@logto/schemas 1.39.0 → 1.40.0

package/lib/types/application.js

@@ -9,6 +9,7 @@ export const featuredApplicationGuard = Applications.guard.pick({
 });
 export const applicationCreateGuard = Applications.createGuard
     .omit({
+    appLevelAccessControlEnabled: true,
     id: true,
     createdAt: true,
     secret: true,
@@ -20,6 +21,60 @@ export const applicationPatchGuard = applicationCreateGuard.partial().omit({
     type: true,
     isThirdParty: true,
 });
+const applicationAccessControlRuleLimit = 1000;
+const applicationAccessControlRawRuleLimit = applicationAccessControlRuleLimit * 2;
+const uniqueStringArrayGuard = z
+    .array(z.string())
+    .max(applicationAccessControlRawRuleLimit)
+    .transform((values) => [...new Set(values)])
+    .pipe(z.array(z.string()).max(applicationAccessControlRuleLimit));
+/** The guard for one organization role access-control rule group. */
+export const applicationAccessControlOrganizationRoleRuleGuard = z.object({
+    organizationId: z.string(),
+    organizationRoleIds: uniqueStringArrayGuard,
+});
+/** The guard for application-level access control rule payloads. */
+export const applicationAccessControlGuard = z
+    .object({
+    userIds: uniqueStringArrayGuard,
+    userRoleIds: uniqueStringArrayGuard,
+    organizationIds: uniqueStringArrayGuard,
+    organizationRoleRules: z
+        .array(applicationAccessControlOrganizationRoleRuleGuard)
+        .max(applicationAccessControlRawRuleLimit),
+})
+    .transform(({ organizationRoleRules, ...rest }) => {
+    const organizationRoleRulesMap = new Map();
+    for (const { organizationId, organizationRoleIds } of organizationRoleRules) {
+        const roleIds = organizationRoleRulesMap.get(organizationId) ?? new Set();
+        for (const roleId of organizationRoleIds) {
+            roleIds.add(roleId);
+        }
+        organizationRoleRulesMap.set(organizationId, roleIds);
+    }
+    return {
+        ...rest,
+        organizationRoleRules: [...organizationRoleRulesMap.entries()].map(([organizationId, organizationRoleIds]) => ({
+            organizationId,
+            organizationRoleIds: [...organizationRoleIds],
+        })),
+    };
+})
+    .pipe(z.object({
+    userIds: z.array(z.string()).max(applicationAccessControlRuleLimit),
+    userRoleIds: z.array(z.string()).max(applicationAccessControlRuleLimit),
+    organizationIds: z.array(z.string()).max(applicationAccessControlRuleLimit),
+    organizationRoleRules: z
+        .array(applicationAccessControlOrganizationRoleRuleGuard)
+        .max(applicationAccessControlRuleLimit),
+}));
+/** Create an empty application-level access control rule set. */
+export const createDefaultApplicationAccessControl = () => ({
+    userIds: [],
+    userRoleIds: [],
+    organizationIds: [],
+    organizationRoleRules: [],
+});
 const resourceScopesGuard = z.array(z.object({
     resource: Resources.guard.pick({ id: true, name: true, indicator: true }),
     scopes: z.array(Scopes.guard.pick({ id: true, name: true, description: true })),

package/lib/types/application.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/types/application.test.js

@@ -0,0 +1,120 @@
+import { describe, expect, it } from 'vitest';
+import { applicationAccessControlGuard, createDefaultApplicationAccessControl, } from './application.js';
+describe('applicationAccessControlGuard', () => {
+    it('deduplicates direct user and role rules', () => {
+        expect(applicationAccessControlGuard.parse({
+            userIds: ['user-1', 'user-2', 'user-1'],
+            userRoleIds: ['role-1', 'role-1', 'role-2'],
+            organizationIds: ['organization-1', 'organization-1', 'organization-2'],
+            organizationRoleRules: [],
+        })).toMatchObject({
+            userIds: ['user-1', 'user-2'],
+            userRoleIds: ['role-1', 'role-2'],
+            organizationIds: ['organization-1', 'organization-2'],
+            organizationRoleRules: [],
+        });
+    });
+    it('merges organization role rules by organization', () => {
+        expect(applicationAccessControlGuard.parse({
+            userIds: [],
+            userRoleIds: [],
+            organizationIds: [],
+            organizationRoleRules: [
+                {
+                    organizationId: 'organization-1',
+                    organizationRoleIds: ['organization-role-1', 'organization-role-2'],
+                },
+                {
+                    organizationId: 'organization-1',
+                    organizationRoleIds: ['organization-role-1', 'organization-role-3'],
+                },
+                {
+                    organizationId: 'organization-2',
+                    organizationRoleIds: ['organization-role-1'],
+                },
+            ],
+        })).toMatchObject({
+            userIds: [],
+            userRoleIds: [],
+            organizationIds: [],
+            organizationRoleRules: [
+                {
+                    organizationId: 'organization-1',
+                    organizationRoleIds: [
+                        'organization-role-1',
+                        'organization-role-2',
+                        'organization-role-3',
+                    ],
+                },
+                {
+                    organizationId: 'organization-2',
+                    organizationRoleIds: ['organization-role-1'],
+                },
+            ],
+        });
+    });
+    it('creates a fresh default rule set', () => {
+        const first = createDefaultApplicationAccessControl();
+        const second = createDefaultApplicationAccessControl();
+        expect(first).not.toBe(second);
+        expect(first.userIds).not.toBe(second.userIds);
+        expect(first.userRoleIds).not.toBe(second.userRoleIds);
+        expect(first.organizationIds).not.toBe(second.organizationIds);
+        expect(first.organizationRoleRules).not.toBe(second.organizationRoleRules);
+    });
+    it('rejects oversized rule lists', () => {
+        const oversizedIds = Array.from({ length: 1001 }, (_, index) => `id-${index}`);
+        const emptyAccessControl = createDefaultApplicationAccessControl();
+        expect(() => applicationAccessControlGuard.parse({ ...emptyAccessControl, userIds: oversizedIds })).toThrow();
+        expect(() => applicationAccessControlGuard.parse({
+            ...emptyAccessControl,
+            organizationRoleRules: oversizedIds.map((organizationId) => ({
+                organizationId,
+                organizationRoleIds: [],
+            })),
+        })).toThrow();
+        expect(() => applicationAccessControlGuard.parse({
+            ...emptyAccessControl,
+            organizationRoleRules: [
+                { organizationId: 'organization-1', organizationRoleIds: oversizedIds },
+            ],
+        })).toThrow();
+    });
+    it('enforces rule list limits after normalization', () => {
+        const emptyAccessControl = createDefaultApplicationAccessControl();
+        const duplicateHeavyIds = Array.from({ length: 1001 }, () => 'user-1');
+        const mergedOrganizationRoleRules = [
+            {
+                organizationId: 'organization-1',
+                organizationRoleIds: Array.from({ length: 1000 }, (_, index) => `role-${index}`),
+            },
+            {
+                organizationId: 'organization-1',
+                organizationRoleIds: ['role-1000'],
+            },
+        ];
+        expect(applicationAccessControlGuard.parse({ ...emptyAccessControl, userIds: duplicateHeavyIds })).toMatchObject({ userIds: ['user-1'] });
+        expect(() => applicationAccessControlGuard.parse({
+            ...emptyAccessControl,
+            organizationRoleRules: mergedOrganizationRoleRules,
+        })).toThrow();
+    });
+    it('rejects overly large raw rule inputs before normalization', () => {
+        const emptyAccessControl = createDefaultApplicationAccessControl();
+        const oversizedDuplicateIds = Array.from({ length: 2001 }, () => 'id-1');
+        expect(() => applicationAccessControlGuard.parse({ ...emptyAccessControl, userIds: oversizedDuplicateIds })).toThrow();
+        expect(() => applicationAccessControlGuard.parse({
+            ...emptyAccessControl,
+            organizationRoleRules: oversizedDuplicateIds.map(() => ({
+                organizationId: 'organization-1',
+                organizationRoleIds: [],
+            })),
+        })).toThrow();
+        expect(() => applicationAccessControlGuard.parse({
+            ...emptyAccessControl,
+            organizationRoleRules: [
+                { organizationId: 'organization-1', organizationRoleIds: oversizedDuplicateIds },
+            ],
+        })).toThrow();
+    });
+});

package/lib/types/consent.d.ts

@@ -179,6 +179,7 @@ export declare const publicApplicationGuard: z.ZodObject<Pick<{
         pageRules: {
             path: string;
         }[];
+        additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
         customDomains?: {
             status: import("../index.js").DomainStatus;
             domain: string;
@@ -207,6 +208,7 @@ export declare const publicApplicationGuard: z.ZodObject<Pick<{
         pageRules: {
             path: string;
         }[];
+        additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
         customDomains?: {
             status: import("../index.js").DomainStatus;
             domain: string;
@@ -231,6 +233,7 @@ export declare const publicApplicationGuard: z.ZodObject<Pick<{
     } | null>;
     customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
     isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     createdAt: z.ZodType<number, z.ZodTypeDef, number>;
 }, "name" | "id">, "strip", z.ZodTypeAny, {
     name: string;
@@ -502,6 +505,7 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
             pageRules: {
                 path: string;
             }[];
+            additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
             customDomains?: {
                 status: import("../index.js").DomainStatus;
                 domain: string;
@@ -530,6 +534,7 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
             pageRules: {
                 path: string;
             }[];
+            additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
             customDomains?: {
                 status: import("../index.js").DomainStatus;
                 domain: string;
@@ -554,6 +559,7 @@ export declare const consentInfoResponseGuard: z.ZodObject<{
         } | null>;
         customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
         isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+        appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
         createdAt: z.ZodType<number, z.ZodTypeDef, number>;
     }, "name" | "id"> & {
         displayName: z.ZodOptional<z.ZodType<string | null, z.ZodTypeDef, string | null>>;

package/lib/types/logto-config/index.d.ts

@@ -1270,6 +1270,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -1298,6 +1299,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -1321,6 +1323,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null>>;
                 isThirdParty: z.ZodOptional<ZodType<boolean, z.ZodTypeDef, boolean>>;
+                appLevelAccessControlEnabled: z.ZodOptional<ZodType<boolean, z.ZodTypeDef, boolean>>;
             }, "strip", z.ZodTypeAny, {
                 type?: import("../../index.js").ApplicationType | undefined;
                 name?: string | undefined;
@@ -1349,6 +1352,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -1372,6 +1376,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             }, {
                 type?: import("../../index.js").ApplicationType | undefined;
                 name?: string | undefined;
@@ -1400,6 +1405,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -1423,6 +1429,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             }>>;
         }, "strip", z.ZodTypeAny, {
             user: {
@@ -1521,6 +1528,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -1544,6 +1552,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
             grant?: {
                 type?: import("../oidc-config.js").GrantType.TokenExchange | undefined;
@@ -1761,6 +1770,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -1784,6 +1794,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
             grant?: {
                 type?: import("../oidc-config.js").GrantType.TokenExchange | undefined;
@@ -2005,6 +2016,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -2028,6 +2040,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
             grant?: {
                 type?: import("../oidc-config.js").GrantType.TokenExchange | undefined;
@@ -2263,6 +2276,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -2286,6 +2300,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
             grant?: {
                 type?: import("../oidc-config.js").GrantType.TokenExchange | undefined;
@@ -2523,6 +2538,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -2546,6 +2562,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
             grant?: {
                 type?: import("../oidc-config.js").GrantType.TokenExchange | undefined;
@@ -2784,6 +2801,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -2807,6 +2825,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
             grant?: {
                 type?: import("../oidc-config.js").GrantType.TokenExchange | undefined;
@@ -3010,6 +3029,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3038,6 +3058,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3061,6 +3082,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null>>;
                 isThirdParty: z.ZodOptional<ZodType<boolean, z.ZodTypeDef, boolean>>;
+                appLevelAccessControlEnabled: z.ZodOptional<ZodType<boolean, z.ZodTypeDef, boolean>>;
             }, "strip", z.ZodTypeAny, {
                 type?: import("../../index.js").ApplicationType | undefined;
                 name?: string | undefined;
@@ -3089,6 +3111,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3112,6 +3135,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             }, {
                 type?: import("../../index.js").ApplicationType | undefined;
                 name?: string | undefined;
@@ -3140,6 +3164,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3163,6 +3188,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             }>>;
         }, "strip", z.ZodTypeAny, {
             application?: {
@@ -3193,6 +3219,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3216,6 +3243,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
         }, {
             application?: {
@@ -3246,6 +3274,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3269,6 +3298,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
         }>>;
     }, "strict", z.ZodTypeAny, {
@@ -3303,6 +3333,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3326,6 +3357,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
         } | undefined;
         blockIssuanceOnError?: boolean | undefined;
@@ -3368,6 +3400,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3391,6 +3424,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
         } | undefined;
         blockIssuanceOnError?: boolean | undefined;
@@ -3435,6 +3469,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3458,6 +3493,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
         } | undefined;
         blockIssuanceOnError?: boolean | undefined;
@@ -3503,6 +3539,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     pageRules: {
                         path: string;
                     }[];
+                    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
                     customDomains?: {
                         status: import("../../index.js").DomainStatus;
                         domain: string;
@@ -3526,6 +3563,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }[] | undefined;
                 } | null | undefined;
                 isThirdParty?: boolean | undefined;
+                appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
         } | undefined;
         blockIssuanceOnError?: boolean | undefined;