@logto/schemas 1.40.1 → 1.41.0

package/lib/types/custom-profile-fields.d.ts

@@ -2471,6 +2471,7 @@ export declare const signInIdentifierKeyGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: import("../foundations/index.js").MfaFactor.WebAuthn;
@@ -2498,6 +2499,7 @@ export declare const signInIdentifierKeyGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: import("../foundations/index.js").MfaFactor.WebAuthn;
@@ -2522,7 +2524,9 @@ export declare const signInIdentifierKeyGuard: z.ZodObject<Pick<{
         lastUsedAt?: string | undefined;
     })[]>>;
     isSuspended: z.ZodOptional<z.ZodType<boolean, z.ZodTypeDef, boolean>>;
+    isPasswordExpired: z.ZodOptional<z.ZodType<boolean, z.ZodTypeDef, boolean>>;
     lastSignInAt: z.ZodOptional<z.ZodType<number | null, z.ZodTypeDef, number | null>>;
+    passwordUpdatedAt: z.ZodOptional<z.ZodType<number | null, z.ZodTypeDef, number | null>>;
     createdAt: z.ZodOptional<z.ZodType<number, z.ZodTypeDef, number>>;
     updatedAt: z.ZodOptional<z.ZodType<number, z.ZodTypeDef, number>>;
 }, "username" | "primaryEmail" | "primaryPhone"> & {

package/lib/types/hook.d.ts

@@ -18,8 +18,8 @@ export declare const hookResponseGuard: z.ZodObject<{
     tenantId: z.ZodType<string, z.ZodTypeDef, string>;
     id: z.ZodType<string, z.ZodTypeDef, string>;
     name: z.ZodType<string, z.ZodTypeDef, string>;
-    event: z.ZodType<"User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | InteractionHookEvent | "Identifier.Lockout" | null, z.ZodTypeDef, "User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | InteractionHookEvent | "Identifier.Lockout" | null>;
-    events: z.ZodType<("User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | InteractionHookEvent | "Identifier.Lockout")[], z.ZodTypeDef, ("User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | InteractionHookEvent | "Identifier.Lockout")[]>;
+    event: z.ZodType<"User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | InteractionHookEvent | null, z.ZodTypeDef, "User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | InteractionHookEvent | null>;
+    events: z.ZodType<("User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | InteractionHookEvent)[], z.ZodTypeDef, ("User.Created" | "User.Deleted" | "Role.Created" | "Role.Deleted" | "Scope.Created" | "Scope.Deleted" | "Organization.Created" | "Organization.Deleted" | "OrganizationRole.Created" | "OrganizationRole.Deleted" | "OrganizationScope.Created" | "OrganizationScope.Deleted" | "User.Data.Updated" | "Role.Data.Updated" | "Scope.Data.Updated" | "Organization.Data.Updated" | "OrganizationRole.Data.Updated" | "OrganizationScope.Data.Updated" | "User.SuspensionStatus.Updated" | "Role.Scopes.Updated" | "Organization.Membership.Updated" | "OrganizationRole.Scopes.Updated" | "Identifier.Lockout" | "Message.RateLimited" | InteractionHookEvent)[]>;
     config: z.ZodType<{
         url: string;
         headers?: Record<string, string> | undefined;

package/lib/types/interactions.js

@@ -24,7 +24,9 @@ export const interactionIdentifierGuard = z.object({
 export const verificationCodeIdentifierGuard = z.discriminatedUnion('type', [
     z.object({
         type: z.literal(SignInIdentifier.Email),
-        value: z.string().regex(emailRegEx),
+        // `.max(256)` caps the input length as defense-in-depth for downstream email processing
+        // (a valid address is at most 254 chars per RFC 5321).
+        value: z.string().max(256).regex(emailRegEx),
     }),
     z.object({
         type: z.literal(SignInIdentifier.Phone),

package/lib/types/logto-config/index.d.ts

@@ -2,9 +2,12 @@ import { extendedIdTokenClaims } from '@logto/core-kit';
 import { type Nullable, type Optional } from '@silverhand/essentials';
 import type { ZodType } from 'zod';
 import { z } from 'zod';
+import { type MessageRateLimitOverride } from '../../consts/message-rate-limit.js';
+import { type InlineHook, LogtoInlineHookKey } from './inline-hook.js';
 import { type AccessTokenJwtCustomizer, type ClientCredentialsJwtCustomizer } from './jwt-customizer.js';
 export * from './oidc-provider.js';
 export * from './jwt-customizer.js';
+export * from './inline-hook.js';
 /**
  * Logto OIDC signing key types, used mainly in REST API routes.
  */
@@ -91,6 +94,13 @@ export type JwtCustomizerType = {
 export declare const jwtCustomizerConfigGuard: Readonly<{
     [key in LogtoJwtTokenKey]: ZodType<JwtCustomizerType[key]>;
 }>;
+export type InlineHookType = {
+    [LogtoInlineHookKey.PostFirstFactorVerification]: InlineHook;
+    [LogtoInlineHookKey.PostSignIn]: InlineHook;
+};
+export declare const inlineHookConfigGuard: Readonly<{
+    [key in LogtoInlineHookKey]: ZodType<InlineHookType[key]>;
+}>;
 export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [z.ZodObject<{
     key: z.ZodLiteral<LogtoJwtTokenKey.AccessToken>;
     value: z.ZodObject<{
@@ -1431,6 +1441,22 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 isThirdParty?: boolean | undefined;
                 appLevelAccessControlEnabled?: boolean | undefined;
             }>>;
+            organization: z.ZodOptional<z.ZodObject<{
+                name: z.ZodOptional<ZodType<string, z.ZodTypeDef, string>>;
+                id: z.ZodOptional<ZodType<string, z.ZodTypeDef, string>>;
+                customData: z.ZodOptional<ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>>;
+                description: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+            }, "strip", z.ZodTypeAny, {
+                name?: string | undefined;
+                id?: string | undefined;
+                customData?: import("@withtyped/server").JsonObject | undefined;
+                description?: string | null | undefined;
+            }, {
+                name?: string | undefined;
+                id?: string | undefined;
+                customData?: import("@withtyped/server").JsonObject | undefined;
+                description?: string | null | undefined;
+            }>>;
         }, "strip", z.ZodTypeAny, {
             user: {
                 name?: string | null | undefined;
@@ -1554,6 +1580,12 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 isThirdParty?: boolean | undefined;
                 appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
+            organization?: {
+                name?: string | undefined;
+                id?: string | undefined;
+                customData?: import("@withtyped/server").JsonObject | undefined;
+                description?: string | null | undefined;
+            } | undefined;
             grant?: {
                 type?: import("../oidc-config.js").GrantType.TokenExchange | undefined;
                 subjectTokenContext?: Record<string, import("@withtyped/server").Json> | undefined;
@@ -1796,6 +1828,12 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 isThirdParty?: boolean | undefined;
                 appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
+            organization?: {
+                name?: string | undefined;
+                id?: string | undefined;
+                customData?: import("@withtyped/server").JsonObject | undefined;
+                description?: string | null | undefined;
+            } | undefined;
             grant?: {
                 type?: import("../oidc-config.js").GrantType.TokenExchange | undefined;
                 subjectTokenContext?: Record<string, import("@withtyped/server").Json> | undefined;
@@ -2042,6 +2080,12 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 isThirdParty?: boolean | undefined;
                 appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
+            organization?: {
+                name?: string | undefined;
+                id?: string | undefined;
+                customData?: import("@withtyped/server").JsonObject | undefined;
+                description?: string | null | undefined;
+            } | undefined;
             grant?: {
                 type?: import("../oidc-config.js").GrantType.TokenExchange | undefined;
                 subjectTokenContext?: Record<string, import("@withtyped/server").Json> | undefined;
@@ -2302,6 +2346,12 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 isThirdParty?: boolean | undefined;
                 appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
+            organization?: {
+                name?: string | undefined;
+                id?: string | undefined;
+                customData?: import("@withtyped/server").JsonObject | undefined;
+                description?: string | null | undefined;
+            } | undefined;
             grant?: {
                 type?: import("../oidc-config.js").GrantType.TokenExchange | undefined;
                 subjectTokenContext?: Record<string, import("@withtyped/server").Json> | undefined;
@@ -2564,6 +2614,12 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 isThirdParty?: boolean | undefined;
                 appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
+            organization?: {
+                name?: string | undefined;
+                id?: string | undefined;
+                customData?: import("@withtyped/server").JsonObject | undefined;
+                description?: string | null | undefined;
+            } | undefined;
             grant?: {
                 type?: import("../oidc-config.js").GrantType.TokenExchange | undefined;
                 subjectTokenContext?: Record<string, import("@withtyped/server").Json> | undefined;
@@ -2827,6 +2883,12 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 isThirdParty?: boolean | undefined;
                 appLevelAccessControlEnabled?: boolean | undefined;
             } | undefined;
+            organization?: {
+                name?: string | undefined;
+                id?: string | undefined;
+                customData?: import("@withtyped/server").JsonObject | undefined;
+                description?: string | null | undefined;
+            } | undefined;
             grant?: {
                 type?: import("../oidc-config.js").GrantType.TokenExchange | undefined;
                 subjectTokenContext?: Record<string, import("@withtyped/server").Json> | undefined;
@@ -3687,7 +3749,9 @@ export declare enum LogtoTenantConfigKey {
     /** ID token configuration for extended claims. */
     IdToken = "idToken",
     /** Tenant-scoped rotation state for staged private signing key activation. */
-    SigningKeyRotationState = "signingKeyRotationState"
+    SigningKeyRotationState = "signingKeyRotationState",
+    /** Internal, ops-only override of the system message send-rate-limit policy. Not exposed by any API. */
+    MessageRateLimitOverride = "messageRateLimitOverride"
 }
 export type LogtoTenantConfigType = {
     [LogtoTenantConfigKey.AdminConsole]: AdminConsoleData;
@@ -3697,13 +3761,14 @@ export type LogtoTenantConfigType = {
     };
     [LogtoTenantConfigKey.IdToken]: IdTokenConfig;
     [LogtoTenantConfigKey.SigningKeyRotationState]: SigningKeyRotationState;
+    [LogtoTenantConfigKey.MessageRateLimitOverride]: MessageRateLimitOverride;
 };
 export declare const logtoTenantConfigGuard: Readonly<{
     [key in LogtoTenantConfigKey]: ZodType<LogtoTenantConfigType[key]>;
 }>;
-export type LogtoConfigKey = LogtoOidcConfigKey | LogtoJwtTokenKey | LogtoTenantConfigKey;
-export type LogtoConfigType = LogtoOidcConfigType | JwtCustomizerType | LogtoTenantConfigType;
-export type LogtoConfigGuard = typeof logtoOidcConfigGuard & typeof jwtCustomizerConfigGuard & typeof logtoTenantConfigGuard;
+export type LogtoConfigKey = LogtoOidcConfigKey | LogtoJwtTokenKey | LogtoInlineHookKey | LogtoTenantConfigKey;
+export type LogtoConfigType = LogtoOidcConfigType | JwtCustomizerType | InlineHookType | LogtoTenantConfigType;
+export type LogtoConfigGuard = typeof logtoOidcConfigGuard & typeof jwtCustomizerConfigGuard & typeof inlineHookConfigGuard & typeof logtoTenantConfigGuard;
 export declare const logtoConfigKeys: readonly LogtoConfigKey[];
 export declare const logtoConfigGuards: LogtoConfigGuard;
 export declare const oidcConfigKeysResponseGuard: z.ZodObject<Omit<{

package/lib/types/logto-config/index.js

@@ -1,8 +1,11 @@
 import { extendedIdTokenClaims } from '@logto/core-kit';
 import { z } from 'zod';
+import { messageRateLimitOverrideGuard, } from '../../consts/message-rate-limit.js';
+import { LogtoInlineHookKey, inlineHookGuard } from './inline-hook.js';
 import { accessTokenJwtCustomizerGuard, clientCredentialsJwtCustomizerGuard, } from './jwt-customizer.js';
 export * from './oidc-provider.js';
 export * from './jwt-customizer.js';
+export * from './inline-hook.js';
 /**
  * Logto OIDC signing key types, used mainly in REST API routes.
  */
@@ -60,6 +63,10 @@ export const jwtCustomizerConfigGuard = Object.freeze({
     [LogtoJwtTokenKey.AccessToken]: accessTokenJwtCustomizerGuard,
     [LogtoJwtTokenKey.ClientCredentials]: clientCredentialsJwtCustomizerGuard,
 });
+export const inlineHookConfigGuard = Object.freeze({
+    [LogtoInlineHookKey.PostFirstFactorVerification]: inlineHookGuard,
+    [LogtoInlineHookKey.PostSignIn]: inlineHookGuard,
+});
 export const jwtCustomizerConfigsGuard = z.discriminatedUnion('key', [
     z.object({
         key: z.literal(LogtoJwtTokenKey.AccessToken),
@@ -119,6 +126,8 @@ export var LogtoTenantConfigKey;
     LogtoTenantConfigKey["IdToken"] = "idToken";
     /** Tenant-scoped rotation state for staged private signing key activation. */
     LogtoTenantConfigKey["SigningKeyRotationState"] = "signingKeyRotationState";
+    /** Internal, ops-only override of the system message send-rate-limit policy. Not exposed by any API. */
+    LogtoTenantConfigKey["MessageRateLimitOverride"] = "messageRateLimitOverride";
 })(LogtoTenantConfigKey || (LogtoTenantConfigKey = {}));
 export const logtoTenantConfigGuard = Object.freeze({
     [LogtoTenantConfigKey.AdminConsole]: adminConsoleDataGuard,
@@ -126,15 +135,18 @@ export const logtoTenantConfigGuard = Object.freeze({
     [LogtoTenantConfigKey.SessionNotFoundRedirectUrl]: z.object({ url: z.string() }),
     [LogtoTenantConfigKey.IdToken]: idTokenConfigGuard,
     [LogtoTenantConfigKey.SigningKeyRotationState]: signingKeyRotationStateGuard,
+    [LogtoTenantConfigKey.MessageRateLimitOverride]: messageRateLimitOverrideGuard,
 });
 export const logtoConfigKeys = Object.freeze([
     ...Object.values(LogtoOidcConfigKey),
     ...Object.values(LogtoJwtTokenKey),
+    ...Object.values(LogtoInlineHookKey),
     ...Object.values(LogtoTenantConfigKey),
 ]);
 export const logtoConfigGuards = Object.freeze({
     ...logtoOidcConfigGuard,
     ...jwtCustomizerConfigGuard,
+    ...inlineHookConfigGuard,
     ...logtoTenantConfigGuard,
 });
 export const oidcConfigKeysResponseGuard = oidcConfigKeyGuard.omit({ value: true }).merge(z.object({

package/lib/types/logto-config/index.test.js

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { LogtoOidcConfigKey, LogtoTenantConfigKey, OidcSigningKeyStatus, logtoOidcConfigGuard, logtoTenantConfigGuard, oidcConfigKeysResponseGuard, } from './index.js';
+import { LogtoInlineHookKey, LogtoOidcConfigKey, LogtoTenantConfigKey, OidcSigningKeyStatus, inlineHookConfigGuard, logtoOidcConfigGuard, logtoConfigGuards, logtoConfigKeys, logtoTenantConfigGuard, oidcConfigKeysResponseGuard, } from './index.js';
 describe('logto config guards', () => {
     it('accepts legacy private keys without status', () => {
         const privateKeys = [
@@ -26,4 +26,28 @@ describe('logto config guards', () => {
         });
         expect(result.success).toBe(true);
     });
+    it('accepts inline hook configs', () => {
+        const result = inlineHookConfigGuard[LogtoInlineHookKey.PostFirstFactorVerification].safeParse({
+            script: 'export default async () => ({ action: "createUser" });',
+            environmentVariables: {
+                endpoint: 'https://example.com',
+            },
+            contextSample: ['json', { value: true }],
+            enabled: true,
+            onExecutionError: 'block',
+        });
+        expect(result.success).toBe(true);
+    });
+    it('rejects invalid inline hook execution error policy', () => {
+        const result = inlineHookConfigGuard[LogtoInlineHookKey.PostSignIn].safeParse({
+            script: 'export default async () => ({ action: "updateUser" });',
+            onExecutionError: 'ignore',
+        });
+        expect(result.success).toBe(false);
+    });
+    it('includes inline hook keys in the logto config summary guards', () => {
+        expect(logtoConfigKeys).toContain(LogtoInlineHookKey.PostFirstFactorVerification);
+        expect(logtoConfigKeys).toContain(LogtoInlineHookKey.PostSignIn);
+        expect(logtoConfigGuards[LogtoInlineHookKey.PostSignIn]).toBe(inlineHookConfigGuard[LogtoInlineHookKey.PostSignIn]);
+    });
 });

package/lib/types/logto-config/inline-hook.d.ts

@@ -0,0 +1,76 @@
+import { z } from 'zod';
+import type { Json } from '../../foundations/index.js';
+import type { InteractionEvent, InteractionIdentifier } from '../interactions.js';
+import type { UserInfo } from '../user.js';
+export declare enum LogtoInlineHookKey {
+    PostFirstFactorVerification = "inlineHook.postFirstFactorVerification",
+    PostSignIn = "inlineHook.postSignIn"
+}
+export declare const inlineHookExecutionErrorPolicies: readonly ["block", "allow"];
+export type InlineHookExecutionErrorPolicy = (typeof inlineHookExecutionErrorPolicies)[number];
+export type InlineHook = {
+    script: string;
+    environmentVariables?: Record<string, string>;
+    contextSample?: Json;
+    enabled?: boolean;
+    onExecutionError?: InlineHookExecutionErrorPolicy;
+};
+export declare const inlineHookGuard: z.ZodObject<{
+    script: z.ZodString;
+    environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    contextSample: z.ZodOptional<z.ZodType<Json, z.ZodTypeDef, Json>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    onExecutionError: z.ZodOptional<z.ZodEnum<["block", "allow"]>>;
+}, "strict", z.ZodTypeAny, {
+    script: string;
+    enabled?: boolean | undefined;
+    environmentVariables?: Record<string, string> | undefined;
+    contextSample?: Json | undefined;
+    onExecutionError?: "block" | "allow" | undefined;
+}, {
+    script: string;
+    enabled?: boolean | undefined;
+    environmentVariables?: Record<string, string> | undefined;
+    contextSample?: Json | undefined;
+    onExecutionError?: "block" | "allow" | undefined;
+}>;
+export declare const inlineHookTestRequestBodyGuard: z.ZodObject<{
+    script: z.ZodString;
+    hookType: z.ZodNativeEnum<typeof LogtoInlineHookKey>;
+    event: z.ZodType<Json, z.ZodTypeDef, Json>;
+    environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, "strict", z.ZodTypeAny, {
+    event: Json;
+    script: string;
+    hookType: LogtoInlineHookKey;
+    environmentVariables?: Record<string, string> | undefined;
+}, {
+    event: Json;
+    script: string;
+    hookType: LogtoInlineHookKey;
+    environmentVariables?: Record<string, string> | undefined;
+}>;
+export type InlineHookTestRequestBody = z.infer<typeof inlineHookTestRequestBodyGuard>;
+export type HookUser = Pick<UserInfo, 'id' | 'username' | 'primaryEmail' | 'primaryPhone' | 'name' | 'avatar' | 'customData' | 'profile' | 'applicationId' | 'isSuspended'>;
+export type HookUserPatch = Partial<Omit<HookUser, 'id'>>;
+export type PostFirstFactorVerificationEvent = {
+    key: LogtoInlineHookKey.PostFirstFactorVerification;
+    interactionEvent: InteractionEvent.SignIn;
+    identifier: InteractionIdentifier;
+    /** Sensitive credential provided for inline hook controlled password verification. */
+    password: string;
+};
+export type PostSignInEvent = {
+    key: LogtoInlineHookKey.PostSignIn;
+    interactionEvent: InteractionEvent.SignIn;
+    user: HookUser;
+};
+export type PostFirstFactorVerificationResult = {
+    action: 'createUser' | 'updateUser';
+    user: HookUserPatch;
+    passwordVerified: true;
+};
+export type PostSignInResult = {
+    action: 'updateUser';
+    user?: HookUserPatch;
+};

package/lib/types/logto-config/inline-hook.js

@@ -0,0 +1,25 @@
+import { jsonGuard } from '@logto/connector-kit';
+import { z } from 'zod';
+export var LogtoInlineHookKey;
+(function (LogtoInlineHookKey) {
+    LogtoInlineHookKey["PostFirstFactorVerification"] = "inlineHook.postFirstFactorVerification";
+    LogtoInlineHookKey["PostSignIn"] = "inlineHook.postSignIn";
+})(LogtoInlineHookKey || (LogtoInlineHookKey = {}));
+export const inlineHookExecutionErrorPolicies = Object.freeze(['block', 'allow']);
+export const inlineHookGuard = z
+    .object({
+    script: z.string(),
+    environmentVariables: z.record(z.string()).optional(),
+    contextSample: jsonGuard.optional(),
+    enabled: z.boolean().optional(),
+    onExecutionError: z.enum(inlineHookExecutionErrorPolicies).optional(),
+})
+    .strict();
+export const inlineHookTestRequestBodyGuard = z
+    .object({
+    script: z.string(),
+    hookType: z.nativeEnum(LogtoInlineHookKey),
+    event: jsonGuard,
+    environmentVariables: z.record(z.string()).optional(),
+})
+    .strict();

package/lib/types/logto-config/jwt-customizer.d.ts

@@ -106,6 +106,7 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: import("../../foundations/index.js").MfaFactor.WebAuthn;
@@ -133,6 +134,7 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: import("../../foundations/index.js").MfaFactor.WebAuthn;
@@ -157,7 +159,9 @@ export declare const jwtCustomizerUserContextGuard: z.ZodObject<Pick<{
         lastUsedAt?: string | undefined;
     })[]>;
     isSuspended: ZodType<boolean, z.ZodTypeDef, boolean>;
+    isPasswordExpired: ZodType<boolean, z.ZodTypeDef, boolean>;
     lastSignInAt: ZodType<number | null, z.ZodTypeDef, number | null>;
+    passwordUpdatedAt: ZodType<number | null, z.ZodTypeDef, number | null>;
     createdAt: ZodType<number, z.ZodTypeDef, number>;
     updatedAt: ZodType<number, z.ZodTypeDef, number>;
 }, "name" | "id" | "applicationId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended"> & {
@@ -1273,6 +1277,54 @@ export declare const jwtCustomizerApplicationContextGuard: z.ZodObject<Omit<{
     isThirdParty: boolean;
     appLevelAccessControlEnabled: boolean;
 }>;
+/**
+ * The target organization context for organization (API resource) access tokens.
+ *
+ * Only populated when the token is being issued for a specific organization (i.e. the
+ * `organization_id` request parameter is present), letting the customizer attach per-org
+ * claims without embedding every organization the user belongs to.
+ */
+export declare const jwtCustomizerOrganizationContextGuard: z.ZodObject<Pick<{
+    tenantId: ZodType<string, z.ZodTypeDef, string>;
+    id: ZodType<string, z.ZodTypeDef, string>;
+    name: ZodType<string, z.ZodTypeDef, string>;
+    description: ZodType<string | null, z.ZodTypeDef, string | null>;
+    customData: ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>;
+    isMfaRequired: ZodType<boolean, z.ZodTypeDef, boolean>;
+    color: ZodType<Partial<{
+        primaryColor: string;
+        isDarkModeEnabled: boolean;
+        darkPrimaryColor: string;
+    }>, z.ZodTypeDef, Partial<{
+        primaryColor: string;
+        isDarkModeEnabled: boolean;
+        darkPrimaryColor: string;
+    }>>;
+    branding: ZodType<{
+        logoUrl?: string | undefined;
+        darkLogoUrl?: string | undefined;
+        favicon?: string | undefined;
+        darkFavicon?: string | undefined;
+    }, z.ZodTypeDef, {
+        logoUrl?: string | undefined;
+        darkLogoUrl?: string | undefined;
+        favicon?: string | undefined;
+        darkFavicon?: string | undefined;
+    }>;
+    customCss: ZodType<string | null, z.ZodTypeDef, string | null>;
+    createdAt: ZodType<number, z.ZodTypeDef, number>;
+}, "name" | "id" | "customData" | "description">, "strip", z.ZodTypeAny, {
+    name: string;
+    id: string;
+    customData: import("@withtyped/server/lib/types.js").JsonObject;
+    description: string | null;
+}, {
+    name: string;
+    id: string;
+    customData: import("@withtyped/server/lib/types.js").JsonObject;
+    description: string | null;
+}>;
+export type JwtCustomizerOrganizationContext = z.infer<typeof jwtCustomizerOrganizationContextGuard>;
 export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
     script: z.ZodString;
     environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -2611,6 +2663,22 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         }>>;
+        organization: z.ZodOptional<z.ZodObject<{
+            name: z.ZodOptional<ZodType<string, z.ZodTypeDef, string>>;
+            id: z.ZodOptional<ZodType<string, z.ZodTypeDef, string>>;
+            customData: z.ZodOptional<ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>>;
+            description: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+        }, "strip", z.ZodTypeAny, {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        }, {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         user: {
             name?: string | null | undefined;
@@ -2734,6 +2802,12 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         } | undefined;
+        organization?: {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        } | undefined;
         grant?: {
             type?: GrantType.TokenExchange | undefined;
             subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -2976,6 +3050,12 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         } | undefined;
+        organization?: {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        } | undefined;
         grant?: {
             type?: GrantType.TokenExchange | undefined;
             subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -3222,6 +3302,12 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         } | undefined;
+        organization?: {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        } | undefined;
         grant?: {
             type?: GrantType.TokenExchange | undefined;
             subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -3482,6 +3568,12 @@ export declare const accessTokenJwtCustomizerGuard: z.ZodObject<{
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         } | undefined;
+        organization?: {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        } | undefined;
         grant?: {
             type?: GrantType.TokenExchange | undefined;
             subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -5431,6 +5523,22 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         }>>;
+        organization: z.ZodOptional<z.ZodObject<{
+            name: z.ZodOptional<ZodType<string, z.ZodTypeDef, string>>;
+            id: z.ZodOptional<ZodType<string, z.ZodTypeDef, string>>;
+            customData: z.ZodOptional<ZodType<import("@withtyped/server/lib/types.js").JsonObject, z.ZodTypeDef, import("@withtyped/server/lib/types.js").JsonObject>>;
+            description: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+        }, "strip", z.ZodTypeAny, {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        }, {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         user: {
             name?: string | null | undefined;
@@ -5554,6 +5662,12 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         } | undefined;
+        organization?: {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        } | undefined;
         grant?: {
             type?: GrantType.TokenExchange | undefined;
             subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -5796,6 +5910,12 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         } | undefined;
+        organization?: {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        } | undefined;
         grant?: {
             type?: GrantType.TokenExchange | undefined;
             subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -6056,6 +6176,12 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         } | undefined;
+        organization?: {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        } | undefined;
         grant?: {
             type?: GrantType.TokenExchange | undefined;
             subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -6316,6 +6442,12 @@ export declare const jwtCustomizerTestRequestBodyGuard: z.ZodDiscriminatedUnion<
             isThirdParty?: boolean | undefined;
             appLevelAccessControlEnabled?: boolean | undefined;
         } | undefined;
+        organization?: {
+            name?: string | undefined;
+            id?: string | undefined;
+            customData?: import("@withtyped/server/lib/types.js").JsonObject | undefined;
+            description?: string | null | undefined;
+        } | undefined;
         grant?: {
             type?: GrantType.TokenExchange | undefined;
             subjectTokenContext?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -6977,7 +7109,7 @@ export declare const customJwtErrorBodyGuard: z.ZodObject<{
 export type CustomJwtErrorBody = z.infer<typeof customJwtErrorBodyGuard>;
 export type CustomJwtApiContext = {
     /**
-     * Reject the the current token request.
+     * Reject the current token request.
      *
      * @remarks
      * By calling this function, the current token request will be rejected,