@logto/schemas 1.17.0 → 1.19.0

package/lib/types/logto-config/jwt-customizer.d.ts

@@ -1,8 +1,13 @@
-import { z } from 'zod';
+import { type ZodType, z } from 'zod';
+import { type Organization, type Role, type UserSsoIdentity } from '../../db-entries/index.js';
+import { type MfaFactors } from '../../foundations/index.js';
+import { GrantType } from '../oidc-config.js';
+import { type ScopeResponse } from '../scope.js';
+import { type UserInfo } from '../user.js';
 export declare const jwtCustomizerGuard: z.ZodObject<{
     script: z.ZodString;
     environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    contextSample: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>>;
+    contextSample: z.ZodOptional<z.ZodRecord<z.ZodString, ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>>;
 }, "strip", z.ZodTypeAny, {
     script: string;
     environmentVariables?: Record<string, string> | undefined;
@@ -16,12 +21,31 @@ export declare enum LogtoJwtTokenKeyType {
     AccessToken = "access-token",
     ClientCredentials = "client-credentials"
 }
-export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
-    name: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-    id: z.ZodType<string, z.ZodTypeDef, string>;
-    applicationId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-    username: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-    profile: z.ZodType<Partial<{
+export type JwtCustomizerUserContext = UserInfo & {
+    hasPassword: boolean;
+    ssoIdentities: Array<Pick<UserSsoIdentity, 'issuer' | 'identityId' | 'detail'>>;
+    mfaVerificationFactors: MfaFactors;
+    roles: Array<Pick<Role, 'id' | 'name' | 'description'> & {
+        scopes: Array<Pick<ScopeResponse, 'id' | 'name' | 'description' | 'resourceId' | 'resource'>>;
+    }>;
+    organizations: Array<Pick<Organization, 'id' | 'name' | 'description'>>;
+    organizationRoles: Array<{
+        organizationId: string;
+        roleId: string;
+        roleName: string;
+    }>;
+};
+export declare const jwtCustomizerUserContextGuard: z.ZodObject<z.objectUtil.extendShape<Pick<{
+    tenantId: ZodType<string, z.ZodTypeDef, string>;
+    id: ZodType<string, z.ZodTypeDef, string>;
+    username: ZodType<string | null, z.ZodTypeDef, string | null>;
+    primaryEmail: ZodType<string | null, z.ZodTypeDef, string | null>;
+    primaryPhone: ZodType<string | null, z.ZodTypeDef, string | null>;
+    passwordEncrypted: ZodType<string | null, z.ZodTypeDef, string | null>;
+    passwordEncryptionMethod: ZodType<import("../../db-entries/custom-types.js").UsersPasswordEncryptionMethod | null, z.ZodTypeDef, import("../../db-entries/custom-types.js").UsersPasswordEncryptionMethod | null>;
+    name: ZodType<string | null, z.ZodTypeDef, string | null>;
+    avatar: ZodType<string | null, z.ZodTypeDef, string | null>;
+    profile: ZodType<Partial<{
         familyName: string;
         givenName: string;
         middleName: string;
@@ -62,30 +86,82 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
             country: string;
         }>;
     }>>;
-    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
-    updatedAt: z.ZodType<number, z.ZodTypeDef, number>;
-    customData: z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
-    primaryEmail: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-    primaryPhone: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-    avatar: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-    identities: z.ZodType<Record<string, {
+    applicationId: ZodType<string | null, z.ZodTypeDef, string | null>;
+    identities: ZodType<Record<string, {
         userId: string;
         details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
     }>, z.ZodTypeDef, Record<string, {
         userId: string;
         details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
     }>>;
-    isSuspended: z.ZodType<boolean, z.ZodTypeDef, boolean>;
-    lastSignInAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
+    customData: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
+    logtoConfig: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
+    mfaVerifications: ZodType<({
+        type: import("../../foundations/index.js").MfaFactor.TOTP;
+        id: string;
+        key: string;
+        createdAt: string;
+        lastUsedAt?: string | undefined;
+    } | {
+        type: import("../../foundations/index.js").MfaFactor.WebAuthn;
+        id: string;
+        createdAt: string;
+        credentialId: string;
+        publicKey: string;
+        counter: number;
+        agent: string;
+        lastUsedAt?: string | undefined;
+        transports?: ("usb" | "nfc" | "ble" | "internal" | "cable" | "hybrid" | "smart-card")[] | undefined;
+    } | {
+        type: import("../../foundations/index.js").MfaFactor.BackupCode;
+        id: string;
+        createdAt: string;
+        codes: {
+            code: string;
+            usedAt?: string | undefined;
+        }[];
+        lastUsedAt?: string | undefined;
+    })[], z.ZodTypeDef, ({
+        type: import("../../foundations/index.js").MfaFactor.TOTP;
+        id: string;
+        key: string;
+        createdAt: string;
+        lastUsedAt?: string | undefined;
+    } | {
+        type: import("../../foundations/index.js").MfaFactor.WebAuthn;
+        id: string;
+        createdAt: string;
+        credentialId: string;
+        publicKey: string;
+        counter: number;
+        agent: string;
+        lastUsedAt?: string | undefined;
+        transports?: ("usb" | "nfc" | "ble" | "internal" | "cable" | "hybrid" | "smart-card")[] | undefined;
+    } | {
+        type: import("../../foundations/index.js").MfaFactor.BackupCode;
+        id: string;
+        createdAt: string;
+        codes: {
+            code: string;
+            usedAt?: string | undefined;
+        }[];
+        lastUsedAt?: string | undefined;
+    })[]>;
+    isSuspended: ZodType<boolean, z.ZodTypeDef, boolean>;
+    lastSignInAt: ZodType<number | null, z.ZodTypeDef, number | null>;
+    createdAt: ZodType<number, z.ZodTypeDef, number>;
+    updatedAt: ZodType<number, z.ZodTypeDef, number>;
+}, "name" | "id" | "applicationId" | "username" | "createdAt" | "profile" | "customData" | "updatedAt" | "primaryEmail" | "primaryPhone" | "avatar" | "identities" | "isSuspended" | "lastSignInAt">, {
+    hasPassword: z.ZodBoolean;
     ssoIdentities: z.ZodArray<z.ZodObject<Pick<{
-        tenantId: z.ZodType<string, z.ZodTypeDef, string>;
-        id: z.ZodType<string, z.ZodTypeDef, string>;
-        userId: z.ZodType<string, z.ZodTypeDef, string>;
-        issuer: z.ZodType<string, z.ZodTypeDef, string>;
-        identityId: z.ZodType<string, z.ZodTypeDef, string>;
-        detail: z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
-        createdAt: z.ZodType<number, z.ZodTypeDef, number>;
-        ssoConnectorId: z.ZodType<string, z.ZodTypeDef, string>;
+        tenantId: ZodType<string, z.ZodTypeDef, string>;
+        id: ZodType<string, z.ZodTypeDef, string>;
+        userId: ZodType<string, z.ZodTypeDef, string>;
+        issuer: ZodType<string, z.ZodTypeDef, string>;
+        identityId: ZodType<string, z.ZodTypeDef, string>;
+        detail: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
+        createdAt: ZodType<number, z.ZodTypeDef, number>;
+        ssoConnectorId: ZodType<string, z.ZodTypeDef, string>;
     }, "issuer" | "identityId" | "detail">, "strip", z.ZodTypeAny, {
         issuer: string;
         identityId: string;
@@ -96,19 +172,24 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
         detail: import("@withtyped/server/lib/types.js").JsonObject;
     }>, "many">;
     mfaVerificationFactors: z.ZodArray<z.ZodNativeEnum<typeof import("../../foundations/index.js").MfaFactor>, "many">;
-    roles: z.ZodArray<z.ZodObject<{
-        name: z.ZodType<string, z.ZodTypeDef, string>;
-        id: z.ZodType<string, z.ZodTypeDef, string>;
-        description: z.ZodType<string, z.ZodTypeDef, string>;
-        scopes: z.ZodArray<z.ZodObject<Pick<{
-            name: z.ZodType<string, z.ZodTypeDef, string>;
-            id: z.ZodType<string, z.ZodTypeDef, string>;
-            tenantId: z.ZodType<string, z.ZodTypeDef, string>;
-            createdAt: z.ZodType<number, z.ZodTypeDef, number>;
-            description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-            resourceId: z.ZodType<string, z.ZodTypeDef, string>;
+    roles: z.ZodArray<z.ZodObject<z.objectUtil.extendShape<Pick<{
+        tenantId: ZodType<string, z.ZodTypeDef, string>;
+        id: ZodType<string, z.ZodTypeDef, string>;
+        name: ZodType<string, z.ZodTypeDef, string>;
+        description: ZodType<string, z.ZodTypeDef, string>;
+        type: ZodType<import("../../db-entries/custom-types.js").RoleType, z.ZodTypeDef, import("../../db-entries/custom-types.js").RoleType>;
+        isDefault: ZodType<boolean, z.ZodTypeDef, boolean>;
+    }, "name" | "id" | "description">, {
+        scopes: z.ZodArray<z.ZodObject<Pick<z.objectUtil.extendShape<{
+            tenantId: ZodType<string, z.ZodTypeDef, string>;
+            id: ZodType<string, z.ZodTypeDef, string>;
+            resourceId: ZodType<string, z.ZodTypeDef, string>;
+            name: ZodType<string, z.ZodTypeDef, string>;
+            description: ZodType<string | null, z.ZodTypeDef, string | null>;
+            createdAt: ZodType<number, z.ZodTypeDef, number>;
+        }, {
             resource: import("../../foundations/schemas.js").Guard<import("../../db-entries/resource.js").Resource>;
-        }, "name" | "id" | "description" | "resource" | "resourceId">, "strip", z.ZodTypeAny, {
+        }>, "name" | "id" | "description" | "resource" | "resourceId">, "strip", z.ZodTypeAny, {
             name: string;
             id: string;
             description: string | null;
@@ -121,7 +202,7 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
             resource: import("../../db-entries/resource.js").Resource;
             resourceId: string;
         }>, "many">;
-    }, "strip", z.ZodTypeAny, {
+    }>, "strip", z.ZodTypeAny, {
         name: string;
         id: string;
         description: string;
@@ -145,12 +226,24 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
         }[];
     }>, "many">;
     organizations: z.ZodArray<z.ZodObject<Pick<{
-        tenantId: z.ZodType<string, z.ZodTypeDef, string>;
-        id: z.ZodType<string, z.ZodTypeDef, string>;
-        name: z.ZodType<string, z.ZodTypeDef, string>;
-        description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-        customData: z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
-        createdAt: z.ZodType<number, z.ZodTypeDef, number>;
+        tenantId: ZodType<string, z.ZodTypeDef, string>;
+        id: ZodType<string, z.ZodTypeDef, string>;
+        name: ZodType<string, z.ZodTypeDef, string>;
+        description: ZodType<string | null, z.ZodTypeDef, string | null>;
+        customData: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
+        isMfaRequired: ZodType<boolean, z.ZodTypeDef, boolean>;
+        branding: ZodType<{
+            logoUrl?: string | undefined;
+            darkLogoUrl?: string | undefined;
+            favicon?: string | undefined;
+            darkFavicon?: string | undefined;
+        }, z.ZodTypeDef, {
+            logoUrl?: string | undefined;
+            darkLogoUrl?: string | undefined;
+            favicon?: string | undefined;
+            darkFavicon?: string | undefined;
+        }>;
+        createdAt: ZodType<number, z.ZodTypeDef, number>;
     }, "name" | "id" | "description">, "strip", z.ZodTypeAny, {
         name: string;
         id: string;
@@ -173,35 +266,15 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
         roleId: string;
         roleName: string;
     }>, "many">;
-}, "strip", z.ZodTypeAny, {
+}>, "strip", z.ZodTypeAny, {
     name: string | null;
     id: string;
     applicationId: string | null;
     username: string | null;
-    profile: Partial<{
-        familyName: string;
-        givenName: string;
-        middleName: string;
-        nickname: string;
-        preferredUsername: string;
-        profile: string;
-        website: string;
-        gender: string;
-        birthdate: string;
-        zoneinfo: string;
-        locale: string;
-        address: Partial<{
-            formatted: string;
-            streetAddress: string;
-            locality: string;
-            region: string;
-            postalCode: string;
-            country: string;
-        }>;
-    }>;
     createdAt: number;
-    updatedAt: number;
+    profile: import("../../foundations/index.js").UserProfile;
     customData: import("@withtyped/server/lib/types.js").JsonObject;
+    updatedAt: number;
     organizations: {
         name: string;
         id: string;
@@ -222,12 +295,10 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
     primaryEmail: string | null;
     primaryPhone: string | null;
     avatar: string | null;
-    identities: Record<string, {
-        userId: string;
-        details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
-    }>;
+    identities: import("../../foundations/index.js").Identities;
     isSuspended: boolean;
     lastSignInAt: number | null;
+    hasPassword: boolean;
     ssoIdentities: {
         issuer: string;
         identityId: string;
@@ -244,30 +315,10 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
     id: string;
     applicationId: string | null;
     username: string | null;
-    profile: Partial<{
-        familyName: string;
-        givenName: string;
-        middleName: string;
-        nickname: string;
-        preferredUsername: string;
-        profile: string;
-        website: string;
-        gender: string;
-        birthdate: string;
-        zoneinfo: string;
-        locale: string;
-        address: Partial<{
-            formatted: string;
-            streetAddress: string;
-            locality: string;
-            region: string;
-            postalCode: string;
-            country: string;
-        }>;
-    }>;
     createdAt: number;
-    updatedAt: number;
+    profile: import("../../foundations/index.js").UserProfile;
     customData: import("@withtyped/server/lib/types.js").JsonObject;
+    updatedAt: number;
     organizations: {
         name: string;
         id: string;
@@ -288,12 +339,10 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
     primaryEmail: string | null;
     primaryPhone: string | null;
     avatar: string | null;
-    identities: Record<string, {
-        userId: string;
-        details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
-    }>;
+    identities: import("../../foundations/index.js").Identities;
     isSuspended: boolean;
     lastSignInAt: number | null;
+    hasPassword: boolean;
     ssoIdentities: {
         issuer: string;
         identityId: string;
@@ -306,10 +355,22 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
         roleName: string;
     }[];
 }>;
-export type JwtCustomizerUserContext = z.infer<typeof jwtCustomizerUserContextGuard>;
-export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
+export declare const jwtCustomizerGrantContextGuard: z.ZodObject<{
+    type: z.ZodLiteral<GrantType.TokenExchange>;
+    subjectTokenContext: z.ZodRecord<z.ZodString, ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>;
+}, "strip", z.ZodTypeAny, {
+    type: GrantType.TokenExchange;
+    subjectTokenContext: Record<string, import("@withtyped/server/lib/types.js").Json>;
+}, {
+    type: GrantType.TokenExchange;
+    subjectTokenContext: Record<string, import("@withtyped/server/lib/types.js").Json>;
+}>;
+export type JwtCustomizerGrantContext = z.infer<typeof jwtCustomizerGrantContextGuard>;
+export declare const accessTokenJwtCustomizerGuard: z.ZodObject<z.objectUtil.extendShape<{
     script: z.ZodString;
     environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    contextSample: z.ZodOptional<z.ZodRecord<z.ZodString, ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>>;
+}, {
     tokenSample: z.ZodOptional<z.ZodObject<{
         accountId: z.ZodOptional<z.ZodString>;
         expiresWithSession: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
@@ -323,37 +384,38 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
         scope: z.ZodOptional<z.ZodOptional<z.ZodString>>;
         clientId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
     }, "strict", z.ZodTypeAny, {
+        grantId?: string | undefined;
+        scope?: string | undefined;
         accountId?: string | undefined;
         expiresWithSession?: boolean | undefined;
-        grantId?: string | undefined;
         gty?: string | undefined;
         sessionUid?: string | undefined;
         sid?: string | undefined;
         kind?: "AccessToken" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     }, {
+        grantId?: string | undefined;
+        scope?: string | undefined;
         accountId?: string | undefined;
         expiresWithSession?: boolean | undefined;
-        grantId?: string | undefined;
         gty?: string | undefined;
         sessionUid?: string | undefined;
         sid?: string | undefined;
         kind?: "AccessToken" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     }>>;
     contextSample: z.ZodOptional<z.ZodObject<{
         user: z.ZodObject<{
-            name: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
-            id: z.ZodOptional<z.ZodType<string, z.ZodTypeDef, string>>;
-            applicationId: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
-            username: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
-            profile: z.ZodOptional<z.ZodType<Partial<{
+            name: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+            id: z.ZodOptional<ZodType<string, z.ZodTypeDef, string>>;
+            applicationId: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+            username: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+            createdAt: z.ZodOptional<ZodType<number, z.ZodTypeDef, number>>;
+            profile: z.ZodOptional<ZodType<Partial<{
                 familyName: string;
                 givenName: string;
                 middleName: string;
@@ -394,30 +456,30 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                     country: string;
                 }>;
             }>>>;
-            createdAt: z.ZodOptional<z.ZodType<number, z.ZodTypeDef, number>>;
-            updatedAt: z.ZodOptional<z.ZodType<number, z.ZodTypeDef, number>>;
-            customData: z.ZodOptional<z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>>;
-            primaryEmail: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
-            primaryPhone: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
-            avatar: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
-            identities: z.ZodOptional<z.ZodType<Record<string, {
+            customData: z.ZodOptional<ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>>;
+            updatedAt: z.ZodOptional<ZodType<number, z.ZodTypeDef, number>>;
+            primaryEmail: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+            primaryPhone: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+            avatar: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+            identities: z.ZodOptional<ZodType<Record<string, {
                 userId: string;
                 details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
             }>, z.ZodTypeDef, Record<string, {
                 userId: string;
                 details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
             }>>>;
-            isSuspended: z.ZodOptional<z.ZodType<boolean, z.ZodTypeDef, boolean>>;
-            lastSignInAt: z.ZodOptional<z.ZodType<number | null, z.ZodTypeDef, number | null>>;
+            isSuspended: z.ZodOptional<ZodType<boolean, z.ZodTypeDef, boolean>>;
+            lastSignInAt: z.ZodOptional<ZodType<number | null, z.ZodTypeDef, number | null>>;
+            hasPassword: z.ZodOptional<z.ZodBoolean>;
             ssoIdentities: z.ZodOptional<z.ZodArray<z.ZodObject<Pick<{
-                tenantId: z.ZodType<string, z.ZodTypeDef, string>;
-                id: z.ZodType<string, z.ZodTypeDef, string>;
-                userId: z.ZodType<string, z.ZodTypeDef, string>;
-                issuer: z.ZodType<string, z.ZodTypeDef, string>;
-                identityId: z.ZodType<string, z.ZodTypeDef, string>;
-                detail: z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
-                createdAt: z.ZodType<number, z.ZodTypeDef, number>;
-                ssoConnectorId: z.ZodType<string, z.ZodTypeDef, string>;
+                tenantId: ZodType<string, z.ZodTypeDef, string>;
+                id: ZodType<string, z.ZodTypeDef, string>;
+                userId: ZodType<string, z.ZodTypeDef, string>;
+                issuer: ZodType<string, z.ZodTypeDef, string>;
+                identityId: ZodType<string, z.ZodTypeDef, string>;
+                detail: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
+                createdAt: ZodType<number, z.ZodTypeDef, number>;
+                ssoConnectorId: ZodType<string, z.ZodTypeDef, string>;
             }, "issuer" | "identityId" | "detail">, "strip", z.ZodTypeAny, {
                 issuer: string;
                 identityId: string;
@@ -428,19 +490,24 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }>, "many">>;
             mfaVerificationFactors: z.ZodOptional<z.ZodArray<z.ZodNativeEnum<typeof import("../../foundations/index.js").MfaFactor>, "many">>;
-            roles: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                name: z.ZodType<string, z.ZodTypeDef, string>;
-                id: z.ZodType<string, z.ZodTypeDef, string>;
-                description: z.ZodType<string, z.ZodTypeDef, string>;
-                scopes: z.ZodArray<z.ZodObject<Pick<{
-                    name: z.ZodType<string, z.ZodTypeDef, string>;
-                    id: z.ZodType<string, z.ZodTypeDef, string>;
-                    tenantId: z.ZodType<string, z.ZodTypeDef, string>;
-                    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
-                    description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-                    resourceId: z.ZodType<string, z.ZodTypeDef, string>;
+            roles: z.ZodOptional<z.ZodArray<z.ZodObject<z.objectUtil.extendShape<Pick<{
+                tenantId: ZodType<string, z.ZodTypeDef, string>;
+                id: ZodType<string, z.ZodTypeDef, string>;
+                name: ZodType<string, z.ZodTypeDef, string>;
+                description: ZodType<string, z.ZodTypeDef, string>;
+                type: ZodType<import("../../db-entries/custom-types.js").RoleType, z.ZodTypeDef, import("../../db-entries/custom-types.js").RoleType>;
+                isDefault: ZodType<boolean, z.ZodTypeDef, boolean>;
+            }, "name" | "id" | "description">, {
+                scopes: z.ZodArray<z.ZodObject<Pick<z.objectUtil.extendShape<{
+                    tenantId: ZodType<string, z.ZodTypeDef, string>;
+                    id: ZodType<string, z.ZodTypeDef, string>;
+                    resourceId: ZodType<string, z.ZodTypeDef, string>;
+                    name: ZodType<string, z.ZodTypeDef, string>;
+                    description: ZodType<string | null, z.ZodTypeDef, string | null>;
+                    createdAt: ZodType<number, z.ZodTypeDef, number>;
+                }, {
                     resource: import("../../foundations/schemas.js").Guard<import("../../db-entries/resource.js").Resource>;
-                }, "name" | "id" | "description" | "resource" | "resourceId">, "strip", z.ZodTypeAny, {
+                }>, "name" | "id" | "description" | "resource" | "resourceId">, "strip", z.ZodTypeAny, {
                     name: string;
                     id: string;
                     description: string | null;
@@ -453,7 +520,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                     resource: import("../../db-entries/resource.js").Resource;
                     resourceId: string;
                 }>, "many">;
-            }, "strip", z.ZodTypeAny, {
+            }>, "strip", z.ZodTypeAny, {
                 name: string;
                 id: string;
                 description: string;
@@ -477,12 +544,24 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 }[];
             }>, "many">>;
             organizations: z.ZodOptional<z.ZodArray<z.ZodObject<Pick<{
-                tenantId: z.ZodType<string, z.ZodTypeDef, string>;
-                id: z.ZodType<string, z.ZodTypeDef, string>;
-                name: z.ZodType<string, z.ZodTypeDef, string>;
-                description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-                customData: z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
-                createdAt: z.ZodType<number, z.ZodTypeDef, number>;
+                tenantId: ZodType<string, z.ZodTypeDef, string>;
+                id: ZodType<string, z.ZodTypeDef, string>;
+                name: ZodType<string, z.ZodTypeDef, string>;
+                description: ZodType<string | null, z.ZodTypeDef, string | null>;
+                customData: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
+                isMfaRequired: ZodType<boolean, z.ZodTypeDef, boolean>;
+                branding: ZodType<{
+                    logoUrl?: string | undefined;
+                    darkLogoUrl?: string | undefined;
+                    favicon?: string | undefined;
+                    darkFavicon?: string | undefined;
+                }, z.ZodTypeDef, {
+                    logoUrl?: string | undefined;
+                    darkLogoUrl?: string | undefined;
+                    favicon?: string | undefined;
+                    darkFavicon?: string | undefined;
+                }>;
+                createdAt: ZodType<number, z.ZodTypeDef, number>;
             }, "name" | "id" | "description">, "strip", z.ZodTypeAny, {
                 name: string;
                 id: string;
@@ -510,6 +589,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -531,9 +611,25 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -543,29 +639,13 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             }> | undefined;
             isSuspended?: boolean | undefined;
             lastSignInAt?: number | null | undefined;
+            hasPassword?: boolean | undefined;
             ssoIdentities?: {
                 issuer: string;
                 identityId: string;
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
@@ -576,6 +656,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -597,9 +678,25 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -609,41 +706,36 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             }> | undefined;
             isSuspended?: boolean | undefined;
             lastSignInAt?: number | null | undefined;
+            hasPassword?: boolean | undefined;
             ssoIdentities?: {
                 issuer: string;
                 identityId: string;
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         }>;
+        grant: z.ZodOptional<z.ZodObject<{
+            type: z.ZodOptional<z.ZodLiteral<GrantType.TokenExchange>>;
+            subjectTokenContext: z.ZodOptional<z.ZodRecord<z.ZodString, ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>>;
+        }, "strip", z.ZodTypeAny, {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        }, {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         user: {
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -665,9 +757,25 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -677,41 +785,30 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             }> | undefined;
             isSuspended?: boolean | undefined;
             lastSignInAt?: number | null | undefined;
+            hasPassword?: boolean | undefined;
             ssoIdentities?: {
                 issuer: string;
                 identityId: string;
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         };
+        grant?: {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        } | undefined;
     }, {
         user: {
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -733,9 +830,25 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -745,58 +858,34 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             }> | undefined;
             isSuspended?: boolean | undefined;
             lastSignInAt?: number | null | undefined;
+            hasPassword?: boolean | undefined;
             ssoIdentities?: {
                 issuer: string;
                 identityId: string;
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         };
+        grant?: {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        } | undefined;
     }>>;
-}, "strict", z.ZodTypeAny, {
+}>, "strict", z.ZodTypeAny, {
     script: string;
     environmentVariables?: Record<string, string> | undefined;
-    tokenSample?: {
-        accountId?: string | undefined;
-        expiresWithSession?: boolean | undefined;
-        grantId?: string | undefined;
-        gty?: string | undefined;
-        sessionUid?: string | undefined;
-        sid?: string | undefined;
-        kind?: "AccessToken" | undefined;
-        jti?: string | undefined;
-        aud?: string | string[] | undefined;
-        scope?: string | undefined;
-        clientId?: string | undefined;
-    } | undefined;
     contextSample?: {
         user: {
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -818,24 +907,13 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
-            primaryEmail?: string | null | undefined;
-            primaryPhone?: string | null | undefined;
-            avatar?: string | null | undefined;
-            identities?: Record<string, {
-                userId: string;
-                details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
-            }> | undefined;
-            isSuspended?: boolean | undefined;
-            lastSignInAt?: number | null | undefined;
-            ssoIdentities?: {
-                issuer: string;
-                identityId: string;
-                detail: import("@withtyped/server/lib/types.js").JsonObject;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
             }[] | undefined;
-            mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
             roles?: {
                 name: string;
                 id: string;
@@ -848,40 +926,56 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                     resourceId: string;
                 }[];
             }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
+            primaryEmail?: string | null | undefined;
+            primaryPhone?: string | null | undefined;
+            avatar?: string | null | undefined;
+            identities?: Record<string, {
+                userId: string;
+                details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+            }> | undefined;
+            isSuspended?: boolean | undefined;
+            lastSignInAt?: number | null | undefined;
+            hasPassword?: boolean | undefined;
+            ssoIdentities?: {
+                issuer: string;
+                identityId: string;
+                detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
+            mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         };
+        grant?: {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        } | undefined;
     } | undefined;
-}, {
-    script: string;
-    environmentVariables?: Record<string, string> | undefined;
     tokenSample?: {
+        grantId?: string | undefined;
+        scope?: string | undefined;
         accountId?: string | undefined;
         expiresWithSession?: boolean | undefined;
-        grantId?: string | undefined;
         gty?: string | undefined;
         sessionUid?: string | undefined;
         sid?: string | undefined;
         kind?: "AccessToken" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     } | undefined;
+}, {
+    script: string;
+    environmentVariables?: Record<string, string> | undefined;
     contextSample?: {
         user: {
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -903,9 +997,25 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -915,42 +1025,44 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             }> | undefined;
             isSuspended?: boolean | undefined;
             lastSignInAt?: number | null | undefined;
+            hasPassword?: boolean | undefined;
             ssoIdentities?: {
                 issuer: string;
                 identityId: string;
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         };
+        grant?: {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        } | undefined;
+    } | undefined;
+    tokenSample?: {
+        grantId?: string | undefined;
+        scope?: string | undefined;
+        accountId?: string | undefined;
+        expiresWithSession?: boolean | undefined;
+        gty?: string | undefined;
+        sessionUid?: string | undefined;
+        sid?: string | undefined;
+        kind?: "AccessToken" | undefined;
+        jti?: string | undefined;
+        aud?: string | string[] | undefined;
+        clientId?: string | undefined;
     } | undefined;
 }>;
 export type AccessTokenJwtCustomizer = z.infer<typeof accessTokenJwtCustomizerGuard>;
-export declare const clientCredentialsJwtCustomizerGuard: z.ZodObject<{
+export declare const clientCredentialsJwtCustomizerGuard: z.ZodObject<z.objectUtil.extendShape<{
     script: z.ZodString;
     environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    contextSample: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>>;
+    contextSample: z.ZodOptional<z.ZodRecord<z.ZodString, ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>>;
+}, {
     tokenSample: z.ZodOptional<z.ZodObject<{
         kind: z.ZodOptional<z.ZodLiteral<"ClientCredentials">>;
         jti: z.ZodOptional<z.ZodString>;
@@ -958,27 +1070,27 @@ export declare const clientCredentialsJwtCustomizerGuard: z.ZodObject<{
         scope: z.ZodOptional<z.ZodOptional<z.ZodString>>;
         clientId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
     }, "strict", z.ZodTypeAny, {
+        scope?: string | undefined;
         kind?: "ClientCredentials" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     }, {
+        scope?: string | undefined;
         kind?: "ClientCredentials" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     }>>;
-}, "strict", z.ZodTypeAny, {
+}>, "strict", z.ZodTypeAny, {
     script: string;
     environmentVariables?: Record<string, string> | undefined;
     contextSample?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
     tokenSample?: {
+        scope?: string | undefined;
         kind?: "ClientCredentials" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     } | undefined;
 }, {
@@ -986,10 +1098,10 @@ export declare const clientCredentialsJwtCustomizerGuard: z.ZodObject<{
     environmentVariables?: Record<string, string> | undefined;
     contextSample?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
     tokenSample?: {
+        scope?: string | undefined;
         kind?: "ClientCredentials" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     } | undefined;
 }>;
@@ -1015,37 +1127,38 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
         scope: z.ZodOptional<z.ZodOptional<z.ZodString>>;
         clientId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
     }, "strict", z.ZodTypeAny, {
+        grantId?: string | undefined;
+        scope?: string | undefined;
         accountId?: string | undefined;
         expiresWithSession?: boolean | undefined;
-        grantId?: string | undefined;
         gty?: string | undefined;
         sessionUid?: string | undefined;
         sid?: string | undefined;
         kind?: "AccessToken" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     }, {
+        grantId?: string | undefined;
+        scope?: string | undefined;
         accountId?: string | undefined;
         expiresWithSession?: boolean | undefined;
-        grantId?: string | undefined;
         gty?: string | undefined;
         sessionUid?: string | undefined;
         sid?: string | undefined;
         kind?: "AccessToken" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     }>;
     context: z.ZodObject<{
         user: z.ZodObject<{
-            name: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
-            id: z.ZodOptional<z.ZodType<string, z.ZodTypeDef, string>>;
-            applicationId: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
-            username: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
-            profile: z.ZodOptional<z.ZodType<Partial<{
+            name: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+            id: z.ZodOptional<ZodType<string, z.ZodTypeDef, string>>;
+            applicationId: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+            username: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+            createdAt: z.ZodOptional<ZodType<number, z.ZodTypeDef, number>>;
+            profile: z.ZodOptional<ZodType<Partial<{
                 familyName: string;
                 givenName: string;
                 middleName: string;
@@ -1086,30 +1199,30 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                     country: string;
                 }>;
             }>>>;
-            createdAt: z.ZodOptional<z.ZodType<number, z.ZodTypeDef, number>>;
-            updatedAt: z.ZodOptional<z.ZodType<number, z.ZodTypeDef, number>>;
-            customData: z.ZodOptional<z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>>;
-            primaryEmail: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
-            primaryPhone: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
-            avatar: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;
-            identities: z.ZodOptional<z.ZodType<Record<string, {
+            customData: z.ZodOptional<ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>>;
+            updatedAt: z.ZodOptional<ZodType<number, z.ZodTypeDef, number>>;
+            primaryEmail: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+            primaryPhone: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+            avatar: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+            identities: z.ZodOptional<ZodType<Record<string, {
                 userId: string;
                 details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
             }>, z.ZodTypeDef, Record<string, {
                 userId: string;
                 details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
             }>>>;
-            isSuspended: z.ZodOptional<z.ZodType<boolean, z.ZodTypeDef, boolean>>;
-            lastSignInAt: z.ZodOptional<z.ZodType<number | null, z.ZodTypeDef, number | null>>;
+            isSuspended: z.ZodOptional<ZodType<boolean, z.ZodTypeDef, boolean>>;
+            lastSignInAt: z.ZodOptional<ZodType<number | null, z.ZodTypeDef, number | null>>;
+            hasPassword: z.ZodOptional<z.ZodBoolean>;
             ssoIdentities: z.ZodOptional<z.ZodArray<z.ZodObject<Pick<{
-                tenantId: z.ZodType<string, z.ZodTypeDef, string>;
-                id: z.ZodType<string, z.ZodTypeDef, string>;
-                userId: z.ZodType<string, z.ZodTypeDef, string>;
-                issuer: z.ZodType<string, z.ZodTypeDef, string>;
-                identityId: z.ZodType<string, z.ZodTypeDef, string>;
-                detail: z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
-                createdAt: z.ZodType<number, z.ZodTypeDef, number>;
-                ssoConnectorId: z.ZodType<string, z.ZodTypeDef, string>;
+                tenantId: ZodType<string, z.ZodTypeDef, string>;
+                id: ZodType<string, z.ZodTypeDef, string>;
+                userId: ZodType<string, z.ZodTypeDef, string>;
+                issuer: ZodType<string, z.ZodTypeDef, string>;
+                identityId: ZodType<string, z.ZodTypeDef, string>;
+                detail: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
+                createdAt: ZodType<number, z.ZodTypeDef, number>;
+                ssoConnectorId: ZodType<string, z.ZodTypeDef, string>;
             }, "issuer" | "identityId" | "detail">, "strip", z.ZodTypeAny, {
                 issuer: string;
                 identityId: string;
@@ -1120,19 +1233,24 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }>, "many">>;
             mfaVerificationFactors: z.ZodOptional<z.ZodArray<z.ZodNativeEnum<typeof import("../../foundations/index.js").MfaFactor>, "many">>;
-            roles: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                name: z.ZodType<string, z.ZodTypeDef, string>;
-                id: z.ZodType<string, z.ZodTypeDef, string>;
-                description: z.ZodType<string, z.ZodTypeDef, string>;
-                scopes: z.ZodArray<z.ZodObject<Pick<{
-                    name: z.ZodType<string, z.ZodTypeDef, string>;
-                    id: z.ZodType<string, z.ZodTypeDef, string>;
-                    tenantId: z.ZodType<string, z.ZodTypeDef, string>;
-                    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
-                    description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-                    resourceId: z.ZodType<string, z.ZodTypeDef, string>;
+            roles: z.ZodOptional<z.ZodArray<z.ZodObject<z.objectUtil.extendShape<Pick<{
+                tenantId: ZodType<string, z.ZodTypeDef, string>;
+                id: ZodType<string, z.ZodTypeDef, string>;
+                name: ZodType<string, z.ZodTypeDef, string>;
+                description: ZodType<string, z.ZodTypeDef, string>;
+                type: ZodType<import("../../db-entries/custom-types.js").RoleType, z.ZodTypeDef, import("../../db-entries/custom-types.js").RoleType>;
+                isDefault: ZodType<boolean, z.ZodTypeDef, boolean>;
+            }, "name" | "id" | "description">, {
+                scopes: z.ZodArray<z.ZodObject<Pick<z.objectUtil.extendShape<{
+                    tenantId: ZodType<string, z.ZodTypeDef, string>;
+                    id: ZodType<string, z.ZodTypeDef, string>;
+                    resourceId: ZodType<string, z.ZodTypeDef, string>;
+                    name: ZodType<string, z.ZodTypeDef, string>;
+                    description: ZodType<string | null, z.ZodTypeDef, string | null>;
+                    createdAt: ZodType<number, z.ZodTypeDef, number>;
+                }, {
                     resource: import("../../foundations/schemas.js").Guard<import("../../db-entries/resource.js").Resource>;
-                }, "name" | "id" | "description" | "resource" | "resourceId">, "strip", z.ZodTypeAny, {
+                }>, "name" | "id" | "description" | "resource" | "resourceId">, "strip", z.ZodTypeAny, {
                     name: string;
                     id: string;
                     description: string | null;
@@ -1145,7 +1263,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                     resource: import("../../db-entries/resource.js").Resource;
                     resourceId: string;
                 }>, "many">;
-            }, "strip", z.ZodTypeAny, {
+            }>, "strip", z.ZodTypeAny, {
                 name: string;
                 id: string;
                 description: string;
@@ -1169,12 +1287,24 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 }[];
             }>, "many">>;
             organizations: z.ZodOptional<z.ZodArray<z.ZodObject<Pick<{
-                tenantId: z.ZodType<string, z.ZodTypeDef, string>;
-                id: z.ZodType<string, z.ZodTypeDef, string>;
-                name: z.ZodType<string, z.ZodTypeDef, string>;
-                description: z.ZodType<string | null, z.ZodTypeDef, string | null>;
-                customData: z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
-                createdAt: z.ZodType<number, z.ZodTypeDef, number>;
+                tenantId: ZodType<string, z.ZodTypeDef, string>;
+                id: ZodType<string, z.ZodTypeDef, string>;
+                name: ZodType<string, z.ZodTypeDef, string>;
+                description: ZodType<string | null, z.ZodTypeDef, string | null>;
+                customData: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
+                isMfaRequired: ZodType<boolean, z.ZodTypeDef, boolean>;
+                branding: ZodType<{
+                    logoUrl?: string | undefined;
+                    darkLogoUrl?: string | undefined;
+                    favicon?: string | undefined;
+                    darkFavicon?: string | undefined;
+                }, z.ZodTypeDef, {
+                    logoUrl?: string | undefined;
+                    darkLogoUrl?: string | undefined;
+                    favicon?: string | undefined;
+                    darkFavicon?: string | undefined;
+                }>;
+                createdAt: ZodType<number, z.ZodTypeDef, number>;
             }, "name" | "id" | "description">, "strip", z.ZodTypeAny, {
                 name: string;
                 id: string;
@@ -1202,6 +1332,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -1223,9 +1354,25 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -1235,29 +1382,13 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             }> | undefined;
             isSuspended?: boolean | undefined;
             lastSignInAt?: number | null | undefined;
+            hasPassword?: boolean | undefined;
             ssoIdentities?: {
                 issuer: string;
                 identityId: string;
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
@@ -1268,6 +1399,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -1289,9 +1421,25 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -1301,41 +1449,36 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             }> | undefined;
             isSuspended?: boolean | undefined;
             lastSignInAt?: number | null | undefined;
+            hasPassword?: boolean | undefined;
             ssoIdentities?: {
                 issuer: string;
                 identityId: string;
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         }>;
+        grant: z.ZodOptional<z.ZodObject<{
+            type: z.ZodOptional<z.ZodLiteral<GrantType.TokenExchange>>;
+            subjectTokenContext: z.ZodOptional<z.ZodRecord<z.ZodString, ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>>;
+        }, "strip", z.ZodTypeAny, {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        }, {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         user: {
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -1357,9 +1500,25 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -1369,41 +1528,30 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             }> | undefined;
             isSuspended?: boolean | undefined;
             lastSignInAt?: number | null | undefined;
+            hasPassword?: boolean | undefined;
             ssoIdentities?: {
                 issuer: string;
                 identityId: string;
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         };
+        grant?: {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        } | undefined;
     }, {
         user: {
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -1425,9 +1573,25 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -1437,61 +1601,35 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             }> | undefined;
             isSuspended?: boolean | undefined;
             lastSignInAt?: number | null | undefined;
+            hasPassword?: boolean | undefined;
             ssoIdentities?: {
                 issuer: string;
                 identityId: string;
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         };
+        grant?: {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        } | undefined;
     }>;
     script: z.ZodString;
     environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     tokenType: z.ZodLiteral<LogtoJwtTokenKeyType.AccessToken>;
 }, "strip", z.ZodTypeAny, {
-    script: string;
-    tokenType: LogtoJwtTokenKeyType.AccessToken;
-    token: {
-        accountId?: string | undefined;
-        expiresWithSession?: boolean | undefined;
-        grantId?: string | undefined;
-        gty?: string | undefined;
-        sessionUid?: string | undefined;
-        sid?: string | undefined;
-        kind?: "AccessToken" | undefined;
-        jti?: string | undefined;
-        aud?: string | string[] | undefined;
-        scope?: string | undefined;
-        clientId?: string | undefined;
-    };
     context: {
         user: {
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -1513,9 +1651,25 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -1525,59 +1679,48 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             }> | undefined;
             isSuspended?: boolean | undefined;
             lastSignInAt?: number | null | undefined;
+            hasPassword?: boolean | undefined;
             ssoIdentities?: {
                 issuer: string;
                 identityId: string;
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         };
+        grant?: {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        } | undefined;
     };
-    environmentVariables?: Record<string, string> | undefined;
-}, {
     script: string;
     tokenType: LogtoJwtTokenKeyType.AccessToken;
     token: {
+        grantId?: string | undefined;
+        scope?: string | undefined;
         accountId?: string | undefined;
         expiresWithSession?: boolean | undefined;
-        grantId?: string | undefined;
         gty?: string | undefined;
         sessionUid?: string | undefined;
         sid?: string | undefined;
         kind?: "AccessToken" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     };
+    environmentVariables?: Record<string, string> | undefined;
+}, {
     context: {
         user: {
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -1599,9 +1742,25 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -1611,35 +1770,38 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             }> | undefined;
             isSuspended?: boolean | undefined;
             lastSignInAt?: number | null | undefined;
+            hasPassword?: boolean | undefined;
             ssoIdentities?: {
                 issuer: string;
                 identityId: string;
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         };
+        grant?: {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        } | undefined;
+    };
+    script: string;
+    tokenType: LogtoJwtTokenKeyType.AccessToken;
+    token: {
+        grantId?: string | undefined;
+        scope?: string | undefined;
+        accountId?: string | undefined;
+        expiresWithSession?: boolean | undefined;
+        gty?: string | undefined;
+        sessionUid?: string | undefined;
+        sid?: string | undefined;
+        kind?: "AccessToken" | undefined;
+        jti?: string | undefined;
+        aud?: string | string[] | undefined;
+        clientId?: string | undefined;
     };
     environmentVariables?: Record<string, string> | undefined;
 }>, z.ZodObject<{
@@ -1650,16 +1812,16 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
         scope: z.ZodOptional<z.ZodOptional<z.ZodString>>;
         clientId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
     }, "strict", z.ZodTypeAny, {
+        scope?: string | undefined;
         kind?: "ClientCredentials" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     }, {
+        scope?: string | undefined;
         kind?: "ClientCredentials" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     }>;
     script: z.ZodString;
@@ -1669,10 +1831,10 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
     script: string;
     tokenType: LogtoJwtTokenKeyType.ClientCredentials;
     token: {
+        scope?: string | undefined;
         kind?: "ClientCredentials" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     };
     environmentVariables?: Record<string, string> | undefined;
@@ -1680,39 +1842,43 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
     script: string;
     tokenType: LogtoJwtTokenKeyType.ClientCredentials;
     token: {
+        scope?: string | undefined;
         kind?: "ClientCredentials" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     };
     environmentVariables?: Record<string, string> | undefined;
 }>]>;
 export type JwtCustomizerTestRequestBody = z.infer<typeof jwtCustomizerTestRequestBodyGuard>;
-export declare const customJwtFetcherGuard: z.ZodDiscriminatedUnion<"tokenType", [z.ZodObject<{
+export declare const customJwtFetcherGuard: z.ZodDiscriminatedUnion<"tokenType", [z.ZodObject<z.objectUtil.extendShape<z.objectUtil.extendShape<{
     script: z.ZodString;
     environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    token: z.ZodRecord<z.ZodString, z.ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>;
+}, {
+    token: z.ZodRecord<z.ZodString, ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>;
+}>, {
     tokenType: z.ZodLiteral<LogtoJwtTokenKeyType.AccessToken>;
-    context: z.ZodRecord<z.ZodString, z.ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>;
-}, "strip", z.ZodTypeAny, {
+    context: z.ZodRecord<z.ZodString, ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>;
+}>, "strip", z.ZodTypeAny, {
+    context: Record<string, import("@withtyped/server/lib/types.js").Json>;
     script: string;
     tokenType: LogtoJwtTokenKeyType.AccessToken;
     token: Record<string, import("@withtyped/server/lib/types.js").Json>;
-    context: Record<string, import("@withtyped/server/lib/types.js").Json>;
     environmentVariables?: Record<string, string> | undefined;
 }, {
+    context: Record<string, import("@withtyped/server/lib/types.js").Json>;
     script: string;
     tokenType: LogtoJwtTokenKeyType.AccessToken;
     token: Record<string, import("@withtyped/server/lib/types.js").Json>;
-    context: Record<string, import("@withtyped/server/lib/types.js").Json>;
     environmentVariables?: Record<string, string> | undefined;
-}>, z.ZodObject<{
+}>, z.ZodObject<z.objectUtil.extendShape<z.objectUtil.extendShape<{
     script: z.ZodString;
     environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    token: z.ZodRecord<z.ZodString, z.ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>;
+}, {
+    token: z.ZodRecord<z.ZodString, ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>;
+}>, {
     tokenType: z.ZodLiteral<LogtoJwtTokenKeyType.ClientCredentials>;
-}, "strip", z.ZodTypeAny, {
+}>, "strip", z.ZodTypeAny, {
     script: string;
     tokenType: LogtoJwtTokenKeyType.ClientCredentials;
     token: Record<string, import("@withtyped/server/lib/types.js").Json>;