@logto/schemas 1.41.0 → 1.43.0

package/lib/types/application.d.ts

@@ -1,7 +1,137 @@
 import { UserScope } from '@logto/core-kit';
 import { z } from 'zod';
 import { type Application } from '../db-entries/index.js';
-export type ApplicationResponse = Application & {
+/**
+ * The application response returned by Management APIs.
+ *
+ * The legacy client secret is only present before it has been replaced by an internal secret.
+ */
+export declare const applicationResponseGuard: z.ZodObject<{
+    tenantId: z.ZodType<string, z.ZodTypeDef, string>;
+    id: z.ZodType<string, z.ZodTypeDef, string>;
+    name: z.ZodType<string, z.ZodTypeDef, string>;
+    description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    type: z.ZodType<import("../db-entries/custom-types.js").ApplicationType, z.ZodTypeDef, import("../db-entries/custom-types.js").ApplicationType>;
+    oidcClientMetadata: z.ZodType<import("../index.js").OidcClientMetadata, z.ZodTypeDef, import("../index.js").OidcClientMetadata>;
+    customClientMetadata: z.ZodType<{
+        corsAllowedOrigins?: string[] | undefined;
+        idTokenTtl?: number | undefined;
+        refreshTokenTtl?: number | undefined;
+        refreshTokenTtlInDays?: number | undefined;
+        tenantId?: string | undefined;
+        alwaysIssueRefreshToken?: boolean | undefined;
+        rotateRefreshToken?: boolean | undefined;
+        allowTokenExchange?: boolean | undefined;
+        isDeviceFlow?: boolean | undefined;
+        maxAllowedGrants?: number | undefined;
+    }, z.ZodTypeDef, {
+        corsAllowedOrigins?: string[] | undefined;
+        idTokenTtl?: number | undefined;
+        refreshTokenTtl?: number | undefined;
+        refreshTokenTtlInDays?: number | undefined;
+        tenantId?: string | undefined;
+        alwaysIssueRefreshToken?: boolean | undefined;
+        rotateRefreshToken?: boolean | undefined;
+        allowTokenExchange?: boolean | undefined;
+        isDeviceFlow?: boolean | undefined;
+        maxAllowedGrants?: number | undefined;
+    }>;
+    protectedAppMetadata: z.ZodType<{
+        host: string;
+        origin: string;
+        sessionDuration: number;
+        pageRules: {
+            path: string;
+        }[];
+        additionalScopes?: (UserScope.CustomData | UserScope.Identities | UserScope.Roles | UserScope.Organizations | UserScope.OrganizationRoles)[] | undefined;
+        customDomains?: {
+            status: import("../index.js").DomainStatus;
+            domain: string;
+            errorMessage: string | null;
+            dnsRecords: {
+                value: string;
+                type: string;
+                name: string;
+            }[];
+            cloudflareData: {
+                status: string;
+                id: string;
+                ssl: {
+                    status: string;
+                    validation_errors?: {
+                        message: string;
+                    }[] | undefined;
+                };
+                verification_errors?: string[] | undefined;
+            } | null;
+        }[] | undefined;
+    } | null, z.ZodTypeDef, {
+        host: string;
+        origin: string;
+        sessionDuration: number;
+        pageRules: {
+            path: string;
+        }[];
+        additionalScopes?: (UserScope.CustomData | UserScope.Identities | UserScope.Roles | UserScope.Organizations | UserScope.OrganizationRoles)[] | undefined;
+        customDomains?: {
+            status: import("../index.js").DomainStatus;
+            domain: string;
+            errorMessage: string | null;
+            dnsRecords: {
+                value: string;
+                type: string;
+                name: string;
+            }[];
+            cloudflareData: {
+                status: string;
+                id: string;
+                ssl: {
+                    status: string;
+                    validation_errors?: {
+                        message: string;
+                    }[] | undefined;
+                };
+                verification_errors?: string[] | undefined;
+            } | null;
+        }[] | undefined;
+    } | null>;
+    customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
+    isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
+} & {
+    secret: z.ZodOptional<z.ZodType<string, z.ZodTypeDef, string>>;
+}, "strip", z.ZodTypeAny, {
+    type: import("../db-entries/custom-types.js").ApplicationType;
+    name: string;
+    id: string;
+    tenantId: string;
+    createdAt: number;
+    customData: import("@withtyped/server").JsonObject;
+    description: string | null;
+    oidcClientMetadata: import("../index.js").OidcClientMetadata;
+    customClientMetadata: import("../index.js").CustomClientMetadata;
+    protectedAppMetadata: import("../index.js").ProtectedAppMetadata | null;
+    isThirdParty: boolean;
+    appLevelAccessControlEnabled: boolean;
+    secret?: string | undefined;
+}, {
+    type: import("../db-entries/custom-types.js").ApplicationType;
+    name: string;
+    id: string;
+    tenantId: string;
+    createdAt: number;
+    customData: import("@withtyped/server").JsonObject;
+    description: string | null;
+    oidcClientMetadata: import("../index.js").OidcClientMetadata;
+    customClientMetadata: import("../index.js").CustomClientMetadata;
+    protectedAppMetadata: import("../index.js").ProtectedAppMetadata | null;
+    isThirdParty: boolean;
+    appLevelAccessControlEnabled: boolean;
+    secret?: string | undefined;
+}>;
+export type ApplicationApiResponse = z.infer<typeof applicationResponseGuard>;
+export type ApplicationResponse = ApplicationApiResponse & {
     isAdmin: boolean;
 };
 /**

package/lib/types/application.js

@@ -1,6 +1,14 @@
 import { UserScope } from '@logto/core-kit';
 import { z } from 'zod';
 import { Applications, OrganizationScopes, Resources, Scopes, ApplicationSignInExperiences, } from '../db-entries/index.js';
+/**
+ * The application response returned by Management APIs.
+ *
+ * The legacy client secret is only present before it has been replaced by an internal secret.
+ */
+export const applicationResponseGuard = Applications.guard.extend({
+    secret: Applications.guard.shape.secret.optional(),
+});
 /** The guard for {@link FeaturedApplication}. */
 export const featuredApplicationGuard = Applications.guard.pick({
     id: true,

package/lib/types/connector.d.ts

@@ -255,6 +255,7 @@ export declare const connectorResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -389,6 +390,7 @@ export declare const connectorResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -593,6 +595,7 @@ export declare const connectorResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -727,6 +730,7 @@ export declare const connectorResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -1136,6 +1140,7 @@ export declare const connectorFactoryResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -1270,6 +1275,7 @@ export declare const connectorFactoryResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -1467,6 +1473,7 @@ export declare const connectorFactoryResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -1601,6 +1608,7 @@ export declare const connectorFactoryResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;

package/lib/types/consent.d.ts

@@ -54,6 +54,7 @@ export declare const publicUserInfoGuard: z.ZodObject<Pick<{
         }>;
     }>>;
     applicationId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    cimdClientId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     identities: z.ZodType<Record<string, {
         userId: string;
         details?: Record<string, import("@withtyped/server").Json> | undefined;
@@ -144,102 +145,15 @@ export declare const publicUserInfoGuard: z.ZodObject<Pick<{
 export type PublicUserInfo = z.infer<typeof publicUserInfoGuard>;
 /**
  * Define the public application info that can be exposed to the public. e.g. on the user consent page.
+ *
+ * The overrides lift the applications-table column length bounds for CIMD clients: `id` carries
+ * the identifier URL (up to 2048 characters), and `name` the remote document's `client_name`,
+ * which is unbounded and empty when the document omits it.
  */
-export declare const publicApplicationGuard: z.ZodObject<Pick<{
-    tenantId: z.ZodType<string, z.ZodTypeDef, string>;
-    id: z.ZodType<string, z.ZodTypeDef, string>;
-    name: z.ZodType<string, z.ZodTypeDef, string>;
-    secret: z.ZodType<string, z.ZodTypeDef, string>;
-    description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-    type: z.ZodType<import("../db-entries/custom-types.js").ApplicationType, z.ZodTypeDef, import("../db-entries/custom-types.js").ApplicationType>;
-    oidcClientMetadata: z.ZodType<import("../index.js").OidcClientMetadata, z.ZodTypeDef, import("../index.js").OidcClientMetadata>;
-    customClientMetadata: z.ZodType<{
-        corsAllowedOrigins?: string[] | undefined;
-        idTokenTtl?: number | undefined;
-        refreshTokenTtl?: number | undefined;
-        refreshTokenTtlInDays?: number | undefined;
-        tenantId?: string | undefined;
-        alwaysIssueRefreshToken?: boolean | undefined;
-        rotateRefreshToken?: boolean | undefined;
-        allowTokenExchange?: boolean | undefined;
-        isDeviceFlow?: boolean | undefined;
-        maxAllowedGrants?: number | undefined;
-    }, z.ZodTypeDef, {
-        corsAllowedOrigins?: string[] | undefined;
-        idTokenTtl?: number | undefined;
-        refreshTokenTtl?: number | undefined;
-        refreshTokenTtlInDays?: number | undefined;
-        tenantId?: string | undefined;
-        alwaysIssueRefreshToken?: boolean | undefined;
-        rotateRefreshToken?: boolean | undefined;
-        allowTokenExchange?: boolean | undefined;
-        isDeviceFlow?: boolean | undefined;
-        maxAllowedGrants?: number | undefined;
-    }>;
-    protectedAppMetadata: z.ZodType<{
-        host: string;
-        origin: string;
-        sessionDuration: number;
-        pageRules: {
-            path: string;
-        }[];
-        additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
-        customDomains?: {
-            status: import("../index.js").DomainStatus;
-            domain: string;
-            errorMessage: string | null;
-            dnsRecords: {
-                value: string;
-                type: string;
-                name: string;
-            }[];
-            cloudflareData: {
-                status: string;
-                id: string;
-                ssl: {
-                    status: string;
-                    validation_errors?: {
-                        message: string;
-                    }[] | undefined;
-                };
-                verification_errors?: string[] | undefined;
-            } | null;
-        }[] | undefined;
-    } | null, z.ZodTypeDef, {
-        host: string;
-        origin: string;
-        sessionDuration: number;
-        pageRules: {
-            path: string;
-        }[];
-        additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
-        customDomains?: {
-            status: import("../index.js").DomainStatus;
-            domain: string;
-            errorMessage: string | null;
-            dnsRecords: {
-                value: string;
-                type: string;
-                name: string;
-            }[];
-            cloudflareData: {
-                status: string;
-                id: string;
-                ssl: {
-                    status: string;
-                    validation_errors?: {
-                        message: string;
-                    }[] | undefined;
-                };
-                verification_errors?: string[] | undefined;
-            } | null;
-        }[] | undefined;
-    } | null>;
-    customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
-    isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
-    appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
-    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
-}, "name" | "id">, "strip", z.ZodTypeAny, {
+export declare const publicApplicationGuard: z.ZodObject<{} & {
+    id: z.ZodString;
+    name: z.ZodString;
+}, "strip", z.ZodTypeAny, {
     name: string;
     id: string;
 }, {
@@ -357,6 +271,7 @@ export declare const publicOrganizationGuard: z.ZodObject<Pick<{
     description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
     isMfaRequired: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    isTrustedDeviceAllowed: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     color: z.ZodType<Partial<{
         primaryColor: string;
         isDarkModeEnabled: boolean;
@@ -471,101 +386,10 @@ export declare const publicOrganizationGuard: z.ZodObject<Pick<{
 }>;
 export type PublicOrganization = z.infer<typeof publicOrganizationGuard>;
 export declare const consentInfoResponseGuard: z.ZodObject<{
-    application: z.ZodObject<Pick<{
-        tenantId: z.ZodType<string, z.ZodTypeDef, string>;
-        id: z.ZodType<string, z.ZodTypeDef, string>;
-        name: z.ZodType<string, z.ZodTypeDef, string>;
-        secret: z.ZodType<string, z.ZodTypeDef, string>;
-        description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-        type: z.ZodType<import("../db-entries/custom-types.js").ApplicationType, z.ZodTypeDef, import("../db-entries/custom-types.js").ApplicationType>;
-        oidcClientMetadata: z.ZodType<import("../index.js").OidcClientMetadata, z.ZodTypeDef, import("../index.js").OidcClientMetadata>;
-        customClientMetadata: z.ZodType<{
-            corsAllowedOrigins?: string[] | undefined;
-            idTokenTtl?: number | undefined;
-            refreshTokenTtl?: number | undefined;
-            refreshTokenTtlInDays?: number | undefined;
-            tenantId?: string | undefined;
-            alwaysIssueRefreshToken?: boolean | undefined;
-            rotateRefreshToken?: boolean | undefined;
-            allowTokenExchange?: boolean | undefined;
-            isDeviceFlow?: boolean | undefined;
-            maxAllowedGrants?: number | undefined;
-        }, z.ZodTypeDef, {
-            corsAllowedOrigins?: string[] | undefined;
-            idTokenTtl?: number | undefined;
-            refreshTokenTtl?: number | undefined;
-            refreshTokenTtlInDays?: number | undefined;
-            tenantId?: string | undefined;
-            alwaysIssueRefreshToken?: boolean | undefined;
-            rotateRefreshToken?: boolean | undefined;
-            allowTokenExchange?: boolean | undefined;
-            isDeviceFlow?: boolean | undefined;
-            maxAllowedGrants?: number | undefined;
-        }>;
-        protectedAppMetadata: z.ZodType<{
-            host: string;
-            origin: string;
-            sessionDuration: number;
-            pageRules: {
-                path: string;
-            }[];
-            additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
-            customDomains?: {
-                status: import("../index.js").DomainStatus;
-                domain: string;
-                errorMessage: string | null;
-                dnsRecords: {
-                    value: string;
-                    type: string;
-                    name: string;
-                }[];
-                cloudflareData: {
-                    status: string;
-                    id: string;
-                    ssl: {
-                        status: string;
-                        validation_errors?: {
-                            message: string;
-                        }[] | undefined;
-                    };
-                    verification_errors?: string[] | undefined;
-                } | null;
-            }[] | undefined;
-        } | null, z.ZodTypeDef, {
-            host: string;
-            origin: string;
-            sessionDuration: number;
-            pageRules: {
-                path: string;
-            }[];
-            additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
-            customDomains?: {
-                status: import("../index.js").DomainStatus;
-                domain: string;
-                errorMessage: string | null;
-                dnsRecords: {
-                    value: string;
-                    type: string;
-                    name: string;
-                }[];
-                cloudflareData: {
-                    status: string;
-                    id: string;
-                    ssl: {
-                        status: string;
-                        validation_errors?: {
-                            message: string;
-                        }[] | undefined;
-                    };
-                    verification_errors?: string[] | undefined;
-                } | null;
-            }[] | undefined;
-        } | null>;
-        customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
-        isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
-        appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
-        createdAt: z.ZodType<number, z.ZodTypeDef, number>;
-    }, "name" | "id"> & {
+    application: z.ZodObject<{} & {
+        id: z.ZodString;
+        name: z.ZodString;
+    } & {
         displayName: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
         branding: z.ZodOptional<z.ZodType<{
             logoUrl?: string | undefined;
@@ -657,6 +481,7 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
             }>;
         }>>;
         applicationId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+        cimdClientId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
         identities: z.ZodType<Record<string, {
             userId: string;
             details?: Record<string, import("@withtyped/server").Json> | undefined;
@@ -751,6 +576,7 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
         description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
         customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
         isMfaRequired: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+        isTrustedDeviceAllowed: z.ZodType<boolean, z.ZodTypeDef, boolean>;
         color: z.ZodType<Partial<{
             primaryColor: string;
             isDarkModeEnabled: boolean;

package/lib/types/consent.js

@@ -13,10 +13,19 @@ export const publicUserInfoGuard = Users.guard.pick({
 });
 /**
  * Define the public application info that can be exposed to the public. e.g. on the user consent page.
+ *
+ * The overrides lift the applications-table column length bounds for CIMD clients: `id` carries
+ * the identifier URL (up to 2048 characters), and `name` the remote document's `client_name`,
+ * which is unbounded and empty when the document omits it.
  */
-export const publicApplicationGuard = Applications.guard.pick({
+export const publicApplicationGuard = Applications.guard
+    .pick({
     id: true,
     name: true,
+})
+    .extend({
+    id: z.string(),
+    name: z.string(),
 });
 export const applicationSignInExperienceGuard = ApplicationSignInExperiences.guard.pick({
     branding: true,

package/lib/types/custom-profile-fields.d.ts

@@ -2457,6 +2457,7 @@ export declare const signInIdentifierKeyGuard: z.ZodObject<Pick<{
         }>;
     }>>>;
     applicationId: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
+    cimdClientId: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
     identities: z.ZodOptional<z.ZodType<Record<string, {
         userId: string;
         details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -2545,7 +2546,7 @@ export declare const signInIdentifierKeyGuard: z.ZodObject<Pick<{
     primaryEmail?: string | null;
     primaryPhone?: string | null;
 }>;
-export declare const reservedSignInIdentifierKeys: readonly ["username", "email", "phone", "primaryEmail", "primaryPhone"];
+export declare const reservedSignInIdentifierKeys: readonly ["username", "primaryEmail", "primaryPhone", "email", "phone"];
 /** Reserved user profile keys. Currently only `preferredUsername` is reserved for standard IdP usage. */
 export declare const reservedBuiltInProfileKeyGuard: z.ZodObject<Pick<{
     familyName: z.ZodOptional<z.ZodString>;

package/lib/types/domain.d.ts

@@ -15,6 +15,15 @@ export declare const domainResponseGuard: z.ZodObject<Pick<{
         type: string;
         name: string;
     }[]>;
+    verificationFiles: z.ZodType<{
+        path: string;
+        content: string;
+        contentType: import("../index.js").DomainVerificationFileContentType;
+    }[], z.ZodTypeDef, {
+        path: string;
+        content: string;
+        contentType: import("../index.js").DomainVerificationFileContentType;
+    }[]>;
     cloudflareData: z.ZodType<{
         status: string;
         id: string;

package/lib/types/hook.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { type Application, type User } from '../db-entries/index.js';
+import { type Application, type TrustedDevice, type User } from '../db-entries/index.js';
 import { type ExceptionHookEvent, type DataHookEvent, type InteractionHookEvent } from '../foundations/index.js';
 import { type InteractionEvent } from './interactions.js';
 import { type userInfoSelectFields } from './user.js';
@@ -18,8 +18,8 @@ export declare const hookResponseGuard: z.ZodObject<{
     tenantId: z.ZodType<string, z.ZodTypeDef, string>;
     id: z.ZodType<string, z.ZodTypeDef, string>;
     name: z.ZodType<string, z.ZodTypeDef, string>;
-    event: z.ZodType<"User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | InteractionHookEvent | null, z.ZodTypeDef, "User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | InteractionHookEvent | null>;
-    events: z.ZodType<("User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | InteractionHookEvent)[], z.ZodTypeDef, ("User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | InteractionHookEvent)[]>;
+    event: z.ZodType<"User.Created" | "User.Deleted" | "TrustedDevice.Created" | "TrustedDevice.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent | null, z.ZodTypeDef, "User.Created" | "User.Deleted" | "TrustedDevice.Created" | "TrustedDevice.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent | null>;
+    events: z.ZodType<("User.Created" | "User.Deleted" | "TrustedDevice.Created" | "TrustedDevice.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent)[], z.ZodTypeDef, ("User.Created" | "User.Deleted" | "TrustedDevice.Created" | "TrustedDevice.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent)[]>;
     config: z.ZodType<{
         url: string;
         headers?: Record<string, string> | undefined;
@@ -90,8 +90,13 @@ export type HookTestErrorResponseData = z.infer<typeof hookTestErrorResponseData
  * we will store the context before processing the interaction and consume it after the interaction is processed if needed.
  */
 export type InteractionApiMetadata = {
-    /** The application ID if the hook is triggered by interaction API. */
+    /** The registered application ID if the hook is triggered by interaction API. */
     applicationId?: string;
+    /**
+     * The CIMD client identifier URL, kept apart from `applicationId` so payload consumers
+     * branch on key presence instead of URL shape.
+     */
+    cimdClientId?: string;
     /** The session ID if the hook is triggered by interaction API. */
     sessionId?: string;
     /** The InteractionEvent if the hook is triggered by interaction API. */
@@ -100,6 +105,8 @@ export type InteractionApiMetadata = {
 type InteractionApiContextPayload = {
     /** Fetch application detail by application ID before sending the hook event */
     application?: Pick<Application, 'id' | 'type' | 'name' | 'description'>;
+    /** CIMD clients are unregistered, so the identifier URL stands in for `application`. */
+    cimdClientId?: string;
     sessionId?: string;
     interactionEvent?: InteractionEvent;
 };
@@ -140,8 +147,33 @@ export type DataHookEventPayload = {
     userAgent?: string;
     data?: unknown;
 } & Partial<InteractionApiContextPayload> & Partial<ManagementApiContext> & Record<string, unknown>;
-export type ExceptionHookEventPayload = Omit<DataHookEventPayload, 'event'> & {
+/** The intentionally limited trusted-device projection exposed by lifecycle events. */
+export type TrustedDeviceEventData = Pick<TrustedDevice, 'id' | 'userId' | 'expiresAt'>;
+/**
+ * A key-remapping omit instead of the built-in `Omit`: on a type carrying a string index
+ * signature (e.g. the hook event payloads), `Omit` collapses every named property into
+ * `unknown`; the homomorphic form keeps the named properties typed.
+ */
+export type BetterOmit<T, Ignore> = {
+    [key in keyof T as key extends Ignore ? never : key]: T[key];
+};
+export type ExceptionHookEventPayload = BetterOmit<DataHookEventPayload, 'event'> & {
     event: ExceptionHookEvent;
 };
+export type GrantLimitExceededEventData = {
+    userId: string;
+    /** The registered application ID; absent for a CIMD client. */
+    applicationId?: string;
+    /**
+     * The CIMD client identifier URL, set instead of `applicationId`. No grant-ceiling source
+     * exists for CIMD clients today (the CIMD policy denies Logto private client metadata
+     * regardless of source), so this key is defensive: it keeps `applicationId` registered-only
+     * by construction should a ceiling for CIMD clients ever be introduced.
+     */
+    cimdClientId?: string;
+    revokedGrantIds: string[];
+    maxAllowedGrants: number;
+    preRevocationActiveGrantCount: number;
+};
 export type HookEventPayload = InteractionHookEventPayload | DataHookEventPayload | ExceptionHookEventPayload;
 export {};

package/lib/types/index.d.ts

@@ -36,3 +36,4 @@ export * from './custom-profile-fields.js';
 export * from './secrets.js';
 export * from './user-logto-config.js';
 export * from './user-sessions.js';
+export * from './trusted-device.js';

package/lib/types/index.js

@@ -36,3 +36,4 @@ export * from './custom-profile-fields.js';
 export * from './secrets.js';
 export * from './user-logto-config.js';
 export * from './user-sessions.js';
+export * from './trusted-device.js';

package/lib/types/interaction-event.d.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+/**
+ * User interaction events defined in Logto RFC 0004.
+ * @see {@link https://github.com/logto-io/rfcs | Logto RFCs} for more information.
+ */
+export declare enum InteractionEvent {
+    SignIn = "SignIn",
+    Register = "Register",
+    ForgotPassword = "ForgotPassword"
+}
+export declare const eventGuard: z.ZodNativeEnum<typeof InteractionEvent>;

package/lib/types/interaction-event.js

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+/**
+ * User interaction events defined in Logto RFC 0004.
+ * @see {@link https://github.com/logto-io/rfcs | Logto RFCs} for more information.
+ */
+export var InteractionEvent;
+(function (InteractionEvent) {
+    InteractionEvent["SignIn"] = "SignIn";
+    InteractionEvent["Register"] = "Register";
+    InteractionEvent["ForgotPassword"] = "ForgotPassword";
+})(InteractionEvent || (InteractionEvent = {}));
+export const eventGuard = z.nativeEnum(InteractionEvent);