@logto/schemas 1.38.0 → 1.40.0

package/lib/types/logto-config/index.d.ts

@@ -41,6 +41,29 @@ export declare const oidcConfigKeyGuard: z.ZodObject<{
     createdAt: number;
 }>;
 export type OidcConfigKey = z.infer<typeof oidcConfigKeyGuard>;
+export declare enum OidcSigningKeyStatus {
+    Next = "Next",
+    Current = "Current",
+    Previous = "Previous"
+}
+export declare const oidcPrivateKeyGuard: z.ZodObject<{
+    id: z.ZodString;
+    value: z.ZodString;
+    createdAt: z.ZodNumber;
+} & {
+    status: z.ZodOptional<z.ZodNativeEnum<typeof OidcSigningKeyStatus>>;
+}, "strip", z.ZodTypeAny, {
+    value: string;
+    id: string;
+    createdAt: number;
+    status?: OidcSigningKeyStatus | undefined;
+}, {
+    value: string;
+    id: string;
+    createdAt: number;
+    status?: OidcSigningKeyStatus | undefined;
+}>;
+export type OidcPrivateKey = z.infer<typeof oidcPrivateKeyGuard>;
 export declare const oidcSessionConfigGuard: z.ZodObject<{
     ttl: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
@@ -50,7 +73,7 @@ export declare const oidcSessionConfigGuard: z.ZodObject<{
 }>;
 export type OidcSessionConfig = z.infer<typeof oidcSessionConfigGuard>;
 export type LogtoOidcConfigType = {
-    [LogtoOidcConfigKey.PrivateKeys]: OidcConfigKey[];
+    [LogtoOidcConfigKey.PrivateKeys]: OidcPrivateKey[];
     [LogtoOidcConfigKey.CookieKeys]: OidcConfigKey[];
     [LogtoOidcConfigKey.Session]: OidcSessionConfig;
 };
@@ -73,6 +96,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
     value: z.ZodObject<{
         script: z.ZodString;
         environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        blockIssuanceOnError: z.ZodOptional<z.ZodBoolean>;
     } & {
         tokenSample: z.ZodOptional<z.ZodObject<{
             accountId: z.ZodOptional<z.ZodString>;
@@ -1246,6 +1270,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -1274,6 +1299,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -1297,6 +1323,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null>>;
                 isThirdParty: z.ZodOptional<ZodType<boolean, z.ZodTypeDef, boolean>>;
+                appLevelAccessControlEnabled: z.ZodOptional<ZodType<boolean, z.ZodTypeDef, boolean>>;
             }, "strip", z.ZodTypeAny, {
                 type?: import("../../index.js").ApplicationType | undefined;
                 name?: string | undefined;
@@ -1325,6 +1352,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -1348,6 +1376,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             }, {
                 type?: import("../../index.js").ApplicationType | undefined;
                 name?: string | undefined;
@@ -1376,6 +1405,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -1399,6 +1429,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             }>>;
         }, "strip", z.ZodTypeAny, {
             user: {
@@ -1497,6 +1528,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -1520,6 +1552,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
             grant?: {
                 type?: import("../oidc-config.js").GrantType.TokenExchange | undefined;
@@ -1737,6 +1770,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -1760,6 +1794,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
             grant?: {
                 type?: import("../oidc-config.js").GrantType.TokenExchange | undefined;
@@ -1981,6 +2016,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -2004,6 +2040,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
             grant?: {
                 type?: import("../oidc-config.js").GrantType.TokenExchange | undefined;
@@ -2125,6 +2162,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 signInContext?: Record<string, string> | undefined;
             } | undefined;
         } | undefined;
+        blockIssuanceOnError?: boolean | undefined;
         tokenSample?: {
             grantId?: string | undefined;
             sid?: string | undefined;
@@ -2238,6 +2276,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -2261,6 +2300,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
             grant?: {
                 type?: import("../oidc-config.js").GrantType.TokenExchange | undefined;
@@ -2382,6 +2422,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 signInContext?: Record<string, string> | undefined;
             } | undefined;
         } | undefined;
+        blockIssuanceOnError?: boolean | undefined;
         tokenSample?: {
             grantId?: string | undefined;
             sid?: string | undefined;
@@ -2497,6 +2538,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -2520,6 +2562,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
             grant?: {
                 type?: import("../oidc-config.js").GrantType.TokenExchange | undefined;
@@ -2641,6 +2684,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 signInContext?: Record<string, string> | undefined;
             } | undefined;
         } | undefined;
+        blockIssuanceOnError?: boolean | undefined;
         tokenSample?: {
             grantId?: string | undefined;
             sid?: string | undefined;
@@ -2757,6 +2801,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -2780,6 +2825,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
             grant?: {
                 type?: import("../oidc-config.js").GrantType.TokenExchange | undefined;
@@ -2901,6 +2947,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 signInContext?: Record<string, string> | undefined;
             } | undefined;
         } | undefined;
+        blockIssuanceOnError?: boolean | undefined;
         tokenSample?: {
             grantId?: string | undefined;
             sid?: string | undefined;
@@ -2921,6 +2968,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
     value: z.ZodObject<{
         script: z.ZodString;
         environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        blockIssuanceOnError: z.ZodOptional<z.ZodBoolean>;
     } & {
         tokenSample: z.ZodOptional<z.ZodObject<{
             kind: z.ZodOptional<z.ZodLiteral<"ClientCredentials">>;
@@ -2981,6 +3029,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3009,6 +3058,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3032,6 +3082,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null>>;
                 isThirdParty: z.ZodOptional<ZodType<boolean, z.ZodTypeDef, boolean>>;
+                appLevelAccessControlEnabled: z.ZodOptional<ZodType<boolean, z.ZodTypeDef, boolean>>;
             }, "strip", z.ZodTypeAny, {
                 type?: import("../../index.js").ApplicationType | undefined;
                 name?: string | undefined;
@@ -3060,6 +3111,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3083,6 +3135,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             }, {
                 type?: import("../../index.js").ApplicationType | undefined;
                 name?: string | undefined;
@@ -3111,6 +3164,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3134,6 +3188,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             }>>;
         }, "strip", z.ZodTypeAny, {
             application?: {
@@ -3164,6 +3219,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3187,6 +3243,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
         }, {
             application?: {
@@ -3217,6 +3274,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3240,6 +3298,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
         }>>;
     }, "strict", z.ZodTypeAny, {
@@ -3274,6 +3333,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3297,8 +3357,10 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
         } | undefined;
+        blockIssuanceOnError?: boolean | undefined;
         tokenSample?: {
             jti?: string | undefined;
             kind?: "ClientCredentials" | undefined;
@@ -3338,6 +3400,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3361,8 +3424,10 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
         } | undefined;
+        blockIssuanceOnError?: boolean | undefined;
         tokenSample?: {
             jti?: string | undefined;
             kind?: "ClientCredentials" | undefined;
@@ -3404,6 +3469,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3427,8 +3493,10 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
         } | undefined;
+        blockIssuanceOnError?: boolean | undefined;
         tokenSample?: {
             jti?: string | undefined;
             kind?: "ClientCredentials" | undefined;
@@ -3471,6 +3539,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3494,8 +3563,10 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
         } | undefined;
+        blockIssuanceOnError?: boolean | undefined;
         tokenSample?: {
             jti?: string | undefined;
             kind?: "ClientCredentials" | undefined;
@@ -3597,13 +3668,26 @@ export declare const idTokenConfigGuard: z.ZodObject<{
     enabledExtendedClaims?: ("custom_data" | "identities" | "sso_identities" | "roles" | "organizations" | "organization_data" | "organization_roles")[] | undefined;
 }>;
 export type IdTokenConfig = z.infer<typeof idTokenConfigGuard>;
+export declare const signingKeyRotationStateGuard: z.ZodObject<{
+    tenantCacheExpiresAt: z.ZodOptional<z.ZodNumber>;
+    signingKeyRotationAt: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    tenantCacheExpiresAt?: number | undefined;
+    signingKeyRotationAt?: number | undefined;
+}, {
+    tenantCacheExpiresAt?: number | undefined;
+    signingKeyRotationAt?: number | undefined;
+}>;
+export type SigningKeyRotationState = z.infer<typeof signingKeyRotationStateGuard>;
 export declare enum LogtoTenantConfigKey {
     AdminConsole = "adminConsole",
     CloudConnection = "cloudConnection",
     /** The URL to redirect when session not found in Sign-in Experience. */
     SessionNotFoundRedirectUrl = "sessionNotFoundRedirectUrl",
     /** ID token configuration for extended claims. */
-    IdToken = "idToken"
+    IdToken = "idToken",
+    /** Tenant-scoped rotation state for staged private signing key activation. */
+    SigningKeyRotationState = "signingKeyRotationState"
 }
 export type LogtoTenantConfigType = {
     [LogtoTenantConfigKey.AdminConsole]: AdminConsoleData;
@@ -3612,6 +3696,7 @@ export type LogtoTenantConfigType = {
         url: string;
     };
     [LogtoTenantConfigKey.IdToken]: IdTokenConfig;
+    [LogtoTenantConfigKey.SigningKeyRotationState]: SigningKeyRotationState;
 };
 export declare const logtoTenantConfigGuard: Readonly<{
     [key in LogtoTenantConfigKey]: ZodType<LogtoTenantConfigType[key]>;
@@ -3627,13 +3712,19 @@ export declare const oidcConfigKeysResponseGuard: z.ZodObject<Omit<{
     createdAt: z.ZodNumber;
 }, "value"> & {
     signingKeyAlgorithm: z.ZodOptional<z.ZodNativeEnum<typeof SupportedSigningKeyAlgorithm>>;
+    status: z.ZodOptional<z.ZodNativeEnum<typeof OidcSigningKeyStatus>>;
+    effectiveAt: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     id: string;
     createdAt: number;
+    status?: OidcSigningKeyStatus | undefined;
     signingKeyAlgorithm?: SupportedSigningKeyAlgorithm | undefined;
+    effectiveAt?: number | undefined;
 }, {
     id: string;
     createdAt: number;
+    status?: OidcSigningKeyStatus | undefined;
     signingKeyAlgorithm?: SupportedSigningKeyAlgorithm | undefined;
+    effectiveAt?: number | undefined;
 }>;
 export type OidcConfigKeysResponse = z.infer<typeof oidcConfigKeysResponseGuard>;

package/lib/types/logto-config/index.js

@@ -33,11 +33,20 @@ export const oidcConfigKeyGuard = z.object({
     value: z.string(),
     createdAt: z.number(),
 });
+export var OidcSigningKeyStatus;
+(function (OidcSigningKeyStatus) {
+    OidcSigningKeyStatus["Next"] = "Next";
+    OidcSigningKeyStatus["Current"] = "Current";
+    OidcSigningKeyStatus["Previous"] = "Previous";
+})(OidcSigningKeyStatus || (OidcSigningKeyStatus = {}));
+export const oidcPrivateKeyGuard = oidcConfigKeyGuard.extend({
+    status: z.nativeEnum(OidcSigningKeyStatus).optional(),
+});
 export const oidcSessionConfigGuard = z.object({
     ttl: z.number().int().min(1).max(31_536_000).optional(),
 });
 export const logtoOidcConfigGuard = Object.freeze({
-    [LogtoOidcConfigKey.PrivateKeys]: oidcConfigKeyGuard.array(),
+    [LogtoOidcConfigKey.PrivateKeys]: oidcPrivateKeyGuard.array(),
     [LogtoOidcConfigKey.CookieKeys]: oidcConfigKeyGuard.array(),
     // Session config is optional, if not set, it will fallback to default value in core.
     [LogtoOidcConfigKey.Session]: oidcSessionConfigGuard.nullish().transform((data) => data ?? {}),
@@ -96,6 +105,10 @@ export const extendedIdTokenClaimsGuard = z.enum(extendedIdTokenClaims);
 export const idTokenConfigGuard = z.object({
     enabledExtendedClaims: extendedIdTokenClaimsGuard.array().optional(),
 });
+export const signingKeyRotationStateGuard = z.object({
+    tenantCacheExpiresAt: z.number().optional(),
+    signingKeyRotationAt: z.number().optional(),
+});
 export var LogtoTenantConfigKey;
 (function (LogtoTenantConfigKey) {
     LogtoTenantConfigKey["AdminConsole"] = "adminConsole";
@@ -104,12 +117,15 @@ export var LogtoTenantConfigKey;
     LogtoTenantConfigKey["SessionNotFoundRedirectUrl"] = "sessionNotFoundRedirectUrl";
     /** ID token configuration for extended claims. */
     LogtoTenantConfigKey["IdToken"] = "idToken";
+    /** Tenant-scoped rotation state for staged private signing key activation. */
+    LogtoTenantConfigKey["SigningKeyRotationState"] = "signingKeyRotationState";
 })(LogtoTenantConfigKey || (LogtoTenantConfigKey = {}));
 export const logtoTenantConfigGuard = Object.freeze({
     [LogtoTenantConfigKey.AdminConsole]: adminConsoleDataGuard,
     [LogtoTenantConfigKey.CloudConnection]: cloudConnectionDataGuard,
     [LogtoTenantConfigKey.SessionNotFoundRedirectUrl]: z.object({ url: z.string() }),
     [LogtoTenantConfigKey.IdToken]: idTokenConfigGuard,
+    [LogtoTenantConfigKey.SigningKeyRotationState]: signingKeyRotationStateGuard,
 });
 export const logtoConfigKeys = Object.freeze([
     ...Object.values(LogtoOidcConfigKey),
@@ -121,6 +137,8 @@ export const logtoConfigGuards = Object.freeze({
     ...jwtCustomizerConfigGuard,
     ...logtoTenantConfigGuard,
 });
-export const oidcConfigKeysResponseGuard = oidcConfigKeyGuard
-    .omit({ value: true })
-    .merge(z.object({ signingKeyAlgorithm: z.nativeEnum(SupportedSigningKeyAlgorithm).optional() }));
+export const oidcConfigKeysResponseGuard = oidcConfigKeyGuard.omit({ value: true }).merge(z.object({
+    signingKeyAlgorithm: z.nativeEnum(SupportedSigningKeyAlgorithm).optional(),
+    status: z.nativeEnum(OidcSigningKeyStatus).optional(),
+    effectiveAt: z.number().optional(),
+}));

package/lib/types/logto-config/index.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/types/logto-config/index.test.js

@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest';
+import { LogtoOidcConfigKey, LogtoTenantConfigKey, OidcSigningKeyStatus, logtoOidcConfigGuard, logtoTenantConfigGuard, oidcConfigKeysResponseGuard, } from './index.js';
+describe('logto config guards', () => {
+    it('accepts legacy private keys without status', () => {
+        const privateKeys = [
+            {
+                id: 'key_1',
+                value: 'private-key-1',
+                createdAt: 1_710_000_000_000,
+            },
+        ];
+        const result = logtoOidcConfigGuard[LogtoOidcConfigKey.PrivateKeys].safeParse(privateKeys);
+        expect(result.success).toBe(true);
+    });
+    it('accepts signing key status in OIDC key responses', () => {
+        const result = oidcConfigKeysResponseGuard.safeParse({
+            id: 'key_1',
+            createdAt: 1_710_000_000_000,
+            status: OidcSigningKeyStatus.Current,
+        });
+        expect(result.success).toBe(true);
+    });
+    it('accepts partial signing key rotation state', () => {
+        const result = logtoTenantConfigGuard[LogtoTenantConfigKey.SigningKeyRotationState].safeParse({
+            signingKeyRotationAt: 1_710_000_000_000,
+        });
+        expect(result.success).toBe(true);
+    });
+});