@logto/schemas 1.42.0 → 1.44.0

package/lib/db-entries/user.js

@@ -4,7 +4,7 @@ import { userProfileGuard, identitiesGuard, jsonObjectGuard, mfaVerificationsGua
 import { UsersPasswordEncryptionMethod } from './custom-types.js';
 const createGuard = z.object({
     tenantId: z.string().max(21).optional(),
-    id: z.string().min(1).max(12),
+    id: z.string().min(1).max(128),
     username: z.string().max(128).nullable().optional(),
     primaryEmail: z.string().max(128).nullable().optional(),
     primaryPhone: z.string().max(128).nullable().optional(),
@@ -14,6 +14,7 @@ const createGuard = z.object({
     avatar: z.string().max(2048).nullable().optional(),
     profile: userProfileGuard.optional(),
     applicationId: z.string().max(21).nullable().optional(),
+    cimdClientId: z.string().max(2048).nullable().optional(),
     identities: identitiesGuard.optional(),
     customData: jsonObjectGuard.optional(),
     logtoConfig: jsonObjectGuard.optional(),
@@ -27,7 +28,7 @@ const createGuard = z.object({
 });
 const guard = z.object({
     tenantId: z.string().max(21),
-    id: z.string().min(1).max(12),
+    id: z.string().min(1).max(128),
     username: z.string().max(128).nullable(),
     primaryEmail: z.string().max(128).nullable(),
     primaryPhone: z.string().max(128).nullable(),
@@ -37,6 +38,7 @@ const guard = z.object({
     avatar: z.string().max(2048).nullable(),
     profile: userProfileGuard,
     applicationId: z.string().max(21).nullable(),
+    cimdClientId: z.string().max(2048).nullable(),
     identities: identitiesGuard,
     customData: jsonObjectGuard,
     logtoConfig: jsonObjectGuard,
@@ -63,6 +65,7 @@ export const Users = Object.freeze({
         avatar: 'avatar',
         profile: 'profile',
         applicationId: 'application_id',
+        cimdClientId: 'cimd_client_id',
         identities: 'identities',
         customData: 'custom_data',
         logtoConfig: 'logto_config',
@@ -86,6 +89,7 @@ export const Users = Object.freeze({
         'avatar',
         'profile',
         'applicationId',
+        'cimdClientId',
         'identities',
         'customData',
         'logtoConfig',

package/lib/db-entries/users-role.js

@@ -3,13 +3,13 @@ import { z } from 'zod';
 const createGuard = z.object({
     tenantId: z.string().max(21).optional(),
     id: z.string().min(1).max(21),
-    userId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(128),
     roleId: z.string().min(1).max(21),
 });
 const guard = z.object({
     tenantId: z.string().max(21),
     id: z.string().min(1).max(21),
-    userId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(128),
     roleId: z.string().min(1).max(21),
 });
 export const UsersRoles = Object.freeze({

package/lib/db-entries/verification-record.js

@@ -4,7 +4,7 @@ import { jsonObjectGuard } from './../foundations/index.js';
 const createGuard = z.object({
     tenantId: z.string().max(21).optional(),
     id: z.string().min(1).max(21),
-    userId: z.string().max(21).nullable().optional(),
+    userId: z.string().max(128).nullable().optional(),
     createdAt: z.number().optional(),
     expiresAt: z.number(),
     data: jsonObjectGuard.optional(),
@@ -12,7 +12,7 @@ const createGuard = z.object({
 const guard = z.object({
     tenantId: z.string().max(21),
     id: z.string().min(1).max(21),
-    userId: z.string().max(21).nullable(),
+    userId: z.string().max(128).nullable(),
     createdAt: z.number(),
     expiresAt: z.number(),
     data: jsonObjectGuard,

package/lib/db-entries/verification-status.js

@@ -3,14 +3,14 @@ import { z } from 'zod';
 const createGuard = z.object({
     tenantId: z.string().max(21).optional(),
     id: z.string().min(1).max(21),
-    userId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(128),
     createdAt: z.number().optional(),
     verifiedIdentifier: z.string().max(255).nullable().optional(),
 });
 const guard = z.object({
     tenantId: z.string().max(21),
     id: z.string().min(1).max(21),
-    userId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(128),
     createdAt: z.number(),
     verifiedIdentifier: z.string().max(255).nullable(),
 });

package/lib/foundations/jsonb-types/account-centers.d.ts

@@ -22,6 +22,7 @@ export declare const accountCenterFieldControlGuard: z.ZodObject<{
     mfa: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
     passkey: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
     session: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
+    trustedDevice: z.ZodOptional<z.ZodNativeEnum<typeof AccountCenterControlValue>>;
 }, "strip", z.ZodTypeAny, {
     name?: AccountCenterControlValue | undefined;
     username?: AccountCenterControlValue | undefined;
@@ -35,6 +36,7 @@ export declare const accountCenterFieldControlGuard: z.ZodObject<{
     mfa?: AccountCenterControlValue | undefined;
     passkey?: AccountCenterControlValue | undefined;
     session?: AccountCenterControlValue | undefined;
+    trustedDevice?: AccountCenterControlValue | undefined;
 }, {
     name?: AccountCenterControlValue | undefined;
     username?: AccountCenterControlValue | undefined;
@@ -48,6 +50,7 @@ export declare const accountCenterFieldControlGuard: z.ZodObject<{
     mfa?: AccountCenterControlValue | undefined;
     passkey?: AccountCenterControlValue | undefined;
     session?: AccountCenterControlValue | undefined;
+    trustedDevice?: AccountCenterControlValue | undefined;
 }>;
 export type AccountCenterFieldControl = z.infer<typeof accountCenterFieldControlGuard>;
 export declare const webauthnRelatedOriginsGuard: z.ZodArray<z.ZodString, "many">;

package/lib/foundations/jsonb-types/account-centers.js

@@ -24,6 +24,7 @@ export const accountCenterFieldControlGuard = z
     mfa: z.nativeEnum(AccountCenterControlValue),
     passkey: z.nativeEnum(AccountCenterControlValue),
     session: z.nativeEnum(AccountCenterControlValue),
+    trustedDevice: z.nativeEnum(AccountCenterControlValue),
 })
     .partial();
 export const webauthnRelatedOriginsGuard = z.array(z.string());

package/lib/foundations/jsonb-types/account-centers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/foundations/jsonb-types/account-centers.test.js

@@ -0,0 +1,13 @@
+import { describe, expect, it } from 'vitest';
+import { AccountCenterControlValue, accountCenterFieldControlGuard } from './account-centers.js';
+describe('accountCenterFieldControlGuard', () => {
+    it('allows trusted device control to be omitted', () => {
+        expect(accountCenterFieldControlGuard.parse({})).toEqual({});
+    });
+    it.each(Object.values(AccountCenterControlValue))('accepts trusted device control value %s', (trustedDevice) => {
+        expect(accountCenterFieldControlGuard.parse({ trustedDevice })).toEqual({ trustedDevice });
+    });
+    it('rejects an invalid trusted device control value', () => {
+        expect(accountCenterFieldControlGuard.safeParse({ trustedDevice: 'Invalid' }).success).toBe(false);
+    });
+});

package/lib/foundations/jsonb-types/captcha.d.ts

@@ -1,7 +1,8 @@
 import { z } from 'zod';
 export declare enum CaptchaType {
     RecaptchaEnterprise = "RecaptchaEnterprise",
-    Turnstile = "Turnstile"
+    Turnstile = "Turnstile",
+    Cap = "Cap"
 }
 export declare enum RecaptchaEnterpriseMode {
     Invisible = "invisible",
@@ -28,6 +29,7 @@ export declare const recaptchaEnterpriseConfigGuard: z.ZodObject<{
     projectId: z.ZodString;
     domain: z.ZodOptional<z.ZodString>;
     mode: z.ZodOptional<z.ZodNativeEnum<typeof RecaptchaEnterpriseMode>>;
+    scoreThreshold: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     type: CaptchaType.RecaptchaEnterprise;
     siteKey: string;
@@ -35,6 +37,7 @@ export declare const recaptchaEnterpriseConfigGuard: z.ZodObject<{
     projectId: string;
     domain?: string | undefined;
     mode?: RecaptchaEnterpriseMode | undefined;
+    scoreThreshold?: number | undefined;
 }, {
     type: CaptchaType.RecaptchaEnterprise;
     siteKey: string;
@@ -42,8 +45,32 @@ export declare const recaptchaEnterpriseConfigGuard: z.ZodObject<{
     projectId: string;
     domain?: string | undefined;
     mode?: RecaptchaEnterpriseMode | undefined;
+    scoreThreshold?: number | undefined;
 }>;
 export type RecaptchaEnterpriseConfig = z.infer<typeof recaptchaEnterpriseConfigGuard>;
+/**
+ * Config of a self-hosted Cap Standalone instance.
+ *
+ * @see https://capjs.js.org/guide/standalone/
+ */
+export declare const capConfigGuard: z.ZodObject<{
+    type: z.ZodLiteral<CaptchaType.Cap>;
+    /** The public base URL of the Cap Standalone instance, e.g. `https://cap.example.com`. */
+    endpoint: z.ZodEffects<z.ZodString, string, string>;
+    siteKey: z.ZodString;
+    secretKey: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: CaptchaType.Cap;
+    siteKey: string;
+    secretKey: string;
+    endpoint: string;
+}, {
+    type: CaptchaType.Cap;
+    siteKey: string;
+    secretKey: string;
+    endpoint: string;
+}>;
+export type CapConfig = z.infer<typeof capConfigGuard>;
 export declare const captchaConfigGuard: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
     type: z.ZodLiteral<CaptchaType.Turnstile>;
     siteKey: z.ZodString;
@@ -63,6 +90,7 @@ export declare const captchaConfigGuard: z.ZodDiscriminatedUnion<"type", [z.ZodO
     projectId: z.ZodString;
     domain: z.ZodOptional<z.ZodString>;
     mode: z.ZodOptional<z.ZodNativeEnum<typeof RecaptchaEnterpriseMode>>;
+    scoreThreshold: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     type: CaptchaType.RecaptchaEnterprise;
     siteKey: string;
@@ -70,6 +98,7 @@ export declare const captchaConfigGuard: z.ZodDiscriminatedUnion<"type", [z.ZodO
     projectId: string;
     domain?: string | undefined;
     mode?: RecaptchaEnterpriseMode | undefined;
+    scoreThreshold?: number | undefined;
 }, {
     type: CaptchaType.RecaptchaEnterprise;
     siteKey: string;
@@ -77,5 +106,22 @@ export declare const captchaConfigGuard: z.ZodDiscriminatedUnion<"type", [z.ZodO
     projectId: string;
     domain?: string | undefined;
     mode?: RecaptchaEnterpriseMode | undefined;
+    scoreThreshold?: number | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<CaptchaType.Cap>;
+    /** The public base URL of the Cap Standalone instance, e.g. `https://cap.example.com`. */
+    endpoint: z.ZodEffects<z.ZodString, string, string>;
+    siteKey: z.ZodString;
+    secretKey: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: CaptchaType.Cap;
+    siteKey: string;
+    secretKey: string;
+    endpoint: string;
+}, {
+    type: CaptchaType.Cap;
+    siteKey: string;
+    secretKey: string;
+    endpoint: string;
 }>]>;
 export type CaptchaConfig = z.infer<typeof captchaConfigGuard>;

package/lib/foundations/jsonb-types/captcha.js

@@ -3,6 +3,7 @@ export var CaptchaType;
 (function (CaptchaType) {
     CaptchaType["RecaptchaEnterprise"] = "RecaptchaEnterprise";
     CaptchaType["Turnstile"] = "Turnstile";
+    CaptchaType["Cap"] = "Cap";
 })(CaptchaType || (CaptchaType = {}));
 export var RecaptchaEnterpriseMode;
 (function (RecaptchaEnterpriseMode) {
@@ -21,8 +22,27 @@ export const recaptchaEnterpriseConfigGuard = z.object({
     projectId: z.string(),
     domain: z.string().optional(),
     mode: z.nativeEnum(RecaptchaEnterpriseMode).optional(),
+    scoreThreshold: z.number().min(0).max(1).optional(),
+});
+/**
+ * Config of a self-hosted Cap Standalone instance.
+ *
+ * @see https://capjs.js.org/guide/standalone/
+ */
+export const capConfigGuard = z.object({
+    type: z.literal(CaptchaType.Cap),
+    /** The public base URL of the Cap Standalone instance, e.g. `https://cap.example.com`. */
+    endpoint: z
+        .string()
+        .url()
+        .refine((value) => ['http:', 'https:'].includes(new URL(value).protocol), {
+        message: 'The endpoint must be an HTTP(S) URL.',
+    }),
+    siteKey: z.string(),
+    secretKey: z.string(),
 });
 export const captchaConfigGuard = z.discriminatedUnion('type', [
     turnstileConfigGuard,
     recaptchaEnterpriseConfigGuard,
+    capConfigGuard,
 ]);

package/lib/foundations/jsonb-types/hooks.d.ts

@@ -14,6 +14,7 @@ export declare enum InteractionHookEvent {
 }
 export declare enum DataHookSchema {
     User = "User",
+    TrustedDevice = "TrustedDevice",
     Role = "Role",
     Scope = "Scope",
     Organization = "Organization",
@@ -28,16 +29,16 @@ declare enum DataHookDetailMutationType {
     Updated = "Updated"
 }
 type BasicDataHookEvent = `${DataHookSchema}.${DataHookBasicMutationType}`;
-type CustomDataHookMutableSchema = `${DataHookSchema}.Data` | `${DataHookSchema.User}.SuspensionStatus` | `${DataHookSchema.Role}.Scopes` | `${DataHookSchema.Organization}.Membership` | `${DataHookSchema.OrganizationRole}.Scopes`;
+type CustomDataHookMutableSchema = `${Exclude<DataHookSchema, DataHookSchema.TrustedDevice>}.Data` | `${DataHookSchema.User}.SuspensionStatus` | `${DataHookSchema.Role}.Scopes` | `${DataHookSchema.Organization}.Membership` | `${DataHookSchema.OrganizationRole}.Scopes`;
 type DataHookPropertyUpdateEvent = `${CustomDataHookMutableSchema}.${DataHookDetailMutationType.Updated}`;
 export type ExceptionHookEvent = 'Identifier.Lockout' | 'Message.RateLimited' | 'Grant.LimitExceeded';
 export type DataHookEvent = BasicDataHookEvent | DataHookPropertyUpdateEvent;
 /** The hook event values that can be registered. */
-export declare const hookEvents: readonly [InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"];
+export declare const hookEvents: readonly [InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "TrustedDevice.Created", "TrustedDevice.Deleted", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"];
 /** The type of hook event values that can be registered. */
 export type HookEvent = (typeof hookEvents)[number];
-export declare const hookEventGuard: z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"]>;
-export declare const hookEventsGuard: z.ZodArray<z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"]>, "many">;
+export declare const hookEventGuard: z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "TrustedDevice.Created", "TrustedDevice.Deleted", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"]>;
+export declare const hookEventsGuard: z.ZodArray<z.ZodEnum<[InteractionHookEvent.PostRegister, InteractionHookEvent.PostSignIn, InteractionHookEvent.PostSignInAdaptiveMfaTriggered, InteractionHookEvent.PostResetPassword, "User.Created", "User.Deleted", "User.Data.Updated", "User.SuspensionStatus.Updated", "TrustedDevice.Created", "TrustedDevice.Deleted", "Role.Created", "Role.Deleted", "Role.Data.Updated", "Role.Scopes.Updated", "Scope.Created", "Scope.Deleted", "Scope.Data.Updated", "Organization.Created", "Organization.Deleted", "Organization.Data.Updated", "Organization.Membership.Updated", "OrganizationRole.Created", "OrganizationRole.Deleted", "OrganizationRole.Data.Updated", "OrganizationRole.Scopes.Updated", "OrganizationScope.Created", "OrganizationScope.Deleted", "OrganizationScope.Data.Updated", "Identifier.Lockout", "Message.RateLimited", "Grant.LimitExceeded"]>, "many">;
 export type HookEvents = z.infer<typeof hookEventsGuard>;
 export declare const interactionHookEventGuard: z.ZodNativeEnum<typeof InteractionHookEvent>;
 /**

package/lib/foundations/jsonb-types/hooks.js

@@ -18,6 +18,7 @@ export var InteractionHookEvent;
 export var DataHookSchema;
 (function (DataHookSchema) {
     DataHookSchema["User"] = "User";
+    DataHookSchema["TrustedDevice"] = "TrustedDevice";
     DataHookSchema["Role"] = "Role";
     DataHookSchema["Scope"] = "Scope";
     DataHookSchema["Organization"] = "Organization";
@@ -43,6 +44,8 @@ export const hookEvents = Object.freeze([
     'User.Deleted',
     'User.Data.Updated',
     'User.SuspensionStatus.Updated',
+    'TrustedDevice.Created',
+    'TrustedDevice.Deleted',
     'Role.Created',
     'Role.Deleted',
     'Role.Data.Updated',

package/lib/foundations/jsonb-types/logs.d.ts

@@ -362,7 +362,13 @@ export declare const logContextPayloadGuard: z.ZodObject<{
         }, z.ZodUnknown, "strip">>>;
     }, z.ZodUnknown, "strip">>>;
     userId: z.ZodOptional<z.ZodString>;
+    /** Registered application ids only; a CIMD client identifier goes under {@link cimdClientId}. */
     applicationId: z.ZodOptional<z.ZodString>;
+    /**
+     * The CIMD client identifier URL, kept apart from `applicationId` so payload consumers
+     * branch on key presence instead of URL shape.
+     */
+    cimdClientId: z.ZodOptional<z.ZodString>;
     sessionId: z.ZodOptional<z.ZodString>;
     params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, "strip", z.ZodUnknown, z.objectOutputType<{
@@ -547,7 +553,13 @@ export declare const logContextPayloadGuard: z.ZodObject<{
         }, z.ZodUnknown, "strip">>>;
     }, z.ZodUnknown, "strip">>>;
     userId: z.ZodOptional<z.ZodString>;
+    /** Registered application ids only; a CIMD client identifier goes under {@link cimdClientId}. */
     applicationId: z.ZodOptional<z.ZodString>;
+    /**
+     * The CIMD client identifier URL, kept apart from `applicationId` so payload consumers
+     * branch on key presence instead of URL shape.
+     */
+    cimdClientId: z.ZodOptional<z.ZodString>;
     sessionId: z.ZodOptional<z.ZodString>;
     params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.ZodUnknown, "strip">, z.objectInputType<{
@@ -732,7 +744,13 @@ export declare const logContextPayloadGuard: z.ZodObject<{
         }, z.ZodUnknown, "strip">>>;
     }, z.ZodUnknown, "strip">>>;
     userId: z.ZodOptional<z.ZodString>;
+    /** Registered application ids only; a CIMD client identifier goes under {@link cimdClientId}. */
     applicationId: z.ZodOptional<z.ZodString>;
+    /**
+     * The CIMD client identifier URL, kept apart from `applicationId` so payload consumers
+     * branch on key presence instead of URL shape.
+     */
+    cimdClientId: z.ZodOptional<z.ZodString>;
     sessionId: z.ZodOptional<z.ZodString>;
     params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.ZodUnknown, "strip">>;

package/lib/foundations/jsonb-types/logs.js

@@ -64,7 +64,13 @@ export const logContextPayloadGuard = z
     userAgent: z.string().optional(),
     userAgentParsed: userAgentParsedGuard.optional(),
     userId: z.string().optional(),
+    /** Registered application ids only; a CIMD client identifier goes under {@link cimdClientId}. */
     applicationId: z.string().optional(),
+    /**
+     * The CIMD client identifier URL, kept apart from `applicationId` so payload consumers
+     * branch on key presence instead of URL shape.
+     */
+    cimdClientId: z.string().optional(),
     sessionId: z.string().optional(),
     params: z.record(z.string(), z.unknown()).optional(),
 })

package/lib/foundations/jsonb-types/saml-application-configs.d.ts

@@ -49,6 +49,29 @@ export declare const samlEncryptionGuard: z.ZodEffects<z.ZodObject<{
     certificate?: string | undefined;
 }>;
 export type SamlEncryption = z.input<typeof samlEncryptionGuard>;
+/** Authentication and request-signature policy for a SAML application. */
+export declare const samlAuthnRequestConfigGuard: z.ZodEffects<z.ZodObject<{
+    forceAuthn: z.ZodOptional<z.ZodBoolean>;
+    requireSignedAuthnRequests: z.ZodOptional<z.ZodBoolean>;
+    signingCertificate: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    forceAuthn?: boolean | undefined;
+    requireSignedAuthnRequests?: boolean | undefined;
+    signingCertificate?: string | undefined;
+}, {
+    forceAuthn?: boolean | undefined;
+    requireSignedAuthnRequests?: boolean | undefined;
+    signingCertificate?: string | undefined;
+}>, {
+    forceAuthn?: boolean | undefined;
+    requireSignedAuthnRequests?: boolean | undefined;
+    signingCertificate?: string | undefined;
+}, {
+    forceAuthn?: boolean | undefined;
+    requireSignedAuthnRequests?: boolean | undefined;
+    signingCertificate?: string | undefined;
+}>;
+export type SamlAuthnRequestConfig = z.infer<typeof samlAuthnRequestConfigGuard>;
 export declare enum NameIdFormat {
     /** Uses unique and persistent identifiers for the user. */
     Persistent = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",

package/lib/foundations/jsonb-types/saml-application-configs.js

@@ -28,6 +28,22 @@ export const samlEncryptionGuard = z
         return z.NEVER;
     }
 });
+/** Authentication and request-signature policy for a SAML application. */
+export const samlAuthnRequestConfigGuard = z
+    .object({
+    forceAuthn: z.boolean().optional(),
+    requireSignedAuthnRequests: z.boolean().optional(),
+    signingCertificate: z.string().trim().min(1).optional(),
+})
+    .superRefine(({ requireSignedAuthnRequests, signingCertificate }, ctx) => {
+    if (requireSignedAuthnRequests && !signingCertificate) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['signingCertificate'],
+            message: '`signingCertificate` is required when `requireSignedAuthnRequests` is `true`',
+        });
+    }
+});
 export var NameIdFormat;
 (function (NameIdFormat) {
     /** Uses unique and persistent identifiers for the user. */

package/lib/foundations/jsonb-types/saml-application-configs.test.js

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { samlEncryptionGuard } from './saml-application-configs.js';
+import { samlEncryptionGuard, samlAuthnRequestConfigGuard } from './saml-application-configs.js';
 describe('samlEncryptionGuard', () => {
     // Test valid configurations
     it('should pass when encryption is disabled', () => {
@@ -47,3 +47,26 @@ describe('samlEncryptionGuard', () => {
         }
     });
 });
+describe('samlAuthnRequestConfigGuard', () => {
+    it('keeps the per-application force-login setting', () => {
+        expect(samlAuthnRequestConfigGuard.parse({ forceAuthn: true })).toEqual({ forceAuthn: true });
+    });
+    it('allows default session reuse', () => {
+        expect(samlAuthnRequestConfigGuard.parse({})).toEqual({});
+    });
+    it('rejects a non-boolean force-login setting', () => {
+        expect(samlAuthnRequestConfigGuard.safeParse({ forceAuthn: 'true' }).success).toBe(false);
+    });
+});
+describe('signed AuthnRequest policy', () => {
+    it('requires a signing certificate when signatures are required', () => {
+        expect(samlAuthnRequestConfigGuard.safeParse({ requireSignedAuthnRequests: true }).success).toBe(false);
+    });
+    it('keeps the configured trust certificate', () => {
+        const config = { requireSignedAuthnRequests: true, signingCertificate: 'certificate' };
+        expect(samlAuthnRequestConfigGuard.parse(config)).toEqual(config);
+    });
+    it.each(['', '   '])('rejects an empty certificate: %j', (signingCertificate) => {
+        expect(samlAuthnRequestConfigGuard.safeParse({ signingCertificate }).success).toBe(false);
+    });
+});

package/lib/foundations/jsonb-types/sign-in-experience.d.ts

@@ -51,13 +51,13 @@ export declare const brandingGuard: z.ZodObject<{
 export type Branding = z.infer<typeof brandingGuard>;
 export declare const languageInfoGuard: z.ZodObject<{
     autoDetect: z.ZodBoolean;
-    fallbackLanguage: z.ZodType<"af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR", z.ZodTypeDef, "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR">;
+    fallbackLanguage: z.ZodType<"af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "es-MX" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR", z.ZodTypeDef, "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "es-MX" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR">;
 }, "strip", z.ZodTypeAny, {
     autoDetect: boolean;
-    fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
+    fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "es-MX" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
 }, {
     autoDetect: boolean;
-    fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
+    fallbackLanguage: "af-ZA" | "am-ET" | "ar" | "ar-AR" | "as-IN" | "az-AZ" | "be-BY" | "bg-BG" | "bn-IN" | "br-FR" | "bs-BA" | "ca-ES" | "cb-IQ" | "co-FR" | "cs" | "cs-CZ" | "cx-PH" | "cy-GB" | "da-DK" | "de" | "de-DE" | "el-GR" | "en" | "en-GB" | "en-US" | "eo-EO" | "es" | "es-ES" | "es-419" | "es-MX" | "et-EE" | "eu-ES" | "fa-IR" | "ff-NG" | "fi" | "fi-FI" | "fo-FO" | "fr" | "fr-CA" | "fr-FR" | "fy-NL" | "ga-IE" | "gl-ES" | "gn-PY" | "gu-IN" | "ha-NG" | "he-IL" | "hi-IN" | "hr-HR" | "ht-HT" | "hu-HU" | "hy-AM" | "id-ID" | "ik-US" | "is-IS" | "it" | "it-IT" | "iu-CA" | "ja" | "ja-JP" | "ja-KS" | "jv-ID" | "ka-GE" | "kk-KZ" | "km-KH" | "kn-IN" | "ko" | "ko-KR" | "ku-TR" | "ky-KG" | "lo-LA" | "lt-LT" | "lv-LV" | "mg-MG" | "mk-MK" | "ml-IN" | "mn-MN" | "mr-IN" | "ms-MY" | "mt-MT" | "my-MM" | "nb-NO" | "ne-NP" | "nl" | "nl-BE" | "nl-NL" | "nn-NO" | "or-IN" | "pa-IN" | "pl-PL" | "ps-AF" | "pt" | "pt-BR" | "pt-PT" | "ro-RO" | "ru" | "ru-RU" | "rw-RW" | "sc-IT" | "si-LK" | "sk-SK" | "sl-SI" | "sn-ZW" | "sq-AL" | "sr-RS" | "sv" | "sv-SE" | "sw-KE" | "sy-SY" | "sz-PL" | "ta-IN" | "te-IN" | "tg-TJ" | "th" | "th-TH" | "tl-PH" | "tr" | "tr-TR" | "tt-RU" | "tz-MA" | "uk-UA" | "ur-PK" | "uz-UZ" | "vi-VN" | "zh" | "zh-CN" | "zh-HK" | "zh-MO" | "zh-TW" | "zz-TR";
 }>;
 export type LanguageInfo = z.infer<typeof languageInfoGuard>;
 export declare enum SignInIdentifier {
@@ -320,6 +320,26 @@ export declare const adaptiveMfaGuard: z.ZodObject<{
 }, {
     enabled?: boolean | undefined;
 }>;
+/** Stored tenant-level overrides for MFA trusted-device credentials. */
+export type TrustedDevicePolicy = {
+    enabled?: boolean;
+    durationDays?: number;
+};
+/** Default trusted-device policy for newly created sign-in experiences. */
+export declare const defaultTrustedDevicePolicy: Readonly<{
+    enabled: false;
+    durationDays: 30;
+}>;
+export declare const trustedDevicePolicyGuard: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    durationDays: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    enabled?: boolean | undefined;
+    durationDays?: number | undefined;
+}, {
+    enabled?: boolean | undefined;
+    durationDays?: number | undefined;
+}>;
 export declare const customUiAssetsGuard: z.ZodObject<{
     id: z.ZodString;
     createdAt: z.ZodNumber;

package/lib/foundations/jsonb-types/sign-in-experience.js

@@ -112,6 +112,15 @@ export const mfaGuard = z.object({
 export const adaptiveMfaGuard = z.object({
     enabled: z.boolean().optional(),
 });
+/** Default trusted-device policy for newly created sign-in experiences. */
+export const defaultTrustedDevicePolicy = Object.freeze({
+    enabled: false,
+    durationDays: 30,
+});
+export const trustedDevicePolicyGuard = z.object({
+    enabled: z.boolean().optional(),
+    durationDays: z.number().int().min(1).max(365).optional(),
+});
 export const customUiAssetsGuard = z.object({
     id: z.string(),
     createdAt: z.number(),

package/lib/foundations/jsonb-types/sign-in-experience.test.js

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { customUiCspGuard, passwordExpirationPolicyGuard } from './sign-in-experience.js';
+import { customUiCspGuard, defaultTrustedDevicePolicy, passwordExpirationPolicyGuard, trustedDevicePolicyGuard, } from './sign-in-experience.js';
 describe('customUiCspGuard', () => {
     it.each([
         {},
@@ -64,3 +64,19 @@ describe('passwordExpirationPolicyGuard', () => {
         expect(passwordExpirationPolicyGuard.safeParse(value).success).toBe(false);
     });
 });
+describe('trustedDevicePolicyGuard', () => {
+    it.each([{}, { enabled: false }, { durationDays: 1 }, { enabled: true, durationDays: 365 }])('accepts valid policy %p', (value) => {
+        expect(trustedDevicePolicyGuard.parse(value)).toEqual(value);
+    });
+    it.each([{ durationDays: 0 }, { durationDays: 366 }, { durationDays: 1.5 }])('rejects invalid policy %p', (value) => {
+        expect(trustedDevicePolicyGuard.safeParse(value).success).toBe(false);
+    });
+    it('provides the complete effective default', () => {
+        expect(defaultTrustedDevicePolicy).toEqual({ enabled: false, durationDays: 30 });
+        expect(trustedDevicePolicyGuard.safeParse(defaultTrustedDevicePolicy).success).toBe(true);
+    });
+    it('rejects invalid enabled values', () => {
+        const value = { enabled: 'true' };
+        expect(trustedDevicePolicyGuard.safeParse(value).success).toBe(false);
+    });
+});