@logto/schemas 1.42.0 → 1.43.0

package/lib/types/logto-config/index.d.ts

@@ -127,8 +127,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
             kind?: "AccessToken" | undefined;
             accountId?: string | undefined;
             scope?: string | undefined;
-            sessionUid?: string | undefined;
             clientId?: string | undefined;
+            sessionUid?: string | undefined;
             expiresWithSession?: boolean | undefined;
             gty?: string | undefined;
             aud?: string | string[] | undefined;
@@ -139,8 +139,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
             kind?: "AccessToken" | undefined;
             accountId?: string | undefined;
             scope?: string | undefined;
-            sessionUid?: string | undefined;
             clientId?: string | undefined;
+            sessionUid?: string | undefined;
             expiresWithSession?: boolean | undefined;
             gty?: string | undefined;
             aud?: string | string[] | undefined;
@@ -150,6 +150,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 name: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
                 id: z.ZodOptional<ZodType<string, z.ZodTypeDef, string>>;
                 applicationId: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+                cimdClientId: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
                 username: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
                 createdAt: z.ZodOptional<ZodType<number, z.ZodTypeDef, number>>;
                 profile: z.ZodOptional<ZodType<Partial<{
@@ -288,6 +289,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     description: ZodType<string | null, z.ZodTypeDef, string | null>;
                     customData: ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
                     isMfaRequired: ZodType<boolean, z.ZodTypeDef, boolean>;
+                    isTrustedDeviceAllowed: ZodType<boolean, z.ZodTypeDef, boolean>;
                     color: ZodType<Partial<{
                         primaryColor: string;
                         isDarkModeEnabled: boolean;
@@ -336,6 +338,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 name?: string | null | undefined;
                 id?: string | undefined;
                 applicationId?: string | null | undefined;
+                cimdClientId?: string | null | undefined;
                 username?: string | null | undefined;
                 createdAt?: number | undefined;
                 profile?: Partial<{
@@ -403,6 +406,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 name?: string | null | undefined;
                 id?: string | undefined;
                 applicationId?: string | null | undefined;
+                cimdClientId?: string | null | undefined;
                 username?: string | null | undefined;
                 createdAt?: number | undefined;
                 profile?: Partial<{
@@ -1469,6 +1473,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 name?: string | null | undefined;
                 id?: string | undefined;
                 applicationId?: string | null | undefined;
+                cimdClientId?: string | null | undefined;
                 username?: string | null | undefined;
                 createdAt?: number | undefined;
                 profile?: Partial<{
@@ -1718,6 +1723,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 name?: string | null | undefined;
                 id?: string | undefined;
                 applicationId?: string | null | undefined;
+                cimdClientId?: string | null | undefined;
                 username?: string | null | undefined;
                 createdAt?: number | undefined;
                 profile?: Partial<{
@@ -1971,6 +1977,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 name?: string | null | undefined;
                 id?: string | undefined;
                 applicationId?: string | null | undefined;
+                cimdClientId?: string | null | undefined;
                 username?: string | null | undefined;
                 createdAt?: number | undefined;
                 profile?: Partial<{
@@ -2224,8 +2231,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
             kind?: "AccessToken" | undefined;
             accountId?: string | undefined;
             scope?: string | undefined;
-            sessionUid?: string | undefined;
             clientId?: string | undefined;
+            sessionUid?: string | undefined;
             expiresWithSession?: boolean | undefined;
             gty?: string | undefined;
             aud?: string | string[] | undefined;
@@ -2238,6 +2245,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 name?: string | null | undefined;
                 id?: string | undefined;
                 applicationId?: string | null | undefined;
+                cimdClientId?: string | null | undefined;
                 username?: string | null | undefined;
                 createdAt?: number | undefined;
                 profile?: Partial<{
@@ -2491,8 +2499,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
             kind?: "AccessToken" | undefined;
             accountId?: string | undefined;
             scope?: string | undefined;
-            sessionUid?: string | undefined;
             clientId?: string | undefined;
+            sessionUid?: string | undefined;
             expiresWithSession?: boolean | undefined;
             gty?: string | undefined;
             aud?: string | string[] | undefined;
@@ -2507,6 +2515,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 name?: string | null | undefined;
                 id?: string | undefined;
                 applicationId?: string | null | undefined;
+                cimdClientId?: string | null | undefined;
                 username?: string | null | undefined;
                 createdAt?: number | undefined;
                 profile?: Partial<{
@@ -2760,8 +2769,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
             kind?: "AccessToken" | undefined;
             accountId?: string | undefined;
             scope?: string | undefined;
-            sessionUid?: string | undefined;
             clientId?: string | undefined;
+            sessionUid?: string | undefined;
             expiresWithSession?: boolean | undefined;
             gty?: string | undefined;
             aud?: string | string[] | undefined;
@@ -2777,6 +2786,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 name?: string | null | undefined;
                 id?: string | undefined;
                 applicationId?: string | null | undefined;
+                cimdClientId?: string | null | undefined;
                 username?: string | null | undefined;
                 createdAt?: number | undefined;
                 profile?: Partial<{
@@ -3030,8 +3040,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
             kind?: "AccessToken" | undefined;
             accountId?: string | undefined;
             scope?: string | undefined;
-            sessionUid?: string | undefined;
             clientId?: string | undefined;
+            sessionUid?: string | undefined;
             expiresWithSession?: boolean | undefined;
             gty?: string | undefined;
             aud?: string | string[] | undefined;
@@ -3754,6 +3764,22 @@ export declare const signingKeyRotationStateGuard: z.ZodObject<{
     signingKeyRotationAt?: number | undefined;
 }>;
 export type SigningKeyRotationState = z.infer<typeof signingKeyRotationStateGuard>;
+/**
+ * Config for the OAuth Client ID Metadata Document (CIMD) feature. The row is only written once
+ * the feature is toggled, so readers must fall back to {@link defaultCimdConfig}.
+ */
+export declare const cimdConfigGuard: z.ZodObject<{
+    enabled: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+}, {
+    enabled: boolean;
+}>;
+export type CimdConfig = z.infer<typeof cimdConfigGuard>;
+/** Applied when the `cimd` row is absent: the feature is opt-in per tenant. */
+export declare const defaultCimdConfig: Readonly<{
+    enabled: false;
+}>;
 export declare enum LogtoTenantConfigKey {
     AdminConsole = "adminConsole",
     CloudConnection = "cloudConnection",
@@ -3764,7 +3790,9 @@ export declare enum LogtoTenantConfigKey {
     /** Tenant-scoped rotation state for staged private signing key activation. */
     SigningKeyRotationState = "signingKeyRotationState",
     /** Internal, ops-only override of the system message send-rate-limit policy. Not exposed by any API. */
-    MessageRateLimitOverride = "messageRateLimitOverride"
+    MessageRateLimitOverride = "messageRateLimitOverride",
+    /** Tenant-level switch for the OAuth Client ID Metadata Document feature. */
+    Cimd = "cimd"
 }
 export type LogtoTenantConfigType = {
     [LogtoTenantConfigKey.AdminConsole]: AdminConsoleData;
@@ -3775,6 +3803,7 @@ export type LogtoTenantConfigType = {
     [LogtoTenantConfigKey.IdToken]: IdTokenConfig;
     [LogtoTenantConfigKey.SigningKeyRotationState]: SigningKeyRotationState;
     [LogtoTenantConfigKey.MessageRateLimitOverride]: MessageRateLimitOverride;
+    [LogtoTenantConfigKey.Cimd]: CimdConfig;
 };
 export declare const logtoTenantConfigGuard: Readonly<{
     [key in LogtoTenantConfigKey]: ZodType<LogtoTenantConfigType[key]>;

package/lib/types/logto-config/index.js

@@ -116,6 +116,16 @@ export const signingKeyRotationStateGuard = z.object({
     tenantCacheExpiresAt: z.number().optional(),
     signingKeyRotationAt: z.number().optional(),
 });
+/* --- CIMD Config --- */
+/**
+ * Config for the OAuth Client ID Metadata Document (CIMD) feature. The row is only written once
+ * the feature is toggled, so readers must fall back to {@link defaultCimdConfig}.
+ */
+export const cimdConfigGuard = z.object({
+    enabled: z.boolean(),
+});
+/** Applied when the `cimd` row is absent: the feature is opt-in per tenant. */
+export const defaultCimdConfig = Object.freeze({ enabled: false });
 export var LogtoTenantConfigKey;
 (function (LogtoTenantConfigKey) {
     LogtoTenantConfigKey["AdminConsole"] = "adminConsole";
@@ -128,6 +138,8 @@ export var LogtoTenantConfigKey;
     LogtoTenantConfigKey["SigningKeyRotationState"] = "signingKeyRotationState";
     /** Internal, ops-only override of the system message send-rate-limit policy. Not exposed by any API. */
     LogtoTenantConfigKey["MessageRateLimitOverride"] = "messageRateLimitOverride";
+    /** Tenant-level switch for the OAuth Client ID Metadata Document feature. */
+    LogtoTenantConfigKey["Cimd"] = "cimd";
 })(LogtoTenantConfigKey || (LogtoTenantConfigKey = {}));
 export const logtoTenantConfigGuard = Object.freeze({
     [LogtoTenantConfigKey.AdminConsole]: adminConsoleDataGuard,
@@ -136,6 +148,7 @@ export const logtoTenantConfigGuard = Object.freeze({
     [LogtoTenantConfigKey.IdToken]: idTokenConfigGuard,
     [LogtoTenantConfigKey.SigningKeyRotationState]: signingKeyRotationStateGuard,
     [LogtoTenantConfigKey.MessageRateLimitOverride]: messageRateLimitOverrideGuard,
+    [LogtoTenantConfigKey.Cimd]: cimdConfigGuard,
 });
 export const logtoConfigKeys = Object.freeze([
     ...Object.values(LogtoOidcConfigKey),

package/lib/types/logto-config/index.test.js

@@ -1,4 +1,5 @@
 import { describe, expect, it } from 'vitest';
+import { z } from 'zod';
 import { LogtoActionKey, LogtoOidcConfigKey, LogtoTenantConfigKey, OidcSigningKeyStatus, actionConfigGuard, logtoOidcConfigGuard, logtoConfigGuards, logtoConfigKeys, logtoTenantConfigGuard, oidcConfigKeysResponseGuard, } from './index.js';
 describe('logto config guards', () => {
     it('accepts legacy private keys without status', () => {
@@ -50,4 +51,26 @@ describe('logto config guards', () => {
         expect(logtoConfigKeys).toContain(LogtoActionKey.PostSignIn);
         expect(logtoConfigGuards[LogtoActionKey.PostSignIn]).toBe(actionConfigGuard[LogtoActionKey.PostSignIn]);
     });
+    it('includes the CIMD key in the logto config summary guards', () => {
+        expect(logtoConfigKeys).toContain(LogtoTenantConfigKey.Cimd);
+        expect(logtoConfigGuards[LogtoTenantConfigKey.Cimd]).toBe(logtoTenantConfigGuard[LogtoTenantConfigKey.Cimd]);
+    });
+    it('keeps a stored CIMD config value', () => {
+        expect(logtoTenantConfigGuard[LogtoTenantConfigKey.Cimd].parse({ enabled: true })).toEqual({
+            enabled: true,
+        });
+    });
+    it('rejects invalid CIMD config values', () => {
+        const result = logtoTenantConfigGuard[LogtoTenantConfigKey.Cimd].safeParse({ enabled: 'yes' });
+        expect(result.success).toBe(false);
+    });
+    it('parses OIDC configs without the optional session row', () => {
+        const result = z.object(logtoOidcConfigGuard).parse({
+            [LogtoOidcConfigKey.PrivateKeys]: [
+                { id: 'key_1', value: 'private-key-1', createdAt: 1_710_000_000_000 },
+            ],
+            [LogtoOidcConfigKey.CookieKeys]: [],
+        });
+        expect(result[LogtoOidcConfigKey.Session]).toEqual({});
+    });
 });

package/lib/types/logto-config/jwt-customizer.d.ts

@@ -92,6 +92,7 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<Pick<{
         }>;
     }>>;
     applicationId: ZodType<string | null, z.ZodTypeDef, string | null>;
+    cimdClientId: ZodType<string | null, z.ZodTypeDef, string | null>;
     identities: ZodType<Record<string, {
         userId: string;
         details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -164,7 +165,7 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<Pick<{
     passwordUpdatedAt: ZodType<number | null, z.ZodTypeDef, number | null>;
     createdAt: ZodType<number, z.ZodTypeDef, number>;
     updatedAt: ZodType<number, z.ZodTypeDef, number>;
-}, "name" | "id" | "applicationId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended"> & {
+}, "name" | "id" | "applicationId" | "cimdClientId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended"> & {
     hasPassword: z.ZodBoolean;
     ssoIdentities: z.ZodArray<z.ZodObject<Pick<{
         tenantId: ZodType<string, z.ZodTypeDef, string>;
@@ -246,6 +247,7 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<Pick<{
         description: ZodType<string | null, z.ZodTypeDef, string | null>;
         customData: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
         isMfaRequired: ZodType<boolean, z.ZodTypeDef, boolean>;
+        isTrustedDeviceAllowed: ZodType<boolean, z.ZodTypeDef, boolean>;
         color: ZodType<Partial<{
             primaryColor: string;
             isDarkModeEnabled: boolean;
@@ -294,6 +296,7 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<Pick<{
     name: string | null;
     id: string;
     applicationId: string | null;
+    cimdClientId: string | null;
     username: string | null;
     createdAt: number;
     profile: import("../../foundations/index.js").UserProfile;
@@ -338,6 +341,7 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<Pick<{
     name: string | null;
     id: string;
     applicationId: string | null;
+    cimdClientId: string | null;
     username: string | null;
     createdAt: number;
     profile: import("../../foundations/index.js").UserProfile;
@@ -1298,6 +1302,7 @@ export declare const jwtCustomizerOrganizationContextGuard: z.ZodObject<Pick<{
     description: ZodType<string | null, z.ZodTypeDef, string | null>;
     customData: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
     isMfaRequired: ZodType<boolean, z.ZodTypeDef, boolean>;
+    isTrustedDeviceAllowed: ZodType<boolean, z.ZodTypeDef, boolean>;
     color: ZodType<Partial<{
         primaryColor: string;
         isDarkModeEnabled: boolean;
@@ -1356,8 +1361,8 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
         kind?: "AccessToken" | undefined;
         accountId?: string | undefined;
         scope?: string | undefined;
-        sessionUid?: string | undefined;
         clientId?: string | undefined;
+        sessionUid?: string | undefined;
         expiresWithSession?: boolean | undefined;
         gty?: string | undefined;
         aud?: string | string[] | undefined;
@@ -1368,8 +1373,8 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
         kind?: "AccessToken" | undefined;
         accountId?: string | undefined;
         scope?: string | undefined;
-        sessionUid?: string | undefined;
         clientId?: string | undefined;
+        sessionUid?: string | undefined;
         expiresWithSession?: boolean | undefined;
         gty?: string | undefined;
         aud?: string | string[] | undefined;
@@ -1379,6 +1384,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             name: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
             id: z.ZodOptional<ZodType<string, z.ZodTypeDef, string>>;
             applicationId: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+            cimdClientId: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
             username: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
             createdAt: z.ZodOptional<ZodType<number, z.ZodTypeDef, number>>;
             profile: z.ZodOptional<ZodType<Partial<{
@@ -1517,6 +1523,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 description: ZodType<string | null, z.ZodTypeDef, string | null>;
                 customData: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
                 isMfaRequired: ZodType<boolean, z.ZodTypeDef, boolean>;
+                isTrustedDeviceAllowed: ZodType<boolean, z.ZodTypeDef, boolean>;
                 color: ZodType<Partial<{
                     primaryColor: string;
                     isDarkModeEnabled: boolean;
@@ -1565,6 +1572,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
+            cimdClientId?: string | null | undefined;
             username?: string | null | undefined;
             createdAt?: number | undefined;
             profile?: Partial<{
@@ -1632,6 +1640,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
+            cimdClientId?: string | null | undefined;
             username?: string | null | undefined;
             createdAt?: number | undefined;
             profile?: Partial<{
@@ -2698,6 +2707,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
+            cimdClientId?: string | null | undefined;
             username?: string | null | undefined;
             createdAt?: number | undefined;
             profile?: Partial<{
@@ -2947,6 +2957,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
+            cimdClientId?: string | null | undefined;
             username?: string | null | undefined;
             createdAt?: number | undefined;
             profile?: Partial<{
@@ -3200,6 +3211,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
+            cimdClientId?: string | null | undefined;
             username?: string | null | undefined;
             createdAt?: number | undefined;
             profile?: Partial<{
@@ -3453,8 +3465,8 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
         kind?: "AccessToken" | undefined;
         accountId?: string | undefined;
         scope?: string | undefined;
-        sessionUid?: string | undefined;
         clientId?: string | undefined;
+        sessionUid?: string | undefined;
         expiresWithSession?: boolean | undefined;
         gty?: string | undefined;
         aud?: string | string[] | undefined;
@@ -3467,6 +3479,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
+            cimdClientId?: string | null | undefined;
             username?: string | null | undefined;
             createdAt?: number | undefined;
             profile?: Partial<{
@@ -3720,8 +3733,8 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
         kind?: "AccessToken" | undefined;
         accountId?: string | undefined;
         scope?: string | undefined;
-        sessionUid?: string | undefined;
         clientId?: string | undefined;
+        sessionUid?: string | undefined;
         expiresWithSession?: boolean | undefined;
         gty?: string | undefined;
         aud?: string | string[] | undefined;
@@ -4227,8 +4240,8 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
         kind?: "AccessToken" | undefined;
         accountId?: string | undefined;
         scope?: string | undefined;
-        sessionUid?: string | undefined;
         clientId?: string | undefined;
+        sessionUid?: string | undefined;
         expiresWithSession?: boolean | undefined;
         gty?: string | undefined;
         aud?: string | string[] | undefined;
@@ -4239,8 +4252,8 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
         kind?: "AccessToken" | undefined;
         accountId?: string | undefined;
         scope?: string | undefined;
-        sessionUid?: string | undefined;
         clientId?: string | undefined;
+        sessionUid?: string | undefined;
         expiresWithSession?: boolean | undefined;
         gty?: string | undefined;
         aud?: string | string[] | undefined;
@@ -4250,6 +4263,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             name: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
             id: z.ZodOptional<ZodType<string, z.ZodTypeDef, string>>;
             applicationId: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+            cimdClientId: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
             username: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
             createdAt: z.ZodOptional<ZodType<number, z.ZodTypeDef, number>>;
             profile: z.ZodOptional<ZodType<Partial<{
@@ -4388,6 +4402,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 description: ZodType<string | null, z.ZodTypeDef, string | null>;
                 customData: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
                 isMfaRequired: ZodType<boolean, z.ZodTypeDef, boolean>;
+                isTrustedDeviceAllowed: ZodType<boolean, z.ZodTypeDef, boolean>;
                 color: ZodType<Partial<{
                     primaryColor: string;
                     isDarkModeEnabled: boolean;
@@ -4436,6 +4451,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
+            cimdClientId?: string | null | undefined;
             username?: string | null | undefined;
             createdAt?: number | undefined;
             profile?: Partial<{
@@ -4503,6 +4519,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
+            cimdClientId?: string | null | undefined;
             username?: string | null | undefined;
             createdAt?: number | undefined;
             profile?: Partial<{
@@ -5569,6 +5586,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
+            cimdClientId?: string | null | undefined;
             username?: string | null | undefined;
             createdAt?: number | undefined;
             profile?: Partial<{
@@ -5818,6 +5836,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
+            cimdClientId?: string | null | undefined;
             username?: string | null | undefined;
             createdAt?: number | undefined;
             profile?: Partial<{
@@ -6074,8 +6093,8 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
         kind?: "AccessToken" | undefined;
         accountId?: string | undefined;
         scope?: string | undefined;
-        sessionUid?: string | undefined;
         clientId?: string | undefined;
+        sessionUid?: string | undefined;
         expiresWithSession?: boolean | undefined;
         gty?: string | undefined;
         aud?: string | string[] | undefined;
@@ -6085,6 +6104,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
+            cimdClientId?: string | null | undefined;
             username?: string | null | undefined;
             createdAt?: number | undefined;
             profile?: Partial<{
@@ -6341,8 +6361,8 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
         kind?: "AccessToken" | undefined;
         accountId?: string | undefined;
         scope?: string | undefined;
-        sessionUid?: string | undefined;
         clientId?: string | undefined;
+        sessionUid?: string | undefined;
         expiresWithSession?: boolean | undefined;
         gty?: string | undefined;
         aud?: string | string[] | undefined;
@@ -6352,6 +6372,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
+            cimdClientId?: string | null | undefined;
             username?: string | null | undefined;
             createdAt?: number | undefined;
             profile?: Partial<{
@@ -7121,7 +7142,7 @@ export declare enum CustomJwtErrorCode {
     AccessDenied = "AccessDenied",
     /** General JWT customizer error,
      * this is the fallback custom jwt error code
-     * for any internal error thrown by the JWT customizer (localVM, azure function, or CF worker).
+     * for any internal error thrown by the JWT customizer on any runtime.
      */
     General = "General"
 }

package/lib/types/logto-config/jwt-customizer.js

@@ -203,7 +203,7 @@ export var CustomJwtErrorCode;
     CustomJwtErrorCode["AccessDenied"] = "AccessDenied";
     /** General JWT customizer error,
      * this is the fallback custom jwt error code
-     * for any internal error thrown by the JWT customizer (localVM, azure function, or CF worker).
+     * for any internal error thrown by the JWT customizer on any runtime.
      */
     CustomJwtErrorCode["General"] = "General";
 })(CustomJwtErrorCode || (CustomJwtErrorCode = {}));

package/lib/types/logto-config/oidc-provider.d.ts

@@ -28,8 +28,8 @@ export declare const accessTokenPayloadGuard: z.ZodObject<{
     aud: string | string[];
     sid?: string | undefined;
     scope?: string | undefined;
-    sessionUid?: string | undefined;
     clientId?: string | undefined;
+    sessionUid?: string | undefined;
     expiresWithSession?: boolean | undefined;
 }, {
     grantId: string;
@@ -40,8 +40,8 @@ export declare const accessTokenPayloadGuard: z.ZodObject<{
     aud: string | string[];
     sid?: string | undefined;
     scope?: string | undefined;
-    sessionUid?: string | undefined;
     clientId?: string | undefined;
+    sessionUid?: string | undefined;
     expiresWithSession?: boolean | undefined;
 }>;
 export type AccessTokenPayload = z.infer<typeof accessTokenPayloadGuard>;

package/lib/types/service-log.d.ts

@@ -1,5 +1,18 @@
+/**
+ * Types of `service_logs` rows. The rows are written by the Logto Cloud service; some members
+ * are cloud-only concepts kept here so every type shares this single definition.
+ */
 export declare enum ServiceLogType {
     SendEmail = "sendEmail",
     SendSms = "sendSms",
-    FetchCustomJwt = "fetchCustomJwt"
+    /** Cloud-only: custom JWT worker invocations. */
+    FetchCustomJwt = "fetchCustomJwt",
+    /**
+     * Cloud-only: a hosted-email send that failed at the provider; the payload carries the
+     * normalized provider error. Deliberately distinct from {@link ServiceLogType.SendEmail}:
+     * usage counting matches on that exact type, so failed sends never count toward email usage.
+     */
+    SendEmailFailed = "sendEmailFailed",
+    /** Cloud-only: an Actions script run on the script runner. Mirrors the `runAction` entry. */
+    RunAction = "runAction"
 }

package/lib/types/service-log.js

@@ -1,6 +1,19 @@
+/**
+ * Types of `service_logs` rows. The rows are written by the Logto Cloud service; some members
+ * are cloud-only concepts kept here so every type shares this single definition.
+ */
 export var ServiceLogType;
 (function (ServiceLogType) {
     ServiceLogType["SendEmail"] = "sendEmail";
     ServiceLogType["SendSms"] = "sendSms";
+    /** Cloud-only: custom JWT worker invocations. */
     ServiceLogType["FetchCustomJwt"] = "fetchCustomJwt";
+    /**
+     * Cloud-only: a hosted-email send that failed at the provider; the payload carries the
+     * normalized provider error. Deliberately distinct from {@link ServiceLogType.SendEmail}:
+     * usage counting matches on that exact type, so failed sends never count toward email usage.
+     */
+    ServiceLogType["SendEmailFailed"] = "sendEmailFailed";
+    /** Cloud-only: an Actions script run on the script runner. Mirrors the `runAction` entry. */
+    ServiceLogType["RunAction"] = "runAction";
 })(ServiceLogType || (ServiceLogType = {}));