@logto/schemas 1.42.0 → 1.44.0

package/lib/types/connector.d.ts

@@ -255,6 +255,7 @@ export declare const connectorResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -389,6 +390,7 @@ export declare const connectorResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -593,6 +595,7 @@ export declare const connectorResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -727,6 +730,7 @@ export declare const connectorResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -1136,6 +1140,7 @@ export declare const connectorFactoryResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -1270,6 +1275,7 @@ export declare const connectorFactoryResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -1467,6 +1473,7 @@ export declare const connectorFactoryResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;
@@ -1601,6 +1608,7 @@ export declare const connectorFactoryResponseGuard: z.ZodObject<{
         es?: string | undefined;
         "es-ES"?: string | undefined;
         "es-419"?: string | undefined;
+        "es-MX"?: string | undefined;
         "et-EE"?: string | undefined;
         "eu-ES"?: string | undefined;
         "fa-IR"?: string | undefined;

package/lib/types/consent.d.ts

@@ -54,6 +54,7 @@ export declare const publicUserInfoGuard: z.ZodObject<Pick<{
         }>;
     }>>;
     applicationId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    cimdClientId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     identities: z.ZodType<Record<string, {
         userId: string;
         details?: Record<string, import("@withtyped/server").Json> | undefined;
@@ -144,102 +145,15 @@ export declare const publicUserInfoGuard: z.ZodObject<Pick<{
 export type PublicUserInfo = z.infer<typeof publicUserInfoGuard>;
 /**
  * Define the public application info that can be exposed to the public. e.g. on the user consent page.
+ *
+ * The overrides lift the applications-table column length bounds for CIMD clients: `id` carries
+ * the identifier URL (up to 2048 characters), and `name` the remote document's `client_name`,
+ * which is unbounded and empty when the document omits it.
  */
-export declare const publicApplicationGuard: z.ZodObject<Pick<{
-    tenantId: z.ZodType<string, z.ZodTypeDef, string>;
-    id: z.ZodType<string, z.ZodTypeDef, string>;
-    name: z.ZodType<string, z.ZodTypeDef, string>;
-    secret: z.ZodType<string, z.ZodTypeDef, string>;
-    description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-    type: z.ZodType<import("../db-entries/custom-types.js").ApplicationType, z.ZodTypeDef, import("../db-entries/custom-types.js").ApplicationType>;
-    oidcClientMetadata: z.ZodType<import("../index.js").OidcClientMetadata, z.ZodTypeDef, import("../index.js").OidcClientMetadata>;
-    customClientMetadata: z.ZodType<{
-        corsAllowedOrigins?: string[] | undefined;
-        idTokenTtl?: number | undefined;
-        refreshTokenTtl?: number | undefined;
-        refreshTokenTtlInDays?: number | undefined;
-        tenantId?: string | undefined;
-        alwaysIssueRefreshToken?: boolean | undefined;
-        rotateRefreshToken?: boolean | undefined;
-        allowTokenExchange?: boolean | undefined;
-        isDeviceFlow?: boolean | undefined;
-        maxAllowedGrants?: number | undefined;
-    }, z.ZodTypeDef, {
-        corsAllowedOrigins?: string[] | undefined;
-        idTokenTtl?: number | undefined;
-        refreshTokenTtl?: number | undefined;
-        refreshTokenTtlInDays?: number | undefined;
-        tenantId?: string | undefined;
-        alwaysIssueRefreshToken?: boolean | undefined;
-        rotateRefreshToken?: boolean | undefined;
-        allowTokenExchange?: boolean | undefined;
-        isDeviceFlow?: boolean | undefined;
-        maxAllowedGrants?: number | undefined;
-    }>;
-    protectedAppMetadata: z.ZodType<{
-        host: string;
-        origin: string;
-        sessionDuration: number;
-        pageRules: {
-            path: string;
-        }[];
-        additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
-        customDomains?: {
-            status: import("../index.js").DomainStatus;
-            domain: string;
-            errorMessage: string | null;
-            dnsRecords: {
-                value: string;
-                type: string;
-                name: string;
-            }[];
-            cloudflareData: {
-                status: string;
-                id: string;
-                ssl: {
-                    status: string;
-                    validation_errors?: {
-                        message: string;
-                    }[] | undefined;
-                };
-                verification_errors?: string[] | undefined;
-            } | null;
-        }[] | undefined;
-    } | null, z.ZodTypeDef, {
-        host: string;
-        origin: string;
-        sessionDuration: number;
-        pageRules: {
-            path: string;
-        }[];
-        additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
-        customDomains?: {
-            status: import("../index.js").DomainStatus;
-            domain: string;
-            errorMessage: string | null;
-            dnsRecords: {
-                value: string;
-                type: string;
-                name: string;
-            }[];
-            cloudflareData: {
-                status: string;
-                id: string;
-                ssl: {
-                    status: string;
-                    validation_errors?: {
-                        message: string;
-                    }[] | undefined;
-                };
-                verification_errors?: string[] | undefined;
-            } | null;
-        }[] | undefined;
-    } | null>;
-    customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
-    isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
-    appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
-    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
-}, "name" | "id">, "strip", z.ZodTypeAny, {
+export declare const publicApplicationGuard: z.ZodObject<{} & {
+    id: z.ZodString;
+    name: z.ZodString;
+}, "strip", z.ZodTypeAny, {
     name: string;
     id: string;
 }, {
@@ -357,6 +271,7 @@ export declare const publicOrganizationGuard: z.ZodObject<Pick<{
     description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
     isMfaRequired: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    isTrustedDeviceAllowed: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     color: z.ZodType<Partial<{
         primaryColor: string;
         isDarkModeEnabled: boolean;
@@ -471,101 +386,10 @@ export declare const publicOrganizationGuard: z.ZodObject<Pick<{
 }>;
 export type PublicOrganization = z.infer<typeof publicOrganizationGuard>;
 export declare const consentInfoResponseGuard: z.ZodObject<{
-    application: z.ZodObject<Pick<{
-        tenantId: z.ZodType<string, z.ZodTypeDef, string>;
-        id: z.ZodType<string, z.ZodTypeDef, string>;
-        name: z.ZodType<string, z.ZodTypeDef, string>;
-        secret: z.ZodType<string, z.ZodTypeDef, string>;
-        description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-        type: z.ZodType<import("../db-entries/custom-types.js").ApplicationType, z.ZodTypeDef, import("../db-entries/custom-types.js").ApplicationType>;
-        oidcClientMetadata: z.ZodType<import("../index.js").OidcClientMetadata, z.ZodTypeDef, import("../index.js").OidcClientMetadata>;
-        customClientMetadata: z.ZodType<{
-            corsAllowedOrigins?: string[] | undefined;
-            idTokenTtl?: number | undefined;
-            refreshTokenTtl?: number | undefined;
-            refreshTokenTtlInDays?: number | undefined;
-            tenantId?: string | undefined;
-            alwaysIssueRefreshToken?: boolean | undefined;
-            rotateRefreshToken?: boolean | undefined;
-            allowTokenExchange?: boolean | undefined;
-            isDeviceFlow?: boolean | undefined;
-            maxAllowedGrants?: number | undefined;
-        }, z.ZodTypeDef, {
-            corsAllowedOrigins?: string[] | undefined;
-            idTokenTtl?: number | undefined;
-            refreshTokenTtl?: number | undefined;
-            refreshTokenTtlInDays?: number | undefined;
-            tenantId?: string | undefined;
-            alwaysIssueRefreshToken?: boolean | undefined;
-            rotateRefreshToken?: boolean | undefined;
-            allowTokenExchange?: boolean | undefined;
-            isDeviceFlow?: boolean | undefined;
-            maxAllowedGrants?: number | undefined;
-        }>;
-        protectedAppMetadata: z.ZodType<{
-            host: string;
-            origin: string;
-            sessionDuration: number;
-            pageRules: {
-                path: string;
-            }[];
-            additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
-            customDomains?: {
-                status: import("../index.js").DomainStatus;
-                domain: string;
-                errorMessage: string | null;
-                dnsRecords: {
-                    value: string;
-                    type: string;
-                    name: string;
-                }[];
-                cloudflareData: {
-                    status: string;
-                    id: string;
-                    ssl: {
-                        status: string;
-                        validation_errors?: {
-                            message: string;
-                        }[] | undefined;
-                    };
-                    verification_errors?: string[] | undefined;
-                } | null;
-            }[] | undefined;
-        } | null, z.ZodTypeDef, {
-            host: string;
-            origin: string;
-            sessionDuration: number;
-            pageRules: {
-                path: string;
-            }[];
-            additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
-            customDomains?: {
-                status: import("../index.js").DomainStatus;
-                domain: string;
-                errorMessage: string | null;
-                dnsRecords: {
-                    value: string;
-                    type: string;
-                    name: string;
-                }[];
-                cloudflareData: {
-                    status: string;
-                    id: string;
-                    ssl: {
-                        status: string;
-                        validation_errors?: {
-                            message: string;
-                        }[] | undefined;
-                    };
-                    verification_errors?: string[] | undefined;
-                } | null;
-            }[] | undefined;
-        } | null>;
-        customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
-        isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
-        appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
-        createdAt: z.ZodType<number, z.ZodTypeDef, number>;
-    }, "name" | "id"> & {
+    application: z.ZodObject<{} & {
+        id: z.ZodString;
+        name: z.ZodString;
+    } & {
         displayName: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
         branding: z.ZodOptional<z.ZodType<{
             logoUrl?: string | undefined;
@@ -657,6 +481,7 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
             }>;
         }>>;
         applicationId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+        cimdClientId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
         identities: z.ZodType<Record<string, {
             userId: string;
             details?: Record<string, import("@withtyped/server").Json> | undefined;
@@ -751,6 +576,7 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
         description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
         customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
         isMfaRequired: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+        isTrustedDeviceAllowed: z.ZodType<boolean, z.ZodTypeDef, boolean>;
         color: z.ZodType<Partial<{
             primaryColor: string;
             isDarkModeEnabled: boolean;

package/lib/types/consent.js

@@ -13,10 +13,19 @@ export const publicUserInfoGuard = Users.guard.pick({
 });
 /**
  * Define the public application info that can be exposed to the public. e.g. on the user consent page.
+ *
+ * The overrides lift the applications-table column length bounds for CIMD clients: `id` carries
+ * the identifier URL (up to 2048 characters), and `name` the remote document's `client_name`,
+ * which is unbounded and empty when the document omits it.
  */
-export const publicApplicationGuard = Applications.guard.pick({
+export const publicApplicationGuard = Applications.guard
+    .pick({
     id: true,
     name: true,
+})
+    .extend({
+    id: z.string(),
+    name: z.string(),
 });
 export const applicationSignInExperienceGuard = ApplicationSignInExperiences.guard.pick({
     branding: true,

package/lib/types/cookie.d.ts

@@ -3,17 +3,21 @@ export type LogtoUiCookie = Partial<{
     appId: string;
     organizationId: string;
     uiLocales: string;
+    theme: string;
 }>;
 export declare const logtoUiCookieGuard: z.ZodObject<{
     appId: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
     uiLocales: z.ZodOptional<z.ZodString>;
+    theme: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     organizationId?: string | undefined;
     appId?: string | undefined;
     uiLocales?: string | undefined;
+    theme?: string | undefined;
 }, {
     organizationId?: string | undefined;
     appId?: string | undefined;
     uiLocales?: string | undefined;
+    theme?: string | undefined;
 }>;

package/lib/types/cookie.js

@@ -1,4 +1,9 @@
 import { z } from 'zod';
 export const logtoUiCookieGuard = z
-    .object({ appId: z.string(), organizationId: z.string(), uiLocales: z.string() })
+    .object({
+    appId: z.string(),
+    organizationId: z.string(),
+    uiLocales: z.string(),
+    theme: z.string(),
+})
     .partial();

package/lib/types/custom-profile-fields.d.ts

@@ -2457,6 +2457,7 @@ export declare const signInIdentifierKeyGuard: z.ZodObject<Pick<{
         }>;
     }>>>;
     applicationId: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
+    cimdClientId: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
     identities: z.ZodOptional<z.ZodType<Record<string, {
         userId: string;
         details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;

package/lib/types/hook.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { type Application, type User } from '../db-entries/index.js';
+import { type Application, type TrustedDevice, type User } from '../db-entries/index.js';
 import { type ExceptionHookEvent, type DataHookEvent, type InteractionHookEvent } from '../foundations/index.js';
 import { type InteractionEvent } from './interactions.js';
 import { type userInfoSelectFields } from './user.js';
@@ -18,8 +18,8 @@ export declare const hookResponseGuard: z.ZodObject<{
     tenantId: z.ZodType<string, z.ZodTypeDef, string>;
     id: z.ZodType<string, z.ZodTypeDef, string>;
     name: z.ZodType<string, z.ZodTypeDef, string>;
-    event: z.ZodType<"User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent | null, z.ZodTypeDef, "User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent | null>;
-    events: z.ZodType<("User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent)[], z.ZodTypeDef, ("User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent)[]>;
+    event: z.ZodType<"User.Created" | "User.Deleted" | "TrustedDevice.Created" | "TrustedDevice.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent | null, z.ZodTypeDef, "User.Created" | "User.Deleted" | "TrustedDevice.Created" | "TrustedDevice.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent | null>;
+    events: z.ZodType<("User.Created" | "User.Deleted" | "TrustedDevice.Created" | "TrustedDevice.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent)[], z.ZodTypeDef, ("User.Created" | "User.Deleted" | "TrustedDevice.Created" | "TrustedDevice.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | "Grant.LimitExceeded" | InteractionHookEvent)[]>;
     config: z.ZodType<{
         url: string;
         headers?: Record<string, string> | undefined;
@@ -90,8 +90,13 @@ export type HookTestErrorResponseData = z.infer<typeof hookTestErrorResponseData
  * we will store the context before processing the interaction and consume it after the interaction is processed if needed.
  */
 export type InteractionApiMetadata = {
-    /** The application ID if the hook is triggered by interaction API. */
+    /** The registered application ID if the hook is triggered by interaction API. */
     applicationId?: string;
+    /**
+     * The CIMD client identifier URL, kept apart from `applicationId` so payload consumers
+     * branch on key presence instead of URL shape.
+     */
+    cimdClientId?: string;
     /** The session ID if the hook is triggered by interaction API. */
     sessionId?: string;
     /** The InteractionEvent if the hook is triggered by interaction API. */
@@ -100,6 +105,8 @@ export type InteractionApiMetadata = {
 type InteractionApiContextPayload = {
     /** Fetch application detail by application ID before sending the hook event */
     application?: Pick<Application, 'id' | 'type' | 'name' | 'description'>;
+    /** CIMD clients are unregistered, so the identifier URL stands in for `application`. */
+    cimdClientId?: string;
     sessionId?: string;
     interactionEvent?: InteractionEvent;
 };
@@ -140,12 +147,30 @@ export type DataHookEventPayload = {
     userAgent?: string;
     data?: unknown;
 } & Partial<InteractionApiContextPayload> & Partial<ManagementApiContext> & Record<string, unknown>;
-export type ExceptionHookEventPayload = Omit<DataHookEventPayload, 'event'> & {
+/** The intentionally limited trusted-device projection exposed by lifecycle events. */
+export type TrustedDeviceEventData = Pick<TrustedDevice, 'id' | 'userId' | 'expiresAt'>;
+/**
+ * A key-remapping omit instead of the built-in `Omit`: on a type carrying a string index
+ * signature (e.g. the hook event payloads), `Omit` collapses every named property into
+ * `unknown`; the homomorphic form keeps the named properties typed.
+ */
+export type BetterOmit<T, Ignore> = {
+    [key in keyof T as key extends Ignore ? never : key]: T[key];
+};
+export type ExceptionHookEventPayload = BetterOmit<DataHookEventPayload, 'event'> & {
     event: ExceptionHookEvent;
 };
 export type GrantLimitExceededEventData = {
     userId: string;
-    applicationId: string;
+    /** The registered application ID; absent for a CIMD client. */
+    applicationId?: string;
+    /**
+     * The CIMD client identifier URL, set instead of `applicationId`. No grant-ceiling source
+     * exists for CIMD clients today (the CIMD policy denies Logto private client metadata
+     * regardless of source), so this key is defensive: it keeps `applicationId` registered-only
+     * by construction should a ceiling for CIMD clients ever be introduced.
+     */
+    cimdClientId?: string;
     revokedGrantIds: string[];
     maxAllowedGrants: number;
     preRevocationActiveGrantCount: number;

package/lib/types/index.d.ts

@@ -36,3 +36,5 @@ export * from './custom-profile-fields.js';
 export * from './secrets.js';
 export * from './user-logto-config.js';
 export * from './user-sessions.js';
+export * from './trusted-device.js';
+export * from './authentication-context.js';

package/lib/types/index.js

@@ -36,3 +36,5 @@ export * from './custom-profile-fields.js';
 export * from './secrets.js';
 export * from './user-logto-config.js';
 export * from './user-sessions.js';
+export * from './trusted-device.js';
+export * from './authentication-context.js';

package/lib/types/interactions.d.ts

@@ -1,7 +1,9 @@
 import { z } from 'zod';
 import { AdditionalIdentifier, MfaFactor, SignInIdentifier } from '../foundations/index.js';
+import { type RequestedAuthenticationContext } from './authentication-context.js';
 import { InteractionEvent } from './interaction-event.js';
 import type { EmailVerificationCodePayload, PhoneVerificationCodePayload } from './verification-code.js';
+import { VerificationType } from './verification-records/verification-type.js';
 export { eventGuard, InteractionEvent } from './interaction-event.js';
 export type VerificationIdentifier = {
     type: SignInIdentifier | AdditionalIdentifier;
@@ -57,6 +59,55 @@ export declare const verificationCodeIdentifierGuard: z.ZodDiscriminatedUnion<"t
     value: string;
     type: SignInIdentifier.Phone;
 }>]>;
+/**
+ * The subject-bound verification code identifier: the type alone. Accepted once the interaction
+ * carries a subject; core fills the value from that user's primary email / phone. A present
+ * `value` is rejected so a malformed full identifier is never mistaken for this shape.
+ */
+export type SubjectVerificationCodeIdentifier = {
+    type: VerificationCodeSignInIdentifier;
+    value?: undefined;
+};
+export declare const subjectVerificationCodeIdentifierGuard: z.ZodObject<{
+    type: z.ZodEnum<[SignInIdentifier.Email, SignInIdentifier.Phone]>;
+    value: z.ZodUndefined;
+}, "strip", z.ZodTypeAny, {
+    type: SignInIdentifier.Email | SignInIdentifier.Phone;
+    value?: undefined;
+}, {
+    type: SignInIdentifier.Email | SignInIdentifier.Phone;
+    value?: undefined;
+}>;
+/** The full identifier, or the subject-bound shape. */
+export type VerificationCodeIdentifierPayload = VerificationCodeIdentifier | SubjectVerificationCodeIdentifier;
+export declare const verificationCodeIdentifierPayloadGuard: z.ZodUnion<[z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+    type: z.ZodLiteral<SignInIdentifier.Email>;
+    value: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    value: string;
+    type: SignInIdentifier.Email;
+}, {
+    value: string;
+    type: SignInIdentifier.Email;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<SignInIdentifier.Phone>;
+    value: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    value: string;
+    type: SignInIdentifier.Phone;
+}, {
+    value: string;
+    type: SignInIdentifier.Phone;
+}>]>, z.ZodObject<{
+    type: z.ZodEnum<[SignInIdentifier.Email, SignInIdentifier.Phone]>;
+    value: z.ZodUndefined;
+}, "strip", z.ZodTypeAny, {
+    type: SignInIdentifier.Email | SignInIdentifier.Phone;
+    value?: undefined;
+}, {
+    type: SignInIdentifier.Email | SignInIdentifier.Phone;
+    value?: undefined;
+}>]>;
 /** Payload type for `POST /api/experience/verification/{social|sso}/:connectorId/authorization-uri`. */
 export type SocialAuthorizationUrlPayload = {
     state: string;
@@ -128,6 +179,26 @@ export declare const passwordVerificationPayloadGuard: z.ZodObject<{
         type: SignInIdentifier;
     };
 }>;
+/**
+ * The subject-bound password payload: the password alone. Accepted only when the interaction
+ * carries a subject; the password is then verified against that user's credential.
+ */
+export type SubjectPasswordVerificationPayload = {
+    identifier?: undefined;
+    password: string;
+};
+export declare const subjectPasswordVerificationPayloadGuard: z.ZodObject<{
+    identifier: z.ZodUndefined;
+    password: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    password: string;
+    identifier?: undefined;
+}, {
+    password: string;
+    identifier?: undefined;
+}>;
+/** The full password payload, or the subject-bound shape. */
+export type PasswordVerificationRequestBody = PasswordVerificationPayload | SubjectPasswordVerificationPayload;
 /** Payload type for `POST /api/experience/verification/totp/verify`. */
 export type TotpVerificationVerifyPayload = {
     code: string;
@@ -472,6 +543,96 @@ export declare enum MissingProfile {
     emailOrPhone = "emailOrPhone",
     extraProfile = "extraProfile"
 }
+/** A social or enterprise SSO connector linked to the pinned user that can serve as subject proof. */
+export type SubjectProofConnector = {
+    type: 'social' | 'sso';
+    connectorId: string;
+};
+/**
+ * The masked primary identifiers of the pinned user. Only the masked values ever leave the
+ * server: the step-up UI shows them as hints and never supplies a raw identifier.
+ */
+export type MaskedIdentifiers = {
+    email?: string;
+    phone?: string;
+};
+/**
+ * The authentication context `GET /api/experience/interaction` exposes when the interaction was
+ * created from a login prompt that carries requested `acr_values`. The requested part is copied
+ * verbatim from the prompt details at creation and never mutated; the lists are evaluated on
+ * every read from the pinned user's enrolled methods and the context the interaction achieved so
+ * far, and are never persisted, so a factor change during the interaction's lifetime is reflected.
+ */
+export type InteractionAuthenticationContext = RequestedAuthenticationContext & {
+    /** The methods that can still contribute to the selected class from where the interaction stands. */
+    availableMethods: VerificationType[];
+    /** The first factors the user may establish under a fresh subject proof; `[]` until enrollment lands. */
+    establishableMethods: MissingProfile[];
+    /** The MFA factors the user may enroll after a fresh first factor; `[]` until enrollment lands. */
+    enrollableFactors: MfaFactor[];
+    /** The linked connectors that can serve as subject proof in pure step-up; `[]` until enrollment lands. */
+    subjectProofConnectors: SubjectProofConnector[];
+    maskedIdentifiers: MaskedIdentifiers;
+};
+export declare const interactionAuthenticationContextGuard: z.ZodObject<{
+    requestedAcrValues: z.ZodArray<z.ZodNativeEnum<typeof import("./authentication-context.js").LogtoAcr>, "many">;
+    selectedAcr: z.ZodOptional<z.ZodNativeEnum<typeof import("./authentication-context.js").LogtoAcr>>;
+    mode: z.ZodOptional<z.ZodNativeEnum<typeof import("./authentication-context.js").AuthenticationContextMode>>;
+} & {
+    availableMethods: z.ZodArray<z.ZodNativeEnum<typeof VerificationType>, "many">;
+    establishableMethods: z.ZodArray<z.ZodNativeEnum<typeof MissingProfile>, "many">;
+    enrollableFactors: z.ZodArray<z.ZodNativeEnum<typeof MfaFactor>, "many">;
+    subjectProofConnectors: z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<["social", "sso"]>;
+        connectorId: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        type: "social" | "sso";
+        connectorId: string;
+    }, {
+        type: "social" | "sso";
+        connectorId: string;
+    }>, "many">;
+    maskedIdentifiers: z.ZodObject<{
+        email: z.ZodOptional<z.ZodString>;
+        phone: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        email?: string | undefined;
+        phone?: string | undefined;
+    }, {
+        email?: string | undefined;
+        phone?: string | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    requestedAcrValues: import("./authentication-context.js").LogtoAcr[];
+    availableMethods: VerificationType[];
+    establishableMethods: MissingProfile[];
+    enrollableFactors: MfaFactor[];
+    subjectProofConnectors: {
+        type: "social" | "sso";
+        connectorId: string;
+    }[];
+    maskedIdentifiers: {
+        email?: string | undefined;
+        phone?: string | undefined;
+    };
+    mode?: import("./authentication-context.js").AuthenticationContextMode | undefined;
+    selectedAcr?: import("./authentication-context.js").LogtoAcr | undefined;
+}, {
+    requestedAcrValues: import("./authentication-context.js").LogtoAcr[];
+    availableMethods: VerificationType[];
+    establishableMethods: MissingProfile[];
+    enrollableFactors: MfaFactor[];
+    subjectProofConnectors: {
+        type: "social" | "sso";
+        connectorId: string;
+    }[];
+    maskedIdentifiers: {
+        email?: string | undefined;
+        phone?: string | undefined;
+    };
+    mode?: import("./authentication-context.js").AuthenticationContextMode | undefined;
+    selectedAcr?: import("./authentication-context.js").LogtoAcr | undefined;
+}>;
 export declare const bindTotpPayloadGuard: z.ZodObject<{
     type: z.ZodLiteral<MfaFactor.TOTP>;
     code: z.ZodString;