@logto/schemas 1.42.0 → 1.43.0

package/lib/db-entries/organization.d.ts

@@ -17,6 +17,8 @@ export type CreateOrganization = {
     customData?: JsonObject;
     /** Whether multi-factor authentication configuration is required for the members of the organization. */
     isMfaRequired?: boolean;
+    /** Whether trusted devices are allowed for members of the organization. */
+    isTrustedDeviceAllowed?: boolean;
     /** The organization's branding color configuration. */
     color?: PartialColor;
     /** The organization's branding configuration. */
@@ -39,6 +41,8 @@ export type Organization = {
     customData: JsonObject;
     /** Whether multi-factor authentication configuration is required for the members of the organization. */
     isMfaRequired: boolean;
+    /** Whether trusted devices are allowed for members of the organization. */
+    isTrustedDeviceAllowed: boolean;
     /** The organization's branding color configuration. */
     color: PartialColor;
     /** The organization's branding configuration. */
@@ -48,5 +52,5 @@ export type Organization = {
     /** When the organization was created. */
     createdAt: number;
 };
-export type OrganizationKeys = 'tenantId' | 'id' | 'name' | 'description' | 'customData' | 'isMfaRequired' | 'color' | 'branding' | 'customCss' | 'createdAt';
+export type OrganizationKeys = 'tenantId' | 'id' | 'name' | 'description' | 'customData' | 'isMfaRequired' | 'isTrustedDeviceAllowed' | 'color' | 'branding' | 'customCss' | 'createdAt';
 export declare const Organizations: GeneratedSchema<OrganizationKeys, CreateOrganization, Organization, 'organizations', 'organization'>;

package/lib/db-entries/organization.js

@@ -8,6 +8,7 @@ const createGuard = z.object({
     description: z.string().max(256).nullable().optional(),
     customData: jsonObjectGuard.optional(),
     isMfaRequired: z.boolean().optional(),
+    isTrustedDeviceAllowed: z.boolean().optional(),
     color: partialColorGuard.optional(),
     branding: brandingGuard.optional(),
     customCss: z.string().nullable().optional(),
@@ -20,6 +21,7 @@ const guard = z.object({
     description: z.string().max(256).nullable(),
     customData: jsonObjectGuard,
     isMfaRequired: z.boolean(),
+    isTrustedDeviceAllowed: z.boolean(),
     color: partialColorGuard,
     branding: brandingGuard,
     customCss: z.string().nullable(),
@@ -35,6 +37,7 @@ export const Organizations = Object.freeze({
         description: 'description',
         customData: 'custom_data',
         isMfaRequired: 'is_mfa_required',
+        isTrustedDeviceAllowed: 'is_trusted_device_allowed',
         color: 'color',
         branding: 'branding',
         customCss: 'custom_css',
@@ -47,6 +50,7 @@ export const Organizations = Object.freeze({
         'description',
         'customData',
         'isMfaRequired',
+        'isTrustedDeviceAllowed',
         'color',
         'branding',
         'customCss',

package/lib/db-entries/sign-in-experience.d.ts

@@ -1,4 +1,4 @@
-import { Color, Branding, LanguageInfo, SignIn, SignUp, SocialSignIn, ConnectorTargets, CustomContent, CustomUiAssets, CustomUiCsp, PartialPasswordPolicy, Mfa, AdaptiveMfa, CaptchaPolicy, SentinelPolicy, EmailBlocklistPolicy, VerificationCodePolicy, ForgotPasswordMethods, PasskeySignIn, SignUpProfileFields, PasswordExpirationPolicy, UsernamePolicy, GeneratedSchema } from './../foundations/index.js';
+import { Color, Branding, LanguageInfo, SignIn, SignUp, SocialSignIn, ConnectorTargets, CustomContent, CustomUiAssets, CustomUiCsp, PartialPasswordPolicy, Mfa, AdaptiveMfa, TrustedDevicePolicy, CaptchaPolicy, SentinelPolicy, EmailBlocklistPolicy, VerificationCodePolicy, ForgotPasswordMethods, PasskeySignIn, SignUpProfileFields, PasswordExpirationPolicy, UsernamePolicy, GeneratedSchema } from './../foundations/index.js';
 import { AgreeToTermsPolicy, SignInMode } from './custom-types.js';
 /**
  *
@@ -28,6 +28,7 @@ export type CreateSignInExperience = {
     passwordPolicy?: PartialPasswordPolicy;
     mfa?: Mfa;
     adaptiveMfa?: AdaptiveMfa;
+    trustedDevice?: TrustedDevicePolicy;
     singleSignOnEnabled?: boolean;
     supportEmail?: string | null;
     supportWebsiteUrl?: string | null;
@@ -66,6 +67,7 @@ export type SignInExperience = {
     passwordPolicy: PartialPasswordPolicy;
     mfa: Mfa;
     adaptiveMfa: AdaptiveMfa;
+    trustedDevice: TrustedDevicePolicy;
     singleSignOnEnabled: boolean;
     supportEmail: string | null;
     supportWebsiteUrl: string | null;
@@ -81,5 +83,5 @@ export type SignInExperience = {
     passwordExpiration: PasswordExpirationPolicy;
     usernamePolicy: UsernamePolicy;
 };
-export type SignInExperienceKeys = 'tenantId' | 'id' | 'color' | 'branding' | 'hideLogtoBranding' | 'languageInfo' | 'termsOfUseUrl' | 'privacyPolicyUrl' | 'agreeToTermsPolicy' | 'signIn' | 'signUp' | 'socialSignIn' | 'socialSignInConnectorTargets' | 'signInMode' | 'customCss' | 'customContent' | 'customUiAssets' | 'customUiCsp' | 'passwordPolicy' | 'mfa' | 'adaptiveMfa' | 'singleSignOnEnabled' | 'supportEmail' | 'supportWebsiteUrl' | 'unknownSessionRedirectUrl' | 'captchaPolicy' | 'sentinelPolicy' | 'emailBlocklistPolicy' | 'verificationCodePolicy' | 'forgotPasswordMethods' | 'passkeySignIn' | 'signUpProfileFields' | 'passwordExpiration' | 'usernamePolicy';
+export type SignInExperienceKeys = 'tenantId' | 'id' | 'color' | 'branding' | 'hideLogtoBranding' | 'languageInfo' | 'termsOfUseUrl' | 'privacyPolicyUrl' | 'agreeToTermsPolicy' | 'signIn' | 'signUp' | 'socialSignIn' | 'socialSignInConnectorTargets' | 'signInMode' | 'customCss' | 'customContent' | 'customUiAssets' | 'customUiCsp' | 'passwordPolicy' | 'mfa' | 'adaptiveMfa' | 'trustedDevice' | 'singleSignOnEnabled' | 'supportEmail' | 'supportWebsiteUrl' | 'unknownSessionRedirectUrl' | 'captchaPolicy' | 'sentinelPolicy' | 'emailBlocklistPolicy' | 'verificationCodePolicy' | 'forgotPasswordMethods' | 'passkeySignIn' | 'signUpProfileFields' | 'passwordExpiration' | 'usernamePolicy';
 export declare const SignInExperiences: GeneratedSchema<SignInExperienceKeys, CreateSignInExperience, SignInExperience, 'sign_in_experiences', 'sign_in_experience'>;

package/lib/db-entries/sign-in-experience.js

@@ -1,6 +1,6 @@
 // THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
 import { z } from 'zod';
-import { colorGuard, brandingGuard, languageInfoGuard, signInGuard, signUpGuard, socialSignInGuard, connectorTargetsGuard, customContentGuard, customUiAssetsGuard, customUiCspGuard, partialPasswordPolicyGuard, mfaGuard, adaptiveMfaGuard, captchaPolicyGuard, sentinelPolicyGuard, emailBlocklistPolicyGuard, verificationCodePolicyGuard, forgotPasswordMethodsGuard, passkeySignInGuard, signUpProfileFieldsGuard, passwordExpirationPolicyGuard, usernamePolicyGuard } from './../foundations/index.js';
+import { colorGuard, brandingGuard, languageInfoGuard, signInGuard, signUpGuard, socialSignInGuard, connectorTargetsGuard, customContentGuard, customUiAssetsGuard, customUiCspGuard, partialPasswordPolicyGuard, mfaGuard, adaptiveMfaGuard, trustedDevicePolicyGuard, captchaPolicyGuard, sentinelPolicyGuard, emailBlocklistPolicyGuard, verificationCodePolicyGuard, forgotPasswordMethodsGuard, passkeySignInGuard, signUpProfileFieldsGuard, passwordExpirationPolicyGuard, usernamePolicyGuard } from './../foundations/index.js';
 import { AgreeToTermsPolicy, SignInMode } from './custom-types.js';
 const createGuard = z.object({
     tenantId: z.string().max(21).optional(),
@@ -24,6 +24,7 @@ const createGuard = z.object({
     passwordPolicy: partialPasswordPolicyGuard.optional(),
     mfa: mfaGuard.optional(),
     adaptiveMfa: adaptiveMfaGuard.optional(),
+    trustedDevice: trustedDevicePolicyGuard.optional(),
     singleSignOnEnabled: z.boolean().optional(),
     supportEmail: z.string().nullable().optional(),
     supportWebsiteUrl: z.string().nullable().optional(),
@@ -60,6 +61,7 @@ const guard = z.object({
     passwordPolicy: partialPasswordPolicyGuard,
     mfa: mfaGuard,
     adaptiveMfa: adaptiveMfaGuard,
+    trustedDevice: trustedDevicePolicyGuard,
     singleSignOnEnabled: z.boolean(),
     supportEmail: z.string().nullable(),
     supportWebsiteUrl: z.string().nullable(),
@@ -99,6 +101,7 @@ export const SignInExperiences = Object.freeze({
         passwordPolicy: 'password_policy',
         mfa: 'mfa',
         adaptiveMfa: 'adaptive_mfa',
+        trustedDevice: 'trusted_device',
         singleSignOnEnabled: 'single_sign_on_enabled',
         supportEmail: 'support_email',
         supportWebsiteUrl: 'support_website_url',
@@ -135,6 +138,7 @@ export const SignInExperiences = Object.freeze({
         'passwordPolicy',
         'mfa',
         'adaptiveMfa',
+        'trustedDevice',
         'singleSignOnEnabled',
         'supportEmail',
         'supportWebsiteUrl',

package/lib/db-entries/trusted-device.d.ts

@@ -0,0 +1,36 @@
+import { BufferLike, GeneratedSchema } from './../foundations/index.js';
+/**
+ * A revocable server-side credential that can fulfill sign-in MFA for a user.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link TrustedDevice} for the original type.
+ */
+export type CreateTrustedDevice = {
+    tenantId?: string;
+    id: string;
+    userId: string;
+    secretHash: BufferLike;
+    userAgent?: string | null;
+    ip?: string | null;
+    country?: string | null;
+    city?: string | null;
+    createdAt?: number;
+    lastUsedAt?: number;
+    expiresAt: number;
+};
+/** A revocable server-side credential that can fulfill sign-in MFA for a user. */
+export type TrustedDevice = {
+    tenantId: string;
+    id: string;
+    userId: string;
+    secretHash: BufferLike;
+    userAgent: string | null;
+    ip: string | null;
+    country: string | null;
+    city: string | null;
+    createdAt: number;
+    lastUsedAt: number;
+    expiresAt: number;
+};
+export type TrustedDeviceKeys = 'tenantId' | 'id' | 'userId' | 'secretHash' | 'userAgent' | 'ip' | 'country' | 'city' | 'createdAt' | 'lastUsedAt' | 'expiresAt';
+export declare const TrustedDevices: GeneratedSchema<TrustedDeviceKeys, CreateTrustedDevice, TrustedDevice, 'trusted_devices', 'trusted_device'>;

package/lib/db-entries/trusted-device.js

@@ -0,0 +1,62 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+import { bufferLikeGuard } from './../foundations/index.js';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    id: z.string().min(1).max(21),
+    userId: z.string().min(1).max(12),
+    secretHash: bufferLikeGuard,
+    userAgent: z.string().nullable().optional(),
+    ip: z.string().nullable().optional(),
+    country: z.string().max(16).nullable().optional(),
+    city: z.string().nullable().optional(),
+    createdAt: z.number().optional(),
+    lastUsedAt: z.number().optional(),
+    expiresAt: z.number(),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    id: z.string().min(1).max(21),
+    userId: z.string().min(1).max(12),
+    secretHash: bufferLikeGuard,
+    userAgent: z.string().nullable(),
+    ip: z.string().nullable(),
+    country: z.string().max(16).nullable(),
+    city: z.string().nullable(),
+    createdAt: z.number(),
+    lastUsedAt: z.number(),
+    expiresAt: z.number(),
+});
+export const TrustedDevices = Object.freeze({
+    table: 'trusted_devices',
+    tableSingular: 'trusted_device',
+    fields: {
+        tenantId: 'tenant_id',
+        id: 'id',
+        userId: 'user_id',
+        secretHash: 'secret_hash',
+        userAgent: 'user_agent',
+        ip: 'ip',
+        country: 'country',
+        city: 'city',
+        createdAt: 'created_at',
+        lastUsedAt: 'last_used_at',
+        expiresAt: 'expires_at',
+    },
+    fieldKeys: [
+        'tenantId',
+        'id',
+        'userId',
+        'secretHash',
+        'userAgent',
+        'ip',
+        'country',
+        'city',
+        'createdAt',
+        'lastUsedAt',
+        'expiresAt',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/user.d.ts

@@ -19,6 +19,7 @@ export type CreateUser = {
     /** Additional OpenID Connect standard claims that are not included in user's properties. */
     profile?: UserProfile;
     applicationId?: string | null;
+    cimdClientId?: string | null;
     identities?: Identities;
     customData?: JsonObject;
     logtoConfig?: JsonObject;
@@ -44,6 +45,7 @@ export type User = {
     /** Additional OpenID Connect standard claims that are not included in user's properties. */
     profile: UserProfile;
     applicationId: string | null;
+    cimdClientId: string | null;
     identities: Identities;
     customData: JsonObject;
     logtoConfig: JsonObject;
@@ -55,5 +57,5 @@ export type User = {
     createdAt: number;
     updatedAt: number;
 };
-export type UserKeys = 'tenantId' | 'id' | 'username' | 'primaryEmail' | 'primaryPhone' | 'passwordEncrypted' | 'passwordEncryptionMethod' | 'name' | 'avatar' | 'profile' | 'applicationId' | 'identities' | 'customData' | 'logtoConfig' | 'mfaVerifications' | 'isSuspended' | 'isPasswordExpired' | 'lastSignInAt' | 'passwordUpdatedAt' | 'createdAt' | 'updatedAt';
+export type UserKeys = 'tenantId' | 'id' | 'username' | 'primaryEmail' | 'primaryPhone' | 'passwordEncrypted' | 'passwordEncryptionMethod' | 'name' | 'avatar' | 'profile' | 'applicationId' | 'cimdClientId' | 'identities' | 'customData' | 'logtoConfig' | 'mfaVerifications' | 'isSuspended' | 'isPasswordExpired' | 'lastSignInAt' | 'passwordUpdatedAt' | 'createdAt' | 'updatedAt';
 export declare const Users: GeneratedSchema<UserKeys, CreateUser, User, 'users', 'user'>;

package/lib/db-entries/user.js

@@ -14,6 +14,7 @@ const createGuard = z.object({
     avatar: z.string().max(2048).nullable().optional(),
     profile: userProfileGuard.optional(),
     applicationId: z.string().max(21).nullable().optional(),
+    cimdClientId: z.string().max(2048).nullable().optional(),
     identities: identitiesGuard.optional(),
     customData: jsonObjectGuard.optional(),
     logtoConfig: jsonObjectGuard.optional(),
@@ -37,6 +38,7 @@ const guard = z.object({
     avatar: z.string().max(2048).nullable(),
     profile: userProfileGuard,
     applicationId: z.string().max(21).nullable(),
+    cimdClientId: z.string().max(2048).nullable(),
     identities: identitiesGuard,
     customData: jsonObjectGuard,
     logtoConfig: jsonObjectGuard,
@@ -63,6 +65,7 @@ export const Users = Object.freeze({
         avatar: 'avatar',
         profile: 'profile',
         applicationId: 'application_id',
+        cimdClientId: 'cimd_client_id',
         identities: 'identities',
         customData: 'custom_data',
         logtoConfig: 'logto_config',
@@ -86,6 +89,7 @@ export const Users = Object.freeze({
         'avatar',
         'profile',
         'applicationId',
+        'cimdClientId',
         'identities',
         'customData',
         'logtoConfig',

package/lib/foundations/jsonb-types/account-centers.d.ts

@@ -22,6 +22,7 @@ export declare const accountCenterFieldControlGuard: z.ZodObject<{
     mfa: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
     passkey: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
     session: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
+    trustedDevice: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
 }, "strip", z.ZodTypeAny, {
     name?: AccountCenterControlValue | undefined;
     username?: AccountCenterControlValue | undefined;
@@ -35,6 +36,7 @@ export declare const accountCenterFieldControlGuard: z.ZodObject<{
     mfa?: AccountCenterControlValue | undefined;
     passkey?: AccountCenterControlValue | undefined;
     session?: AccountCenterControlValue | undefined;
+    trustedDevice?: AccountCenterControlValue | undefined;
 }, {
     name?: AccountCenterControlValue | undefined;
     username?: AccountCenterControlValue | undefined;
@@ -48,6 +50,7 @@ export declare const accountCenterFieldControlGuard: z.ZodObject<{
     mfa?: AccountCenterControlValue | undefined;
     passkey?: AccountCenterControlValue | undefined;
     session?: AccountCenterControlValue | undefined;
+    trustedDevice?: AccountCenterControlValue | undefined;
 }>;
 export type AccountCenterFieldControl = z.infer<typeof accountCenterFieldControlGuard>;
 export declare const webauthnRelatedOriginsGuard: z.ZodArray<z.ZodString, "many">;

package/lib/foundations/jsonb-types/account-centers.js

@@ -24,6 +24,7 @@ export const accountCenterFieldControlGuard = z
     mfa: z.nativeEnum(AccountCenterControlValue),
     passkey: z.nativeEnum(AccountCenterControlValue),
     session: z.nativeEnum(AccountCenterControlValue),
+    trustedDevice: z.nativeEnum(AccountCenterControlValue),
 })
     .partial();
 export const webauthnRelatedOriginsGuard = z.array(z.string());

package/lib/foundations/jsonb-types/account-centers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/foundations/jsonb-types/account-centers.test.js

@@ -0,0 +1,13 @@
+import { describe, expect, it } from 'vitest';
+import { AccountCenterControlValue, accountCenterFieldControlGuard } from './account-centers.js';
+describe('accountCenterFieldControlGuard', () => {
+    it('allows trusted device control to be omitted', () => {
+        expect(accountCenterFieldControlGuard.parse({})).toEqual({});
+    });
+    it.each(Object.values(AccountCenterControlValue))('accepts trusted device control value %s', (trustedDevice) => {
+        expect(accountCenterFieldControlGuard.parse({ trustedDevice })).toEqual({ trustedDevice });
+    });
+    it('rejects an invalid trusted device control value', () => {
+        expect(accountCenterFieldControlGuard.safeParse({ trustedDevice: 'Invalid' }).success).toBe(false);
+    });
+});

package/lib/foundations/jsonb-types/hooks.d.ts

@@ -14,6 +14,7 @@ export declare enum InteractionHookEvent {
 }
 export declare enum DataHookSchema {
     User = "User",
+    TrustedDevice = "TrustedDevice",
     Role = "Role",
     Scope = "Scope",
     Organization = "Organization",
@@ -28,16 +29,19 @@ declare enum DataHookDetailMutationType {
     Updated = "Updated"
 }
 type BasicDataHookEvent = `${DataHookSchema}.${DataHookBasicMutationType}`;
-type CustomDataHookMutableSchema = `${DataHookSchema}.Data` | `${DataHookSchema.User}.SuspensionStatus` | `${DataHookSchema.Role}.Scopes` | `${DataHookSchema.Organization}.Membership` | `${DataHookSchema.OrganizationRole}.Scopes`;
+type CustomDataHookMutableSchema = `${Exclude<DataHookSchema, DataHookSchema.TrustedDevice>}.Data` | `${DataHookSchema.User}.SuspensionStatus` | `${DataHookSchema.Role}.Scopes` | `${DataHookSchema.Organization}.Membership` | `${DataHookSchema.OrganizationRole}.Scopes`;
 type DataHookPropertyUpdateEvent = `${CustomDataHookMutableSchema}.${DataHookDetailMutationType.Updated}`;
 export type ExceptionHookEvent = 'Identifier.Lockout' | 'Message.RateLimited' | 'Grant.LimitExceeded';
 export type DataHookEvent = BasicDataHookEvent | DataHookPropertyUpdateEvent;
+/** Data hook events that are available only while their feature is under development. */
+export declare const devFeatureHookEvents: readonly ["TrustedDevice.Created", "TrustedDevice.Deleted"];
+export type DevFeatureHookEvent = (typeof devFeatureHookEvents)[number];
 /** The hook event values that can be registered. */
-export declare const hookEvents: readonly [InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"];
+export declare const hookEvents: readonly [InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "TrustedDevice.Created", "TrustedDevice.Deleted", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"];
 /** The type of hook event values that can be registered. */
 export type HookEvent = (typeof hookEvents)[number];
-export declare const hookEventGuard: z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"]>;
-export declare const hookEventsGuard: z.ZodArray<z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"]>, "many">;
+export declare const hookEventGuard: z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "TrustedDevice.Created", "TrustedDevice.Deleted", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"]>;
+export declare const hookEventsGuard: z.ZodArray<z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "TrustedDevice.Created", "TrustedDevice.Deleted", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"]>, "many">;
 export type HookEvents = z.infer<typeof hookEventsGuard>;
 export declare const interactionHookEventGuard: z.ZodNativeEnum<typeof InteractionHookEvent>;
 /**

package/lib/foundations/jsonb-types/hooks.js

@@ -18,6 +18,7 @@ export var InteractionHookEvent;
 export var DataHookSchema;
 (function (DataHookSchema) {
     DataHookSchema["User"] = "User";
+    DataHookSchema["TrustedDevice"] = "TrustedDevice";
     DataHookSchema["Role"] = "Role";
     DataHookSchema["Scope"] = "Scope";
     DataHookSchema["Organization"] = "Organization";
@@ -33,6 +34,11 @@ var DataHookDetailMutationType;
 (function (DataHookDetailMutationType) {
     DataHookDetailMutationType["Updated"] = "Updated";
 })(DataHookDetailMutationType || (DataHookDetailMutationType = {}));
+/** Data hook events that are available only while their feature is under development. */
+export const devFeatureHookEvents = Object.freeze([
+    'TrustedDevice.Created',
+    'TrustedDevice.Deleted',
+]);
 /** The hook event values that can be registered. */
 export const hookEvents = Object.freeze([
     InteractionHookEvent.PostRegister,
@@ -43,6 +49,7 @@ export const hookEvents = Object.freeze([
     'User.Deleted',
     'User.Data.Updated',
     'User.SuspensionStatus.Updated',
+    ...devFeatureHookEvents,
     'Role.Created',
     'Role.Deleted',
     'Role.Data.Updated',

package/lib/foundations/jsonb-types/logs.d.ts

@@ -362,7 +362,13 @@ export declare const logContextPayloadGuard: z.ZodObject<{
         }, z.ZodUnknown, "strip">>>;
     }, z.ZodUnknown, "strip">>>;
     userId: z.ZodOptional<z.ZodString>;
+    /** Registered application ids only; a CIMD client identifier goes under {@link cimdClientId}. */
     applicationId: z.ZodOptional<z.ZodString>;
+    /**
+     * The CIMD client identifier URL, kept apart from `applicationId` so payload consumers
+     * branch on key presence instead of URL shape.
+     */
+    cimdClientId: z.ZodOptional<z.ZodString>;
     sessionId: z.ZodOptional<z.ZodString>;
     params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, "strip", z.ZodUnknown, z.objectOutputType<{
@@ -547,7 +553,13 @@ export declare const logContextPayloadGuard: z.ZodObject<{
         }, z.ZodUnknown, "strip">>>;
     }, z.ZodUnknown, "strip">>>;
     userId: z.ZodOptional<z.ZodString>;
+    /** Registered application ids only; a CIMD client identifier goes under {@link cimdClientId}. */
     applicationId: z.ZodOptional<z.ZodString>;
+    /**
+     * The CIMD client identifier URL, kept apart from `applicationId` so payload consumers
+     * branch on key presence instead of URL shape.
+     */
+    cimdClientId: z.ZodOptional<z.ZodString>;
     sessionId: z.ZodOptional<z.ZodString>;
     params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.ZodUnknown, "strip">, z.objectInputType<{
@@ -732,7 +744,13 @@ export declare const logContextPayloadGuard: z.ZodObject<{
         }, z.ZodUnknown, "strip">>>;
     }, z.ZodUnknown, "strip">>>;
     userId: z.ZodOptional<z.ZodString>;
+    /** Registered application ids only; a CIMD client identifier goes under {@link cimdClientId}. */
     applicationId: z.ZodOptional<z.ZodString>;
+    /**
+     * The CIMD client identifier URL, kept apart from `applicationId` so payload consumers
+     * branch on key presence instead of URL shape.
+     */
+    cimdClientId: z.ZodOptional<z.ZodString>;
     sessionId: z.ZodOptional<z.ZodString>;
     params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.ZodUnknown, "strip">>;

package/lib/foundations/jsonb-types/logs.js

@@ -64,7 +64,13 @@ export const logContextPayloadGuard = z
     userAgent: z.string().optional(),
     userAgentParsed: userAgentParsedGuard.optional(),
     userId: z.string().optional(),
+    /** Registered application ids only; a CIMD client identifier goes under {@link cimdClientId}. */
     applicationId: z.string().optional(),
+    /**
+     * The CIMD client identifier URL, kept apart from `applicationId` so payload consumers
+     * branch on key presence instead of URL shape.
+     */
+    cimdClientId: z.string().optional(),
     sessionId: z.string().optional(),
     params: z.record(z.string(), z.unknown()).optional(),
 })

package/lib/foundations/jsonb-types/sign-in-experience.d.ts

@@ -51,13 +51,13 @@ export declare const brandingGuard: z.ZodObject<{
 export type Branding = z.infer<typeof brandingGuard>;
 export declare const languageInfoGuard: z.ZodObject<{
     autoDetect: z.ZodBoolean;
-    fallbackLanguage: z.ZodType<"af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR", z.ZodTypeDef, "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR">;
+    fallbackLanguage: z.ZodType<"af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "es-MX" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR", z.ZodTypeDef, "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "es-MX" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR">;
 }, "strip", z.ZodTypeAny, {
     autoDetect: boolean;
-    fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
+    fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "es-MX" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
 }, {
     autoDetect: boolean;
-    fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
+    fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "es-MX" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
 }>;
 export type LanguageInfo = z.infer<typeof languageInfoGuard>;
 export declare enum SignInIdentifier {
@@ -320,6 +320,26 @@ export declare const adaptiveMfaGuard: z.ZodObject<{
 }, {
     enabled?: boolean | undefined;
 }>;
+/** Stored tenant-level overrides for MFA trusted-device credentials. */
+export type TrustedDevicePolicy = {
+    enabled?: boolean;
+    durationDays?: number;
+};
+/** Default trusted-device policy for newly created sign-in experiences. */
+export declare const defaultTrustedDevicePolicy: Readonly<{
+    enabled: false;
+    durationDays: 30;
+}>;
+export declare const trustedDevicePolicyGuard: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    durationDays: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    enabled?: boolean | undefined;
+    durationDays?: number | undefined;
+}, {
+    enabled?: boolean | undefined;
+    durationDays?: number | undefined;
+}>;
 export declare const customUiAssetsGuard: z.ZodObject<{
     id: z.ZodString;
     createdAt: z.ZodNumber;

package/lib/foundations/jsonb-types/sign-in-experience.js

@@ -112,6 +112,15 @@ export const mfaGuard = z.object({
 export const adaptiveMfaGuard = z.object({
     enabled: z.boolean().optional(),
 });
+/** Default trusted-device policy for newly created sign-in experiences. */
+export const defaultTrustedDevicePolicy = Object.freeze({
+    enabled: false,
+    durationDays: 30,
+});
+export const trustedDevicePolicyGuard = z.object({
+    enabled: z.boolean().optional(),
+    durationDays: z.number().int().min(1).max(365).optional(),
+});
 export const customUiAssetsGuard = z.object({
     id: z.string(),
     createdAt: z.number(),

package/lib/foundations/jsonb-types/sign-in-experience.test.js

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { customUiCspGuard, passwordExpirationPolicyGuard } from './sign-in-experience.js';
+import { customUiCspGuard, defaultTrustedDevicePolicy, passwordExpirationPolicyGuard, trustedDevicePolicyGuard, } from './sign-in-experience.js';
 describe('customUiCspGuard', () => {
     it.each([
         {},
@@ -64,3 +64,19 @@ describe('passwordExpirationPolicyGuard', () => {
         expect(passwordExpirationPolicyGuard.safeParse(value).success).toBe(false);
     });
 });
+describe('trustedDevicePolicyGuard', () => {
+    it.each([{}, { enabled: false }, { durationDays: 1 }, { enabled: true, durationDays: 365 }])('accepts valid policy %p', (value) => {
+        expect(trustedDevicePolicyGuard.parse(value)).toEqual(value);
+    });
+    it.each([{ durationDays: 0 }, { durationDays: 366 }, { durationDays: 1.5 }])('rejects invalid policy %p', (value) => {
+        expect(trustedDevicePolicyGuard.safeParse(value).success).toBe(false);
+    });
+    it('provides the complete effective default', () => {
+        expect(defaultTrustedDevicePolicy).toEqual({ enabled: false, durationDays: 30 });
+        expect(trustedDevicePolicyGuard.safeParse(defaultTrustedDevicePolicy).success).toBe(true);
+    });
+    it('rejects invalid enabled values', () => {
+        const value = { enabled: 'true' };
+        expect(trustedDevicePolicyGuard.safeParse(value).success).toBe(false);
+    });
+});