@logto/schemas 1.42.0 → 1.43.0

package/lib/types/connector.d.ts

@@ -255,6 +255,7 @@ export declare const connectorResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -389,6 +390,7 @@ export declare const connectorResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -593,6 +595,7 @@ export declare const connectorResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -727,6 +730,7 @@ export declare const connectorResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -1136,6 +1140,7 @@ export declare const connectorFactoryResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -1270,6 +1275,7 @@ export declare const connectorFactoryResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -1467,6 +1473,7 @@ export declare const connectorFactoryResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -1601,6 +1608,7 @@ export declare const connectorFactoryResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;

package/lib/types/consent.d.ts

@@ -54,6 +54,7 @@ export declare const publicUserInfoGuard: z.ZodObject<Pick<{
         }>;
     }>>;
     applicationId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    cimdClientId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     identities: z.ZodType<Record<string, {
         userId: string;
         details?: Record<string, import("@withtyped/server").Json> | undefined;
@@ -144,102 +145,15 @@ export declare const publicUserInfoGuard: z.ZodObject<Pick<{
 export type PublicUserInfo = z.infer<typeof publicUserInfoGuard>;
 /**
  * Define the public application info that can be exposed to the public. e.g. on the user consent page.
+ *
+ * The overrides lift the applications-table column length bounds for CIMD clients: `id` carries
+ * the identifier URL (up to 2048 characters), and `name` the remote document's `client_name`,
+ * which is unbounded and empty when the document omits it.
  */
-export declare const publicApplicationGuard: z.ZodObject<Pick<{
-    tenantId: z.ZodType<string, z.ZodTypeDef, string>;
-    id: z.ZodType<string, z.ZodTypeDef, string>;
-    name: z.ZodType<string, z.ZodTypeDef, string>;
-    secret: z.ZodType<string, z.ZodTypeDef, string>;
-    description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-    type: z.ZodType<import("../db-entries/custom-types.js").ApplicationType, z.ZodTypeDef, import("../db-entries/custom-types.js").ApplicationType>;
-    oidcClientMetadata: z.ZodType<import("../index.js").OidcClientMetadata, z.ZodTypeDef, import("../index.js").OidcClientMetadata>;
-    customClientMetadata: z.ZodType<{
-        corsAllowedOrigins?: string[] | undefined;
-        idTokenTtl?: number | undefined;
-        refreshTokenTtl?: number | undefined;
-        refreshTokenTtlInDays?: number | undefined;
-        tenantId?: string | undefined;
-        alwaysIssueRefreshToken?: boolean | undefined;
-        rotateRefreshToken?: boolean | undefined;
-        allowTokenExchange?: boolean | undefined;
-        isDeviceFlow?: boolean | undefined;
-        maxAllowedGrants?: number | undefined;
-    }, z.ZodTypeDef, {
-        corsAllowedOrigins?: string[] | undefined;
-        idTokenTtl?: number | undefined;
-        refreshTokenTtl?: number | undefined;
-        refreshTokenTtlInDays?: number | undefined;
-        tenantId?: string | undefined;
-        alwaysIssueRefreshToken?: boolean | undefined;
-        rotateRefreshToken?: boolean | undefined;
-        allowTokenExchange?: boolean | undefined;
-        isDeviceFlow?: boolean | undefined;
-        maxAllowedGrants?: number | undefined;
-    }>;
-    protectedAppMetadata: z.ZodType<{
-        host: string;
-        origin: string;
-        sessionDuration: number;
-        pageRules: {
-            path: string;
-        }[];
-        additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
-        customDomains?: {
-            status: import("../index.js").DomainStatus;
-            domain: string;
-            errorMessage: string | null;
-            dnsRecords: {
-                value: string;
-                type: string;
-                name: string;
-            }[];
-            cloudflareData: {
-                status: string;
-                id: string;
-                ssl: {
-                    status: string;
-                    validation_errors?: {
-                        message: string;
-                    }[] | undefined;
-                };
-                verification_errors?: string[] | undefined;
-            } | null;
-        }[] | undefined;
-    } | null, z.ZodTypeDef, {
-        host: string;
-        origin: string;
-        sessionDuration: number;
-        pageRules: {
-            path: string;
-        }[];
-        additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
-        customDomains?: {
-            status: import("../index.js").DomainStatus;
-            domain: string;
-            errorMessage: string | null;
-            dnsRecords: {
-                value: string;
-                type: string;
-                name: string;
-            }[];
-            cloudflareData: {
-                status: string;
-                id: string;
-                ssl: {
-                    status: string;
-                    validation_errors?: {
-                        message: string;
-                    }[] | undefined;
-                };
-                verification_errors?: string[] | undefined;
-            } | null;
-        }[] | undefined;
-    } | null>;
-    customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
-    isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
-    appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
-    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
-}, "name" | "id">, "strip", z.ZodTypeAny, {
+export declare const publicApplicationGuard: z.ZodObject<{} & {
+    id: z.ZodString;
+    name: z.ZodString;
+}, "strip", z.ZodTypeAny, {
     name: string;
     id: string;
 }, {
@@ -357,6 +271,7 @@ export declare const publicOrganizationGuard: z.ZodObject<Pick<{
     description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
     isMfaRequired: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    isTrustedDeviceAllowed: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     color: z.ZodType<Partial<{
         primaryColor: string;
         isDarkModeEnabled: boolean;
@@ -471,101 +386,10 @@ export declare const publicOrganizationGuard: z.ZodObject<Pick<{
 }>;
 export type PublicOrganization = z.infer<typeof publicOrganizationGuard>;
 export declare const consentInfoResponseGuard: z.ZodObject<{
-    application: z.ZodObject<Pick<{
-        tenantId: z.ZodType<string, z.ZodTypeDef, string>;
-        id: z.ZodType<string, z.ZodTypeDef, string>;
-        name: z.ZodType<string, z.ZodTypeDef, string>;
-        secret: z.ZodType<string, z.ZodTypeDef, string>;
-        description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-        type: z.ZodType<import("../db-entries/custom-types.js").ApplicationType, z.ZodTypeDef, import("../db-entries/custom-types.js").ApplicationType>;
-        oidcClientMetadata: z.ZodType<import("../index.js").OidcClientMetadata, z.ZodTypeDef, import("../index.js").OidcClientMetadata>;
-        customClientMetadata: z.ZodType<{
-            corsAllowedOrigins?: string[] | undefined;
-            idTokenTtl?: number | undefined;
-            refreshTokenTtl?: number | undefined;
-            refreshTokenTtlInDays?: number | undefined;
-            tenantId?: string | undefined;
-            alwaysIssueRefreshToken?: boolean | undefined;
-            rotateRefreshToken?: boolean | undefined;
-            allowTokenExchange?: boolean | undefined;
-            isDeviceFlow?: boolean | undefined;
-            maxAllowedGrants?: number | undefined;
-        }, z.ZodTypeDef, {
-            corsAllowedOrigins?: string[] | undefined;
-            idTokenTtl?: number | undefined;
-            refreshTokenTtl?: number | undefined;
-            refreshTokenTtlInDays?: number | undefined;
-            tenantId?: string | undefined;
-            alwaysIssueRefreshToken?: boolean | undefined;
-            rotateRefreshToken?: boolean | undefined;
-            allowTokenExchange?: boolean | undefined;
-            isDeviceFlow?: boolean | undefined;
-            maxAllowedGrants?: number | undefined;
-        }>;
-        protectedAppMetadata: z.ZodType<{
-            host: string;
-            origin: string;
-            sessionDuration: number;
-            pageRules: {
-                path: string;
-            }[];
-            additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
-            customDomains?: {
-                status: import("../index.js").DomainStatus;
-                domain: string;
-                errorMessage: string | null;
-                dnsRecords: {
-                    value: string;
-                    type: string;
-                    name: string;
-                }[];
-                cloudflareData: {
-                    status: string;
-                    id: string;
-                    ssl: {
-                        status: string;
-                        validation_errors?: {
-                            message: string;
-                        }[] | undefined;
-                    };
-                    verification_errors?: string[] | undefined;
-                } | null;
-            }[] | undefined;
-        } | null, z.ZodTypeDef, {
-            host: string;
-            origin: string;
-            sessionDuration: number;
-            pageRules: {
-                path: string;
-            }[];
-            additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
-            customDomains?: {
-                status: import("../index.js").DomainStatus;
-                domain: string;
-                errorMessage: string | null;
-                dnsRecords: {
-                    value: string;
-                    type: string;
-                    name: string;
-                }[];
-                cloudflareData: {
-                    status: string;
-                    id: string;
-                    ssl: {
-                        status: string;
-                        validation_errors?: {
-                            message: string;
-                        }[] | undefined;
-                    };
-                    verification_errors?: string[] | undefined;
-                } | null;
-            }[] | undefined;
-        } | null>;
-        customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
-        isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
-        appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
-        createdAt: z.ZodType<number, z.ZodTypeDef, number>;
-    }, "name" | "id"> & {
+    application: z.ZodObject<{} & {
+        id: z.ZodString;
+        name: z.ZodString;
+    } & {
         displayName: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
         branding: z.ZodOptional<z.ZodType<{
             logoUrl?: string | undefined;
@@ -657,6 +481,7 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
             }>;
         }>>;
         applicationId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+        cimdClientId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
         identities: z.ZodType<Record<string, {
             userId: string;
             details?: Record<string, import("@withtyped/server").Json> | undefined;
@@ -751,6 +576,7 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
         description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
         customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
         isMfaRequired: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+        isTrustedDeviceAllowed: z.ZodType<boolean, z.ZodTypeDef, boolean>;
         color: z.ZodType<Partial<{
             primaryColor: string;
             isDarkModeEnabled: boolean;

package/lib/types/consent.js

@@ -13,10 +13,19 @@ export const publicUserInfoGuard = Users.guard.pick({
 });
 /**
  * Define the public application info that can be exposed to the public. e.g. on the user consent page.
+ *
+ * The overrides lift the applications-table column length bounds for CIMD clients: `id` carries
+ * the identifier URL (up to 2048 characters), and `name` the remote document's `client_name`,
+ * which is unbounded and empty when the document omits it.
  */
-export const publicApplicationGuard = Applications.guard.pick({
+export const publicApplicationGuard = Applications.guard
+    .pick({
     id: true,
     name: true,
+})
+    .extend({
+    id: z.string(),
+    name: z.string(),
 });
 export const applicationSignInExperienceGuard = ApplicationSignInExperiences.guard.pick({
     branding: true,

package/lib/types/custom-profile-fields.d.ts

@@ -2457,6 +2457,7 @@ export declare const signInIdentifierKeyGuard: z.ZodObject<Pick<{
         }>;
     }>>>;
     applicationId: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
+    cimdClientId: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
     identities: z.ZodOptional<z.ZodType<Record<string, {
         userId: string;
         details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;

package/lib/types/hook.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { type Application, type User } from '../db-entries/index.js';
+import { type Application, type TrustedDevice, type User } from '../db-entries/index.js';
 import { type ExceptionHookEvent, type DataHookEvent, type InteractionHookEvent } from '../foundations/index.js';
 import { type InteractionEvent } from './interactions.js';
 import { type userInfoSelectFields } from './user.js';
@@ -18,8 +18,8 @@ export declare const hookResponseGuard: z.ZodObject<{
     tenantId: z.ZodType<string, z.ZodTypeDef, string>;
     id: z.ZodType<string, z.ZodTypeDef, string>;
     name: z.ZodType<string, z.ZodTypeDef, string>;
-    event: z.ZodType<"User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent | null, z.ZodTypeDef, "User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent | null>;
-    events: z.ZodType<("User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent)[], z.ZodTypeDef, ("User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent)[]>;
+    event: z.ZodType<"User.Created" | "User.Deleted" | "TrustedDevice.Created" | "TrustedDevice.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent | null, z.ZodTypeDef, "User.Created" | "User.Deleted" | "TrustedDevice.Created" | "TrustedDevice.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent | null>;
+    events: z.ZodType<("User.Created" | "User.Deleted" | "TrustedDevice.Created" | "TrustedDevice.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent)[], z.ZodTypeDef, ("User.Created" | "User.Deleted" | "TrustedDevice.Created" | "TrustedDevice.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent)[]>;
     config: z.ZodType<{
         url: string;
         headers?: Record<string, string> | undefined;
@@ -90,8 +90,13 @@ export type HookTestErrorResponseData = z.infer<typeof hookTestErrorResponseData
  * we will store the context before processing the interaction and consume it after the interaction is processed if needed.
  */
 export type InteractionApiMetadata = {
-    /** The application ID if the hook is triggered by interaction API. */
+    /** The registered application ID if the hook is triggered by interaction API. */
     applicationId?: string;
+    /**
+     * The CIMD client identifier URL, kept apart from `applicationId` so payload consumers
+     * branch on key presence instead of URL shape.
+     */
+    cimdClientId?: string;
     /** The session ID if the hook is triggered by interaction API. */
     sessionId?: string;
     /** The InteractionEvent if the hook is triggered by interaction API. */
@@ -100,6 +105,8 @@ export type InteractionApiMetadata = {
 type InteractionApiContextPayload = {
     /** Fetch application detail by application ID before sending the hook event */
     application?: Pick<Application, 'id' | 'type' | 'name' | 'description'>;
+    /** CIMD clients are unregistered, so the identifier URL stands in for `application`. */
+    cimdClientId?: string;
     sessionId?: string;
     interactionEvent?: InteractionEvent;
 };
@@ -140,12 +147,30 @@ export type DataHookEventPayload = {
     userAgent?: string;
     data?: unknown;
 } & Partial<InteractionApiContextPayload> & Partial<ManagementApiContext> & Record<string, unknown>;
-export type ExceptionHookEventPayload = Omit<DataHookEventPayload, 'event'> & {
+/** The intentionally limited trusted-device projection exposed by lifecycle events. */
+export type TrustedDeviceEventData = Pick<TrustedDevice, 'id' | 'userId' | 'expiresAt'>;
+/**
+ * A key-remapping omit instead of the built-in `Omit`: on a type carrying a string index
+ * signature (e.g. the hook event payloads), `Omit` collapses every named property into
+ * `unknown`; the homomorphic form keeps the named properties typed.
+ */
+export type BetterOmit<T, Ignore> = {
+    [key in keyof T as key extends Ignore ? never : key]: T[key];
+};
+export type ExceptionHookEventPayload = BetterOmit<DataHookEventPayload, 'event'> & {
     event: ExceptionHookEvent;
 };
 export type GrantLimitExceededEventData = {
     userId: string;
-    applicationId: string;
+    /** The registered application ID; absent for a CIMD client. */
+    applicationId?: string;
+    /**
+     * The CIMD client identifier URL, set instead of `applicationId`. No grant-ceiling source
+     * exists for CIMD clients today (the CIMD policy denies Logto private client metadata
+     * regardless of source), so this key is defensive: it keeps `applicationId` registered-only
+     * by construction should a ceiling for CIMD clients ever be introduced.
+     */
+    cimdClientId?: string;
     revokedGrantIds: string[];
     maxAllowedGrants: number;
     preRevocationActiveGrantCount: number;

package/lib/types/index.d.ts

@@ -36,3 +36,4 @@ export * from './custom-profile-fields.js';
 export * from './secrets.js';
 export * from './user-logto-config.js';
 export * from './user-sessions.js';
+export * from './trusted-device.js';

package/lib/types/index.js

@@ -36,3 +36,4 @@ export * from './custom-profile-fields.js';
 export * from './secrets.js';
 export * from './user-logto-config.js';
 export * from './user-sessions.js';
+export * from './trusted-device.js';

package/lib/types/log/index.d.ts

@@ -4,12 +4,14 @@ import type * as interaction from './interaction.js';
 import type * as jwtCustomizer from './jwt-customizer.js';
 import type * as saml from './saml.js';
 import type * as token from './token.js';
+import type * as trustedDevice from './trusted-device.js';
 export * as interaction from './interaction.js';
 export * as token from './token.js';
 export * as hook from './hook.js';
 export * as action from './action.js';
 export * as jwtCustomizer from './jwt-customizer.js';
 export * as saml from './saml.js';
+export * as trustedDevice from './trusted-device.js';
 /** Fallback for empty or unrecognized log keys. */
 export declare const LogKeyUnknown = "Unknown";
 export type InteractionLogKey = interaction.LogKey;
@@ -18,17 +20,18 @@ export type WebhookLogKey = hook.LogKey;
 export type ActionLogKey = action.LogKey;
 export type JwtCustomizerLogKey = jwtCustomizer.LogKey;
 export type SamlLogKey = saml.LogKey;
+export type TrustedDeviceLogKey = trustedDevice.LogKey;
 /**
  * The union type of all available audit log keys.
  *
  * - All user-facing audit log keys should be included here.
  * - Webhook log keys are excluded.
  */
-export type AuditLogKey = typeof LogKeyUnknown | InteractionLogKey | TokenLogKey | SamlLogKey | ActionLogKey | JwtCustomizerLogKey;
+export type AuditLogKey = typeof LogKeyUnknown | InteractionLogKey | TokenLogKey | SamlLogKey | ActionLogKey | JwtCustomizerLogKey | TrustedDeviceLogKey;
 /**
  * The union type of all available log keys.
  * Note duplicate keys are allowed but should be avoided.
  **/
 export type LogKey = AuditLogKey | WebhookLogKey;
-export type AuditLogPrefix = interaction.Prefix | token.Type | saml.Prefix | action.Prefix | jwtCustomizer.Prefix | typeof LogKeyUnknown;
+export type AuditLogPrefix = interaction.Prefix | token.Type | saml.Prefix | action.Prefix | jwtCustomizer.Prefix | trustedDevice.Prefix | typeof LogKeyUnknown;
 export type WebhookLogPrefix = hook.Type;

package/lib/types/log/index.js

@@ -4,5 +4,6 @@ export * as hook from './hook.js';
 export * as action from './action.js';
 export * as jwtCustomizer from './jwt-customizer.js';
 export * as saml from './saml.js';
+export * as trustedDevice from './trusted-device.js';
 /** Fallback for empty or unrecognized log keys. */
 export const LogKeyUnknown = 'Unknown';

package/lib/types/log/trusted-device.d.ts

@@ -0,0 +1,7 @@
+export type Prefix = 'TrustedDevice';
+export declare const prefix: Prefix;
+export declare enum Type {
+    Created = "Created",
+    Used = "Used"
+}
+export type LogKey = `${Prefix}.${Type}`;

package/lib/types/log/trusted-device.js

@@ -0,0 +1,6 @@
+export const prefix = 'TrustedDevice';
+export var Type;
+(function (Type) {
+    Type["Created"] = "Created";
+    Type["Used"] = "Used";
+})(Type || (Type = {}));

package/lib/types/logto-config/action.d.ts

@@ -39,7 +39,7 @@ export declare const logtoActionGuard: z.ZodObject<{
 }>;
 /**
  * Shared execution payload for production Actions and Management API dry runs.
- * Cloud remote execution and the local VM runner both accept this shape.
+ * Cloud remote execution and the local runner both accept this shape.
  */
 export declare const actionExecutionRequestBodyGuard: z.ZodObject<{
     script: z.ZodString;

package/lib/types/logto-config/action.js

@@ -21,7 +21,7 @@ export const logtoActionGuard = z
     .strict();
 /**
  * Shared execution payload for production Actions and Management API dry runs.
- * Cloud remote execution and the local VM runner both accept this shape.
+ * Cloud remote execution and the local runner both accept this shape.
  */
 export const actionExecutionRequestBodyGuard = z
     .object({