@logto/schemas 1.37.1 → 1.39.0

package/lib/types/logto-config/index.d.ts

@@ -1,4 +1,5 @@
 import { extendedIdTokenClaims } from '@logto/core-kit';
+import { type Nullable, type Optional } from '@silverhand/essentials';
 import type { ZodType } from 'zod';
 import { z } from 'zod';
 import { type AccessTokenJwtCustomizer, type ClientCredentialsJwtCustomizer } from './jwt-customizer.js';
@@ -16,7 +17,8 @@ export declare enum LogtoOidcConfigKeyType {
  */
 export declare enum LogtoOidcConfigKey {
     PrivateKeys = "oidc.privateKeys",
-    CookieKeys = "oidc.cookieKeys"
+    CookieKeys = "oidc.cookieKeys",
+    Session = "oidc.session"
 }
 /**
  * Logto supported signing key algorithms for OIDC private keys that sign JWT tokens.
@@ -39,12 +41,44 @@ export declare const oidcConfigKeyGuard: z.ZodObject<{
     createdAt: number;
 }>;
 export type OidcConfigKey = z.infer<typeof oidcConfigKeyGuard>;
+export declare enum OidcSigningKeyStatus {
+    Next = "Next",
+    Current = "Current",
+    Previous = "Previous"
+}
+export declare const oidcPrivateKeyGuard: z.ZodObject<{
+    id: z.ZodString;
+    value: z.ZodString;
+    createdAt: z.ZodNumber;
+} & {
+    status: z.ZodOptional<z.ZodNativeEnum<typeof OidcSigningKeyStatus>>;
+}, "strip", z.ZodTypeAny, {
+    value: string;
+    id: string;
+    createdAt: number;
+    status?: OidcSigningKeyStatus | undefined;
+}, {
+    value: string;
+    id: string;
+    createdAt: number;
+    status?: OidcSigningKeyStatus | undefined;
+}>;
+export type OidcPrivateKey = z.infer<typeof oidcPrivateKeyGuard>;
+export declare const oidcSessionConfigGuard: z.ZodObject<{
+    ttl: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    ttl?: number | undefined;
+}, {
+    ttl?: number | undefined;
+}>;
+export type OidcSessionConfig = z.infer<typeof oidcSessionConfigGuard>;
 export type LogtoOidcConfigType = {
-    [LogtoOidcConfigKey.PrivateKeys]: OidcConfigKey[];
+    [LogtoOidcConfigKey.PrivateKeys]: OidcPrivateKey[];
     [LogtoOidcConfigKey.CookieKeys]: OidcConfigKey[];
+    [LogtoOidcConfigKey.Session]: OidcSessionConfig;
 };
 export declare const logtoOidcConfigGuard: Readonly<{
-    [key in LogtoOidcConfigKey]: ZodType<LogtoOidcConfigType[key]>;
+    [key in LogtoOidcConfigKey]: ZodType<LogtoOidcConfigType[key], z.ZodTypeDef, Optional<Nullable<LogtoOidcConfigType[key]>>>;
 }>;
 export declare enum LogtoJwtTokenKey {
     AccessToken = "jwt.accessToken",
@@ -62,6 +96,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
     value: z.ZodObject<{
         script: z.ZodString;
         environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        blockIssuanceOnError: z.ZodOptional<z.ZodBoolean>;
     } & {
         tokenSample: z.ZodOptional<z.ZodObject<{
             accountId: z.ZodOptional<z.ZodString>;
@@ -533,6 +568,74 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     };
                     templateType: import("@logto/connector-kit").TemplateType;
                     verified: boolean;
+                }>, z.ZodObject<{
+                    id: z.ZodString;
+                    templateType: z.ZodNativeEnum<typeof import("@logto/connector-kit").TemplateType>;
+                    verified: z.ZodBoolean;
+                } & {
+                    type: z.ZodLiteral<import("../index.js").VerificationType.MfaEmailVerificationCode>;
+                    identifier: z.ZodObject<{
+                        type: z.ZodLiteral<import("../../index.js").SignInIdentifier.Email>;
+                        value: z.ZodString;
+                    }, "strip", z.ZodTypeAny, {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Email;
+                    }, {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Email;
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    type: import("../index.js").VerificationType.MfaEmailVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Email;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
+                }, {
+                    type: import("../index.js").VerificationType.MfaEmailVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Email;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
+                }>, z.ZodObject<{
+                    id: z.ZodString;
+                    templateType: z.ZodNativeEnum<typeof import("@logto/connector-kit").TemplateType>;
+                    verified: z.ZodBoolean;
+                } & {
+                    type: z.ZodLiteral<import("../index.js").VerificationType.MfaPhoneVerificationCode>;
+                    identifier: z.ZodObject<{
+                        type: z.ZodLiteral<import("../../index.js").SignInIdentifier.Phone>;
+                        value: z.ZodString;
+                    }, "strip", z.ZodTypeAny, {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Phone;
+                    }, {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Phone;
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    type: import("../index.js").VerificationType.MfaPhoneVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Phone;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
+                }, {
+                    type: import("../index.js").VerificationType.MfaPhoneVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Phone;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
                 }>, z.ZodObject<Omit<{
                     id: z.ZodString;
                     connectorId: z.ZodString;
@@ -810,17 +913,17 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                         name?: string | undefined;
                     }>>;
                 } & {
-                    type: z.ZodLiteral<import("../index.js").VerificationType.SignInWebAuthn>;
+                    type: z.ZodLiteral<import("../index.js").VerificationType.SignInPasskey>;
                     userId: z.ZodOptional<z.ZodString>;
                     authenticationRpId: z.ZodOptional<z.ZodString>;
                 }, "registrationChallenge" | "authenticationChallenge" | "registrationInfo" | "authenticationRpId">, "strip", z.ZodTypeAny, {
-                    type: import("../index.js").VerificationType.SignInWebAuthn;
+                    type: import("../index.js").VerificationType.SignInPasskey;
                     id: string;
                     verified: boolean;
                     userId?: string | undefined;
                     registrationRpId?: string | undefined;
                 }, {
-                    type: import("../index.js").VerificationType.SignInWebAuthn;
+                    type: import("../index.js").VerificationType.SignInPasskey;
                     id: string;
                     verified: boolean;
                     userId?: string | undefined;
@@ -925,6 +1028,24 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     };
                     templateType: import("@logto/connector-kit").TemplateType;
                     verified: boolean;
+                } | {
+                    type: import("../index.js").VerificationType.MfaEmailVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Email;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
+                } | {
+                    type: import("../index.js").VerificationType.MfaPhoneVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Phone;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
                 } | {
                     type: import("../index.js").VerificationType.NewPasswordIdentity;
                     id: string;
@@ -988,7 +1109,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     verified: boolean;
                     registrationRpId?: string | undefined;
                 } | {
-                    type: import("../index.js").VerificationType.SignInWebAuthn;
+                    type: import("../index.js").VerificationType.SignInPasskey;
                     id: string;
                     verified: boolean;
                     userId?: string | undefined;
@@ -1021,6 +1142,24 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     };
                     templateType: import("@logto/connector-kit").TemplateType;
                     verified: boolean;
+                } | {
+                    type: import("../index.js").VerificationType.MfaEmailVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Email;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
+                } | {
+                    type: import("../index.js").VerificationType.MfaPhoneVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Phone;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
                 } | {
                     type: import("../index.js").VerificationType.NewPasswordIdentity;
                     id: string;
@@ -1084,7 +1223,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     verified: boolean;
                     registrationRpId?: string | undefined;
                 } | {
-                    type: import("../index.js").VerificationType.SignInWebAuthn;
+                    type: import("../index.js").VerificationType.SignInPasskey;
                     id: string;
                     verified: boolean;
                     userId?: string | undefined;
@@ -1110,6 +1249,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 }, z.ZodTypeDef, {
                     corsAllowedOrigins?: string[] | undefined;
                     idTokenTtl?: number | undefined;
@@ -1119,6 +1260,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 }>>;
                 protectedAppMetadata: z.ZodOptional<ZodType<{
                     host: string;
@@ -1196,6 +1339,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 } | undefined;
                 protectedAppMetadata?: {
                     host: string;
@@ -1245,6 +1390,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 } | undefined;
                 protectedAppMetadata?: {
                     host: string;
@@ -1364,6 +1511,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 } | undefined;
                 protectedAppMetadata?: {
                     host: string;
@@ -1426,6 +1575,24 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     };
                     templateType: import("@logto/connector-kit").TemplateType;
                     verified: boolean;
+                } | {
+                    type: import("../index.js").VerificationType.MfaEmailVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Email;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
+                } | {
+                    type: import("../index.js").VerificationType.MfaPhoneVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Phone;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
                 } | {
                     type: import("../index.js").VerificationType.NewPasswordIdentity;
                     id: string;
@@ -1489,7 +1656,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     verified: boolean;
                     registrationRpId?: string | undefined;
                 } | {
-                    type: import("../index.js").VerificationType.SignInWebAuthn;
+                    type: import("../index.js").VerificationType.SignInPasskey;
                     id: string;
                     verified: boolean;
                     userId?: string | undefined;
@@ -1584,6 +1751,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 } | undefined;
                 protectedAppMetadata?: {
                     host: string;
@@ -1646,6 +1815,24 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     };
                     templateType: import("@logto/connector-kit").TemplateType;
                     verified: boolean;
+                } | {
+                    type: import("../index.js").VerificationType.MfaEmailVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Email;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
+                } | {
+                    type: import("../index.js").VerificationType.MfaPhoneVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Phone;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
                 } | {
                     type: import("../index.js").VerificationType.NewPasswordIdentity;
                     id: string;
@@ -1709,7 +1896,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     verified: boolean;
                     registrationRpId?: string | undefined;
                 } | {
-                    type: import("../index.js").VerificationType.SignInWebAuthn;
+                    type: import("../index.js").VerificationType.SignInPasskey;
                     id: string;
                     verified: boolean;
                     userId?: string | undefined;
@@ -1808,6 +1995,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 } | undefined;
                 protectedAppMetadata?: {
                     host: string;
@@ -1870,6 +2059,24 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     };
                     templateType: import("@logto/connector-kit").TemplateType;
                     verified: boolean;
+                } | {
+                    type: import("../index.js").VerificationType.MfaEmailVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Email;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
+                } | {
+                    type: import("../index.js").VerificationType.MfaPhoneVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Phone;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
                 } | {
                     type: import("../index.js").VerificationType.NewPasswordIdentity;
                     id: string;
@@ -1933,7 +2140,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     verified: boolean;
                     registrationRpId?: string | undefined;
                 } | {
-                    type: import("../index.js").VerificationType.SignInWebAuthn;
+                    type: import("../index.js").VerificationType.SignInPasskey;
                     id: string;
                     verified: boolean;
                     userId?: string | undefined;
@@ -1942,6 +2149,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 signInContext?: Record<string, string> | undefined;
             } | undefined;
         } | undefined;
+        blockIssuanceOnError?: boolean | undefined;
         tokenSample?: {
             grantId?: string | undefined;
             sid?: string | undefined;
@@ -2045,6 +2253,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 } | undefined;
                 protectedAppMetadata?: {
                     host: string;
@@ -2107,6 +2317,24 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     };
                     templateType: import("@logto/connector-kit").TemplateType;
                     verified: boolean;
+                } | {
+                    type: import("../index.js").VerificationType.MfaEmailVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Email;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
+                } | {
+                    type: import("../index.js").VerificationType.MfaPhoneVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Phone;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
                 } | {
                     type: import("../index.js").VerificationType.NewPasswordIdentity;
                     id: string;
@@ -2170,7 +2398,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     verified: boolean;
                     registrationRpId?: string | undefined;
                 } | {
-                    type: import("../index.js").VerificationType.SignInWebAuthn;
+                    type: import("../index.js").VerificationType.SignInPasskey;
                     id: string;
                     verified: boolean;
                     userId?: string | undefined;
@@ -2179,6 +2407,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 signInContext?: Record<string, string> | undefined;
             } | undefined;
         } | undefined;
+        blockIssuanceOnError?: boolean | undefined;
         tokenSample?: {
             grantId?: string | undefined;
             sid?: string | undefined;
@@ -2284,6 +2513,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 } | undefined;
                 protectedAppMetadata?: {
                     host: string;
@@ -2346,6 +2577,24 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     };
                     templateType: import("@logto/connector-kit").TemplateType;
                     verified: boolean;
+                } | {
+                    type: import("../index.js").VerificationType.MfaEmailVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Email;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
+                } | {
+                    type: import("../index.js").VerificationType.MfaPhoneVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Phone;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
                 } | {
                     type: import("../index.js").VerificationType.NewPasswordIdentity;
                     id: string;
@@ -2409,7 +2658,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     verified: boolean;
                     registrationRpId?: string | undefined;
                 } | {
-                    type: import("../index.js").VerificationType.SignInWebAuthn;
+                    type: import("../index.js").VerificationType.SignInPasskey;
                     id: string;
                     verified: boolean;
                     userId?: string | undefined;
@@ -2418,6 +2667,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 signInContext?: Record<string, string> | undefined;
             } | undefined;
         } | undefined;
+        blockIssuanceOnError?: boolean | undefined;
         tokenSample?: {
             grantId?: string | undefined;
             sid?: string | undefined;
@@ -2524,6 +2774,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 } | undefined;
                 protectedAppMetadata?: {
                     host: string;
@@ -2586,6 +2838,24 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     };
                     templateType: import("@logto/connector-kit").TemplateType;
                     verified: boolean;
+                } | {
+                    type: import("../index.js").VerificationType.MfaEmailVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Email;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
+                } | {
+                    type: import("../index.js").VerificationType.MfaPhoneVerificationCode;
+                    id: string;
+                    identifier: {
+                        value: string;
+                        type: import("../../index.js").SignInIdentifier.Phone;
+                    };
+                    templateType: import("@logto/connector-kit").TemplateType;
+                    verified: boolean;
                 } | {
                     type: import("../index.js").VerificationType.NewPasswordIdentity;
                     id: string;
@@ -2649,7 +2919,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     verified: boolean;
                     registrationRpId?: string | undefined;
                 } | {
-                    type: import("../index.js").VerificationType.SignInWebAuthn;
+                    type: import("../index.js").VerificationType.SignInPasskey;
                     id: string;
                     verified: boolean;
                     userId?: string | undefined;
@@ -2658,6 +2928,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 signInContext?: Record<string, string> | undefined;
             } | undefined;
         } | undefined;
+        blockIssuanceOnError?: boolean | undefined;
         tokenSample?: {
             grantId?: string | undefined;
             sid?: string | undefined;
@@ -2678,6 +2949,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
     value: z.ZodObject<{
         script: z.ZodString;
         environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        blockIssuanceOnError: z.ZodOptional<z.ZodBoolean>;
     } & {
         tokenSample: z.ZodOptional<z.ZodObject<{
             kind: z.ZodOptional<z.ZodLiteral<"ClientCredentials">>;
@@ -2717,6 +2989,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 }, z.ZodTypeDef, {
                     corsAllowedOrigins?: string[] | undefined;
                     idTokenTtl?: number | undefined;
@@ -2726,6 +3000,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 }>>;
                 protectedAppMetadata: z.ZodOptional<ZodType<{
                     host: string;
@@ -2803,6 +3079,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 } | undefined;
                 protectedAppMetadata?: {
                     host: string;
@@ -2852,6 +3130,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 } | undefined;
                 protectedAppMetadata?: {
                     host: string;
@@ -2903,6 +3183,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 } | undefined;
                 protectedAppMetadata?: {
                     host: string;
@@ -2954,6 +3236,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 } | undefined;
                 protectedAppMetadata?: {
                     host: string;
@@ -3009,6 +3293,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 } | undefined;
                 protectedAppMetadata?: {
                     host: string;
@@ -3042,6 +3328,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 isThirdParty?: boolean | undefined;
             } | undefined;
         } | undefined;
+        blockIssuanceOnError?: boolean | undefined;
         tokenSample?: {
             jti?: string | undefined;
             kind?: "ClientCredentials" | undefined;
@@ -3071,6 +3358,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 } | undefined;
                 protectedAppMetadata?: {
                     host: string;
@@ -3104,6 +3393,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 isThirdParty?: boolean | undefined;
             } | undefined;
         } | undefined;
+        blockIssuanceOnError?: boolean | undefined;
         tokenSample?: {
             jti?: string | undefined;
             kind?: "ClientCredentials" | undefined;
@@ -3135,6 +3425,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 } | undefined;
                 protectedAppMetadata?: {
                     host: string;
@@ -3168,6 +3460,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 isThirdParty?: boolean | undefined;
             } | undefined;
         } | undefined;
+        blockIssuanceOnError?: boolean | undefined;
         tokenSample?: {
             jti?: string | undefined;
             kind?: "ClientCredentials" | undefined;
@@ -3200,6 +3493,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     alwaysIssueRefreshToken?: boolean | undefined;
                     rotateRefreshToken?: boolean | undefined;
                     allowTokenExchange?: boolean | undefined;
+                    isDeviceFlow?: boolean | undefined;
+                    maxAllowedGrants?: number | undefined;
                 } | undefined;
                 protectedAppMetadata?: {
                     host: string;
@@ -3233,6 +3528,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 isThirdParty?: boolean | undefined;
             } | undefined;
         } | undefined;
+        blockIssuanceOnError?: boolean | undefined;
         tokenSample?: {
             jti?: string | undefined;
             kind?: "ClientCredentials" | undefined;
@@ -3334,13 +3630,26 @@ export declare const idTokenConfigGuard: z.ZodObject<{
     enabledExtendedClaims?: ("custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles")[] | undefined;
 }>;
 export type IdTokenConfig = z.infer<typeof idTokenConfigGuard>;
+export declare const signingKeyRotationStateGuard: z.ZodObject<{
+    tenantCacheExpiresAt: z.ZodOptional<z.ZodNumber>;
+    signingKeyRotationAt: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    tenantCacheExpiresAt?: number | undefined;
+    signingKeyRotationAt?: number | undefined;
+}, {
+    tenantCacheExpiresAt?: number | undefined;
+    signingKeyRotationAt?: number | undefined;
+}>;
+export type SigningKeyRotationState = z.infer<typeof signingKeyRotationStateGuard>;
 export declare enum LogtoTenantConfigKey {
     AdminConsole = "adminConsole",
     CloudConnection = "cloudConnection",
     /** The URL to redirect when session not found in Sign-in Experience. */
     SessionNotFoundRedirectUrl = "sessionNotFoundRedirectUrl",
     /** ID token configuration for extended claims. */
-    IdToken = "idToken"
+    IdToken = "idToken",
+    /** Tenant-scoped rotation state for staged private signing key activation. */
+    SigningKeyRotationState = "signingKeyRotationState"
 }
 export type LogtoTenantConfigType = {
     [LogtoTenantConfigKey.AdminConsole]: AdminConsoleData;
@@ -3349,6 +3658,7 @@ export type LogtoTenantConfigType = {
         url: string;
     };
     [LogtoTenantConfigKey.IdToken]: IdTokenConfig;
+    [LogtoTenantConfigKey.SigningKeyRotationState]: SigningKeyRotationState;
 };
 export declare const logtoTenantConfigGuard: Readonly<{
     [key in LogtoTenantConfigKey]: ZodType<LogtoTenantConfigType[key]>;
@@ -3364,13 +3674,19 @@ export declare const oidcConfigKeysResponseGuard: z.ZodObject<Omit<{
     createdAt: z.ZodNumber;
 }, "value"> & {
     signingKeyAlgorithm: z.ZodOptional<z.ZodNativeEnum<typeof SupportedSigningKeyAlgorithm>>;
+    status: z.ZodOptional<z.ZodNativeEnum<typeof OidcSigningKeyStatus>>;
+    effectiveAt: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     id: string;
     createdAt: number;
+    status?: OidcSigningKeyStatus | undefined;
     signingKeyAlgorithm?: SupportedSigningKeyAlgorithm | undefined;
+    effectiveAt?: number | undefined;
 }, {
     id: string;
     createdAt: number;
+    status?: OidcSigningKeyStatus | undefined;
     signingKeyAlgorithm?: SupportedSigningKeyAlgorithm | undefined;
+    effectiveAt?: number | undefined;
 }>;
 export type OidcConfigKeysResponse = z.infer<typeof oidcConfigKeysResponseGuard>;