@logto/schemas 1.22.0 → 1.23.1

package/lib/foundations/jsonb-types/saml-application-configs.d.ts

@@ -1,12 +1,20 @@
+import { type UserClaim } from '@logto/core-kit';
 import { z } from 'zod';
-export type SamlAttributeMapping = Record<string, string>;
-export declare const samlAttributeMappingGuard: z.ZodRecord<z.ZodString, z.ZodString>;
+export type SamlAttributeMapping = Partial<Record<UserClaim | 'id', string>>;
+export declare const samlAttributeMappingKeys: readonly ("name" | "id" | "username" | "email" | "nickname" | "profile" | "website" | "gender" | "birthdate" | "zoneinfo" | "locale" | "address" | "given_name" | "family_name" | "middle_name" | "preferred_username" | "picture" | "email_verified" | "phone_number" | "phone_number_verified" | "updated_at" | "roles" | "organizations" | "organization_data" | "organization_roles" | "custom_data" | "identities" | "sso_identities" | "created_at")[];
+export declare const samlAttributeMappingGuard: z.ZodObject<{
+    [x: string]: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    [x: string]: string | undefined;
+}, {
+    [x: string]: string | undefined;
+}>;
 export declare enum BindingType {
-    POST = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
-    REDIRECT = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+    Post = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+    Redirect = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
 }
 export type SamlAcsUrl = {
-    binding?: BindingType;
+    binding: BindingType;
     url: string;
 };
 export declare const samlAcsUrlGuard: z.ZodObject<{
@@ -19,3 +27,36 @@ export declare const samlAcsUrlGuard: z.ZodObject<{
     url: string;
     binding: BindingType;
 }>;
+export declare const samlEncryptionGuard: z.ZodEffects<z.ZodObject<{
+    encryptAssertion: z.ZodOptional<z.ZodBoolean>;
+    encryptThenSign: z.ZodOptional<z.ZodBoolean>;
+    certificate: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    encryptAssertion?: boolean | undefined;
+    encryptThenSign?: boolean | undefined;
+    certificate?: string | undefined;
+}, {
+    encryptAssertion?: boolean | undefined;
+    encryptThenSign?: boolean | undefined;
+    certificate?: string | undefined;
+}>, {
+    encryptAssertion?: boolean | undefined;
+    encryptThenSign?: boolean | undefined;
+    certificate?: string | undefined;
+}, {
+    encryptAssertion?: boolean | undefined;
+    encryptThenSign?: boolean | undefined;
+    certificate?: string | undefined;
+}>;
+export type SamlEncryption = z.input<typeof samlEncryptionGuard>;
+export declare enum NameIdFormat {
+    /** Uses unique and persistent identifiers for the user. */
+    Persistent = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
+    /** Returns the email address of the user. */
+    EmailAddress = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+    /** Uses unique and transient identifiers for the user, which can be different for each session. */
+    Transient = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+    /** The Identity Provider can determine the format. */
+    Unspecified = "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
+}
+export declare const nameIdFormatGuard: z.ZodNativeEnum<typeof NameIdFormat>;

package/lib/foundations/jsonb-types/saml-application-configs.js

@@ -1,11 +1,42 @@
+import { completeUserClaims } from '@logto/core-kit';
 import { z } from 'zod';
-export const samlAttributeMappingGuard = z.record(z.string());
+export const samlAttributeMappingKeys = Object.freeze(['id', ...completeUserClaims]);
+export const samlAttributeMappingGuard = z
+    .object(Object.fromEntries(samlAttributeMappingKeys.map((claim) => [claim, z.string()])))
+    .partial();
 export var BindingType;
 (function (BindingType) {
-    BindingType["POST"] = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
-    BindingType["REDIRECT"] = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect";
+    BindingType["Post"] = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+    BindingType["Redirect"] = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect";
 })(BindingType || (BindingType = {}));
 export const samlAcsUrlGuard = z.object({
     binding: z.nativeEnum(BindingType),
-    url: z.string(),
+    url: z.string().url(),
 });
+export const samlEncryptionGuard = z
+    .object({
+    encryptAssertion: z.boolean().optional(),
+    encryptThenSign: z.boolean().optional(),
+    certificate: z.string().optional(),
+})
+    .superRefine(({ encryptAssertion, encryptThenSign, certificate }, ctx) => {
+    if (encryptAssertion && (encryptThenSign === undefined || certificate === undefined)) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: '`encryptThenSign` and `certificate` are required when `encryptAssertion` is `true`',
+        });
+        return z.NEVER;
+    }
+});
+export var NameIdFormat;
+(function (NameIdFormat) {
+    /** Uses unique and persistent identifiers for the user. */
+    NameIdFormat["Persistent"] = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent";
+    /** Returns the email address of the user. */
+    NameIdFormat["EmailAddress"] = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
+    /** Uses unique and transient identifiers for the user, which can be different for each session. */
+    NameIdFormat["Transient"] = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient";
+    /** The Identity Provider can determine the format. */
+    NameIdFormat["Unspecified"] = "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified";
+})(NameIdFormat || (NameIdFormat = {}));
+export const nameIdFormatGuard = z.nativeEnum(NameIdFormat);

package/lib/foundations/jsonb-types/saml-application-configs.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/foundations/jsonb-types/saml-application-configs.test.js

@@ -0,0 +1,49 @@
+import { describe, it, expect } from 'vitest';
+import { samlEncryptionGuard } from './saml-application-configs.js';
+describe('samlEncryptionGuard', () => {
+    // Test valid configurations
+    it('should pass when encryption is disabled', () => {
+        const result = samlEncryptionGuard.safeParse({
+            encryptAssertion: false,
+        });
+        expect(result.success).toBe(true);
+    });
+    it('should pass when encryption is enabled with all required fields', () => {
+        const result = samlEncryptionGuard.safeParse({
+            encryptAssertion: true,
+            encryptThenSign: true,
+            certificate: '-----BEGIN CERTIFICATE-----\nMIICYDCCAcmgAwIBA...',
+        });
+        expect(result.success).toBe(true);
+    });
+    // Test invalid configurations
+    it('should fail when encryptAssertion is true but missing encryptThenSign', () => {
+        const result = samlEncryptionGuard.safeParse({
+            encryptAssertion: true,
+            certificate: '-----BEGIN CERTIFICATE-----\nMIICYDCCAcmgAwIBA...',
+        });
+        expect(result.success).toBe(false);
+        if (!result.success) {
+            expect(result.error.issues[0]?.message).toBe('`encryptThenSign` and `certificate` are required when `encryptAssertion` is `true`');
+        }
+    });
+    it('should fail when encryptAssertion is true but missing certificate', () => {
+        const result = samlEncryptionGuard.safeParse({
+            encryptAssertion: true,
+            encryptThenSign: true,
+        });
+        expect(result.success).toBe(false);
+        if (!result.success) {
+            expect(result.error.issues[0]?.message).toBe('`encryptThenSign` and `certificate` are required when `encryptAssertion` is `true`');
+        }
+    });
+    it('should fail when encryptAssertion is true but missing both encryptThenSign and certificate', () => {
+        const result = samlEncryptionGuard.safeParse({
+            encryptAssertion: true,
+        });
+        expect(result.success).toBe(false);
+        if (!result.success) {
+            expect(result.error.issues[0]?.message).toBe('`encryptThenSign` and `certificate` are required when `encryptAssertion` is `true`');
+        }
+    });
+});

package/lib/foundations/jsonb-types/saml-application-sessions.d.ts

@@ -0,0 +1,45 @@
+import { z } from 'zod';
+export type AuthRequestInfo = {
+    issuer: string;
+    request: {
+        id: string;
+        destination: string;
+        issueInstant: string;
+        assertionConsumerServiceUrl: string;
+    };
+};
+export declare const authRequestInfoGuard: z.ZodObject<{
+    issuer: z.ZodString;
+    request: z.ZodObject<{
+        id: z.ZodString;
+        destination: z.ZodString;
+        issueInstant: z.ZodString;
+        assertionConsumerServiceUrl: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        destination: string;
+        issueInstant: string;
+        assertionConsumerServiceUrl: string;
+    }, {
+        id: string;
+        destination: string;
+        issueInstant: string;
+        assertionConsumerServiceUrl: string;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    issuer: string;
+    request: {
+        id: string;
+        destination: string;
+        issueInstant: string;
+        assertionConsumerServiceUrl: string;
+    };
+}, {
+    issuer: string;
+    request: {
+        id: string;
+        destination: string;
+        issueInstant: string;
+        assertionConsumerServiceUrl: string;
+    };
+}>;

package/lib/foundations/jsonb-types/saml-application-sessions.js

@@ -0,0 +1,10 @@
+import { z } from 'zod';
+export const authRequestInfoGuard = z.object({
+    issuer: z.string(),
+    request: z.object({
+        id: z.string(),
+        destination: z.string(),
+        issueInstant: z.string(),
+        assertionConsumerServiceUrl: z.string(),
+    }),
+});

package/lib/foundations/jsonb-types/sign-in-experience.d.ts

@@ -142,8 +142,16 @@ export declare enum MfaFactor {
 export declare const mfaFactorsGuard: z.ZodArray<z.ZodNativeEnum<typeof MfaFactor>, "many">;
 export type MfaFactors = z.infer<typeof mfaFactorsGuard>;
 export declare enum MfaPolicy {
+    /** @deprecated, use `PromptAtSignInAndSignUp` instead */
     UserControlled = "UserControlled",
-    Mandatory = "Mandatory"
+    /** MFA is required for all users */
+    Mandatory = "Mandatory",
+    /** Ask users to set up MFA on their sign-in after registration (skippable, one-time prompt) */
+    PromptOnlyAtSignIn = "PromptOnlyAtSignIn",
+    /** Ask users to set up MFA during registration (skippable, one-time prompt) */
+    PromptAtSignInAndSignUp = "PromptAtSignInAndSignUp",
+    /** Do not ask users to set up MFA */
+    NoPrompt = "NoPrompt"
 }
 export declare const mfaGuard: z.ZodObject<{
     factors: z.ZodArray<z.ZodNativeEnum<typeof MfaFactor>, "many">;

package/lib/foundations/jsonb-types/sign-in-experience.js

@@ -65,8 +65,16 @@ export var MfaFactor;
 export const mfaFactorsGuard = z.nativeEnum(MfaFactor).array();
 export var MfaPolicy;
 (function (MfaPolicy) {
+    /** @deprecated, use `PromptAtSignInAndSignUp` instead */
     MfaPolicy["UserControlled"] = "UserControlled";
+    /** MFA is required for all users */
     MfaPolicy["Mandatory"] = "Mandatory";
+    /** Ask users to set up MFA on their sign-in after registration (skippable, one-time prompt) */
+    MfaPolicy["PromptOnlyAtSignIn"] = "PromptOnlyAtSignIn";
+    /** Ask users to set up MFA during registration (skippable, one-time prompt) */
+    MfaPolicy["PromptAtSignInAndSignUp"] = "PromptAtSignInAndSignUp";
+    /** Do not ask users to set up MFA */
+    MfaPolicy["NoPrompt"] = "NoPrompt";
 })(MfaPolicy || (MfaPolicy = {}));
 export const mfaGuard = z.object({
     factors: mfaFactorsGuard,

package/lib/types/index.d.ts

@@ -30,3 +30,4 @@ export * from './onboarding.js';
 export * from './sign-in-experience.js';
 export * from './subject-token.js';
 export * from './ssr.js';
+export * from './saml-application.js';

package/lib/types/index.js

@@ -30,3 +30,4 @@ export * from './onboarding.js';
 export * from './sign-in-experience.js';
 export * from './subject-token.js';
 export * from './ssr.js';
+export * from './saml-application.js';

package/lib/types/log/index.d.ts

@@ -1,21 +1,25 @@
 import type * as hook from './hook.js';
 import type * as interaction from './interaction.js';
 import type * as jwtCustomizer from './jwt-customizer.js';
+import type * as saml from './saml.js';
 import type * as token from './token.js';
 export * as interaction from './interaction.js';
 export * as token from './token.js';
 export * as hook from './hook.js';
 export * as jwtCustomizer from './jwt-customizer.js';
+export * as saml from './saml.js';
 /** Fallback for empty or unrecognized log keys. */
 export declare const LogKeyUnknown = "Unknown";
-export type AuditLogKey = typeof LogKeyUnknown | interaction.LogKey | token.LogKey;
+export type AuditLogKey = typeof LogKeyUnknown | interaction.LogKey | token.LogKey | saml.LogKey;
 export type WebhookLogKey = hook.LogKey;
 export type JwtCustomizerLogKey = jwtCustomizer.LogKey;
+export type SamlLogKey = saml.LogKey;
 /**
  * The union type of all available log keys.
  * Note duplicate keys are allowed but should be avoided.
  *
  * @see {@link interaction.LogKey} for interaction log keys.
  * @see {@link token.LogKey} for token log keys.
+ * @see {@link saml.LogKey} for SAML application log keys.
  **/
 export type LogKey = AuditLogKey | WebhookLogKey | JwtCustomizerLogKey;

package/lib/types/log/index.js

@@ -2,5 +2,6 @@ export * as interaction from './interaction.js';
 export * as token from './token.js';
 export * as hook from './hook.js';
 export * as jwtCustomizer from './jwt-customizer.js';
+export * as saml from './saml.js';
 /** Fallback for empty or unrecognized log keys. */
 export const LogKeyUnknown = 'Unknown';

package/lib/types/log/saml.d.ts

@@ -0,0 +1,7 @@
+export type Prefix = 'SamlApplication';
+export declare const prefix: Prefix;
+export declare enum Scenario {
+    Callback = "Callback",
+    AuthnRequest = "AuthnRequest"
+}
+export type LogKey = `${Prefix}.${Scenario}`;

package/lib/types/log/saml.js

@@ -0,0 +1,6 @@
+export const prefix = 'SamlApplication';
+export var Scenario;
+(function (Scenario) {
+    Scenario["Callback"] = "Callback";
+    Scenario["AuthnRequest"] = "AuthnRequest";
+})(Scenario || (Scenario = {}));

package/lib/types/logto-config/index.d.ts

@@ -150,9 +150,6 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 }>>>;
                 avatar: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
                 customData: z.ZodOptional<ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>>;
-                updatedAt: z.ZodOptional<ZodType<number, z.ZodTypeDef, number>>;
-                primaryEmail: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
-                primaryPhone: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
                 identities: z.ZodOptional<ZodType<Record<string, {
                     userId: string;
                     details?: Record<string, import("@withtyped/server").Json> | undefined;
@@ -160,6 +157,9 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     userId: string;
                     details?: Record<string, import("@withtyped/server").Json> | undefined;
                 }>>>;
+                updatedAt: z.ZodOptional<ZodType<number, z.ZodTypeDef, number>>;
+                primaryEmail: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+                primaryPhone: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
                 isSuspended: z.ZodOptional<ZodType<boolean, z.ZodTypeDef, boolean>>;
                 lastSignInAt: z.ZodOptional<ZodType<number | null, z.ZodTypeDef, number | null>>;
                 hasPassword: z.ZodOptional<z.ZodBoolean>;
@@ -305,12 +305,6 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 }> | undefined;
                 avatar?: string | null | undefined;
                 customData?: import("@withtyped/server").JsonObject | undefined;
-                updatedAt?: number | undefined;
-                organizations?: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                }[] | undefined;
                 roles?: {
                     name: string;
                     id: string;
@@ -323,12 +317,18 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                         resourceId: string;
                     }[];
                 }[] | undefined;
-                primaryEmail?: string | null | undefined;
-                primaryPhone?: string | null | undefined;
+                organizations?: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                }[] | undefined;
                 identities?: Record<string, {
                     userId: string;
                     details?: Record<string, import("@withtyped/server").Json> | undefined;
                 }> | undefined;
+                updatedAt?: number | undefined;
+                primaryEmail?: string | null | undefined;
+                primaryPhone?: string | null | undefined;
                 isSuspended?: boolean | undefined;
                 lastSignInAt?: number | null | undefined;
                 hasPassword?: boolean | undefined;
@@ -372,12 +372,6 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 }> | undefined;
                 avatar?: string | null | undefined;
                 customData?: import("@withtyped/server").JsonObject | undefined;
-                updatedAt?: number | undefined;
-                organizations?: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                }[] | undefined;
                 roles?: {
                     name: string;
                     id: string;
@@ -390,12 +384,18 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                         resourceId: string;
                     }[];
                 }[] | undefined;
-                primaryEmail?: string | null | undefined;
-                primaryPhone?: string | null | undefined;
+                organizations?: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                }[] | undefined;
                 identities?: Record<string, {
                     userId: string;
                     details?: Record<string, import("@withtyped/server").Json> | undefined;
                 }> | undefined;
+                updatedAt?: number | undefined;
+                primaryEmail?: string | null | undefined;
+                primaryPhone?: string | null | undefined;
                 isSuspended?: boolean | undefined;
                 lastSignInAt?: number | null | undefined;
                 hasPassword?: boolean | undefined;
@@ -451,12 +451,6 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 }> | undefined;
                 avatar?: string | null | undefined;
                 customData?: import("@withtyped/server").JsonObject | undefined;
-                updatedAt?: number | undefined;
-                organizations?: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                }[] | undefined;
                 roles?: {
                     name: string;
                     id: string;
@@ -469,12 +463,18 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                         resourceId: string;
                     }[];
                 }[] | undefined;
-                primaryEmail?: string | null | undefined;
-                primaryPhone?: string | null | undefined;
+                organizations?: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                }[] | undefined;
                 identities?: Record<string, {
                     userId: string;
                     details?: Record<string, import("@withtyped/server").Json> | undefined;
                 }> | undefined;
+                updatedAt?: number | undefined;
+                primaryEmail?: string | null | undefined;
+                primaryPhone?: string | null | undefined;
                 isSuspended?: boolean | undefined;
                 lastSignInAt?: number | null | undefined;
                 hasPassword?: boolean | undefined;
@@ -524,12 +524,6 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 }> | undefined;
                 avatar?: string | null | undefined;
                 customData?: import("@withtyped/server").JsonObject | undefined;
-                updatedAt?: number | undefined;
-                organizations?: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                }[] | undefined;
                 roles?: {
                     name: string;
                     id: string;
@@ -542,12 +536,18 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                         resourceId: string;
                     }[];
                 }[] | undefined;
-                primaryEmail?: string | null | undefined;
-                primaryPhone?: string | null | undefined;
+                organizations?: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                }[] | undefined;
                 identities?: Record<string, {
                     userId: string;
                     details?: Record<string, import("@withtyped/server").Json> | undefined;
                 }> | undefined;
+                updatedAt?: number | undefined;
+                primaryEmail?: string | null | undefined;
+                primaryPhone?: string | null | undefined;
                 isSuspended?: boolean | undefined;
                 lastSignInAt?: number | null | undefined;
                 hasPassword?: boolean | undefined;
@@ -601,12 +601,6 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 }> | undefined;
                 avatar?: string | null | undefined;
                 customData?: import("@withtyped/server").JsonObject | undefined;
-                updatedAt?: number | undefined;
-                organizations?: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                }[] | undefined;
                 roles?: {
                     name: string;
                     id: string;
@@ -619,12 +613,18 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                         resourceId: string;
                     }[];
                 }[] | undefined;
-                primaryEmail?: string | null | undefined;
-                primaryPhone?: string | null | undefined;
+                organizations?: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                }[] | undefined;
                 identities?: Record<string, {
                     userId: string;
                     details?: Record<string, import("@withtyped/server").Json> | undefined;
                 }> | undefined;
+                updatedAt?: number | undefined;
+                primaryEmail?: string | null | undefined;
+                primaryPhone?: string | null | undefined;
                 isSuspended?: boolean | undefined;
                 lastSignInAt?: number | null | undefined;
                 hasPassword?: boolean | undefined;
@@ -691,12 +691,6 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 }> | undefined;
                 avatar?: string | null | undefined;
                 customData?: import("@withtyped/server").JsonObject | undefined;
-                updatedAt?: number | undefined;
-                organizations?: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                }[] | undefined;
                 roles?: {
                     name: string;
                     id: string;
@@ -709,12 +703,18 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                         resourceId: string;
                     }[];
                 }[] | undefined;
-                primaryEmail?: string | null | undefined;
-                primaryPhone?: string | null | undefined;
+                organizations?: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                }[] | undefined;
                 identities?: Record<string, {
                     userId: string;
                     details?: Record<string, import("@withtyped/server").Json> | undefined;
                 }> | undefined;
+                updatedAt?: number | undefined;
+                primaryEmail?: string | null | undefined;
+                primaryPhone?: string | null | undefined;
                 isSuspended?: boolean | undefined;
                 lastSignInAt?: number | null | undefined;
                 hasPassword?: boolean | undefined;
@@ -783,12 +783,6 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 }> | undefined;
                 avatar?: string | null | undefined;
                 customData?: import("@withtyped/server").JsonObject | undefined;
-                updatedAt?: number | undefined;
-                organizations?: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                }[] | undefined;
                 roles?: {
                     name: string;
                     id: string;
@@ -801,12 +795,18 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                         resourceId: string;
                     }[];
                 }[] | undefined;
-                primaryEmail?: string | null | undefined;
-                primaryPhone?: string | null | undefined;
+                organizations?: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                }[] | undefined;
                 identities?: Record<string, {
                     userId: string;
                     details?: Record<string, import("@withtyped/server").Json> | undefined;
                 }> | undefined;
+                updatedAt?: number | undefined;
+                primaryEmail?: string | null | undefined;
+                primaryPhone?: string | null | undefined;
                 isSuspended?: boolean | undefined;
                 lastSignInAt?: number | null | undefined;
                 hasPassword?: boolean | undefined;
@@ -876,12 +876,6 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 }> | undefined;
                 avatar?: string | null | undefined;
                 customData?: import("@withtyped/server").JsonObject | undefined;
-                updatedAt?: number | undefined;
-                organizations?: {
-                    name: string;
-                    id: string;
-                    description: string | null;
-                }[] | undefined;
                 roles?: {
                     name: string;
                     id: string;
@@ -894,12 +888,18 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                         resourceId: string;
                     }[];
                 }[] | undefined;
-                primaryEmail?: string | null | undefined;
-                primaryPhone?: string | null | undefined;
+                organizations?: {
+                    name: string;
+                    id: string;
+                    description: string | null;
+                }[] | undefined;
                 identities?: Record<string, {
                     userId: string;
                     details?: Record<string, import("@withtyped/server").Json> | undefined;
                 }> | undefined;
+                updatedAt?: number | undefined;
+                primaryEmail?: string | null | undefined;
+                primaryPhone?: string | null | undefined;
                 isSuspended?: boolean | undefined;
                 lastSignInAt?: number | null | undefined;
                 hasPassword?: boolean | undefined;