@logto/schemas 1.41.0 → 1.43.0

package/lib/types/logto-config/action.js

@@ -0,0 +1,77 @@
+import { jsonGuard } from '@logto/connector-kit';
+import { z } from 'zod';
+import { InteractionEvent, interactionIdentifierGuard, } from '../interactions.js';
+import { userInfoGuard } from '../user.js';
+import { VerificationType } from '../verification-records/index.js';
+/** Values map to config key names in `logto_configs`. */
+export var LogtoActionKey;
+(function (LogtoActionKey) {
+    LogtoActionKey["PostFirstFactorVerification"] = "action.postFirstFactorVerification";
+    LogtoActionKey["PostSignIn"] = "action.postSignIn";
+})(LogtoActionKey || (LogtoActionKey = {}));
+export const actionExecutionErrorPolicies = Object.freeze(['block', 'allow']);
+export const logtoActionGuard = z
+    .object({
+    script: z.string(),
+    environmentVariables: z.record(z.string()).optional(),
+    contextSample: jsonGuard.optional(),
+    enabled: z.boolean().optional(),
+    onExecutionError: z.enum(actionExecutionErrorPolicies).optional(),
+})
+    .strict();
+/**
+ * Shared execution payload for production Actions and Management API dry runs.
+ * Cloud remote execution and the local runner both accept this shape.
+ */
+export const actionExecutionRequestBodyGuard = z
+    .object({
+    script: z.string(),
+    actionType: z.nativeEnum(LogtoActionKey),
+    event: jsonGuard,
+    environmentVariables: z.record(z.string()).optional(),
+})
+    .strict();
+export const actionUserPatchGuard = userInfoGuard
+    .pick({
+    username: true,
+    primaryEmail: true,
+    primaryPhone: true,
+    name: true,
+    avatar: true,
+    customData: true,
+    profile: true,
+})
+    .partial();
+// Nested `user` uses passthrough so password fields survive structural parsing.
+export const postFirstFactorVerificationResultGuard = z.discriminatedUnion('action', [
+    z.object({
+        action: z.literal('createUser'),
+        user: actionUserPatchGuard.passthrough(),
+        passwordVerified: z.literal(true),
+    }),
+    z.object({
+        action: z.literal('updateUser'),
+        user: actionUserPatchGuard.passthrough(),
+        passwordVerified: z.literal(true),
+    }),
+]);
+// Nested `user` uses passthrough so password fields survive structural parsing.
+export const postSignInResultGuard = z.discriminatedUnion('action', [
+    z.object({
+        action: z.literal('updateUser'),
+        user: actionUserPatchGuard.passthrough().optional(),
+    }),
+]);
+export const actionUserPatchFields = Object.freeze(actionUserPatchGuard.keyof().options);
+export const loggablePostFirstFactorVerificationEventGuard = z.object({
+    key: z.literal(LogtoActionKey.PostFirstFactorVerification),
+    interactionEvent: z.literal(InteractionEvent.SignIn),
+    verificationType: z.literal(VerificationType.Password),
+    identifier: interactionIdentifierGuard,
+    user: z.object({ id: z.string() }).nullable(),
+});
+export const loggablePostSignInEventGuard = z.object({
+    key: z.literal(LogtoActionKey.PostSignIn),
+    interactionEvent: z.literal(InteractionEvent.SignIn),
+    user: z.object({ id: z.string() }),
+});

package/lib/types/logto-config/index.d.ts

@@ -3,11 +3,11 @@ import { type Nullable, type Optional } from '@silverhand/essentials';
 import type { ZodType } from 'zod';
 import { z } from 'zod';
 import { type MessageRateLimitOverride } from '../../consts/message-rate-limit.js';
-import { type InlineHook, LogtoInlineHookKey } from './inline-hook.js';
+import { type LogtoAction, LogtoActionKey } from './action.js';
 import { type AccessTokenJwtCustomizer, type ClientCredentialsJwtCustomizer } from './jwt-customizer.js';
 export * from './oidc-provider.js';
 export * from './jwt-customizer.js';
-export * from './inline-hook.js';
+export * from './action.js';
 /**
  * Logto OIDC signing key types, used mainly in REST API routes.
  */
@@ -94,12 +94,12 @@ export type JwtCustomizerType = {
 export declare const jwtCustomizerConfigGuard: Readonly<{
     [key in LogtoJwtTokenKey]: ZodType<JwtCustomizerType[key]>;
 }>;
-export type InlineHookType = {
-    [LogtoInlineHookKey.PostFirstFactorVerification]: InlineHook;
-    [LogtoInlineHookKey.PostSignIn]: InlineHook;
+export type ActionType = {
+    [LogtoActionKey.PostFirstFactorVerification]: LogtoAction;
+    [LogtoActionKey.PostSignIn]: LogtoAction;
 };
-export declare const inlineHookConfigGuard: Readonly<{
-    [key in LogtoInlineHookKey]: ZodType<InlineHookType[key]>;
+export declare const actionConfigGuard: Readonly<{
+    [key in LogtoActionKey]: ZodType<ActionType[key]>;
 }>;
 export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [z.ZodObject<{
     key: z.ZodLiteral<LogtoJwtTokenKey.AccessToken>;
@@ -127,8 +127,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
             kind?: "AccessToken" | undefined;
             accountId?: string | undefined;
             scope?: string | undefined;
-            sessionUid?: string | undefined;
             clientId?: string | undefined;
+            sessionUid?: string | undefined;
             expiresWithSession?: boolean | undefined;
             gty?: string | undefined;
             aud?: string | string[] | undefined;
@@ -139,8 +139,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
             kind?: "AccessToken" | undefined;
             accountId?: string | undefined;
             scope?: string | undefined;
-            sessionUid?: string | undefined;
             clientId?: string | undefined;
+            sessionUid?: string | undefined;
             expiresWithSession?: boolean | undefined;
             gty?: string | undefined;
             aud?: string | string[] | undefined;
@@ -150,6 +150,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 name: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
                 id: z.ZodOptional<ZodType<string, z.ZodTypeDef, string>>;
                 applicationId: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
+                cimdClientId: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
                 username: z.ZodOptional<ZodType<string | null, z.ZodTypeDef, string | null>>;
                 createdAt: z.ZodOptional<ZodType<number, z.ZodTypeDef, number>>;
                 profile: z.ZodOptional<ZodType<Partial<{
@@ -288,6 +289,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     description: ZodType<string | null, z.ZodTypeDef, string | null>;
                     customData: ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
                     isMfaRequired: ZodType<boolean, z.ZodTypeDef, boolean>;
+                    isTrustedDeviceAllowed: ZodType<boolean, z.ZodTypeDef, boolean>;
                     color: ZodType<Partial<{
                         primaryColor: string;
                         isDarkModeEnabled: boolean;
@@ -336,6 +338,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 name?: string | null | undefined;
                 id?: string | undefined;
                 applicationId?: string | null | undefined;
+                cimdClientId?: string | null | undefined;
                 username?: string | null | undefined;
                 createdAt?: number | undefined;
                 profile?: Partial<{
@@ -403,6 +406,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 name?: string | null | undefined;
                 id?: string | undefined;
                 applicationId?: string | null | undefined;
+                cimdClientId?: string | null | undefined;
                 username?: string | null | undefined;
                 createdAt?: number | undefined;
                 profile?: Partial<{
@@ -478,7 +482,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 subjectTokenContext?: Record<string, import("@withtyped/server").Json> | undefined;
             }>>;
             interaction: z.ZodOptional<z.ZodObject<{
-                interactionEvent: z.ZodOptional<z.ZodNativeEnum<typeof import("../interactions.js").InteractionEvent>>;
+                interactionEvent: z.ZodOptional<z.ZodNativeEnum<typeof import("../interaction-event.js").InteractionEvent>>;
                 userId: z.ZodOptional<z.ZodString>;
                 verificationRecords: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
                     id: z.ZodString;
@@ -954,10 +958,13 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     }>;
                     oneTimeTokenContext: z.ZodOptional<z.ZodObject<{
                         jitOrganizationIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                        interactionEvent: z.ZodOptional<z.ZodNativeEnum<typeof import("../interaction-event.js").InteractionEvent>>;
                     }, "strip", z.ZodTypeAny, {
                         jitOrganizationIds?: string[] | undefined;
+                        interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                     }, {
                         jitOrganizationIds?: string[] | undefined;
+                        interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                     }>>;
                 }, "strip", z.ZodTypeAny, {
                     type: import("../index.js").VerificationType.OneTimeToken;
@@ -969,6 +976,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     verified: boolean;
                     oneTimeTokenContext?: {
                         jitOrganizationIds?: string[] | undefined;
+                        interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                     } | undefined;
                 }, {
                     type: import("../index.js").VerificationType.OneTimeToken;
@@ -980,6 +988,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     verified: boolean;
                     oneTimeTokenContext?: {
                         jitOrganizationIds?: string[] | undefined;
+                        interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                     } | undefined;
                 }>, z.ZodObject<Omit<{
                     id: z.ZodString;
@@ -1014,7 +1023,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 signInContext: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
             }, "strip", z.ZodTypeAny, {
                 userId?: string | undefined;
-                interactionEvent?: import("../interactions.js").InteractionEvent | undefined;
+                interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                 verificationRecords?: ({
                     type: import("../index.js").VerificationType.BackupCode;
                     id: string;
@@ -1073,6 +1082,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     verified: boolean;
                     oneTimeTokenContext?: {
                         jitOrganizationIds?: string[] | undefined;
+                        interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                     } | undefined;
                 } | {
                     type: import("../index.js").VerificationType.Password;
@@ -1128,7 +1138,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 signInContext?: Record<string, string> | undefined;
             }, {
                 userId?: string | undefined;
-                interactionEvent?: import("../interactions.js").InteractionEvent | undefined;
+                interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                 verificationRecords?: ({
                     type: import("../index.js").VerificationType.BackupCode;
                     id: string;
@@ -1187,6 +1197,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     verified: boolean;
                     oneTimeTokenContext?: {
                         jitOrganizationIds?: string[] | undefined;
+                        interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                     } | undefined;
                 } | {
                     type: import("../index.js").VerificationType.Password;
@@ -1462,6 +1473,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 name?: string | null | undefined;
                 id?: string | undefined;
                 applicationId?: string | null | undefined;
+                cimdClientId?: string | null | undefined;
                 username?: string | null | undefined;
                 createdAt?: number | undefined;
                 profile?: Partial<{
@@ -1592,7 +1604,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
             } | undefined;
             interaction?: {
                 userId?: string | undefined;
-                interactionEvent?: import("../interactions.js").InteractionEvent | undefined;
+                interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                 verificationRecords?: ({
                     type: import("../index.js").VerificationType.BackupCode;
                     id: string;
@@ -1651,6 +1663,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     verified: boolean;
                     oneTimeTokenContext?: {
                         jitOrganizationIds?: string[] | undefined;
+                        interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                     } | undefined;
                 } | {
                     type: import("../index.js").VerificationType.Password;
@@ -1710,6 +1723,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 name?: string | null | undefined;
                 id?: string | undefined;
                 applicationId?: string | null | undefined;
+                cimdClientId?: string | null | undefined;
                 username?: string | null | undefined;
                 createdAt?: number | undefined;
                 profile?: Partial<{
@@ -1840,7 +1854,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
             } | undefined;
             interaction?: {
                 userId?: string | undefined;
-                interactionEvent?: import("../interactions.js").InteractionEvent | undefined;
+                interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                 verificationRecords?: ({
                     type: import("../index.js").VerificationType.BackupCode;
                     id: string;
@@ -1899,6 +1913,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     verified: boolean;
                     oneTimeTokenContext?: {
                         jitOrganizationIds?: string[] | undefined;
+                        interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                     } | undefined;
                 } | {
                     type: import("../index.js").VerificationType.Password;
@@ -1962,6 +1977,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 name?: string | null | undefined;
                 id?: string | undefined;
                 applicationId?: string | null | undefined;
+                cimdClientId?: string | null | undefined;
                 username?: string | null | undefined;
                 createdAt?: number | undefined;
                 profile?: Partial<{
@@ -2092,7 +2108,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
             } | undefined;
             interaction?: {
                 userId?: string | undefined;
-                interactionEvent?: import("../interactions.js").InteractionEvent | undefined;
+                interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                 verificationRecords?: ({
                     type: import("../index.js").VerificationType.BackupCode;
                     id: string;
@@ -2151,6 +2167,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     verified: boolean;
                     oneTimeTokenContext?: {
                         jitOrganizationIds?: string[] | undefined;
+                        interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                     } | undefined;
                 } | {
                     type: import("../index.js").VerificationType.Password;
@@ -2214,8 +2231,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
             kind?: "AccessToken" | undefined;
             accountId?: string | undefined;
             scope?: string | undefined;
-            sessionUid?: string | undefined;
             clientId?: string | undefined;
+            sessionUid?: string | undefined;
             expiresWithSession?: boolean | undefined;
             gty?: string | undefined;
             aud?: string | string[] | undefined;
@@ -2228,6 +2245,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 name?: string | null | undefined;
                 id?: string | undefined;
                 applicationId?: string | null | undefined;
+                cimdClientId?: string | null | undefined;
                 username?: string | null | undefined;
                 createdAt?: number | undefined;
                 profile?: Partial<{
@@ -2358,7 +2376,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
             } | undefined;
             interaction?: {
                 userId?: string | undefined;
-                interactionEvent?: import("../interactions.js").InteractionEvent | undefined;
+                interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                 verificationRecords?: ({
                     type: import("../index.js").VerificationType.BackupCode;
                     id: string;
@@ -2417,6 +2435,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     verified: boolean;
                     oneTimeTokenContext?: {
                         jitOrganizationIds?: string[] | undefined;
+                        interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                     } | undefined;
                 } | {
                     type: import("../index.js").VerificationType.Password;
@@ -2480,8 +2499,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
             kind?: "AccessToken" | undefined;
             accountId?: string | undefined;
             scope?: string | undefined;
-            sessionUid?: string | undefined;
             clientId?: string | undefined;
+            sessionUid?: string | undefined;
             expiresWithSession?: boolean | undefined;
             gty?: string | undefined;
             aud?: string | string[] | undefined;
@@ -2496,6 +2515,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 name?: string | null | undefined;
                 id?: string | undefined;
                 applicationId?: string | null | undefined;
+                cimdClientId?: string | null | undefined;
                 username?: string | null | undefined;
                 createdAt?: number | undefined;
                 profile?: Partial<{
@@ -2626,7 +2646,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
             } | undefined;
             interaction?: {
                 userId?: string | undefined;
-                interactionEvent?: import("../interactions.js").InteractionEvent | undefined;
+                interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                 verificationRecords?: ({
                     type: import("../index.js").VerificationType.BackupCode;
                     id: string;
@@ -2685,6 +2705,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     verified: boolean;
                     oneTimeTokenContext?: {
                         jitOrganizationIds?: string[] | undefined;
+                        interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                     } | undefined;
                 } | {
                     type: import("../index.js").VerificationType.Password;
@@ -2748,8 +2769,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
             kind?: "AccessToken" | undefined;
             accountId?: string | undefined;
             scope?: string | undefined;
-            sessionUid?: string | undefined;
             clientId?: string | undefined;
+            sessionUid?: string | undefined;
             expiresWithSession?: boolean | undefined;
             gty?: string | undefined;
             aud?: string | string[] | undefined;
@@ -2765,6 +2786,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                 name?: string | null | undefined;
                 id?: string | undefined;
                 applicationId?: string | null | undefined;
+                cimdClientId?: string | null | undefined;
                 username?: string | null | undefined;
                 createdAt?: number | undefined;
                 profile?: Partial<{
@@ -2895,7 +2917,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
             } | undefined;
             interaction?: {
                 userId?: string | undefined;
-                interactionEvent?: import("../interactions.js").InteractionEvent | undefined;
+                interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                 verificationRecords?: ({
                     type: import("../index.js").VerificationType.BackupCode;
                     id: string;
@@ -2954,6 +2976,7 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
                     verified: boolean;
                     oneTimeTokenContext?: {
                         jitOrganizationIds?: string[] | undefined;
+                        interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
                     } | undefined;
                 } | {
                     type: import("../index.js").VerificationType.Password;
@@ -3017,8 +3040,8 @@ export declare const jwtCustomizerConfigsGuard: z.ZodDiscriminatedUnion<"key", [
             kind?: "AccessToken" | undefined;
             accountId?: string | undefined;
             scope?: string | undefined;
-            sessionUid?: string | undefined;
             clientId?: string | undefined;
+            sessionUid?: string | undefined;
             expiresWithSession?: boolean | undefined;
             gty?: string | undefined;
             aud?: string | string[] | undefined;
@@ -3741,6 +3764,22 @@ export declare const signingKeyRotationStateGuard: z.ZodObject<{
     signingKeyRotationAt?: number | undefined;
 }>;
 export type SigningKeyRotationState = z.infer<typeof signingKeyRotationStateGuard>;
+/**
+ * Config for the OAuth Client ID Metadata Document (CIMD) feature. The row is only written once
+ * the feature is toggled, so readers must fall back to {@link defaultCimdConfig}.
+ */
+export declare const cimdConfigGuard: z.ZodObject<{
+    enabled: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+}, {
+    enabled: boolean;
+}>;
+export type CimdConfig = z.infer<typeof cimdConfigGuard>;
+/** Applied when the `cimd` row is absent: the feature is opt-in per tenant. */
+export declare const defaultCimdConfig: Readonly<{
+    enabled: false;
+}>;
 export declare enum LogtoTenantConfigKey {
     AdminConsole = "adminConsole",
     CloudConnection = "cloudConnection",
@@ -3751,7 +3790,9 @@ export declare enum LogtoTenantConfigKey {
     /** Tenant-scoped rotation state for staged private signing key activation. */
     SigningKeyRotationState = "signingKeyRotationState",
     /** Internal, ops-only override of the system message send-rate-limit policy. Not exposed by any API. */
-    MessageRateLimitOverride = "messageRateLimitOverride"
+    MessageRateLimitOverride = "messageRateLimitOverride",
+    /** Tenant-level switch for the OAuth Client ID Metadata Document feature. */
+    Cimd = "cimd"
 }
 export type LogtoTenantConfigType = {
     [LogtoTenantConfigKey.AdminConsole]: AdminConsoleData;
@@ -3762,13 +3803,14 @@ export type LogtoTenantConfigType = {
     [LogtoTenantConfigKey.IdToken]: IdTokenConfig;
     [LogtoTenantConfigKey.SigningKeyRotationState]: SigningKeyRotationState;
     [LogtoTenantConfigKey.MessageRateLimitOverride]: MessageRateLimitOverride;
+    [LogtoTenantConfigKey.Cimd]: CimdConfig;
 };
 export declare const logtoTenantConfigGuard: Readonly<{
     [key in LogtoTenantConfigKey]: ZodType<LogtoTenantConfigType[key]>;
 }>;
-export type LogtoConfigKey = LogtoOidcConfigKey | LogtoJwtTokenKey | LogtoInlineHookKey | LogtoTenantConfigKey;
-export type LogtoConfigType = LogtoOidcConfigType | JwtCustomizerType | InlineHookType | LogtoTenantConfigType;
-export type LogtoConfigGuard = typeof logtoOidcConfigGuard & typeof jwtCustomizerConfigGuard & typeof inlineHookConfigGuard & typeof logtoTenantConfigGuard;
+export type LogtoConfigKey = LogtoOidcConfigKey | LogtoJwtTokenKey | LogtoActionKey | LogtoTenantConfigKey;
+export type LogtoConfigType = LogtoOidcConfigType | JwtCustomizerType | ActionType | LogtoTenantConfigType;
+export type LogtoConfigGuard = typeof logtoOidcConfigGuard & typeof jwtCustomizerConfigGuard & typeof actionConfigGuard & typeof logtoTenantConfigGuard;
 export declare const logtoConfigKeys: readonly LogtoConfigKey[];
 export declare const logtoConfigGuards: LogtoConfigGuard;
 export declare const oidcConfigKeysResponseGuard: z.ZodObject<Omit<{

package/lib/types/logto-config/index.js

@@ -1,11 +1,11 @@
 import { extendedIdTokenClaims } from '@logto/core-kit';
 import { z } from 'zod';
 import { messageRateLimitOverrideGuard, } from '../../consts/message-rate-limit.js';
-import { LogtoInlineHookKey, inlineHookGuard } from './inline-hook.js';
+import { LogtoActionKey, logtoActionGuard } from './action.js';
 import { accessTokenJwtCustomizerGuard, clientCredentialsJwtCustomizerGuard, } from './jwt-customizer.js';
 export * from './oidc-provider.js';
 export * from './jwt-customizer.js';
-export * from './inline-hook.js';
+export * from './action.js';
 /**
  * Logto OIDC signing key types, used mainly in REST API routes.
  */
@@ -63,9 +63,9 @@ export const jwtCustomizerConfigGuard = Object.freeze({
     [LogtoJwtTokenKey.AccessToken]: accessTokenJwtCustomizerGuard,
     [LogtoJwtTokenKey.ClientCredentials]: clientCredentialsJwtCustomizerGuard,
 });
-export const inlineHookConfigGuard = Object.freeze({
-    [LogtoInlineHookKey.PostFirstFactorVerification]: inlineHookGuard,
-    [LogtoInlineHookKey.PostSignIn]: inlineHookGuard,
+export const actionConfigGuard = Object.freeze({
+    [LogtoActionKey.PostFirstFactorVerification]: logtoActionGuard,
+    [LogtoActionKey.PostSignIn]: logtoActionGuard,
 });
 export const jwtCustomizerConfigsGuard = z.discriminatedUnion('key', [
     z.object({
@@ -116,6 +116,16 @@ export const signingKeyRotationStateGuard = z.object({
     tenantCacheExpiresAt: z.number().optional(),
     signingKeyRotationAt: z.number().optional(),
 });
+/* --- CIMD Config --- */
+/**
+ * Config for the OAuth Client ID Metadata Document (CIMD) feature. The row is only written once
+ * the feature is toggled, so readers must fall back to {@link defaultCimdConfig}.
+ */
+export const cimdConfigGuard = z.object({
+    enabled: z.boolean(),
+});
+/** Applied when the `cimd` row is absent: the feature is opt-in per tenant. */
+export const defaultCimdConfig = Object.freeze({ enabled: false });
 export var LogtoTenantConfigKey;
 (function (LogtoTenantConfigKey) {
     LogtoTenantConfigKey["AdminConsole"] = "adminConsole";
@@ -128,6 +138,8 @@ export var LogtoTenantConfigKey;
     LogtoTenantConfigKey["SigningKeyRotationState"] = "signingKeyRotationState";
     /** Internal, ops-only override of the system message send-rate-limit policy. Not exposed by any API. */
     LogtoTenantConfigKey["MessageRateLimitOverride"] = "messageRateLimitOverride";
+    /** Tenant-level switch for the OAuth Client ID Metadata Document feature. */
+    LogtoTenantConfigKey["Cimd"] = "cimd";
 })(LogtoTenantConfigKey || (LogtoTenantConfigKey = {}));
 export const logtoTenantConfigGuard = Object.freeze({
     [LogtoTenantConfigKey.AdminConsole]: adminConsoleDataGuard,
@@ -136,17 +148,18 @@ export const logtoTenantConfigGuard = Object.freeze({
     [LogtoTenantConfigKey.IdToken]: idTokenConfigGuard,
     [LogtoTenantConfigKey.SigningKeyRotationState]: signingKeyRotationStateGuard,
     [LogtoTenantConfigKey.MessageRateLimitOverride]: messageRateLimitOverrideGuard,
+    [LogtoTenantConfigKey.Cimd]: cimdConfigGuard,
 });
 export const logtoConfigKeys = Object.freeze([
     ...Object.values(LogtoOidcConfigKey),
     ...Object.values(LogtoJwtTokenKey),
-    ...Object.values(LogtoInlineHookKey),
+    ...Object.values(LogtoActionKey),
     ...Object.values(LogtoTenantConfigKey),
 ]);
 export const logtoConfigGuards = Object.freeze({
     ...logtoOidcConfigGuard,
     ...jwtCustomizerConfigGuard,
-    ...inlineHookConfigGuard,
+    ...actionConfigGuard,
     ...logtoTenantConfigGuard,
 });
 export const oidcConfigKeysResponseGuard = oidcConfigKeyGuard.omit({ value: true }).merge(z.object({

package/lib/types/logto-config/index.test.js

@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest';
-import { LogtoInlineHookKey, LogtoOidcConfigKey, LogtoTenantConfigKey, OidcSigningKeyStatus, inlineHookConfigGuard, logtoOidcConfigGuard, logtoConfigGuards, logtoConfigKeys, logtoTenantConfigGuard, oidcConfigKeysResponseGuard, } from './index.js';
+import { z } from 'zod';
+import { LogtoActionKey, LogtoOidcConfigKey, LogtoTenantConfigKey, OidcSigningKeyStatus, actionConfigGuard, logtoOidcConfigGuard, logtoConfigGuards, logtoConfigKeys, logtoTenantConfigGuard, oidcConfigKeysResponseGuard, } from './index.js';
 describe('logto config guards', () => {
     it('accepts legacy private keys without status', () => {
         const privateKeys = [
@@ -26,8 +27,8 @@ describe('logto config guards', () => {
         });
         expect(result.success).toBe(true);
     });
-    it('accepts inline hook configs', () => {
-        const result = inlineHookConfigGuard[LogtoInlineHookKey.PostFirstFactorVerification].safeParse({
+    it('accepts action configs', () => {
+        const result = actionConfigGuard[LogtoActionKey.PostFirstFactorVerification].safeParse({
             script: 'export default async () => ({ action: "createUser" });',
             environmentVariables: {
                 endpoint: 'https://example.com',
@@ -38,16 +39,38 @@ describe('logto config guards', () => {
         });
         expect(result.success).toBe(true);
     });
-    it('rejects invalid inline hook execution error policy', () => {
-        const result = inlineHookConfigGuard[LogtoInlineHookKey.PostSignIn].safeParse({
+    it('rejects invalid action execution error policy', () => {
+        const result = actionConfigGuard[LogtoActionKey.PostSignIn].safeParse({
             script: 'export default async () => ({ action: "updateUser" });',
             onExecutionError: 'ignore',
         });
         expect(result.success).toBe(false);
     });
-    it('includes inline hook keys in the logto config summary guards', () => {
-        expect(logtoConfigKeys).toContain(LogtoInlineHookKey.PostFirstFactorVerification);
-        expect(logtoConfigKeys).toContain(LogtoInlineHookKey.PostSignIn);
-        expect(logtoConfigGuards[LogtoInlineHookKey.PostSignIn]).toBe(inlineHookConfigGuard[LogtoInlineHookKey.PostSignIn]);
+    it('includes action keys in the logto config summary guards', () => {
+        expect(logtoConfigKeys).toContain(LogtoActionKey.PostFirstFactorVerification);
+        expect(logtoConfigKeys).toContain(LogtoActionKey.PostSignIn);
+        expect(logtoConfigGuards[LogtoActionKey.PostSignIn]).toBe(actionConfigGuard[LogtoActionKey.PostSignIn]);
+    });
+    it('includes the CIMD key in the logto config summary guards', () => {
+        expect(logtoConfigKeys).toContain(LogtoTenantConfigKey.Cimd);
+        expect(logtoConfigGuards[LogtoTenantConfigKey.Cimd]).toBe(logtoTenantConfigGuard[LogtoTenantConfigKey.Cimd]);
+    });
+    it('keeps a stored CIMD config value', () => {
+        expect(logtoTenantConfigGuard[LogtoTenantConfigKey.Cimd].parse({ enabled: true })).toEqual({
+            enabled: true,
+        });
+    });
+    it('rejects invalid CIMD config values', () => {
+        const result = logtoTenantConfigGuard[LogtoTenantConfigKey.Cimd].safeParse({ enabled: 'yes' });
+        expect(result.success).toBe(false);
+    });
+    it('parses OIDC configs without the optional session row', () => {
+        const result = z.object(logtoOidcConfigGuard).parse({
+            [LogtoOidcConfigKey.PrivateKeys]: [
+                { id: 'key_1', value: 'private-key-1', createdAt: 1_710_000_000_000 },
+            ],
+            [LogtoOidcConfigKey.CookieKeys]: [],
+        });
+        expect(result[LogtoOidcConfigKey.Session]).toEqual({});
     });
 });