@logto/schemas 1.42.0 → 1.44.0

package/lib/types/logto-config/jwt-customizer.js

@@ -203,7 +203,7 @@ export var CustomJwtErrorCode;
     CustomJwtErrorCode["AccessDenied"] = "AccessDenied";
     /** General JWT customizer error,
      * this is the fallback custom jwt error code
-     * for any internal error thrown by the JWT customizer (localVM, azure function, or CF worker).
+     * for any internal error thrown by the JWT customizer on any runtime.
      */
     CustomJwtErrorCode["General"] = "General";
 })(CustomJwtErrorCode || (CustomJwtErrorCode = {}));

package/lib/types/logto-config/oidc-provider.d.ts

@@ -28,8 +28,8 @@ export declare const accessTokenPayloadGuard: z.ZodObject<{
     aud: string | string[];
     sid?: string | undefined;
     scope?: string | undefined;
-    sessionUid?: string | undefined;
     clientId?: string | undefined;
+    sessionUid?: string | undefined;
     expiresWithSession?: boolean | undefined;
 }, {
     grantId: string;
@@ -40,8 +40,8 @@ export declare const accessTokenPayloadGuard: z.ZodObject<{
     aud: string | string[];
     sid?: string | undefined;
     scope?: string | undefined;
-    sessionUid?: string | undefined;
     clientId?: string | undefined;
+    sessionUid?: string | undefined;
     expiresWithSession?: boolean | undefined;
 }>;
 export type AccessTokenPayload = z.infer<typeof accessTokenPayloadGuard>;

package/lib/types/saml-application.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { NameIdFormat } from '../foundations/index.js';
+import { NameIdFormat, type SamlAuthnRequestConfig } from '../foundations/index.js';
 export declare const samlApplicationCreateGuard: z.ZodObject<{
     name: z.ZodType<string, z.ZodTypeDef, string>;
     customData: z.ZodOptional<z.ZodOptional<z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>>>;
@@ -16,6 +16,15 @@ export declare const samlApplicationCreateGuard: z.ZodObject<{
         encryptThenSign?: boolean | undefined;
         certificate?: string | undefined;
     } | null>>;
+    authnRequestConfig: z.ZodOptional<z.ZodType<{
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null, z.ZodTypeDef, {
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null>>;
 } & {
     nameIdFormat: z.ZodDefault<z.ZodOptional<z.ZodNativeEnum<typeof NameIdFormat>>>;
 }, "strip", z.ZodTypeAny, {
@@ -31,6 +40,11 @@ export declare const samlApplicationCreateGuard: z.ZodObject<{
         encryptThenSign?: boolean | undefined;
         certificate?: string | undefined;
     } | null | undefined;
+    authnRequestConfig?: {
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null | undefined;
 }, {
     name: string;
     customData?: import("@withtyped/server/lib/types.js").JsonObject;
@@ -43,6 +57,11 @@ export declare const samlApplicationCreateGuard: z.ZodObject<{
         encryptThenSign?: boolean | undefined;
         certificate?: string | undefined;
     } | null | undefined;
+    authnRequestConfig?: {
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null | undefined;
     nameIdFormat?: NameIdFormat | undefined;
 }>;
 export type CreateSamlApplication = z.input<typeof samlApplicationCreateGuard>;
@@ -63,6 +82,15 @@ export declare const samlApplicationPatchGuard: z.ZodObject<{
         encryptThenSign?: boolean | undefined;
         certificate?: string | undefined;
     } | null>>;
+    authnRequestConfig: z.ZodOptional<z.ZodType<{
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null, z.ZodTypeDef, {
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null>>;
 } & {
     nameIdFormat: z.ZodOptional<z.ZodNativeEnum<typeof NameIdFormat>>;
 }, "strip", z.ZodTypeAny, {
@@ -78,6 +106,11 @@ export declare const samlApplicationPatchGuard: z.ZodObject<{
         encryptThenSign?: boolean | undefined;
         certificate?: string | undefined;
     } | null | undefined;
+    authnRequestConfig?: {
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null | undefined;
     nameIdFormat?: NameIdFormat | undefined;
 }, {
     name?: string | undefined;
@@ -92,6 +125,11 @@ export declare const samlApplicationPatchGuard: z.ZodObject<{
         encryptThenSign?: boolean | undefined;
         certificate?: string | undefined;
     } | null | undefined;
+    authnRequestConfig?: {
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null | undefined;
     nameIdFormat?: NameIdFormat | undefined;
 }>;
 export type PatchSamlApplication = z.infer<typeof samlApplicationPatchGuard>;
@@ -117,6 +155,15 @@ export declare const samlApplicationResponseGuard: z.ZodObject<{
         encryptThenSign?: boolean | undefined;
         certificate?: string | undefined;
     } | null>;
+    authnRequestConfig: z.ZodType<{
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null, z.ZodTypeDef, {
+        forceAuthn?: boolean | undefined;
+        requireSignedAuthnRequests?: boolean | undefined;
+        signingCertificate?: string | undefined;
+    } | null>;
 } & {
     nameIdFormat: z.ZodNativeEnum<typeof NameIdFormat>;
 }, "strip", z.ZodTypeAny, {
@@ -133,6 +180,7 @@ export declare const samlApplicationResponseGuard: z.ZodObject<{
     entityId: string | null;
     acsUrl: import("../foundations/index.js").SamlAcsUrl | null;
     encryption: import("../foundations/index.js").SamlEncryption | null;
+    authnRequestConfig: SamlAuthnRequestConfig | null;
     nameIdFormat: NameIdFormat;
 }, {
     type: import("../index.js").ApplicationType;
@@ -148,6 +196,7 @@ export declare const samlApplicationResponseGuard: z.ZodObject<{
     entityId: string | null;
     acsUrl: import("../foundations/index.js").SamlAcsUrl | null;
     encryption: import("../foundations/index.js").SamlEncryption | null;
+    authnRequestConfig: SamlAuthnRequestConfig | null;
     nameIdFormat: NameIdFormat;
 }>;
 export type SamlApplicationResponse = z.infer<typeof samlApplicationResponseGuard>;
@@ -238,4 +287,9 @@ export declare const samlApplicationSecretResponseGuard: z.ZodObject<Omit<{
     };
 }>;
 export type SamlApplicationSecretResponse = z.infer<typeof samlApplicationSecretResponseGuard>;
+/**
+ * Whether a SAML application forces fresh authentication. Forcing is the default; only an explicit
+ * `forceAuthn: false` lets the application reuse an existing session.
+ */
+export declare const isSamlForceAuthnEnabled: (config?: SamlAuthnRequestConfig | null) => boolean;
 export {};

package/lib/types/saml-application.js

@@ -2,13 +2,14 @@ import { z } from 'zod';
 import { Applications } from '../db-entries/application.js';
 import { SamlApplicationConfigs } from '../db-entries/saml-application-config.js';
 import { SamlApplicationSecrets } from '../db-entries/saml-application-secret.js';
-import { nameIdFormatGuard, NameIdFormat } from '../foundations/index.js';
+import { nameIdFormatGuard, NameIdFormat, } from '../foundations/index.js';
 import { applicationCreateGuard, applicationPatchGuard } from './application.js';
 const samlAppConfigGuard = SamlApplicationConfigs.guard.pick({
     attributeMapping: true,
     entityId: true,
     acsUrl: true,
     encryption: true,
+    authnRequestConfig: true,
     nameIdFormat: true,
 });
 export const samlApplicationCreateGuard = applicationCreateGuard
@@ -61,3 +62,8 @@ export const samlApplicationSecretResponseGuard = SamlApplicationSecrets.guard
     .extend({
     fingerprints: certificateFingerprintsGuard,
 });
+/**
+ * Whether a SAML application forces fresh authentication. Forcing is the default; only an explicit
+ * `forceAuthn: false` lets the application reuse an existing session.
+ */
+export const isSamlForceAuthnEnabled = (config) => config?.forceAuthn !== false;

package/lib/types/service-log.d.ts

@@ -1,5 +1,18 @@
+/**
+ * Types of `service_logs` rows. The rows are written by the Logto Cloud service; some members
+ * are cloud-only concepts kept here so every type shares this single definition.
+ */
 export declare enum ServiceLogType {
     SendEmail = "sendEmail",
     SendSms = "sendSms",
-    FetchCustomJwt = "fetchCustomJwt"
+    /** Cloud-only: custom JWT worker invocations. */
+    FetchCustomJwt = "fetchCustomJwt",
+    /**
+     * Cloud-only: a hosted-email send that failed at the provider; the payload carries the
+     * normalized provider error. Deliberately distinct from {@link ServiceLogType.SendEmail}:
+     * usage counting matches on that exact type, so failed sends never count toward email usage.
+     */
+    SendEmailFailed = "sendEmailFailed",
+    /** Cloud-only: an Actions script run on the script runner. Mirrors the `runAction` entry. */
+    RunAction = "runAction"
 }

package/lib/types/service-log.js

@@ -1,6 +1,19 @@
+/**
+ * Types of `service_logs` rows. The rows are written by the Logto Cloud service; some members
+ * are cloud-only concepts kept here so every type shares this single definition.
+ */
 export var ServiceLogType;
 (function (ServiceLogType) {
     ServiceLogType["SendEmail"] = "sendEmail";
     ServiceLogType["SendSms"] = "sendSms";
+    /** Cloud-only: custom JWT worker invocations. */
     ServiceLogType["FetchCustomJwt"] = "fetchCustomJwt";
+    /**
+     * Cloud-only: a hosted-email send that failed at the provider; the payload carries the
+     * normalized provider error. Deliberately distinct from {@link ServiceLogType.SendEmail}:
+     * usage counting matches on that exact type, so failed sends never count toward email usage.
+     */
+    ServiceLogType["SendEmailFailed"] = "sendEmailFailed";
+    /** Cloud-only: an Actions script run on the script runner. Mirrors the `runAction` entry. */
+    ServiceLogType["RunAction"] = "runAction";
 })(ServiceLogType || (ServiceLogType = {}));

package/lib/types/sign-in-experience.d.ts

@@ -32,6 +32,8 @@ export type FullSignInExperience = Omit<SignInExperience, 'emailBlocklistPolicy'
     captchaConfig?: {
         type: CaptchaType;
         siteKey: string;
+        /** The Cap Standalone instance URL, only available for {@link CaptchaType.Cap}. */
+        endpoint?: string;
         domain?: string;
         mode?: RecaptchaEnterpriseMode;
     };
@@ -71,10 +73,10 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     hideLogtoBranding: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     languageInfo: z.ZodType<{
         autoDetect: boolean;
-        fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
+        fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "es-MX" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
     }, z.ZodTypeDef, {
         autoDetect: boolean;
-        fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
+        fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "es-MX" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
     }>;
     termsOfUseUrl: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     privacyPolicyUrl: z.ZodType<string | null, z.ZodTypeDef, string | null>;
@@ -139,6 +141,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     }>;
     mfa: z.ZodType<import("../foundations/jsonb-types/sign-in-experience.js").Mfa, z.ZodTypeDef, import("../foundations/jsonb-types/sign-in-experience.js").Mfa>;
     adaptiveMfa: z.ZodType<import("../foundations/jsonb-types/sign-in-experience.js").AdaptiveMfa, z.ZodTypeDef, import("../foundations/jsonb-types/sign-in-experience.js").AdaptiveMfa>;
+    trustedDevice: z.ZodType<import("../foundations/jsonb-types/sign-in-experience.js").TrustedDevicePolicy, z.ZodTypeDef, import("../foundations/jsonb-types/sign-in-experience.js").TrustedDevicePolicy>;
     singleSignOnEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     supportEmail: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     supportWebsiteUrl: z.ZodType<string | null, z.ZodTypeDef, string | null>;
@@ -393,6 +396,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
             es?: string | undefined;
             "es-ES"?: string | undefined;
             "es-419"?: string | undefined;
+            "es-MX"?: string | undefined;
             "et-EE"?: string | undefined;
             "eu-ES"?: string | undefined;
             "fa-IR"?: string | undefined;
@@ -534,6 +538,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
             es?: string | undefined;
             "es-ES"?: string | undefined;
             "es-419"?: string | undefined;
+            "es-MX"?: string | undefined;
             "et-EE"?: string | undefined;
             "eu-ES"?: string | undefined;
             "fa-IR"?: string | undefined;
@@ -680,15 +685,15 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
         clientId: z.ZodString;
         connectorId: z.ZodString;
     }, "strip", z.ZodTypeAny, {
-        connectorId: string;
         clientId: string;
+        connectorId: string;
         isEnabled?: boolean | undefined;
         autoSelect?: boolean | undefined;
         closeOnTapOutside?: boolean | undefined;
         itpSupport?: boolean | undefined;
     }, {
-        connectorId: string;
         clientId: string;
+        connectorId: string;
         isEnabled?: boolean | undefined;
         autoSelect?: boolean | undefined;
         closeOnTapOutside?: boolean | undefined;
@@ -697,6 +702,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     captchaConfig: z.ZodOptional<z.ZodObject<{
         type: z.ZodNativeEnum<typeof CaptchaType>;
         siteKey: z.ZodString;
+        endpoint: z.ZodOptional<z.ZodString>;
         domain: z.ZodOptional<z.ZodString>;
         mode: z.ZodOptional<z.ZodNativeEnum<typeof RecaptchaEnterpriseMode>>;
     }, "strip", z.ZodTypeAny, {
@@ -704,11 +710,13 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
         siteKey: string;
         domain?: string | undefined;
         mode?: RecaptchaEnterpriseMode | undefined;
+        endpoint?: string | undefined;
     }, {
         type: CaptchaType;
         siteKey: string;
         domain?: string | undefined;
         mode?: RecaptchaEnterpriseMode | undefined;
+        endpoint?: string | undefined;
     }>>;
     customProfileFields: z.ZodArray<import("../index.js").Guard<CustomProfileField>, "many">;
     customProfileFieldCatalog: z.ZodOptional<z.ZodArray<import("../index.js").Guard<CustomProfileField>, "many">>;
@@ -716,6 +724,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     id: string;
     tenantId: string;
     mfa: import("../foundations/jsonb-types/sign-in-experience.js").Mfa;
+    trustedDevice: import("../foundations/jsonb-types/sign-in-experience.js").TrustedDevicePolicy;
     customCss: string | null;
     color: import("../foundations/jsonb-types/sign-in-experience.js").Color;
     branding: import("../foundations/jsonb-types/sign-in-experience.js").Branding;
@@ -777,6 +786,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
             es?: string | undefined;
             "es-ES"?: string | undefined;
             "es-419"?: string | undefined;
+            "es-MX"?: string | undefined;
             "et-EE"?: string | undefined;
             "eu-ES"?: string | undefined;
             "fa-IR"?: string | undefined;
@@ -900,8 +910,8 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     isDevelopmentTenant: boolean;
     customProfileFields: CustomProfileField[];
     googleOneTap?: {
-        connectorId: string;
         clientId: string;
+        connectorId: string;
         isEnabled?: boolean | undefined;
         autoSelect?: boolean | undefined;
         closeOnTapOutside?: boolean | undefined;
@@ -912,12 +922,14 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
         siteKey: string;
         domain?: string | undefined;
         mode?: RecaptchaEnterpriseMode | undefined;
+        endpoint?: string | undefined;
     } | undefined;
     customProfileFieldCatalog?: CustomProfileField[] | undefined;
 }, {
     id: string;
     tenantId: string;
     mfa: import("../foundations/jsonb-types/sign-in-experience.js").Mfa;
+    trustedDevice: import("../foundations/jsonb-types/sign-in-experience.js").TrustedDevicePolicy;
     customCss: string | null;
     color: import("../foundations/jsonb-types/sign-in-experience.js").Color;
     branding: import("../foundations/jsonb-types/sign-in-experience.js").Branding;
@@ -979,6 +991,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
             es?: string | undefined;
             "es-ES"?: string | undefined;
             "es-419"?: string | undefined;
+            "es-MX"?: string | undefined;
             "et-EE"?: string | undefined;
             "eu-ES"?: string | undefined;
             "fa-IR"?: string | undefined;
@@ -1102,8 +1115,8 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
     isDevelopmentTenant: boolean;
     customProfileFields: CustomProfileField[];
     googleOneTap?: {
-        connectorId: string;
         clientId: string;
+        connectorId: string;
         isEnabled?: boolean | undefined;
         autoSelect?: boolean | undefined;
         closeOnTapOutside?: boolean | undefined;
@@ -1114,6 +1127,7 @@ export declare const fullSignInExperienceGuard: z.ZodObject<Omit<{
         siteKey: string;
         domain?: string | undefined;
         mode?: RecaptchaEnterpriseMode | undefined;
+        endpoint?: string | undefined;
     } | undefined;
     customProfileFieldCatalog?: CustomProfileField[] | undefined;
 }>;

package/lib/types/sign-in-experience.js

@@ -25,6 +25,7 @@ export const fullSignInExperienceGuard = SignInExperiences.guard
         .object({
         type: z.nativeEnum(CaptchaType),
         siteKey: z.string(),
+        endpoint: z.string().optional(),
         domain: z.string().optional(),
         mode: z.nativeEnum(RecaptchaEnterpriseMode).optional(),
     })

package/lib/types/ssr.d.ts

@@ -1,6 +1,7 @@
 import { type LocalePhrase } from '@logto/phrases-experience';
 import { type SignInExperience } from '../db-entries/index.js';
 import { type FullSignInExperience } from './sign-in-experience.js';
+import { type Theme } from './theme.js';
 /**
  * The server-side rendering data type for **experience**.
  */
@@ -9,6 +10,7 @@ export type SsrData = {
         appId?: string;
         organizationId?: string;
         uiLocales?: string;
+        theme?: Theme;
         data: FullSignInExperience;
     };
     phrases: {

package/lib/types/system.d.ts

@@ -48,8 +48,8 @@ export declare const storageProviderDataGuard: z.ZodDiscriminatedUnion<"provider
     accessKeyId: string;
     accessSecretKey: string;
     region?: string | undefined;
-    publicUrl?: string | undefined;
     endpoint?: string | undefined;
+    publicUrl?: string | undefined;
     forcePathStyle?: boolean | undefined;
 }, {
     provider: StorageProvider.S3Storage;
@@ -57,8 +57,8 @@ export declare const storageProviderDataGuard: z.ZodDiscriminatedUnion<"provider
     accessKeyId: string;
     accessSecretKey: string;
     region?: string | undefined;
-    publicUrl?: string | undefined;
     endpoint?: string | undefined;
+    publicUrl?: string | undefined;
     forcePathStyle?: boolean | undefined;
 }>, z.ZodObject<{
     publicUrl: z.ZodOptional<z.ZodString>;
@@ -198,14 +198,14 @@ export declare const demoSocialDataGuard: z.ZodArray<z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     name: string;
     logo: string;
-    logoDark: string;
     clientId: string;
+    logoDark: string;
     provider: DemoSocialProvider;
 }, {
     name: string;
     logo: string;
-    logoDark: string;
     clientId: string;
+    logoDark: string;
     provider: DemoSocialProvider;
 }>, "many">;
 export type DemoSocialData = z.infer<typeof demoSocialDataGuard>;
@@ -292,8 +292,60 @@ export type CloudflareType = {
 export declare const cloudflareGuard: Readonly<{
     [key in CloudflareKey]: ZodType<CloudflareType[key]>;
 }>;
-export type SystemKey = AlterationStateKey | StorageProviderKey | DemoSocialKey | CloudflareKey | EmailServiceProviderKey;
-export type SystemType = AlterationStateType | StorageProviderType | DemoSocialType | CloudflareType | EmailServiceProviderType;
-export type SystemGuard = typeof alterationStateGuard & typeof storageProviderGuard & typeof demoSocialGuard & typeof cloudflareGuard & typeof emailServiceProviderGuard;
+/**
+ * The license key installed on a self-hosted instance, stored verbatim so it can be re-verified on
+ * every read and re-signed on refresh. The `systems` table is global, so one deployment installs
+ * one license no matter how many instances share the database.
+ */
+export declare const installedLicenseGuard: z.ZodObject<{
+    /** The raw Ed25519-signed license key JWT, exactly as it was installed. */
+    jwt: z.ZodString;
+    /** When the key was installed, as an ISO 8601 timestamp. */
+    installedAt: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    jwt: string;
+    installedAt: string;
+}, {
+    jwt: string;
+    installedAt: string;
+}>;
+export type InstalledLicense = z.infer<typeof installedLicenseGuard>;
+export declare enum LicenseKey {
+    License = "license",
+    LicenseRefreshState = "licenseRefreshState",
+    LicenseDeploymentId = "licenseDeploymentId"
+}
+export type LicenseType = {
+    [LicenseKey.License]: InstalledLicense;
+    [LicenseKey.LicenseRefreshState]: LicenseRefreshState;
+    [LicenseKey.LicenseDeploymentId]: LicenseDeploymentId;
+};
+/** The state shared by all instances while they lazily refresh the installed license. */
+export declare const licenseRefreshStateGuard: z.ZodObject<{
+    /** The last successful refresh, or the `iat` of the installed key. */
+    lastRefreshedAt: z.ZodString;
+    /** The last refresh attempt. Absent before the first read after installation. */
+    lastAttemptAt: z.ZodOptional<z.ZodString>;
+    /** The refusal reason returned by the license service, if the last attempt was refused. */
+    refusalReason: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    lastRefreshedAt: string;
+    lastAttemptAt?: string | undefined;
+    refusalReason?: string | undefined;
+}, {
+    lastRefreshedAt: string;
+    lastAttemptAt?: string | undefined;
+    refusalReason?: string | undefined;
+}>;
+export type LicenseRefreshState = z.infer<typeof licenseRefreshStateGuard>;
+/** The stable identifier shared by every Core instance using this `systems` table. */
+export declare const licenseDeploymentIdGuard: z.ZodString;
+export type LicenseDeploymentId = z.infer<typeof licenseDeploymentIdGuard>;
+export declare const licenseGuard: Readonly<{
+    [key in LicenseKey]: ZodType<LicenseType[key]>;
+}>;
+export type SystemKey = AlterationStateKey | StorageProviderKey | DemoSocialKey | CloudflareKey | EmailServiceProviderKey | LicenseKey;
+export type SystemType = AlterationStateType | StorageProviderType | DemoSocialType | CloudflareType | EmailServiceProviderType | LicenseType;
+export type SystemGuard = typeof alterationStateGuard & typeof storageProviderGuard & typeof demoSocialGuard & typeof cloudflareGuard & typeof emailServiceProviderGuard & typeof licenseGuard;
 export declare const systemKeys: readonly SystemKey[];
 export declare const systemGuards: SystemGuard;

package/lib/types/system.js

@@ -155,12 +155,47 @@ export const cloudflareGuard = Object.freeze({
     [CloudflareKey.ProtectedAppHostnameProvider]: hostnameProviderDataGuard,
     [CloudflareKey.CustomJwtWorkerConfig]: customJwtWorkerConfigGuard,
 });
+// Self-hosted license
+/**
+ * The license key installed on a self-hosted instance, stored verbatim so it can be re-verified on
+ * every read and re-signed on refresh. The `systems` table is global, so one deployment installs
+ * one license no matter how many instances share the database.
+ */
+export const installedLicenseGuard = z.object({
+    /** The raw Ed25519-signed license key JWT, exactly as it was installed. */
+    jwt: z.string(),
+    /** When the key was installed, as an ISO 8601 timestamp. */
+    installedAt: z.string(),
+});
+export var LicenseKey;
+(function (LicenseKey) {
+    LicenseKey["License"] = "license";
+    LicenseKey["LicenseRefreshState"] = "licenseRefreshState";
+    LicenseKey["LicenseDeploymentId"] = "licenseDeploymentId";
+})(LicenseKey || (LicenseKey = {}));
+/** The state shared by all instances while they lazily refresh the installed license. */
+export const licenseRefreshStateGuard = z.object({
+    /** The last successful refresh, or the `iat` of the installed key. */
+    lastRefreshedAt: z.string(),
+    /** The last refresh attempt. Absent before the first read after installation. */
+    lastAttemptAt: z.string().optional(),
+    /** The refusal reason returned by the license service, if the last attempt was refused. */
+    refusalReason: z.string().optional(),
+});
+/** The stable identifier shared by every Core instance using this `systems` table. */
+export const licenseDeploymentIdGuard = z.string().min(1);
+export const licenseGuard = Object.freeze({
+    [LicenseKey.License]: installedLicenseGuard,
+    [LicenseKey.LicenseRefreshState]: licenseRefreshStateGuard,
+    [LicenseKey.LicenseDeploymentId]: licenseDeploymentIdGuard,
+});
 export const systemKeys = Object.freeze([
     ...Object.values(AlterationStateKey),
     ...Object.values(StorageProviderKey),
     ...Object.values(DemoSocialKey),
     ...Object.values(CloudflareKey),
     ...Object.values(EmailServiceProviderKey),
+    ...Object.values(LicenseKey),
 ]);
 export const systemGuards = Object.freeze({
     ...alterationStateGuard,
@@ -168,4 +203,5 @@ export const systemGuards = Object.freeze({
     ...demoSocialGuard,
     ...cloudflareGuard,
     ...emailServiceProviderGuard,
+    ...licenseGuard,
 });

package/lib/types/system.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/types/system.test.js

@@ -0,0 +1,26 @@
+import { describe, expect, it } from 'vitest';
+import { LicenseKey, systemGuards, systemKeys } from './system.js';
+describe('license system entries', () => {
+    it('registers the license key, so the CLI accepts it', () => {
+        expect(systemKeys).toContain(LicenseKey.License);
+        expect(systemKeys).toContain(LicenseKey.LicenseRefreshState);
+        expect(systemKeys).toContain(LicenseKey.LicenseDeploymentId);
+    });
+    it('parses an installed license row', () => {
+        const value = { jwt: 'header.payload.signature', installedAt: '2026-01-01T00:00:00.000Z' };
+        expect(systemGuards[LicenseKey.License].parse(value)).toEqual(value);
+    });
+    it('rejects an installed license row without a key', () => {
+        expect(systemGuards[LicenseKey.License].safeParse({ installedAt: '2026-01-01T00:00:00.000Z' })
+            .success).toBe(false);
+    });
+    it('parses refresh state and a deployment ID', () => {
+        const state = {
+            lastRefreshedAt: '2026-01-01T00:00:00.000Z',
+            lastAttemptAt: '2026-01-02T00:00:00.000Z',
+            refusalReason: 'canceled',
+        };
+        expect(systemGuards[LicenseKey.LicenseRefreshState].parse(state)).toEqual(state);
+        expect(systemGuards[LicenseKey.LicenseDeploymentId].parse('deployment_123')).toBe('deployment_123');
+    });
+});