@_mustachio/openauth 0.14.0 → 0.15.0

package/dist/esm/domain/token.js

@@ -139,6 +139,19 @@ async function mintTokens(args) {
   const now = deps.clock();
   const receivingClient = tenant.config.clients.find((c) => c.id === payload.clientId);
   const subjectId = await deriveSubjectId(claim, receivingClient?.sectorIdentifier);
+  if (deps.onTokenIssued) {
+    try {
+      await deps.onTokenIssued({
+        tenant,
+        clientId: payload.clientId,
+        subjectId,
+        claim,
+        ...skipRefresh ? {} : { family }
+      });
+    } catch (e) {
+      return err(authError.serverError("onTokenIssued hook threw", e));
+    }
+  }
   const keyRes = await deps.keyStore.currentSigningKey();
   if (isErr(keyRes))
     return err(keyRes.error);

package/dist/esm/http/handlers/token.js

@@ -71,6 +71,7 @@ function makeTokenHandler(deps) {
         ...deps.persistUpstreamTokens ? { persistUpstreamTokens: deps.persistUpstreamTokens } : {},
         issuerUrl: c.get("issuerUrl"),
         clock: deps.clock,
+        ...deps.onTokenIssued ? { onTokenIssued: deps.onTokenIssued } : {},
         ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
       });
       if (isErr(result))
@@ -104,6 +105,7 @@ function makeTokenHandler(deps) {
         ...deps.persistUpstreamTokens ? { persistUpstreamTokens: deps.persistUpstreamTokens } : {},
         issuerUrl: c.get("issuerUrl"),
         clock: deps.clock,
+        ...deps.onTokenIssued ? { onTokenIssued: deps.onTokenIssued } : {},
         ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
       }, tenantRes.value);
       if (isErr(result))
@@ -125,6 +127,7 @@ function makeTokenHandler(deps) {
         ...deps.auditLog ? { auditLog: deps.auditLog } : {},
         issuerUrl: c.get("issuerUrl"),
         clock: deps.clock,
+        ...deps.onTokenIssued ? { onTokenIssued: deps.onTokenIssued } : {},
         ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
       });
       if (isErr(refreshResult))
@@ -149,6 +152,7 @@ function makeTokenHandler(deps) {
       ...deps.exchangeAudience ? { exchangeAudience: deps.exchangeAudience } : {},
       issuerUrl: c.get("issuerUrl"),
       clock: deps.clock,
+      ...deps.onTokenIssued ? { onTokenIssued: deps.onTokenIssued } : {},
       ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
     });
     if (isErr(exchangeResult)) {

package/dist/esm/index.js

@@ -68,6 +68,7 @@ function createIdP(opts) {
     resolveTenant: opts.resolveTenant,
     success: opts.success,
     subjects: opts.subjects,
+    ...opts.onTokenIssued ? { onTokenIssued: opts.onTokenIssued } : {},
     ...opts.onLogout ? { onLogout: opts.onLogout } : {},
     ...opts.persistUpstreamTokens ? { persistUpstreamTokens: opts.persistUpstreamTokens } : {},
     ...opts.exchangeAudience ? { exchangeAudience: opts.exchangeAudience } : {},

package/dist/types/domain/client-credentials.d.ts

@@ -22,7 +22,7 @@ import type { ConfigStore } from "../ports/config-store";
 import type { KeyStore } from "../ports/key-store";
 import type { TokenStore } from "../ports/token-store";
 import { type AuthError } from "../types/error";
-import type { PersistUpstreamTokens, SuccessMapInput } from "../types/idp";
+import type { OnTokenIssued, PersistUpstreamTokens, SuccessMapInput } from "../types/idp";
 import type { Result } from "../types/result";
 import type { SubjectClaim, SubjectSchema } from "../types/subject";
 import type { TenantId } from "../types/tenant";
@@ -48,6 +48,8 @@ export type ClientCredentialsDeps = {
     persistUpstreamTokens?: PersistUpstreamTokens;
     issuerUrl: string;
     clock: () => number;
+    /** See `IdPOptions.onTokenIssued`. Threaded to `mintTokens`. */
+    onTokenIssued?: OnTokenIssued;
     newRefreshFamily?: () => string;
     /** See `IdPOptions.customScopeClaims`. Forwarded to `mintTokens`. */
     customScopeClaims?: Record<string, ReadonlyArray<string>>;

package/dist/types/domain/client-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../src/domain/client-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,KAAK,EAAiB,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAKnD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAI5C,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,oBAAoB,CAAA;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,0EAA0E;IAC1E,QAAQ,EAAE,aAAa,CAAA;IACvB,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;IAC/B,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,wBAAwB,EAC7B,IAAI,EAAE,qBAAqB,EAC3B,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAkI3C"}
+{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../src/domain/client-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EACV,aAAa,EACb,qBAAqB,EACrB,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,KAAK,EAAiB,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAKnD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAI5C,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,oBAAoB,CAAA;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,0EAA0E;IAC1E,QAAQ,EAAE,aAAa,CAAA;IACvB,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,gEAAgE;IAChE,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;IAC/B,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,wBAAwB,EAC7B,IAAI,EAAE,qBAAqB,EAC3B,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAkI3C"}

package/dist/types/domain/refresh.d.ts

@@ -17,6 +17,7 @@ import type { ConfigStore } from "../ports/config-store";
 import type { KeyStore } from "../ports/key-store";
 import type { TokenStore } from "../ports/token-store";
 import { type AuthError } from "../types/error";
+import type { OnTokenIssued } from "../types/idp";
 import type { Result } from "../types/result";
 import type { TokenResponse } from "../types/token";
 export type RefreshGrantRequest = {
@@ -42,6 +43,8 @@ export type RefreshTokensDeps = {
     auditLog?: AuditLog;
     issuerUrl: string;
     clock: () => number;
+    /** See `IdPOptions.onTokenIssued`. Threaded to `mintTokens`. */
+    onTokenIssued?: OnTokenIssued;
     /** Reuse-detection window (ms). Default 60 s. */
     reuseWindowMs?: number;
     newRefreshToken?: () => string;

package/dist/types/domain/refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/domain/refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAMnD,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,eAAe,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;IAC9B,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAsBD,wBAAsB,aAAa,CACjC,GAAG,EAAE,mBAAmB,EACxB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CA4J3C"}
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/domain/refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAMnD,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,eAAe,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,gEAAgE;IAChE,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;IAC9B,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAsBD,wBAAsB,aAAa,CACjC,GAAG,EAAE,mBAAmB,EACxB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CA4J3C"}

package/dist/types/domain/token-exchange.d.ts

@@ -36,7 +36,7 @@ import type { ConfigStore } from "../ports/config-store";
 import type { KeyStore } from "../ports/key-store";
 import type { TokenStore } from "../ports/token-store";
 import { type AuthError } from "../types/error";
-import type { ExchangeAudience } from "../types/idp";
+import type { ExchangeAudience, OnTokenIssued } from "../types/idp";
 import type { Result } from "../types/result";
 import type { TokenResponse } from "../types/token";
 export type TokenExchangeRequest = {
@@ -61,6 +61,8 @@ export type ExchangeTokenDeps = {
     exchangeAudience?: ExchangeAudience;
     issuerUrl: string;
     clock: () => number;
+    /** See `IdPOptions.onTokenIssued`. Threaded to `mintTokens`. */
+    onTokenIssued?: OnTokenIssued;
     newRefreshFamily?: () => string;
     /** See `IdPOptions.customScopeClaims`. Forwarded to `mintTokens`. */
     customScopeClaims?: Record<string, ReadonlyArray<string>>;

package/dist/types/domain/token-exchange.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-exchange.d.ts","sourceRoot":"","sources":["../../../src/domain/token-exchange.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAI7C,OAAO,KAAK,EAAqB,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAQtE,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,iDAAiD,CAAA;IAC5D,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG;IAClD,6DAA6D;IAC7D,iBAAiB,EAAE,+CAA+C,CAAA;CACnE,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;IAC/B,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,oBAAoB,EACzB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC,CA+JnD"}
+{"version":3,"file":"token-exchange.d.ts","sourceRoot":"","sources":["../../../src/domain/token-exchange.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAI7C,OAAO,KAAK,EAAqB,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAQtE,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,iDAAiD,CAAA;IAC5D,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG;IAClD,6DAA6D;IAC7D,iBAAiB,EAAE,+CAA+C,CAAA;CACnE,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,gEAAgE;IAChE,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;IAC/B,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,oBAAoB,EACzB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC,CA+JnD"}

package/dist/types/domain/token.d.ts

@@ -23,7 +23,7 @@ import type { KeyStore } from "../ports/key-store";
 import type { TokenStore } from "../ports/token-store";
 import type { ConfigStore } from "../ports/config-store";
 import type { AuthError } from "../types/error";
-import type { PersistUpstreamTokens, SuccessMapInput } from "../types/idp";
+import type { OnTokenIssued, PersistUpstreamTokens, SuccessMapInput } from "../types/idp";
 import type { Result } from "../types/result";
 import type { SubjectClaim, SubjectSchema } from "../types/subject";
 import type { TenantContext } from "../types/tenant";
@@ -71,6 +71,8 @@ export type ExchangeCodeDeps = {
     persistUpstreamTokens?: PersistUpstreamTokens;
     issuerUrl: string;
     clock: () => number;
+    /** See `IdPOptions.onTokenIssued`. Threaded to `mintTokens`. */
+    onTokenIssued?: OnTokenIssued;
     newRefreshToken?: () => string;
     /** Test override. */
     newRefreshFamily?: () => string;
@@ -127,6 +129,7 @@ export declare function mintTokens(args: {
         auditLog?: AuditLog;
         issuerUrl: string;
         clock: () => number;
+        onTokenIssued?: OnTokenIssued;
         newRefreshToken?: () => string;
         /**
          * Host-supplied vendor scope → claim-names map merged into the

package/dist/types/domain/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/domain/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAEV,WAAW,EAEX,aAAa,EACd,MAAM,gBAAgB,CAAA;AAkBvB;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,EACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GACnD,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAclC;AAED,eAAO,MAAM,qBAAqB,QAAiB,CAAA;AACnD,eAAO,MAAM,sBAAsB,QAA2B,CAAA;AAE9D,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,oBAAoB,CAAA;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,iCAAiC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D;;;;OAIG;IACH,QAAQ,EAAE,aAAa,CAAA;IACvB,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;IAC9B,qBAAqB;IACrB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;IAC/B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,oBAAoB,EACzB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAmI3C;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,YAAY,CAAA;IACnB,OAAO,EAAE,IAAI,CACX,WAAW,EACX,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,QAAQ,GAAG,UAAU,CAC5E,GAAG;QACF;;;;;WAKG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,yDAAyD;QACzD,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB;;;;;WAKG;QACH,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB;;;;WAIG;QACH,aAAa,CAAC,EAAE,OAAO,wBAAwB,EAAE,aAAa,CAAA;KAC/D,CAAA;IACD,MAAM,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,IAAI,EAAE;QACJ,QAAQ,EAAE,QAAQ,CAAA;QAClB,UAAU,EAAE,UAAU,CAAA;QACtB,QAAQ,CAAC,EAAE,QAAQ,CAAA;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,MAAM,CAAA;QACnB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;QAC9B;;;WAGG;QACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;KAC1D,CAAA;CACF,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CA8I5C;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/domain/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,OAAO,KAAK,EACV,aAAa,EACb,qBAAqB,EACrB,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAEV,WAAW,EAEX,aAAa,EACd,MAAM,gBAAgB,CAAA;AAkBvB;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,EACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GACnD,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAclC;AAED,eAAO,MAAM,qBAAqB,QAAiB,CAAA;AACnD,eAAO,MAAM,sBAAsB,QAA2B,CAAA;AAE9D,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,oBAAoB,CAAA;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,iCAAiC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D;;;;OAIG;IACH,QAAQ,EAAE,aAAa,CAAA;IACvB,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,gEAAgE;IAChE,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;IAC9B,qBAAqB;IACrB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;IAC/B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,oBAAoB,EACzB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAmI3C;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,YAAY,CAAA;IACnB,OAAO,EAAE,IAAI,CACX,WAAW,EACX,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,QAAQ,GAAG,UAAU,CAC5E,GAAG;QACF;;;;;WAKG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,yDAAyD;QACzD,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB;;;;;WAKG;QACH,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB;;;;WAIG;QACH,aAAa,CAAC,EAAE,OAAO,wBAAwB,EAAE,aAAa,CAAA;KAC/D,CAAA;IACD,MAAM,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,IAAI,EAAE;QACJ,QAAQ,EAAE,QAAQ,CAAA;QAClB,UAAU,EAAE,UAAU,CAAA;QACtB,QAAQ,CAAC,EAAE,QAAQ,CAAA;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,MAAM,CAAA;QACnB,aAAa,CAAC,EAAE,aAAa,CAAA;QAC7B,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;QAC9B;;;WAGG;QACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;KAC1D,CAAA;CACF,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAmK5C;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE"}

package/dist/types/http/context.d.ts

@@ -15,6 +15,7 @@ import type { SessionStore } from "../ports/session-store";
 import type { TokenStore } from "../ports/token-store";
 import type { MethodCache } from "../domain/method-cache";
 import type { AuthError } from "../types/error";
+import type { OnTokenIssued } from "../types/idp";
 import type { SubjectSchema } from "../types/subject";
 import type { ExchangeAudience, LogoutEventInput, LogoutHookResult, PersistUpstreamTokens, RegisterClient, RenderPicker, SuccessMapInput } from "../types/idp";
 import type { Result } from "../types/result";
@@ -39,6 +40,8 @@ export type HttpDeps = {
     callbackHostFor?: (tenantId: TenantId) => string;
     /** Host-declared subject schemas, validated at issuance. */
     subjects: SubjectSchema;
+    /** See `IdPOptions.onTokenIssued`. */
+    onTokenIssued?: OnTokenIssued;
     resolveTenant: (req: Request) => Promise<Result<TenantId, AuthError>>;
     success: (input: SuccessMapInput) => Promise<SubjectClaim>;
     /** See `IdPOptions.onLogout` — upstream Single Logout host hook. */

package/dist/types/http/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/http/context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACf,MAAM,iBAAiB,CAAA;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE/C,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IACrB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,yEAAyE;IACzE,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,gEAAgE;IAChE,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAA;IACvC,sDAAsD;IACtD,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAChD,4DAA4D;IAC5D,QAAQ,EAAE,aAAa,CAAA;IACvB,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IACrE,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,oEAAoE;IACpE,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IACjD,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/D,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,cAAc,EAAE,cAAc,CAAA;IAC9B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,qDAAqD;AACrD,MAAM,MAAM,QAAQ,GAAG;IACrB,+BAA+B;IAC/B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,8FAA8F;IAC9F,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,kEAAkE;IAClE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,OAAO,GAAG;IACpB,SAAS,EAAE,QAAQ,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;AAE1C,qEAAqE;AACrE,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,QAAQ,CAEV"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/http/context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACf,MAAM,iBAAiB,CAAA;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE/C,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IACrB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,yEAAyE;IACzE,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,gEAAgE;IAChE,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAA;IACvC,sDAAsD;IACtD,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAChD,4DAA4D;IAC5D,QAAQ,EAAE,aAAa,CAAA;IACvB,sCAAsC;IACtC,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IACrE,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,oEAAoE;IACpE,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IACjD,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/D,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,cAAc,EAAE,cAAc,CAAA;IAC9B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,qDAAqD;AACrD,MAAM,MAAM,QAAQ,GAAG;IACrB,+BAA+B;IAC/B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,8FAA8F;IAC9F,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,kEAAkE;IAClE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,OAAO,GAAG;IACpB,SAAS,EAAE,QAAQ,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;AAE1C,qEAAqE;AACrE,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,QAAQ,CAEV"}

package/dist/types/http/handlers/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/token.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAKvD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,OAC5B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAsOjD"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/token.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAKvD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,OAC5B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA0OjD"}

package/dist/types/index.d.ts

@@ -20,7 +20,7 @@ export type { AuthMethod, AuthMethodFactory, CachePolicy, ClientFn, MethodContex
 export type { AuthorizationRequest, AuthorizationState, } from "./types/authorization";
 export type { AccessTokenClaims, AddressClaim, CodePayload, IdTokenClaims, RefreshTokenPayload, ScopedProfileClaims, TokenResponse, } from "./types/token";
 export type { SubjectClaim, SubjectPayload, SubjectSchema, } from "./types/subject";
-export type { ExchangeAudience, IdP, IdPOptions, LogoutEventInput, LogoutHookResult, PersistUpstreamTokens, RegisterClient, RegisterClientRequest, RegisterClientResponse, RenderPicker, SuccessMapInput, } from "./types/idp";
+export type { ExchangeAudience, IdP, IdPOptions, LogoutEventInput, LogoutHookResult, OnTokenIssued, PersistUpstreamTokens, RegisterClient, RegisterClientRequest, RegisterClientResponse, RenderPicker, SuccessMapInput, } from "./types/idp";
 export type { PickerContext, PickerMethod } from "./types/picker";
 export type { AuditEvent, AuditLog } from "./ports/audit-log";
 export type { ConfigStore } from "./ports/config-store";

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,YAAY,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAErD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,SAAS,EACT,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,WAAW,GACZ,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,SAAS,GACV,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAA;AAEtB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,gBAAgB,EAChB,GAAG,EACH,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAA;AAEpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEjE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,GACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,cAAc,EACd,eAAe,EACf,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,GACd,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,SAAS,EACT,aAAa,EACb,YAAY,GACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAGvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAG7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAM7D,OAAO,EACL,aAAa,EACb,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,GACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CAwF/C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,YAAY,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAErD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,SAAS,EACT,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,WAAW,GACZ,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,SAAS,GACV,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAA;AAEtB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,gBAAgB,EAChB,GAAG,EACH,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAA;AAEpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEjE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,GACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,cAAc,EACd,eAAe,EACf,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,GACd,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,SAAS,EACT,aAAa,EACb,YAAY,GACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAGvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAG7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAM7D,OAAO,EACL,aAAa,EACb,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,GACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CAyF/C"}

package/dist/types/types/idp.d.ts

@@ -87,6 +87,62 @@ export type LogoutEventInput = {
 export type LogoutHookResult = {
     revokeSubject?: string;
 } | void;
+/**
+ * Fired when tokens are minted, naming the derived subject id.
+ *
+ * This is the only way a host can learn `subjectId` — the value the
+ * library signs as `sub`, and the key `TokenStore.revokeBySubject` and
+ * `revokeAllForSubject` take. It is derived inside the library from the
+ * claim and the receiving client's `sectorIdentifier`, so without this
+ * hook a host holds a revocation primitive it can never call, and
+ * `onLogout`'s `revokeSubject` has no map to resolve against.
+ *
+ * That matters because refresh rotation never re-consults the host:
+ * `refreshTokens` mints from the claim captured on the stored payload.
+ * Revoking the chain is the only way to stop an offboarded user's tokens
+ * from being renewed indefinitely.
+ *
+ * **A principal maps to many subject ids, not one.** Record them; do not
+ * overwrite. Two reasons, both silent if you assume otherwise:
+ *
+ *  - **Pairwise** — with `ClientConfig.sectorIdentifier` set, derivation
+ *    mixes the sector in (OIDC Core §8.1), so the same person has a
+ *    distinct `sub` per sector. Revoking one leaves the others minting.
+ *  - **Claim contents** — derivation hashes `claim.properties`. If your
+ *    `success()` returns anything mutable (an email, a role), the subject
+ *    id changes when that value changes, and chains issued under the old
+ *    one survive. Returning a single immutable id is the way to avoid
+ *    this; OIDC Core §2 wants `sub` never reassigned.
+ *
+ * Runs **before** the refresh token is persisted, so throwing aborts
+ * issuance with `server_error` and leaves no chain behind. That is
+ * deliberate: recording the mapping after the token is durable would let
+ * a hook failure produce exactly the unrevokable token this exists to
+ * prevent. Like `success` and `persistUpstreamTokens`, and unlike
+ * `AuditLog`, a failure here stops the grant.
+ */
+export type OnTokenIssued = (input: {
+    tenant: TenantContext;
+    /** Client the tokens were minted for. */
+    clientId: string;
+    /**
+     * The `sub` of the issued access token — the key `revokeBySubject` and
+     * `revokeAllForSubject` take.
+     */
+    subjectId: string;
+    /**
+     * The claim your `success()` (or token-exchange audience mapping)
+     * returned, already validated against `subjects`. Use it to attribute
+     * `subjectId` to one of your own principals.
+     */
+    claim: SubjectClaim;
+    /**
+     * Refresh-token family, for `TokenStore.revokeFamily`. Absent when the
+     * grant issued no refresh token (`client_credentials`, RFC 6749
+     * §4.4.3), because then there is no chain to revoke.
+     */
+    family?: string;
+}) => Promise<void> | void;
 /**
  * Optional hook called at `/token` time, after PKCE has succeeded and
  * after the `success` callback has produced a `SubjectClaim`, but
@@ -324,6 +380,22 @@ export type IdPOptions = {
      * `PersistUpstreamTokens` type doc.
      */
     persistUpstreamTokens?: PersistUpstreamTokens;
+    /**
+     * Optional hook fired as tokens are minted, carrying the derived
+     * `subjectId` alongside the claim it came from.
+     *
+     * Supply this if you need to revoke a user's tokens later — on
+     * offboarding, deactivation, or a membership change. `subjectId` is
+     * computed inside the library and appears nowhere else, so without
+     * this hook `TokenStore.revokeBySubject` / `revokeAllForSubject` are
+     * uncallable and `onLogout`'s `revokeSubject` has nothing to resolve
+     * against. See {@link OnTokenIssued} — in particular, one principal
+     * has many subject ids and they must be accumulated, not overwritten.
+     *
+     * Throwing aborts the grant; it runs before the refresh token is
+     * persisted so no unrecorded chain can survive a failure.
+     */
+    onTokenIssued?: OnTokenIssued;
     /**
      * Optional RFC 8693 token-exchange hook. If absent, exchange
      * requests at `/token` return `unsupported_grant_type`. See the

package/dist/types/types/idp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../../../src/types/idp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,WAAW,EACZ,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CACxC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,MAAM,EAAE,cAAc,CAAA;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAA;AAEhE;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,YAAY,EAAE,YAAY,CAAA;CAC3B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE;IACP,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAA;CACrB,KACE,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,sEAAsE;IACtE,0BAA0B,CAAC,EACzB,MAAM,GAAG,qBAAqB,GAAG,oBAAoB,CAAA;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC,sBAAsB;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE;IACnC,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,qBAAqB,CAAA;IAC9B;;;;OAIG;IACH,MAAM,EAAE,YAAY,CAAA;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,KAAK,OAAO,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,SAAS,CAAC,CAAC,CAAA;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,YAAY,EAAE,EACvB,GAAG,EAAE,aAAa,KACf,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEjC,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IAErE;;;;;;;;;;;;;;;OAeG;IACH,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAEhD;;;;;;;;;OASG;IACH,SAAS,EAAE,YAAY,CAAA;IAEvB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,sEAAsE;IACtE,YAAY,EAAE,YAAY,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,yEAAyE;IACzE,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;IAE7B,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAA;IAE9C;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAE7C,QAAQ,EAAE,aAAa,CAAA;IAEvB;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAE1D,KAAK,CAAC,EAAE,WAAW,CAAA;IAEnB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IAEjD;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAE7C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC;;OAEG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAE3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IAEzD;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,GAAG,GAAG;IAChB,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACzC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,oCAAoC;IACpC,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,8CAA8C;IAC9C,GAAG,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACxC,4CAA4C;IAC5C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC9C,CAAA"}
+{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../../../src/types/idp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,WAAW,EACZ,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CACxC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,MAAM,EAAE,cAAc,CAAA;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAA;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE;IAClC,MAAM,EAAE,aAAa,CAAA;IACrB,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,KAAK,EAAE,YAAY,CAAA;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AAE1B;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,YAAY,EAAE,YAAY,CAAA;CAC3B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE;IACP,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAA;CACrB,KACE,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,sEAAsE;IACtE,0BAA0B,CAAC,EACzB,MAAM,GAAG,qBAAqB,GAAG,oBAAoB,CAAA;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC,sBAAsB;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE;IACnC,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,qBAAqB,CAAA;IAC9B;;;;OAIG;IACH,MAAM,EAAE,YAAY,CAAA;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,KAAK,OAAO,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,SAAS,CAAC,CAAC,CAAA;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,YAAY,EAAE,EACvB,GAAG,EAAE,aAAa,KACf,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEjC,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IAErE;;;;;;;;;;;;;;;OAeG;IACH,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAEhD;;;;;;;;;OASG;IACH,SAAS,EAAE,YAAY,CAAA;IAEvB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,sEAAsE;IACtE,YAAY,EAAE,YAAY,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,yEAAyE;IACzE,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;IAE7B,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAA;IAE9C;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAE7C,QAAQ,EAAE,aAAa,CAAA;IAEvB;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAE1D,KAAK,CAAC,EAAE,WAAW,CAAA;IAEnB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IAEjD;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAE7C;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;IAE7B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC;;OAEG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAE3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IAEzD;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,GAAG,GAAG;IAChB,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACzC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,oCAAoC;IACpC,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,8CAA8C;IAC9C,GAAG,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACxC,4CAA4C;IAC5C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC9C,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@_mustachio/openauth",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/domain/client-credentials.ts

@@ -22,7 +22,11 @@ import type { ConfigStore } from "../ports/config-store"
 import type { KeyStore } from "../ports/key-store"
 import type { TokenStore } from "../ports/token-store"
 import { authError, type AuthError } from "../types/error"
-import type { PersistUpstreamTokens, SuccessMapInput } from "../types/idp"
+import type {
+  OnTokenIssued,
+  PersistUpstreamTokens,
+  SuccessMapInput,
+} from "../types/idp"
 import type { Result } from "../types/result"
 import { err, isErr, ok } from "../types/result"
 import type { SubjectClaim, SubjectSchema } from "../types/subject"
@@ -57,6 +61,8 @@ export type ClientCredentialsDeps = {
   persistUpstreamTokens?: PersistUpstreamTokens
   issuerUrl: string
   clock: () => number
+  /** See `IdPOptions.onTokenIssued`. Threaded to `mintTokens`. */
+  onTokenIssued?: OnTokenIssued
   newRefreshFamily?: () => string
   /** See `IdPOptions.customScopeClaims`. Forwarded to `mintTokens`. */
   customScopeClaims?: Record<string, ReadonlyArray<string>>

package/src/domain/refresh.ts

@@ -17,6 +17,7 @@ import type { ConfigStore } from "../ports/config-store"
 import type { KeyStore } from "../ports/key-store"
 import type { TokenStore } from "../ports/token-store"
 import { authError, type AuthError } from "../types/error"
+import type { OnTokenIssued } from "../types/idp"
 import type { Result } from "../types/result"
 import { err, isErr } from "../types/result"
 import type { TenantContext } from "../types/tenant"
@@ -50,6 +51,8 @@ export type RefreshTokensDeps = {
   auditLog?: AuditLog
   issuerUrl: string
   clock: () => number
+  /** See `IdPOptions.onTokenIssued`. Threaded to `mintTokens`. */
+  onTokenIssued?: OnTokenIssued
   /** Reuse-detection window (ms). Default 60 s. */
   reuseWindowMs?: number
   newRefreshToken?: () => string

package/src/domain/token-exchange.ts

@@ -36,7 +36,7 @@ import type { ConfigStore } from "../ports/config-store"
 import type { KeyStore } from "../ports/key-store"
 import type { TokenStore } from "../ports/token-store"
 import { authError, type AuthError } from "../types/error"
-import type { ExchangeAudience } from "../types/idp"
+import type { ExchangeAudience, OnTokenIssued } from "../types/idp"
 import type { Result } from "../types/result"
 import { err, isErr, ok } from "../types/result"
 import type { SubjectClaim } from "../types/subject"
@@ -73,6 +73,8 @@ export type ExchangeTokenDeps = {
   exchangeAudience?: ExchangeAudience
   issuerUrl: string
   clock: () => number
+  /** See `IdPOptions.onTokenIssued`. Threaded to `mintTokens`. */
+  onTokenIssued?: OnTokenIssued
   newRefreshFamily?: () => string
   /** See `IdPOptions.customScopeClaims`. Forwarded to `mintTokens`. */
   customScopeClaims?: Record<string, ReadonlyArray<string>>

package/src/domain/token.ts

@@ -24,7 +24,11 @@ import type { TokenStore } from "../ports/token-store"
 import type { ConfigStore } from "../ports/config-store"
 import type { AuthError } from "../types/error"
 import { authError } from "../types/error"
-import type { PersistUpstreamTokens, SuccessMapInput } from "../types/idp"
+import type {
+  OnTokenIssued,
+  PersistUpstreamTokens,
+  SuccessMapInput,
+} from "../types/idp"
 import type { Result } from "../types/result"
 import { err, isErr, ok } from "../types/result"
 import type { SubjectClaim, SubjectSchema } from "../types/subject"
@@ -114,6 +118,8 @@ export type ExchangeCodeDeps = {
   persistUpstreamTokens?: PersistUpstreamTokens
   issuerUrl: string
   clock: () => number
+  /** See `IdPOptions.onTokenIssued`. Threaded to `mintTokens`. */
+  onTokenIssued?: OnTokenIssued
   newRefreshToken?: () => string
   /** Test override. */
   newRefreshFamily?: () => string
@@ -309,6 +315,7 @@ export async function mintTokens(args: {
     auditLog?: AuditLog
     issuerUrl: string
     clock: () => number
+    onTokenIssued?: OnTokenIssued
     newRefreshToken?: () => string
     /**
      * Host-supplied vendor scope → claim-names map merged into the
@@ -338,6 +345,27 @@ export async function mintTokens(args: {
     receivingClient?.sectorIdentifier,
   )
 
+  // Hand the host the derived subject id *before* anything durable is
+  // written. `subjectId` exists nowhere else — it is signed as `sub` and
+  // is the key `revokeBySubject` takes — so a host that misses it holds a
+  // token it can never revoke. Running after `saveRefresh` and aborting
+  // on failure would leave precisely that: a live chain with no record.
+  if (deps.onTokenIssued) {
+    try {
+      await deps.onTokenIssued({
+        tenant,
+        clientId: payload.clientId,
+        subjectId,
+        claim,
+        // No refresh row is written when `skipRefresh` is set, so there
+        // is no chain for the host to revoke by family.
+        ...(skipRefresh ? {} : { family }),
+      })
+    } catch (e) {
+      return err(authError.serverError("onTokenIssued hook threw", e))
+    }
+  }
+
   const keyRes = await deps.keyStore.currentSigningKey()
   if (isErr(keyRes)) return err(keyRes.error)
   const signingKey = keyRes.value

package/src/http/context.ts

@@ -16,6 +16,7 @@ import type { SessionStore } from "../ports/session-store"
 import type { TokenStore } from "../ports/token-store"
 import type { MethodCache } from "../domain/method-cache"
 import type { AuthError } from "../types/error"
+import type { OnTokenIssued } from "../types/idp"
 import type { SubjectSchema } from "../types/subject"
 import type {
   ExchangeAudience,
@@ -55,6 +56,8 @@ export type HttpDeps = {
   callbackHostFor?: (tenantId: TenantId) => string
   /** Host-declared subject schemas, validated at issuance. */
   subjects: SubjectSchema
+  /** See `IdPOptions.onTokenIssued`. */
+  onTokenIssued?: OnTokenIssued
   resolveTenant: (req: Request) => Promise<Result<TenantId, AuthError>>
   success: (input: SuccessMapInput) => Promise<SubjectClaim>
   /** See `IdPOptions.onLogout` — upstream Single Logout host hook. */

package/src/http/handlers/token.ts

@@ -133,6 +133,7 @@ export function makeTokenHandler(deps: HttpDeps) {
             : {}),
           issuerUrl: c.get("issuerUrl"),
           clock: deps.clock,
+          ...(deps.onTokenIssued ? { onTokenIssued: deps.onTokenIssued } : {}),
           ...(deps.customScopeClaims !== undefined
             ? { customScopeClaims: deps.customScopeClaims }
             : {}),
@@ -181,6 +182,7 @@ export function makeTokenHandler(deps: HttpDeps) {
             : {}),
           issuerUrl: c.get("issuerUrl"),
           clock: deps.clock,
+          ...(deps.onTokenIssued ? { onTokenIssued: deps.onTokenIssued } : {}),
           ...(deps.customScopeClaims !== undefined
             ? { customScopeClaims: deps.customScopeClaims }
             : {}),
@@ -210,6 +212,7 @@ export function makeTokenHandler(deps: HttpDeps) {
           ...(deps.auditLog ? { auditLog: deps.auditLog } : {}),
           issuerUrl: c.get("issuerUrl"),
           clock: deps.clock,
+          ...(deps.onTokenIssued ? { onTokenIssued: deps.onTokenIssued } : {}),
           ...(deps.customScopeClaims !== undefined
             ? { customScopeClaims: deps.customScopeClaims }
             : {}),
@@ -250,6 +253,7 @@ export function makeTokenHandler(deps: HttpDeps) {
           : {}),
         issuerUrl: c.get("issuerUrl"),
         clock: deps.clock,
+        ...(deps.onTokenIssued ? { onTokenIssued: deps.onTokenIssued } : {}),
         ...(deps.customScopeClaims !== undefined
           ? { customScopeClaims: deps.customScopeClaims }
           : {}),

package/src/index.ts

@@ -77,6 +77,7 @@ export type {
   IdPOptions,
   LogoutEventInput,
   LogoutHookResult,
+  OnTokenIssued,
   PersistUpstreamTokens,
   RegisterClient,
   RegisterClientRequest,
@@ -284,6 +285,7 @@ export function createIdP(opts: IdPOptions): IdP {
     resolveTenant: opts.resolveTenant,
     success: opts.success,
     subjects: opts.subjects,
+    ...(opts.onTokenIssued ? { onTokenIssued: opts.onTokenIssued } : {}),
     ...(opts.onLogout ? { onLogout: opts.onLogout } : {}),
     ...(opts.persistUpstreamTokens
       ? { persistUpstreamTokens: opts.persistUpstreamTokens }

package/src/types/idp.ts

@@ -96,6 +96,63 @@ export type LogoutEventInput = {
  */
 export type LogoutHookResult = { revokeSubject?: string } | void
 
+/**
+ * Fired when tokens are minted, naming the derived subject id.
+ *
+ * This is the only way a host can learn `subjectId` — the value the
+ * library signs as `sub`, and the key `TokenStore.revokeBySubject` and
+ * `revokeAllForSubject` take. It is derived inside the library from the
+ * claim and the receiving client's `sectorIdentifier`, so without this
+ * hook a host holds a revocation primitive it can never call, and
+ * `onLogout`'s `revokeSubject` has no map to resolve against.
+ *
+ * That matters because refresh rotation never re-consults the host:
+ * `refreshTokens` mints from the claim captured on the stored payload.
+ * Revoking the chain is the only way to stop an offboarded user's tokens
+ * from being renewed indefinitely.
+ *
+ * **A principal maps to many subject ids, not one.** Record them; do not
+ * overwrite. Two reasons, both silent if you assume otherwise:
+ *
+ *  - **Pairwise** — with `ClientConfig.sectorIdentifier` set, derivation
+ *    mixes the sector in (OIDC Core §8.1), so the same person has a
+ *    distinct `sub` per sector. Revoking one leaves the others minting.
+ *  - **Claim contents** — derivation hashes `claim.properties`. If your
+ *    `success()` returns anything mutable (an email, a role), the subject
+ *    id changes when that value changes, and chains issued under the old
+ *    one survive. Returning a single immutable id is the way to avoid
+ *    this; OIDC Core §2 wants `sub` never reassigned.
+ *
+ * Runs **before** the refresh token is persisted, so throwing aborts
+ * issuance with `server_error` and leaves no chain behind. That is
+ * deliberate: recording the mapping after the token is durable would let
+ * a hook failure produce exactly the unrevokable token this exists to
+ * prevent. Like `success` and `persistUpstreamTokens`, and unlike
+ * `AuditLog`, a failure here stops the grant.
+ */
+export type OnTokenIssued = (input: {
+  tenant: TenantContext
+  /** Client the tokens were minted for. */
+  clientId: string
+  /**
+   * The `sub` of the issued access token — the key `revokeBySubject` and
+   * `revokeAllForSubject` take.
+   */
+  subjectId: string
+  /**
+   * The claim your `success()` (or token-exchange audience mapping)
+   * returned, already validated against `subjects`. Use it to attribute
+   * `subjectId` to one of your own principals.
+   */
+  claim: SubjectClaim
+  /**
+   * Refresh-token family, for `TokenStore.revokeFamily`. Absent when the
+   * grant issued no refresh token (`client_credentials`, RFC 6749
+   * §4.4.3), because then there is no chain to revoke.
+   */
+  family?: string
+}) => Promise<void> | void
+
 /**
  * Optional hook called at `/token` time, after PKCE has succeeded and
  * after the `success` callback has produced a `SubjectClaim`, but
@@ -356,6 +413,23 @@ export type IdPOptions = {
    */
   persistUpstreamTokens?: PersistUpstreamTokens
 
+  /**
+   * Optional hook fired as tokens are minted, carrying the derived
+   * `subjectId` alongside the claim it came from.
+   *
+   * Supply this if you need to revoke a user's tokens later — on
+   * offboarding, deactivation, or a membership change. `subjectId` is
+   * computed inside the library and appears nowhere else, so without
+   * this hook `TokenStore.revokeBySubject` / `revokeAllForSubject` are
+   * uncallable and `onLogout`'s `revokeSubject` has nothing to resolve
+   * against. See {@link OnTokenIssued} — in particular, one principal
+   * has many subject ids and they must be accumulated, not overwritten.
+   *
+   * Throwing aborts the grant; it runs before the refresh token is
+   * persisted so no unrecorded chain can survive a failure.
+   */
+  onTokenIssued?: OnTokenIssued
+
   /**
    * Optional RFC 8693 token-exchange hook. If absent, exchange
    * requests at `/token` return `unsupported_grant_type`. See the