZodTypeAny, {
     jitOrganizationIds?: string[] | undefined;
+    interactionEvent?: InteractionEvent | undefined;
 }, {
     jitOrganizationIds?: string[] | undefined;
+    interactionEvent?: InteractionEvent | undefined;
 }>;
 export declare enum OneTimeTokenStatus {
     Active = "active",

package/lib/foundations/jsonb-types/one-time-tokens.js

@@ -1,7 +1,9 @@
 import { z } from 'zod';
+import { eventGuard } from '../../types/interaction-event.js';
 export const oneTimeTokenContextGuard = z
     .object({
     jitOrganizationIds: z.string().array(),
+    interactionEvent: eventGuard,
 })
     .partial();
 export var OneTimeTokenStatus;

package/lib/foundations/jsonb-types/sign-in-experience.d.ts

@@ -51,13 +51,13 @@ export declare const brandingGuard: z.ZodObject<{
 export type Branding = z.infer<typeof brandingGuard>;
 export declare const languageInfoGuard: z.ZodObject<{
     autoDetect: z.ZodBoolean;
-    fallbackLanguage: z.ZodType<"af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR", z.ZodTypeDef, "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR">;
+    fallbackLanguage: z.ZodType<"af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "es-MX" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR", z.ZodTypeDef, "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "es-MX" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR">;
 }, "strip", z.ZodTypeAny, {
     autoDetect: boolean;
-    fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
+    fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "es-MX" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
 }, {
     autoDetect: boolean;
-    fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
+    fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "es-MX" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
 }>;
 export type LanguageInfo = z.infer<typeof languageInfoGuard>;
 export declare enum SignInIdentifier {
@@ -320,6 +320,26 @@ export declare const adaptiveMfaGuard: z.ZodObject<{
 }, {
     enabled?: boolean | undefined;
 }>;
+/** Stored tenant-level overrides for MFA trusted-device credentials. */
+export type TrustedDevicePolicy = {
+    enabled?: boolean;
+    durationDays?: number;
+};
+/** Default trusted-device policy for newly created sign-in experiences. */
+export declare const defaultTrustedDevicePolicy: Readonly<{
+    enabled: false;
+    durationDays: 30;
+}>;
+export declare const trustedDevicePolicyGuard: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    durationDays: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    enabled?: boolean | undefined;
+    durationDays?: number | undefined;
+}, {
+    enabled?: boolean | undefined;
+    durationDays?: number | undefined;
+}>;
 export declare const customUiAssetsGuard: z.ZodObject<{
     id: z.ZodString;
     createdAt: z.ZodNumber;
@@ -391,27 +411,42 @@ export type EmailBlocklistPolicy = {
     blockDisposableAddresses?: boolean;
     blockSubaddressing?: boolean;
     /**
-     * Custom blocklist of email addresses or domains.
+     * Custom allowlist of email addresses, domains, or wildcard email address patterns.
+     *
+     * The matching semantics are the same as {@link customBlocklist}.
+     */
+    customAllowlist?: string[];
+    /**
+     * Custom blocklist of email addresses, domains, or wildcard email address patterns.
      *
      * @example
      * Email address: abc@xyx.com
      *
      * @example
      * Domain name: @xyz.com
+     *
+     * @example
+     * Wildcard email address pattern: foo*@example.com
+     *
+     * @example
+     * Wildcard domain pattern: @*.example.com
      */
     customBlocklist?: string[];
 };
 export declare const emailBlocklistPolicyGuard: z.ZodObject<{
     blockDisposableAddresses: z.ZodOptional<z.ZodBoolean>;
     blockSubaddressing: z.ZodOptional<z.ZodBoolean>;
+    customAllowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     customBlocklist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
     blockDisposableAddresses?: boolean | undefined;
     blockSubaddressing?: boolean | undefined;
+    customAllowlist?: string[] | undefined;
     customBlocklist?: string[] | undefined;
 }, {
     blockDisposableAddresses?: boolean | undefined;
     blockSubaddressing?: boolean | undefined;
+    customAllowlist?: string[] | undefined;
     customBlocklist?: string[] | undefined;
 }>;
 export declare enum ForgotPasswordMethod {

package/lib/foundations/jsonb-types/sign-in-experience.js

@@ -112,6 +112,15 @@ export const mfaGuard = z.object({
 export const adaptiveMfaGuard = z.object({
     enabled: z.boolean().optional(),
 });
+/** Default trusted-device policy for newly created sign-in experiences. */
+export const defaultTrustedDevicePolicy = Object.freeze({
+    enabled: false,
+    durationDays: 30,
+});
+export const trustedDevicePolicyGuard = z.object({
+    enabled: z.boolean().optional(),
+    durationDays: z.number().int().min(1).max(365).optional(),
+});
 export const customUiAssetsGuard = z.object({
     id: z.string(),
     createdAt: z.number(),
@@ -130,6 +139,7 @@ export const verificationCodePolicyGuard = z.object({
 export const emailBlocklistPolicyGuard = z.object({
     blockDisposableAddresses: z.boolean().optional(),
     blockSubaddressing: z.boolean().optional(),
+    customAllowlist: z.string().array().optional(),
     customBlocklist: z.string().array().optional(),
 });
 export var ForgotPasswordMethod;

package/lib/foundations/jsonb-types/sign-in-experience.test.js

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { customUiCspGuard, passwordExpirationPolicyGuard } from './sign-in-experience.js';
+import { customUiCspGuard, defaultTrustedDevicePolicy, passwordExpirationPolicyGuard, trustedDevicePolicyGuard, } from './sign-in-experience.js';
 describe('customUiCspGuard', () => {
     it.each([
         {},
@@ -64,3 +64,19 @@ describe('passwordExpirationPolicyGuard', () => {
         expect(passwordExpirationPolicyGuard.safeParse(value).success).toBe(false);
     });
 });
+describe('trustedDevicePolicyGuard', () => {
+    it.each([{}, { enabled: false }, { durationDays: 1 }, { enabled: true, durationDays: 365 }])('accepts valid policy %p', (value) => {
+        expect(trustedDevicePolicyGuard.parse(value)).toEqual(value);
+    });
+    it.each([{ durationDays: 0 }, { durationDays: 366 }, { durationDays: 1.5 }])('rejects invalid policy %p', (value) => {
+        expect(trustedDevicePolicyGuard.safeParse(value).success).toBe(false);
+    });
+    it('provides the complete effective default', () => {
+        expect(defaultTrustedDevicePolicy).toEqual({ enabled: false, durationDays: 30 });
+        expect(trustedDevicePolicyGuard.safeParse(defaultTrustedDevicePolicy).success).toBe(true);
+    });
+    it('rejects invalid enabled values', () => {
+        const value = { enabled: 'true' };
+        expect(trustedDevicePolicyGuard.safeParse(value).success).toBe(false);
+    });
+});