@logto/schemas 1.28.0 → 1.30.0

package/lib/types/logto-config/jwt-customizer.js

@@ -1,10 +1,20 @@
-import { jsonObjectGuard } from '@logto/connector-kit';
+import { jsonGuard, jsonObjectGuard, socialUserInfoGuard } from '@logto/connector-kit';
 import { z } from 'zod';
 import { Organizations, Roles, UserSsoIdentities, } from '../../db-entries/index.js';
 import { mfaFactorsGuard } from '../../foundations/index.js';
+import { InteractionEvent } from '../interactions.js';
 import { GrantType } from '../oidc-config.js';
 import { scopeResponseGuard } from '../scope.js';
 import { userInfoGuard } from '../user.js';
+import { backupCodeVerificationRecordDataGuard } from '../verification-records/backup-code-verification.js';
+import { emailCodeVerificationRecordDataGuard, phoneCodeVerificationRecordDataGuard, } from '../verification-records/code-verification.js';
+import { enterpriseSsoVerificationRecordDataGuard } from '../verification-records/enterprise-sso-verification.js';
+import { newPasswordIdentityVerificationRecordDataGuard } from '../verification-records/new-password-identity-verification.js';
+import { oneTimeTokenVerificationRecordDataGuard } from '../verification-records/one-time-token-verification.js';
+import { passwordVerificationRecordDataGuard } from '../verification-records/password-verification.js';
+import { socialVerificationRecordDataGuard } from '../verification-records/social-verification.js';
+import { totpVerificationRecordDataGuard } from '../verification-records/totp-verification.js';
+import { webAuthnVerificationRecordDataGuard } from '../verification-records/web-authn-verification.js';
 import { accessTokenPayloadGuard, clientCredentialsPayloadGuard } from './oidc-provider.js';
 export const jwtCustomizerGuard = z.object({
     script: z.string(),
@@ -43,6 +53,49 @@ export const jwtCustomizerGrantContextGuard = z.object({
     type: z.literal(GrantType.TokenExchange), // Only support token exchange for now
     subjectTokenContext: jsonObjectGuard,
 });
+// Unlike the verification record guard defined in experience interaction,
+// we need to omit sensitive fields like MFA code and secrets from some of the verification record.
+const jwtCustomizerUserInteractionVerificationRecordGuard = z.discriminatedUnion('type', [
+    passwordVerificationRecordDataGuard,
+    emailCodeVerificationRecordDataGuard,
+    phoneCodeVerificationRecordDataGuard,
+    socialVerificationRecordDataGuard.omit({
+        connectorSession: true,
+        encryptedTokenSet: true,
+    }),
+    enterpriseSsoVerificationRecordDataGuard
+        .omit({
+        encryptedTokenSet: true,
+    })
+        .extend({
+        // The original `enterpriseSsoUserInfo` field type is extended with `socialUserInfo` with `catchall(unknown)`.
+        // However, the unknown type may cause error when using the `sql.jsonb` function in Slonik.
+        // See {@logto/cli/src/queries/logto-config.ts#updateValueByKey} for more reference.
+        // So we use `socialUserInfoGuard.catchall(jsonGuard)` to ensure the type is JSON serializable.
+        enterpriseSsoUserInfo: socialUserInfoGuard.catchall(jsonGuard).optional(),
+    }),
+    totpVerificationRecordDataGuard.omit({
+        secret: true,
+    }),
+    backupCodeVerificationRecordDataGuard.omit({
+        backupCodes: true,
+    }),
+    webAuthnVerificationRecordDataGuard.omit({
+        registrationChallenge: true,
+        authenticationChallenge: true,
+        registrationInfo: true,
+    }),
+    oneTimeTokenVerificationRecordDataGuard,
+    newPasswordIdentityVerificationRecordDataGuard.omit({
+        passwordEncrypted: true,
+        passwordEncryptionMethod: true,
+    }),
+]);
+export const jwtCustomizerUserInteractionContextGuard = z.object({
+    interactionEvent: z.nativeEnum(InteractionEvent),
+    userId: z.string(),
+    verificationRecords: jwtCustomizerUserInteractionVerificationRecordGuard.array(),
+});
 export const accessTokenJwtCustomizerGuard = jwtCustomizerGuard
     .extend({
     // Use partial token guard since users customization may not rely on all fields.
@@ -51,6 +104,7 @@ export const accessTokenJwtCustomizerGuard = jwtCustomizerGuard
         .object({
         user: jwtCustomizerUserContextGuard.partial(),
         grant: jwtCustomizerGrantContextGuard.partial().optional(),
+        interaction: jwtCustomizerUserInteractionContextGuard.partial().optional(),
     })
         .optional(),
 })

package/lib/types/logto-config/oidc-provider.d.ts

@@ -22,25 +22,25 @@ export declare const accessTokenPayloadGuard: z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     grantId: string;
     accountId: string;
+    jti: string;
     gty: string;
     kind: "AccessToken";
-    jti: string;
     aud: string | string[];
     scope?: string | undefined;
-    expiresWithSession?: boolean | undefined;
     sessionUid?: string | undefined;
+    expiresWithSession?: boolean | undefined;
     sid?: string | undefined;
     clientId?: string | undefined;
 }, {
     grantId: string;
     accountId: string;
+    jti: string;
     gty: string;
     kind: "AccessToken";
-    jti: string;
     aud: string | string[];
     scope?: string | undefined;
-    expiresWithSession?: boolean | undefined;
     sessionUid?: string | undefined;
+    expiresWithSession?: boolean | undefined;
     sid?: string | undefined;
     clientId?: string | undefined;
 }>;
@@ -52,14 +52,14 @@ export declare const clientCredentialsPayloadGuard: z.ZodObject<{
     scope: z.ZodOptional<z.ZodString>;
     clientId: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
-    kind: "ClientCredentials";
     jti: string;
+    kind: "ClientCredentials";
     aud: string | string[];
     scope?: string | undefined;
     clientId?: string | undefined;
 }, {
-    kind: "ClientCredentials";
     jti: string;
+    kind: "ClientCredentials";
     aud: string | string[];
     scope?: string | undefined;
     clientId?: string | undefined;

package/lib/types/mfa.d.ts

@@ -56,13 +56,13 @@ export declare const webAuthnRegistrationOptionsGuard: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         authenticatorAttachment?: "platform" | "cross-platform" | undefined;
         requireResidentKey?: boolean | undefined;
-        residentKey?: "discouraged" | "preferred" | "required" | undefined;
-        userVerification?: "discouraged" | "preferred" | "required" | undefined;
+        residentKey?: "required" | "discouraged" | "preferred" | undefined;
+        userVerification?: "required" | "discouraged" | "preferred" | undefined;
     }, {
         authenticatorAttachment?: "platform" | "cross-platform" | undefined;
         requireResidentKey?: boolean | undefined;
-        residentKey?: "discouraged" | "preferred" | "required" | undefined;
-        userVerification?: "discouraged" | "preferred" | "required" | undefined;
+        residentKey?: "required" | "discouraged" | "preferred" | undefined;
+        userVerification?: "required" | "discouraged" | "preferred" | undefined;
     }>>;
     attestation: z.ZodOptional<z.ZodEnum<["none", "indirect", "direct", "enterprise"]>>;
     extensions: z.ZodOptional<z.ZodObject<{
@@ -102,8 +102,8 @@ export declare const webAuthnRegistrationOptionsGuard: z.ZodObject<{
     authenticatorSelection?: {
         authenticatorAttachment?: "platform" | "cross-platform" | undefined;
         requireResidentKey?: boolean | undefined;
-        residentKey?: "discouraged" | "preferred" | "required" | undefined;
-        userVerification?: "discouraged" | "preferred" | "required" | undefined;
+        residentKey?: "required" | "discouraged" | "preferred" | undefined;
+        userVerification?: "required" | "discouraged" | "preferred" | undefined;
     } | undefined;
     attestation?: "none" | "indirect" | "direct" | "enterprise" | undefined;
     extensions?: {
@@ -135,8 +135,8 @@ export declare const webAuthnRegistrationOptionsGuard: z.ZodObject<{
     authenticatorSelection?: {
         authenticatorAttachment?: "platform" | "cross-platform" | undefined;
         requireResidentKey?: boolean | undefined;
-        residentKey?: "discouraged" | "preferred" | "required" | undefined;
-        userVerification?: "discouraged" | "preferred" | "required" | undefined;
+        residentKey?: "required" | "discouraged" | "preferred" | undefined;
+        userVerification?: "required" | "discouraged" | "preferred" | undefined;
     } | undefined;
     attestation?: "none" | "indirect" | "direct" | "enterprise" | undefined;
     extensions?: {
@@ -180,7 +180,7 @@ export declare const webAuthnAuthenticationOptionsGuard: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     challenge: string;
     timeout?: number | undefined;
-    userVerification?: "discouraged" | "preferred" | "required" | undefined;
+    userVerification?: "required" | "discouraged" | "preferred" | undefined;
     extensions?: {
         appid?: string | undefined;
         hmacCreateSecret?: boolean | undefined;
@@ -195,7 +195,7 @@ export declare const webAuthnAuthenticationOptionsGuard: z.ZodObject<{
 }, {
     challenge: string;
     timeout?: number | undefined;
-    userVerification?: "discouraged" | "preferred" | "required" | undefined;
+    userVerification?: "required" | "discouraged" | "preferred" | undefined;
     extensions?: {
         appid?: string | undefined;
         hmacCreateSecret?: boolean | undefined;

package/lib/types/secrets.d.ts

@@ -0,0 +1,436 @@
+import { z } from 'zod';
+import { type CreateSecret } from '../db-entries/secret.js';
+import { SecretType } from '../foundations/index.js';
+export declare const encryptedSecretGuard: z.ZodObject<Pick<{
+    tenantId: z.ZodType<string, z.ZodTypeDef, string>;
+    id: z.ZodType<string, z.ZodTypeDef, string>;
+    userId: z.ZodType<string, z.ZodTypeDef, string>;
+    type: z.ZodType<SecretType, z.ZodTypeDef, SecretType>;
+    encryptedDek: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    iv: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    authTag: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    ciphertext: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    metadata: z.ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
+    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
+    updatedAt: z.ZodType<number, z.ZodTypeDef, number>;
+}, "encryptedDek" | "iv" | "authTag" | "ciphertext">, "strip", z.ZodTypeAny, {
+    encryptedDek: import("../foundations/index.js").BufferLike;
+    iv: import("../foundations/index.js").BufferLike;
+    authTag: import("../foundations/index.js").BufferLike;
+    ciphertext: import("../foundations/index.js").BufferLike;
+}, {
+    encryptedDek: import("../foundations/index.js").BufferLike;
+    iv: import("../foundations/index.js").BufferLike;
+    authTag: import("../foundations/index.js").BufferLike;
+    ciphertext: import("../foundations/index.js").BufferLike;
+}>;
+export type EncryptedSecret = z.infer<typeof encryptedSecretGuard>;
+export declare const tokenSetGuard: z.ZodObject<{
+    id_token: z.ZodOptional<z.ZodString>;
+    access_token: z.ZodString;
+    refresh_token: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    access_token: string;
+    id_token?: string | undefined;
+    refresh_token?: string | undefined;
+}, {
+    access_token: string;
+    id_token?: string | undefined;
+    refresh_token?: string | undefined;
+}>;
+export type TokenSet = z.infer<typeof tokenSetGuard>;
+export declare const tokenSetMetadataGuard: z.ZodObject<{
+    scope: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
+    tokenType: z.ZodOptional<z.ZodString>;
+    hasRefreshToken: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    hasRefreshToken: boolean;
+    scope?: string | undefined;
+    expiresAt?: number | undefined;
+    tokenType?: string | undefined;
+}, {
+    hasRefreshToken: boolean;
+    scope?: string | undefined;
+    expiresAt?: number | undefined;
+    tokenType?: string | undefined;
+}>;
+export type TokenSetMetadata = z.infer<typeof tokenSetMetadataGuard>;
+export declare const encryptedTokenSetGuard: z.ZodObject<{
+    encryptedTokenSetBase64: z.ZodString;
+    metadata: z.ZodObject<{
+        scope: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodNumber>;
+        tokenType: z.ZodOptional<z.ZodString>;
+        hasRefreshToken: z.ZodBoolean;
+    }, "strip", z.ZodTypeAny, {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    }, {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    metadata: {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    };
+    encryptedTokenSetBase64: string;
+}, {
+    metadata: {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    };
+    encryptedTokenSetBase64: string;
+}>;
+export type EncryptedTokenSet = z.infer<typeof encryptedTokenSetGuard>;
+export type CreateSocialTokenSetSecret = CreateSecret & {
+    metadata: TokenSetMetadata;
+};
+export declare const secretSocialConnectorRelationPayloadGuard: z.ZodObject<Pick<{
+    tenantId: z.ZodOptional<z.ZodType<string, z.ZodTypeDef, string>>;
+    secretId: z.ZodType<string, z.ZodTypeDef, string>;
+    connectorId: z.ZodType<string, z.ZodTypeDef, string>;
+    target: z.ZodType<string, z.ZodTypeDef, string>;
+    identityId: z.ZodType<string, z.ZodTypeDef, string>;
+}, "connectorId" | "target" | "identityId">, "strip", z.ZodTypeAny, {
+    connectorId: string;
+    target: string;
+    identityId: string;
+}, {
+    connectorId: string;
+    target: string;
+    identityId: string;
+}>;
+export type SecretSocialConnectorRelationPayload = z.infer<typeof secretSocialConnectorRelationPayloadGuard>;
+export declare const secretEnterpriseSsoConnectorRelationPayloadGuard: z.ZodObject<Pick<{
+    tenantId: z.ZodOptional<z.ZodType<string, z.ZodTypeDef, string>>;
+    secretId: z.ZodType<string, z.ZodTypeDef, string>;
+    ssoConnectorId: z.ZodType<string, z.ZodTypeDef, string>;
+    issuer: z.ZodType<string, z.ZodTypeDef, string>;
+    identityId: z.ZodType<string, z.ZodTypeDef, string>;
+}, "issuer" | "ssoConnectorId" | "identityId">, "strip", z.ZodTypeAny, {
+    issuer: string;
+    ssoConnectorId: string;
+    identityId: string;
+}, {
+    issuer: string;
+    ssoConnectorId: string;
+    identityId: string;
+}>;
+export type SecretEnterpriseSsoConnectorRelationPayload = z.infer<typeof secretEnterpriseSsoConnectorRelationPayloadGuard>;
+export declare const socialTokenSetSecretGuard: z.ZodObject<{
+    tenantId: z.ZodType<string, z.ZodTypeDef, string>;
+    id: z.ZodType<string, z.ZodTypeDef, string>;
+    userId: z.ZodType<string, z.ZodTypeDef, string>;
+    encryptedDek: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    iv: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    authTag: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    ciphertext: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
+    updatedAt: z.ZodType<number, z.ZodTypeDef, number>;
+} & {
+    type: z.ZodLiteral<SecretType>;
+    metadata: z.ZodObject<{
+        scope: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodNumber>;
+        tokenType: z.ZodOptional<z.ZodString>;
+        hasRefreshToken: z.ZodBoolean;
+    }, "strip", z.ZodTypeAny, {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    }, {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    }>;
+    connectorId: z.ZodString;
+    identityId: z.ZodString;
+    target: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: SecretType;
+    id: string;
+    userId: string;
+    tenantId: string;
+    createdAt: number;
+    updatedAt: number;
+    connectorId: string;
+    metadata: {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    };
+    target: string;
+    identityId: string;
+    encryptedDek: import("../foundations/index.js").BufferLike;
+    iv: import("../foundations/index.js").BufferLike;
+    authTag: import("../foundations/index.js").BufferLike;
+    ciphertext: import("../foundations/index.js").BufferLike;
+}, {
+    type: SecretType;
+    id: string;
+    userId: string;
+    tenantId: string;
+    createdAt: number;
+    updatedAt: number;
+    connectorId: string;
+    metadata: {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    };
+    target: string;
+    identityId: string;
+    encryptedDek: import("../foundations/index.js").BufferLike;
+    iv: import("../foundations/index.js").BufferLike;
+    authTag: import("../foundations/index.js").BufferLike;
+    ciphertext: import("../foundations/index.js").BufferLike;
+}>;
+/**
+ * Social token set secret type
+ * - Secret type is `FederatedTokenSet`
+ * - Metadata is the social connector token set metadata
+ * - Joined with the social connector relation
+ */
+export type SocialTokenSetSecret = z.infer<typeof socialTokenSetSecretGuard>;
+export declare const desensitizedSocialTokenSetSecretGuard: z.ZodObject<Omit<{
+    tenantId: z.ZodType<string, z.ZodTypeDef, string>;
+    id: z.ZodType<string, z.ZodTypeDef, string>;
+    userId: z.ZodType<string, z.ZodTypeDef, string>;
+    encryptedDek: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    iv: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    authTag: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    ciphertext: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
+    updatedAt: z.ZodType<number, z.ZodTypeDef, number>;
+} & {
+    type: z.ZodLiteral<SecretType>;
+    metadata: z.ZodObject<{
+        scope: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodNumber>;
+        tokenType: z.ZodOptional<z.ZodString>;
+        hasRefreshToken: z.ZodBoolean;
+    }, "strip", z.ZodTypeAny, {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    }, {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    }>;
+    connectorId: z.ZodString;
+    identityId: z.ZodString;
+    target: z.ZodString;
+}, "encryptedDek" | "iv" | "authTag" | "ciphertext">, "strip", z.ZodTypeAny, {
+    type: SecretType;
+    id: string;
+    userId: string;
+    tenantId: string;
+    createdAt: number;
+    updatedAt: number;
+    connectorId: string;
+    metadata: {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    };
+    target: string;
+    identityId: string;
+}, {
+    type: SecretType;
+    id: string;
+    userId: string;
+    tenantId: string;
+    createdAt: number;
+    updatedAt: number;
+    connectorId: string;
+    metadata: {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    };
+    target: string;
+    identityId: string;
+}>;
+export type DesensitizedSocialTokenSetSecret = z.infer<typeof desensitizedSocialTokenSetSecretGuard>;
+export declare const enterpriseSsoTokenSetSecretGuard: z.ZodObject<{
+    tenantId: z.ZodType<string, z.ZodTypeDef, string>;
+    id: z.ZodType<string, z.ZodTypeDef, string>;
+    userId: z.ZodType<string, z.ZodTypeDef, string>;
+    encryptedDek: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    iv: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    authTag: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    ciphertext: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
+    updatedAt: z.ZodType<number, z.ZodTypeDef, number>;
+} & {
+    type: z.ZodLiteral<SecretType>;
+    metadata: z.ZodObject<{
+        scope: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodNumber>;
+        tokenType: z.ZodOptional<z.ZodString>;
+        hasRefreshToken: z.ZodBoolean;
+    }, "strip", z.ZodTypeAny, {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    }, {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    }>;
+    ssoConnectorId: z.ZodString;
+    issuer: z.ZodString;
+    identityId: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: SecretType;
+    id: string;
+    userId: string;
+    tenantId: string;
+    createdAt: number;
+    issuer: string;
+    updatedAt: number;
+    metadata: {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    };
+    ssoConnectorId: string;
+    identityId: string;
+    encryptedDek: import("../foundations/index.js").BufferLike;
+    iv: import("../foundations/index.js").BufferLike;
+    authTag: import("../foundations/index.js").BufferLike;
+    ciphertext: import("../foundations/index.js").BufferLike;
+}, {
+    type: SecretType;
+    id: string;
+    userId: string;
+    tenantId: string;
+    createdAt: number;
+    issuer: string;
+    updatedAt: number;
+    metadata: {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    };
+    ssoConnectorId: string;
+    identityId: string;
+    encryptedDek: import("../foundations/index.js").BufferLike;
+    iv: import("../foundations/index.js").BufferLike;
+    authTag: import("../foundations/index.js").BufferLike;
+    ciphertext: import("../foundations/index.js").BufferLike;
+}>;
+/**
+ * Enterprise SSO token set secret type
+ * - Secret type is `FederatedTokenSet`
+ * - Metadata is the Enterprise SSO connector token set metadata
+ * - Joined with the Enterprise SSO connector relation
+ */
+export type EnterpriseSsoTokenSetSecret = z.infer<typeof enterpriseSsoTokenSetSecretGuard>;
+export declare const desensitizedEnterpriseSsoTokenSetSecretGuard: z.ZodObject<Omit<{
+    tenantId: z.ZodType<string, z.ZodTypeDef, string>;
+    id: z.ZodType<string, z.ZodTypeDef, string>;
+    userId: z.ZodType<string, z.ZodTypeDef, string>;
+    encryptedDek: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    iv: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    authTag: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    ciphertext: z.ZodType<Buffer, z.ZodTypeDef, Buffer>;
+    createdAt: z.ZodType<number, z.ZodTypeDef, number>;
+    updatedAt: z.ZodType<number, z.ZodTypeDef, number>;
+} & {
+    type: z.ZodLiteral<SecretType>;
+    metadata: z.ZodObject<{
+        scope: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodNumber>;
+        tokenType: z.ZodOptional<z.ZodString>;
+        hasRefreshToken: z.ZodBoolean;
+    }, "strip", z.ZodTypeAny, {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    }, {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    }>;
+    ssoConnectorId: z.ZodString;
+    issuer: z.ZodString;
+    identityId: z.ZodString;
+}, "encryptedDek" | "iv" | "authTag" | "ciphertext">, "strip", z.ZodTypeAny, {
+    type: SecretType;
+    id: string;
+    userId: string;
+    tenantId: string;
+    createdAt: number;
+    issuer: string;
+    updatedAt: number;
+    metadata: {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    };
+    ssoConnectorId: string;
+    identityId: string;
+}, {
+    type: SecretType;
+    id: string;
+    userId: string;
+    tenantId: string;
+    createdAt: number;
+    issuer: string;
+    updatedAt: number;
+    metadata: {
+        hasRefreshToken: boolean;
+        scope?: string | undefined;
+        expiresAt?: number | undefined;
+        tokenType?: string | undefined;
+    };
+    ssoConnectorId: string;
+    identityId: string;
+}>;
+export type DesensitizedEnterpriseSsoTokenSetSecret = z.infer<typeof desensitizedEnterpriseSsoTokenSetSecretGuard>;
+export type DesensitizedTokenSetSecret<T extends SocialTokenSetSecret | EnterpriseSsoTokenSetSecret> = Omit<T, 'encryptedDek' | 'iv' | 'authTag' | 'ciphertext'>;
+export declare const getThirdPartyAccessTokenResponseGuard: z.ZodObject<{
+    scope: z.ZodOptional<z.ZodString>;
+    expires_in: z.ZodOptional<z.ZodUnion<[z.ZodNumber, z.ZodString]>>;
+    token_type: z.ZodOptional<z.ZodString>;
+} & {
+    access_token: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    access_token: string;
+    scope?: string | undefined;
+    expires_in?: string | number | undefined;
+    token_type?: string | undefined;
+}, {
+    access_token: string;
+    scope?: string | undefined;
+    expires_in?: string | number | undefined;
+    token_type?: string | undefined;
+}>;
+export type GetThirdPartyAccessTokenResponse = z.infer<typeof getThirdPartyAccessTokenResponseGuard>;