npm - @logto/schemas - Versions diffs - 1.18.0 → 1.19.0 - Mend

@logto/schemas 1.18.0 → 1.19.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (229) hide show

package/lib/types/logto-config/jwt-customizer.d.ts CHANGED Viewed

@@ -1,6 +1,7 @@
 import { type ZodType, z } from 'zod';
 import { type Organization, type Role, type UserSsoIdentity } from '../../db-entries/index.js';
 import { type MfaFactors } from '../../foundations/index.js';
+import { GrantType } from '../oidc-config.js';
 import { type ScopeResponse } from '../scope.js';
 import { type UserInfo } from '../user.js';
 export declare const jwtCustomizerGuard: z.ZodObject<{
@@ -34,11 +35,16 @@ export type JwtCustomizerUserContext = UserInfo & {
         roleName: string;
     }>;
 };
-export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
-    name: ZodType<string | null, z.ZodTypeDef, string | null>;
+export declare const jwtCustomizerUserContextGuard: z.ZodObject<z.objectUtil.extendShape<Pick<{
+    tenantId: ZodType<string, z.ZodTypeDef, string>;
     id: ZodType<string, z.ZodTypeDef, string>;
-    applicationId: ZodType<string | null, z.ZodTypeDef, string | null>;
     username: ZodType<string | null, z.ZodTypeDef, string | null>;
+    primaryEmail: ZodType<string | null, z.ZodTypeDef, string | null>;
+    primaryPhone: ZodType<string | null, z.ZodTypeDef, string | null>;
+    passwordEncrypted: ZodType<string | null, z.ZodTypeDef, string | null>;
+    passwordEncryptionMethod: ZodType<import("../../db-entries/custom-types.js").UsersPasswordEncryptionMethod | null, z.ZodTypeDef, import("../../db-entries/custom-types.js").UsersPasswordEncryptionMethod | null>;
+    name: ZodType<string | null, z.ZodTypeDef, string | null>;
+    avatar: ZodType<string | null, z.ZodTypeDef, string | null>;
     profile: ZodType<Partial<{
         familyName: string;
         givenName: string;
@@ -80,12 +86,7 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
             country: string;
         }>;
     }>>;
-    createdAt: ZodType<number, z.ZodTypeDef, number>;
-    updatedAt: ZodType<number, z.ZodTypeDef, number>;
-    customData: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
-    primaryEmail: ZodType<string | null, z.ZodTypeDef, string | null>;
-    primaryPhone: ZodType<string | null, z.ZodTypeDef, string | null>;
-    avatar: ZodType<string | null, z.ZodTypeDef, string | null>;
+    applicationId: ZodType<string | null, z.ZodTypeDef, string | null>;
     identities: ZodType<Record<string, {
         userId: string;
         details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -93,8 +94,64 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
         userId: string;
         details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
     }>>;
+    customData: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
+    logtoConfig: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
+    mfaVerifications: ZodType<({
+        type: import("../../foundations/index.js").MfaFactor.TOTP;
+        id: string;
+        key: string;
+        createdAt: string;
+        lastUsedAt?: string | undefined;
+    } | {
+        type: import("../../foundations/index.js").MfaFactor.WebAuthn;
+        id: string;
+        createdAt: string;
+        credentialId: string;
+        publicKey: string;
+        counter: number;
+        agent: string;
+        lastUsedAt?: string | undefined;
+        transports?: ("usb" | "nfc" | "ble" | "internal" | "cable" | "hybrid" | "smart-card")[] | undefined;
+    } | {
+        type: import("../../foundations/index.js").MfaFactor.BackupCode;
+        id: string;
+        createdAt: string;
+        codes: {
+            code: string;
+            usedAt?: string | undefined;
+        }[];
+        lastUsedAt?: string | undefined;
+    })[], z.ZodTypeDef, ({
+        type: import("../../foundations/index.js").MfaFactor.TOTP;
+        id: string;
+        key: string;
+        createdAt: string;
+        lastUsedAt?: string | undefined;
+    } | {
+        type: import("../../foundations/index.js").MfaFactor.WebAuthn;
+        id: string;
+        createdAt: string;
+        credentialId: string;
+        publicKey: string;
+        counter: number;
+        agent: string;
+        lastUsedAt?: string | undefined;
+        transports?: ("usb" | "nfc" | "ble" | "internal" | "cable" | "hybrid" | "smart-card")[] | undefined;
+    } | {
+        type: import("../../foundations/index.js").MfaFactor.BackupCode;
+        id: string;
+        createdAt: string;
+        codes: {
+            code: string;
+            usedAt?: string | undefined;
+        }[];
+        lastUsedAt?: string | undefined;
+    })[]>;
     isSuspended: ZodType<boolean, z.ZodTypeDef, boolean>;
     lastSignInAt: ZodType<number | null, z.ZodTypeDef, number | null>;
+    createdAt: ZodType<number, z.ZodTypeDef, number>;
+    updatedAt: ZodType<number, z.ZodTypeDef, number>;
+}, "name" | "id" | "applicationId" | "username" | "createdAt" | "profile" | "customData" | "updatedAt" | "primaryEmail" | "primaryPhone" | "avatar" | "identities" | "isSuspended" | "lastSignInAt">, {
     hasPassword: z.ZodBoolean;
     ssoIdentities: z.ZodArray<z.ZodObject<Pick<{
         tenantId: ZodType<string, z.ZodTypeDef, string>;
@@ -115,19 +172,24 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
         detail: import("@withtyped/server/lib/types.js").JsonObject;
     }>, "many">;
     mfaVerificationFactors: z.ZodArray<z.ZodNativeEnum<typeof import("../../foundations/index.js").MfaFactor>, "many">;
-    roles: z.ZodArray<z.ZodObject<{
-        name: ZodType<string, z.ZodTypeDef, string>;
+    roles: z.ZodArray<z.ZodObject<z.objectUtil.extendShape<Pick<{
+        tenantId: ZodType<string, z.ZodTypeDef, string>;
         id: ZodType<string, z.ZodTypeDef, string>;
+        name: ZodType<string, z.ZodTypeDef, string>;
         description: ZodType<string, z.ZodTypeDef, string>;
-        scopes: z.ZodArray<z.ZodObject<Pick<{
-            name: ZodType<string, z.ZodTypeDef, string>;
-            id: ZodType<string, z.ZodTypeDef, string>;
+        type: ZodType<import("../../db-entries/custom-types.js").RoleType, z.ZodTypeDef, import("../../db-entries/custom-types.js").RoleType>;
+        isDefault: ZodType<boolean, z.ZodTypeDef, boolean>;
+    }, "name" | "id" | "description">, {
+        scopes: z.ZodArray<z.ZodObject<Pick<z.objectUtil.extendShape<{
             tenantId: ZodType<string, z.ZodTypeDef, string>;
-            createdAt: ZodType<number, z.ZodTypeDef, number>;
-            description: ZodType<string | null, z.ZodTypeDef, string | null>;
+            id: ZodType<string, z.ZodTypeDef, string>;
             resourceId: ZodType<string, z.ZodTypeDef, string>;
+            name: ZodType<string, z.ZodTypeDef, string>;
+            description: ZodType<string | null, z.ZodTypeDef, string | null>;
+            createdAt: ZodType<number, z.ZodTypeDef, number>;
+        }, {
             resource: import("../../foundations/schemas.js").Guard<import("../../db-entries/resource.js").Resource>;
-        }, "name" | "id" | "description" | "resource" | "resourceId">, "strip", z.ZodTypeAny, {
+        }>, "name" | "id" | "description" | "resource" | "resourceId">, "strip", z.ZodTypeAny, {
             name: string;
             id: string;
             description: string | null;
@@ -140,7 +202,7 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
             resource: import("../../db-entries/resource.js").Resource;
             resourceId: string;
         }>, "many">;
-    }, "strip", z.ZodTypeAny, {
+    }>, "strip", z.ZodTypeAny, {
         name: string;
         id: string;
         description: string;
@@ -170,6 +232,17 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
         description: ZodType<string | null, z.ZodTypeDef, string | null>;
         customData: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
         isMfaRequired: ZodType<boolean, z.ZodTypeDef, boolean>;
+        branding: ZodType<{
+            logoUrl?: string | undefined;
+            darkLogoUrl?: string | undefined;
+            favicon?: string | undefined;
+            darkFavicon?: string | undefined;
+        }, z.ZodTypeDef, {
+            logoUrl?: string | undefined;
+            darkLogoUrl?: string | undefined;
+            favicon?: string | undefined;
+            darkFavicon?: string | undefined;
+        }>;
         createdAt: ZodType<number, z.ZodTypeDef, number>;
     }, "name" | "id" | "description">, "strip", z.ZodTypeAny, {
         name: string;
@@ -193,35 +266,15 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
         roleId: string;
         roleName: string;
     }>, "many">;
-}, "strip", z.ZodTypeAny, {
+}>, "strip", z.ZodTypeAny, {
     name: string | null;
     id: string;
     applicationId: string | null;
     username: string | null;
-    profile: Partial<{
-        familyName: string;
-        givenName: string;
-        middleName: string;
-        nickname: string;
-        preferredUsername: string;
-        profile: string;
-        website: string;
-        gender: string;
-        birthdate: string;
-        zoneinfo: string;
-        locale: string;
-        address: Partial<{
-            formatted: string;
-            streetAddress: string;
-            locality: string;
-            region: string;
-            postalCode: string;
-            country: string;
-        }>;
-    }>;
     createdAt: number;
-    updatedAt: number;
+    profile: import("../../foundations/index.js").UserProfile;
     customData: import("@withtyped/server/lib/types.js").JsonObject;
+    updatedAt: number;
     organizations: {
         name: string;
         id: string;
@@ -242,10 +295,7 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
     primaryEmail: string | null;
     primaryPhone: string | null;
     avatar: string | null;
-    identities: Record<string, {
-        userId: string;
-        details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
-    }>;
+    identities: import("../../foundations/index.js").Identities;
     isSuspended: boolean;
     lastSignInAt: number | null;
     hasPassword: boolean;
@@ -265,30 +315,10 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
     id: string;
     applicationId: string | null;
     username: string | null;
-    profile: Partial<{
-        familyName: string;
-        givenName: string;
-        middleName: string;
-        nickname: string;
-        preferredUsername: string;
-        profile: string;
-        website: string;
-        gender: string;
-        birthdate: string;
-        zoneinfo: string;
-        locale: string;
-        address: Partial<{
-            formatted: string;
-            streetAddress: string;
-            locality: string;
-            region: string;
-            postalCode: string;
-            country: string;
-        }>;
-    }>;
     createdAt: number;
-    updatedAt: number;
+    profile: import("../../foundations/index.js").UserProfile;
     customData: import("@withtyped/server/lib/types.js").JsonObject;
+    updatedAt: number;
     organizations: {
         name: string;
         id: string;
@@ -309,10 +339,7 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
     primaryEmail: string | null;
     primaryPhone: string | null;
     avatar: string | null;
-    identities: Record<string, {
-        userId: string;
-        details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
-    }>;
+    identities: import("../../foundations/index.js").Identities;
     isSuspended: boolean;
     lastSignInAt: number | null;
     hasPassword: boolean;
@@ -328,9 +355,22 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<{
         roleName: string;
     }[];
 }>;
-export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
+export declare const jwtCustomizerGrantContextGuard: z.ZodObject<{
+    type: z.ZodLiteral<GrantType.TokenExchange>;
+    subjectTokenContext: z.ZodRecord<z.ZodString, ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>;
+}, "strip", z.ZodTypeAny, {
+    type: GrantType.TokenExchange;
+    subjectTokenContext: Record<string, import("@withtyped/server/lib/types.js").Json>;
+}, {
+    type: GrantType.TokenExchange;
+    subjectTokenContext: Record<string, import("@withtyped/server/lib/types.js").Json>;
+}>;
+export type JwtCustomizerGrantContext = z.infer<typeof jwtCustomizerGrantContextGuard>;
+export declare const accessTokenJwtCustomizerGuard: z.ZodObject<z.objectUtil.extendShape<{
     script: z.ZodString;
     environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    contextSample: z.ZodOptional<z.ZodRecord<z.ZodString, ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>>;
+}, {
     tokenSample: z.ZodOptional<z.ZodObject<{
         accountId: z.ZodOptional<z.ZodString>;
         expiresWithSession: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
@@ -344,28 +384,28 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
         scope: z.ZodOptional<z.ZodOptional<z.ZodString>>;
         clientId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
     }, "strict", z.ZodTypeAny, {
+        grantId?: string | undefined;
+        scope?: string | undefined;
         accountId?: string | undefined;
         expiresWithSession?: boolean | undefined;
-        grantId?: string | undefined;
         gty?: string | undefined;
         sessionUid?: string | undefined;
         sid?: string | undefined;
         kind?: "AccessToken" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     }, {
+        grantId?: string | undefined;
+        scope?: string | undefined;
         accountId?: string | undefined;
         expiresWithSession?: boolean | undefined;
-        grantId?: string | undefined;
         gty?: string | undefined;
         sessionUid?: string | undefined;
         sid?: string | undefined;
         kind?: "AccessToken" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     }>>;
     contextSample: z.ZodOptional<z.ZodObject<{
@@ -374,6 +414,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             id: z.ZodOptional<ZodType<string, z.ZodTypeDef, string>>;
             applicationId: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
             username: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+            createdAt: z.ZodOptional<ZodType<number, z.ZodTypeDef, number>>;
             profile: z.ZodOptional<ZodType<Partial<{
                 familyName: string;
                 givenName: string;
@@ -415,9 +456,8 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                     country: string;
                 }>;
             }>>>;
-            createdAt: z.ZodOptional<ZodType<number, z.ZodTypeDef, number>>;
-            updatedAt: z.ZodOptional<ZodType<number, z.ZodTypeDef, number>>;
             customData: z.ZodOptional<ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>>;
+            updatedAt: z.ZodOptional<ZodType<number, z.ZodTypeDef, number>>;
             primaryEmail: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
             primaryPhone: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
             avatar: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
@@ -450,19 +490,24 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }>, "many">>;
             mfaVerificationFactors: z.ZodOptional<z.ZodArray<z.ZodNativeEnum<typeof import("../../foundations/index.js").MfaFactor>, "many">>;
-            roles: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                name: ZodType<string, z.ZodTypeDef, string>;
+            roles: z.ZodOptional<z.ZodArray<z.ZodObject<z.objectUtil.extendShape<Pick<{
+                tenantId: ZodType<string, z.ZodTypeDef, string>;
                 id: ZodType<string, z.ZodTypeDef, string>;
+                name: ZodType<string, z.ZodTypeDef, string>;
                 description: ZodType<string, z.ZodTypeDef, string>;
-                scopes: z.ZodArray<z.ZodObject<Pick<{
-                    name: ZodType<string, z.ZodTypeDef, string>;
-                    id: ZodType<string, z.ZodTypeDef, string>;
+                type: ZodType<import("../../db-entries/custom-types.js").RoleType, z.ZodTypeDef, import("../../db-entries/custom-types.js").RoleType>;
+                isDefault: ZodType<boolean, z.ZodTypeDef, boolean>;
+            }, "name" | "id" | "description">, {
+                scopes: z.ZodArray<z.ZodObject<Pick<z.objectUtil.extendShape<{
                     tenantId: ZodType<string, z.ZodTypeDef, string>;
-                    createdAt: ZodType<number, z.ZodTypeDef, number>;
-                    description: ZodType<string | null, z.ZodTypeDef, string | null>;
+                    id: ZodType<string, z.ZodTypeDef, string>;
                     resourceId: ZodType<string, z.ZodTypeDef, string>;
+                    name: ZodType<string, z.ZodTypeDef, string>;
+                    description: ZodType<string | null, z.ZodTypeDef, string | null>;
+                    createdAt: ZodType<number, z.ZodTypeDef, number>;
+                }, {
                     resource: import("../../foundations/schemas.js").Guard<import("../../db-entries/resource.js").Resource>;
-                }, "name" | "id" | "description" | "resource" | "resourceId">, "strip", z.ZodTypeAny, {
+                }>, "name" | "id" | "description" | "resource" | "resourceId">, "strip", z.ZodTypeAny, {
                     name: string;
                     id: string;
                     description: string | null;
@@ -475,7 +520,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                     resource: import("../../db-entries/resource.js").Resource;
                     resourceId: string;
                 }>, "many">;
-            }, "strip", z.ZodTypeAny, {
+            }>, "strip", z.ZodTypeAny, {
                 name: string;
                 id: string;
                 description: string;
@@ -505,6 +550,17 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 description: ZodType<string | null, z.ZodTypeDef, string | null>;
                 customData: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
                 isMfaRequired: ZodType<boolean, z.ZodTypeDef, boolean>;
+                branding: ZodType<{
+                    logoUrl?: string | undefined;
+                    darkLogoUrl?: string | undefined;
+                    favicon?: string | undefined;
+                    darkFavicon?: string | undefined;
+                }, z.ZodTypeDef, {
+                    logoUrl?: string | undefined;
+                    darkLogoUrl?: string | undefined;
+                    favicon?: string | undefined;
+                    darkFavicon?: string | undefined;
+                }>;
                 createdAt: ZodType<number, z.ZodTypeDef, number>;
             }, "name" | "id" | "description">, "strip", z.ZodTypeAny, {
                 name: string;
@@ -533,6 +589,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -554,9 +611,25 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -573,23 +646,6 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
@@ -600,6 +656,7 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -621,9 +678,25 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -640,35 +713,29 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         }>;
+        grant: z.ZodOptional<z.ZodObject<{
+            type: z.ZodOptional<z.ZodLiteral<GrantType.TokenExchange>>;
+            subjectTokenContext: z.ZodOptional<z.ZodRecord<z.ZodString, ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>>;
+        }, "strip", z.ZodTypeAny, {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        }, {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         user: {
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -690,9 +757,25 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -709,35 +792,23 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         };
+        grant?: {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        } | undefined;
     }, {
         user: {
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -759,26 +830,14 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
-            primaryEmail?: string | null | undefined;
-            primaryPhone?: string | null | undefined;
-            avatar?: string | null | undefined;
-            identities?: Record<string, {
-                userId: string;
-                details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
-            }> | undefined;
-            isSuspended?: boolean | undefined;
-            lastSignInAt?: number | null | undefined;
-            hasPassword?: boolean | undefined;
-            ssoIdentities?: {
-                issuer: string;
-                identityId: string;
-                detail: import("@withtyped/server/lib/types.js").JsonObject;
-            }[] | undefined;
-            mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
                 name: string;
                 id: string;
                 description: string;
@@ -790,40 +849,43 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                     resourceId: string;
                 }[];
             }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
+            primaryEmail?: string | null | undefined;
+            primaryPhone?: string | null | undefined;
+            avatar?: string | null | undefined;
+            identities?: Record<string, {
+                userId: string;
+                details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+            }> | undefined;
+            isSuspended?: boolean | undefined;
+            lastSignInAt?: number | null | undefined;
+            hasPassword?: boolean | undefined;
+            ssoIdentities?: {
+                issuer: string;
+                identityId: string;
+                detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
+            mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         };
+        grant?: {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        } | undefined;
     }>>;
-}, "strict", z.ZodTypeAny, {
+}>, "strict", z.ZodTypeAny, {
     script: string;
     environmentVariables?: Record<string, string> | undefined;
-    tokenSample?: {
-        accountId?: string | undefined;
-        expiresWithSession?: boolean | undefined;
-        grantId?: string | undefined;
-        gty?: string | undefined;
-        sessionUid?: string | undefined;
-        sid?: string | undefined;
-        kind?: "AccessToken" | undefined;
-        jti?: string | undefined;
-        aud?: string | string[] | undefined;
-        scope?: string | undefined;
-        clientId?: string | undefined;
-    } | undefined;
     contextSample?: {
         user: {
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -845,9 +907,25 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -864,52 +942,40 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         };
+        grant?: {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        } | undefined;
     } | undefined;
-}, {
-    script: string;
-    environmentVariables?: Record<string, string> | undefined;
     tokenSample?: {
+        grantId?: string | undefined;
+        scope?: string | undefined;
         accountId?: string | undefined;
         expiresWithSession?: boolean | undefined;
-        grantId?: string | undefined;
         gty?: string | undefined;
         sessionUid?: string | undefined;
         sid?: string | undefined;
         kind?: "AccessToken" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     } | undefined;
+}, {
+    script: string;
+    environmentVariables?: Record<string, string> | undefined;
     contextSample?: {
         user: {
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -931,9 +997,25 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -950,36 +1032,37 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         };
+        grant?: {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        } | undefined;
+    } | undefined;
+    tokenSample?: {
+        grantId?: string | undefined;
+        scope?: string | undefined;
+        accountId?: string | undefined;
+        expiresWithSession?: boolean | undefined;
+        gty?: string | undefined;
+        sessionUid?: string | undefined;
+        sid?: string | undefined;
+        kind?: "AccessToken" | undefined;
+        jti?: string | undefined;
+        aud?: string | string[] | undefined;
+        clientId?: string | undefined;
     } | undefined;
 }>;
 export type AccessTokenJwtCustomizer = z.infer<typeof accessTokenJwtCustomizerGuard>;
-export declare const clientCredentialsJwtCustomizerGuard: z.ZodObject<{
+export declare const clientCredentialsJwtCustomizerGuard: z.ZodObject<z.objectUtil.extendShape<{
     script: z.ZodString;
     environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     contextSample: z.ZodOptional<z.ZodRecord<z.ZodString, ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>>;
+}, {
     tokenSample: z.ZodOptional<z.ZodObject<{
         kind: z.ZodOptional<z.ZodLiteral<"ClientCredentials">>;
         jti: z.ZodOptional<z.ZodString>;
@@ -987,27 +1070,27 @@ export declare const clientCredentialsJwtCustomizerGuard: z.ZodObject<{
         scope: z.ZodOptional<z.ZodOptional<z.ZodString>>;
         clientId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
     }, "strict", z.ZodTypeAny, {
+        scope?: string | undefined;
         kind?: "ClientCredentials" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     }, {
+        scope?: string | undefined;
         kind?: "ClientCredentials" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     }>>;
-}, "strict", z.ZodTypeAny, {
+}>, "strict", z.ZodTypeAny, {
     script: string;
     environmentVariables?: Record<string, string> | undefined;
     contextSample?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
     tokenSample?: {
+        scope?: string | undefined;
         kind?: "ClientCredentials" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     } | undefined;
 }, {
@@ -1015,10 +1098,10 @@ export declare const clientCredentialsJwtCustomizerGuard: z.ZodObject<{
     environmentVariables?: Record<string, string> | undefined;
     contextSample?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
     tokenSample?: {
+        scope?: string | undefined;
         kind?: "ClientCredentials" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     } | undefined;
 }>;
@@ -1044,28 +1127,28 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
         scope: z.ZodOptional<z.ZodOptional<z.ZodString>>;
         clientId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
     }, "strict", z.ZodTypeAny, {
+        grantId?: string | undefined;
+        scope?: string | undefined;
         accountId?: string | undefined;
         expiresWithSession?: boolean | undefined;
-        grantId?: string | undefined;
         gty?: string | undefined;
         sessionUid?: string | undefined;
         sid?: string | undefined;
         kind?: "AccessToken" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     }, {
+        grantId?: string | undefined;
+        scope?: string | undefined;
         accountId?: string | undefined;
         expiresWithSession?: boolean | undefined;
-        grantId?: string | undefined;
         gty?: string | undefined;
         sessionUid?: string | undefined;
         sid?: string | undefined;
         kind?: "AccessToken" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     }>;
     context: z.ZodObject<{
@@ -1074,6 +1157,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             id: z.ZodOptional<ZodType<string, z.ZodTypeDef, string>>;
             applicationId: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
             username: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+            createdAt: z.ZodOptional<ZodType<number, z.ZodTypeDef, number>>;
             profile: z.ZodOptional<ZodType<Partial<{
                 familyName: string;
                 givenName: string;
@@ -1115,9 +1199,8 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                     country: string;
                 }>;
             }>>>;
-            createdAt: z.ZodOptional<ZodType<number, z.ZodTypeDef, number>>;
-            updatedAt: z.ZodOptional<ZodType<number, z.ZodTypeDef, number>>;
             customData: z.ZodOptional<ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>>;
+            updatedAt: z.ZodOptional<ZodType<number, z.ZodTypeDef, number>>;
             primaryEmail: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
             primaryPhone: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
             avatar: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
@@ -1150,19 +1233,24 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }>, "many">>;
             mfaVerificationFactors: z.ZodOptional<z.ZodArray<z.ZodNativeEnum<typeof import("../../foundations/index.js").MfaFactor>, "many">>;
-            roles: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                name: ZodType<string, z.ZodTypeDef, string>;
+            roles: z.ZodOptional<z.ZodArray<z.ZodObject<z.objectUtil.extendShape<Pick<{
+                tenantId: ZodType<string, z.ZodTypeDef, string>;
                 id: ZodType<string, z.ZodTypeDef, string>;
+                name: ZodType<string, z.ZodTypeDef, string>;
                 description: ZodType<string, z.ZodTypeDef, string>;
-                scopes: z.ZodArray<z.ZodObject<Pick<{
-                    name: ZodType<string, z.ZodTypeDef, string>;
-                    id: ZodType<string, z.ZodTypeDef, string>;
+                type: ZodType<import("../../db-entries/custom-types.js").RoleType, z.ZodTypeDef, import("../../db-entries/custom-types.js").RoleType>;
+                isDefault: ZodType<boolean, z.ZodTypeDef, boolean>;
+            }, "name" | "id" | "description">, {
+                scopes: z.ZodArray<z.ZodObject<Pick<z.objectUtil.extendShape<{
                     tenantId: ZodType<string, z.ZodTypeDef, string>;
-                    createdAt: ZodType<number, z.ZodTypeDef, number>;
-                    description: ZodType<string | null, z.ZodTypeDef, string | null>;
+                    id: ZodType<string, z.ZodTypeDef, string>;
                     resourceId: ZodType<string, z.ZodTypeDef, string>;
+                    name: ZodType<string, z.ZodTypeDef, string>;
+                    description: ZodType<string | null, z.ZodTypeDef, string | null>;
+                    createdAt: ZodType<number, z.ZodTypeDef, number>;
+                }, {
                     resource: import("../../foundations/schemas.js").Guard<import("../../db-entries/resource.js").Resource>;
-                }, "name" | "id" | "description" | "resource" | "resourceId">, "strip", z.ZodTypeAny, {
+                }>, "name" | "id" | "description" | "resource" | "resourceId">, "strip", z.ZodTypeAny, {
                     name: string;
                     id: string;
                     description: string | null;
@@ -1175,7 +1263,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                     resource: import("../../db-entries/resource.js").Resource;
                     resourceId: string;
                 }>, "many">;
-            }, "strip", z.ZodTypeAny, {
+            }>, "strip", z.ZodTypeAny, {
                 name: string;
                 id: string;
                 description: string;
@@ -1205,6 +1293,17 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 description: ZodType<string | null, z.ZodTypeDef, string | null>;
                 customData: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
                 isMfaRequired: ZodType<boolean, z.ZodTypeDef, boolean>;
+                branding: ZodType<{
+                    logoUrl?: string | undefined;
+                    darkLogoUrl?: string | undefined;
+                    favicon?: string | undefined;
+                    darkFavicon?: string | undefined;
+                }, z.ZodTypeDef, {
+                    logoUrl?: string | undefined;
+                    darkLogoUrl?: string | undefined;
+                    favicon?: string | undefined;
+                    darkFavicon?: string | undefined;
+                }>;
                 createdAt: ZodType<number, z.ZodTypeDef, number>;
             }, "name" | "id" | "description">, "strip", z.ZodTypeAny, {
                 name: string;
@@ -1233,6 +1332,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -1254,9 +1354,25 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -1273,23 +1389,6 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
@@ -1300,6 +1399,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -1321,9 +1421,25 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -1340,35 +1456,29 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         }>;
+        grant: z.ZodOptional<z.ZodObject<{
+            type: z.ZodOptional<z.ZodLiteral<GrantType.TokenExchange>>;
+            subjectTokenContext: z.ZodOptional<z.ZodRecord<z.ZodString, ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>>;
+        }, "strip", z.ZodTypeAny, {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        }, {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         user: {
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -1390,9 +1500,25 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -1409,35 +1535,23 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         };
+        grant?: {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        } | undefined;
     }, {
         user: {
             name?: string | null | undefined;
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -1459,9 +1573,25 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -1478,29 +1608,16 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         };
+        grant?: {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        } | undefined;
     }>;
     script: z.ZodString;
     environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -1512,6 +1629,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -1533,9 +1651,25 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -1552,43 +1686,30 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         };
+        grant?: {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        } | undefined;
     };
     script: string;
     tokenType: LogtoJwtTokenKeyType.AccessToken;
     token: {
+        grantId?: string | undefined;
+        scope?: string | undefined;
         accountId?: string | undefined;
         expiresWithSession?: boolean | undefined;
-        grantId?: string | undefined;
         gty?: string | undefined;
         sessionUid?: string | undefined;
         sid?: string | undefined;
         kind?: "AccessToken" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     };
     environmentVariables?: Record<string, string> | undefined;
@@ -1599,6 +1720,7 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             id?: string | undefined;
             applicationId?: string | null | undefined;
             username?: string | null | undefined;
+            createdAt?: number | undefined;
             profile?: Partial<{
                 familyName: string;
                 givenName: string;
@@ -1620,9 +1742,25 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                     country: string;
                 }>;
             }> | undefined;
-            createdAt?: number | undefined;
-            updatedAt?: number | undefined;
             customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            updatedAt?: number | undefined;
+            organizations?: {
+                name: string;
+                id: string;
+                description: string | null;
+            }[] | undefined;
+            roles?: {
+                name: string;
+                id: string;
+                description: string;
+                scopes: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                    resource: import("../../db-entries/resource.js").Resource;
+                    resourceId: string;
+                }[];
+            }[] | undefined;
             primaryEmail?: string | null | undefined;
             primaryPhone?: string | null | undefined;
             avatar?: string | null | undefined;
@@ -1639,43 +1777,30 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
                 detail: import("@withtyped/server/lib/types.js").JsonObject;
             }[] | undefined;
             mfaVerificationFactors?: import("../../foundations/index.js").MfaFactor[] | undefined;
-            roles?: {
-                name: string;
-                id: string;
-                description: string;
-                scopes: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                    resource: import("../../db-entries/resource.js").Resource;
-                    resourceId: string;
-                }[];
-            }[] | undefined;
-            organizations?: {
-                name: string;
-                id: string;
-                description: string | null;
-            }[] | undefined;
             organizationRoles?: {
                 organizationId: string;
                 roleId: string;
                 roleName: string;
             }[] | undefined;
         };
+        grant?: {
+            type?: GrantType.TokenExchange | undefined;
+            subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
+        } | undefined;
     };
     script: string;
     tokenType: LogtoJwtTokenKeyType.AccessToken;
     token: {
+        grantId?: string | undefined;
+        scope?: string | undefined;
         accountId?: string | undefined;
         expiresWithSession?: boolean | undefined;
-        grantId?: string | undefined;
         gty?: string | undefined;
         sessionUid?: string | undefined;
         sid?: string | undefined;
         kind?: "AccessToken" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     };
     environmentVariables?: Record<string, string> | undefined;
@@ -1687,16 +1812,16 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
         scope: z.ZodOptional<z.ZodOptional<z.ZodString>>;
         clientId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
     }, "strict", z.ZodTypeAny, {
+        scope?: string | undefined;
         kind?: "ClientCredentials" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     }, {
+        scope?: string | undefined;
         kind?: "ClientCredentials" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     }>;
     script: z.ZodString;
@@ -1706,10 +1831,10 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
     script: string;
     tokenType: LogtoJwtTokenKeyType.ClientCredentials;
     token: {
+        scope?: string | undefined;
         kind?: "ClientCredentials" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     };
     environmentVariables?: Record<string, string> | undefined;
@@ -1717,22 +1842,24 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
     script: string;
     tokenType: LogtoJwtTokenKeyType.ClientCredentials;
     token: {
+        scope?: string | undefined;
         kind?: "ClientCredentials" | undefined;
         jti?: string | undefined;
         aud?: string | string[] | undefined;
-        scope?: string | undefined;
         clientId?: string | undefined;
     };
     environmentVariables?: Record<string, string> | undefined;
 }>]>;
 export type JwtCustomizerTestRequestBody = z.infer<typeof jwtCustomizerTestRequestBodyGuard>;
-export declare const customJwtFetcherGuard: z.ZodDiscriminatedUnion<"tokenType", [z.ZodObject<{
+export declare const customJwtFetcherGuard: z.ZodDiscriminatedUnion<"tokenType", [z.ZodObject<z.objectUtil.extendShape<z.objectUtil.extendShape<{
     script: z.ZodString;
     environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, {
     token: z.ZodRecord<z.ZodString, ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>;
+}>, {
     tokenType: z.ZodLiteral<LogtoJwtTokenKeyType.AccessToken>;
     context: z.ZodRecord<z.ZodString, ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>;
-}, "strip", z.ZodTypeAny, {
+}>, "strip", z.ZodTypeAny, {
     context: Record<string, import("@withtyped/server/lib/types.js").Json>;
     script: string;
     tokenType: LogtoJwtTokenKeyType.AccessToken;
@@ -1744,12 +1871,14 @@ export declare const customJwtFetcherGuard: z.ZodDiscriminatedUnion<"tokenType",
     tokenType: LogtoJwtTokenKeyType.AccessToken;
     token: Record<string, import("@withtyped/server/lib/types.js").Json>;
     environmentVariables?: Record<string, string> | undefined;
-}>, z.ZodObject<{
+}>, z.ZodObject<z.objectUtil.extendShape<z.objectUtil.extendShape<{
     script: z.ZodString;
     environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, {
     token: z.ZodRecord<z.ZodString, ZodType<import("@withtyped/server/lib/types.js").Json, z.ZodTypeDef, import("@withtyped/server/lib/types.js").Json>>;
+}>, {
     tokenType: z.ZodLiteral<LogtoJwtTokenKeyType.ClientCredentials>;
-}, "strip", z.ZodTypeAny, {
+}>, "strip", z.ZodTypeAny, {
     script: string;
     tokenType: LogtoJwtTokenKeyType.ClientCredentials;
     token: Record<string, import("@withtyped/server/lib/types.js").Json>;