@feelflow/ffid-sdk 0.3.0 → 1.1.0

package/dist/{chunk-A6YJDYIX.cjs → chunk-TL6U5TJT.cjs}

@@ -6,11 +6,192 @@ var jsxRuntime = require('react/jsx-runtime');
 // src/constants.ts
 var DEFAULT_API_BASE_URL = "https://id.feelflow.co.jp";
 
+// src/auth/token-store.ts
+var STORAGE_KEY = "ffid_tokens";
+var EXPIRY_BUFFER_SECONDS = 30;
+var EXPIRY_BUFFER_MS = EXPIRY_BUFFER_SECONDS * 1e3;
+function isLocalStorageAvailable() {
+  try {
+    if (typeof window === "undefined") return false;
+    const storage = window.localStorage;
+    if (!storage || typeof storage.setItem !== "function") return false;
+    const testKey = "__ffid_storage_test__";
+    storage.setItem(testKey, "1");
+    storage.removeItem(testKey);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function createLocalStorageStore() {
+  const storage = window.localStorage;
+  return {
+    getTokens() {
+      try {
+        const raw = storage.getItem(STORAGE_KEY);
+        if (!raw) return null;
+        const parsed = JSON.parse(raw);
+        if (!isTokenData(parsed)) return null;
+        return parsed;
+      } catch {
+        return null;
+      }
+    },
+    setTokens(tokens) {
+      try {
+        storage.setItem(STORAGE_KEY, JSON.stringify(tokens));
+      } catch {
+      }
+    },
+    clearTokens() {
+      try {
+        storage.removeItem(STORAGE_KEY);
+      } catch {
+      }
+    },
+    isAccessTokenExpired() {
+      const tokens = this.getTokens();
+      if (!tokens) return true;
+      return Date.now() >= tokens.expiresAt - EXPIRY_BUFFER_MS;
+    }
+  };
+}
+function createMemoryStore() {
+  let stored = null;
+  return {
+    getTokens() {
+      return stored;
+    },
+    setTokens(tokens) {
+      stored = { ...tokens };
+    },
+    clearTokens() {
+      stored = null;
+    },
+    isAccessTokenExpired() {
+      if (!stored) return true;
+      return Date.now() >= stored.expiresAt - EXPIRY_BUFFER_MS;
+    }
+  };
+}
+function isTokenData(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value;
+  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && typeof obj.expiresAt === "number";
+}
+function createTokenStore(storageType) {
+  if (storageType === "memory") {
+    return createMemoryStore();
+  }
+  if (typeof window !== "undefined" && isLocalStorageAvailable()) {
+    return createLocalStorageStore();
+  }
+  return createMemoryStore();
+}
+
+// src/auth/pkce.ts
+var VERIFIER_STORAGE_KEY = "ffid_code_verifier";
+var CODE_VERIFIER_MIN_LENGTH = 43;
+var UNRESERVED_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+function generateCodeVerifier() {
+  const length = CODE_VERIFIER_MIN_LENGTH;
+  const randomValues = new Uint8Array(length);
+  crypto.getRandomValues(randomValues);
+  let verifier = "";
+  for (let i = 0; i < length; i++) {
+    verifier += UNRESERVED_CHARS[randomValues[i] % UNRESERVED_CHARS.length];
+  }
+  return verifier;
+}
+async function generateCodeChallenge(verifier) {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(verifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return base64UrlEncode(digest);
+}
+function storeCodeVerifier(verifier) {
+  try {
+    if (typeof window === "undefined") return;
+    window.sessionStorage.setItem(VERIFIER_STORAGE_KEY, verifier);
+  } catch {
+  }
+}
+function retrieveCodeVerifier() {
+  try {
+    if (typeof window === "undefined") return null;
+    const verifier = window.sessionStorage.getItem(VERIFIER_STORAGE_KEY);
+    if (verifier) {
+      window.sessionStorage.removeItem(VERIFIER_STORAGE_KEY);
+    }
+    return verifier;
+  } catch {
+    return null;
+  }
+}
+function base64UrlEncode(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+// src/client/oauth-userinfo.ts
+var VALID_SUBSCRIPTION_STATUSES = ["trialing", "active", "past_due", "canceled", "paused"];
+function isValidSubscriptionStatus(value) {
+  return VALID_SUBSCRIPTION_STATUSES.includes(value);
+}
+function normalizeUserinfo(raw) {
+  return {
+    sub: raw.sub,
+    email: raw.email,
+    name: raw.name,
+    picture: raw.picture,
+    organizationId: raw.organization_id ?? null,
+    subscription: raw.subscription ? {
+      status: raw.subscription.status ?? null,
+      planCode: raw.subscription.plan_code ?? null,
+      seatModel: raw.subscription.seat_model ?? null,
+      memberRole: raw.subscription.member_role ?? null,
+      organizationId: raw.subscription.organization_id ?? null
+    } : void 0
+  };
+}
+function mapUserinfoSubscriptionToSession(userinfo, serviceCode) {
+  const subscription = userinfo.subscription;
+  if (!subscription || !subscription.planCode || !isValidSubscriptionStatus(subscription.status)) {
+    return [];
+  }
+  return [
+    {
+      id: `userinfo:${serviceCode}`,
+      serviceCode,
+      serviceName: serviceCode,
+      planCode: subscription.planCode,
+      planName: subscription.planCode,
+      status: subscription.status,
+      currentPeriodEnd: null,
+      seatModel: subscription.seatModel ?? void 0,
+      memberRole: subscription.memberRole ?? void 0,
+      organizationId: subscription.organizationId
+    }
+  ];
+}
+
 // src/client/ffid-client.ts
 var NO_CONTENT_STATUS = 204;
 var SESSION_ENDPOINT = "/api/v1/auth/session";
 var LOGOUT_ENDPOINT = "/api/v1/auth/signout";
+var OAUTH_TOKEN_ENDPOINT = "/api/v1/oauth/token";
+var OAUTH_USERINFO_ENDPOINT = "/api/v1/oauth/userinfo";
+var OAUTH_AUTHORIZE_ENDPOINT = "/api/v1/oauth/authorize";
+var OAUTH_REVOKE_ENDPOINT = "/api/v1/oauth/revoke";
 var SDK_LOG_PREFIX = "[FFID SDK]";
+var MS_PER_SECOND = 1e3;
+var UNAUTHORIZED_STATUS = 401;
+var STATE_RANDOM_BYTES = 16;
+var HEX_BASE = 16;
 var noopLogger = {
   debug: () => {
   },
@@ -32,28 +213,30 @@ var FFID_ERROR_CODES = {
   /** Server returned non-JSON response (e.g., HTML error page) */
   PARSE_ERROR: "PARSE_ERROR",
   /** Server returned error without structured error body */
-  UNKNOWN_ERROR: "UNKNOWN_ERROR"
+  UNKNOWN_ERROR: "UNKNOWN_ERROR",
+  /** Token exchange failed */
+  TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR",
+  /** Token refresh failed */
+  TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR",
+  /** No tokens available */
+  NO_TOKENS: "NO_TOKENS"
 };
 function createFFIDClient(config) {
   if (!config.serviceCode || !config.serviceCode.trim()) {
     throw new Error("FFID Client: serviceCode \u304C\u672A\u8A2D\u5B9A\u3067\u3059");
   }
   const baseUrl = config.apiBaseUrl ?? DEFAULT_API_BASE_URL;
+  const authMode = config.authMode ?? "cookie";
+  const clientId = config.clientId ?? config.serviceCode;
   const logger = config.logger ?? (config.debug ? consoleLogger : noopLogger);
+  const tokenStore = authMode === "token" ? createTokenStore() : createTokenStore("memory");
   async function fetchWithAuth(endpoint, options = {}) {
     const url = `${baseUrl}${endpoint}`;
     logger.debug("Fetching:", url);
+    const fetchOptions = buildFetchOptions(options);
     let response;
     try {
-      response = await fetch(url, {
-        ...options,
-        credentials: "include",
-        // Include cookies for authentication
-        headers: {
-          "Content-Type": "application/json",
-          ...options.headers
-        }
-      });
+      response = await fetch(url, fetchOptions);
     } catch (error) {
       logger.error("Network error:", error);
       return {
@@ -63,6 +246,24 @@ function createFFIDClient(config) {
         }
       };
     }
+    if (authMode === "token" && response.status === UNAUTHORIZED_STATUS) {
+      const refreshResult = await refreshAccessToken();
+      if (!refreshResult.error) {
+        logger.debug("Token refreshed, retrying request");
+        const retryOptions = buildFetchOptions(options);
+        try {
+          response = await fetch(url, retryOptions);
+        } catch (retryError) {
+          logger.error("Network error on retry:", retryError);
+          return {
+            error: {
+              code: FFID_ERROR_CODES.NETWORK_ERROR,
+              message: retryError instanceof Error ? retryError.message : "\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F"
+            }
+          };
+        }
+      }
+    }
     let raw;
     try {
       raw = await response.json();
@@ -94,10 +295,140 @@ function createFFIDClient(config) {
     }
     return { data: raw.data };
   }
+  function buildFetchOptions(options) {
+    if (authMode === "token") {
+      const tokens = tokenStore.getTokens();
+      const headers = {
+        "Content-Type": "application/json",
+        ...options.headers
+      };
+      if (tokens) {
+        headers["Authorization"] = `Bearer ${tokens.accessToken}`;
+      }
+      return {
+        ...options,
+        credentials: "omit",
+        headers
+      };
+    }
+    return {
+      ...options,
+      credentials: "include",
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    };
+  }
   async function getSession() {
+    if (authMode === "token") {
+      return getSessionFromUserinfo();
+    }
     return fetchWithAuth(SESSION_ENDPOINT);
   }
+  async function getSessionFromUserinfo() {
+    const tokens = tokenStore.getTokens();
+    if (!tokens) {
+      return {
+        error: {
+          code: FFID_ERROR_CODES.NO_TOKENS,
+          message: "\u30C8\u30FC\u30AF\u30F3\u304C\u4FDD\u5B58\u3055\u308C\u3066\u3044\u307E\u305B\u3093"
+        }
+      };
+    }
+    const url = `${baseUrl}${OAUTH_USERINFO_ENDPOINT}`;
+    logger.debug("Fetching userinfo:", url);
+    let response;
+    try {
+      response = await fetch(url, {
+        credentials: "omit",
+        headers: {
+          "Authorization": `Bearer ${tokens.accessToken}`,
+          "Content-Type": "application/json"
+        }
+      });
+    } catch (error) {
+      logger.error("Network error:", error);
+      return {
+        error: {
+          code: FFID_ERROR_CODES.NETWORK_ERROR,
+          message: error instanceof Error ? error.message : "\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F"
+        }
+      };
+    }
+    if (response.status === UNAUTHORIZED_STATUS) {
+      const refreshResult = await refreshAccessToken();
+      if (!refreshResult.error) {
+        const retryTokens = tokenStore.getTokens();
+        if (retryTokens) {
+          try {
+            response = await fetch(url, {
+              credentials: "omit",
+              headers: {
+                "Authorization": `Bearer ${retryTokens.accessToken}`,
+                "Content-Type": "application/json"
+              }
+            });
+          } catch (retryError) {
+            logger.error("Network error on retry:", retryError);
+            return {
+              error: {
+                code: FFID_ERROR_CODES.NETWORK_ERROR,
+                message: retryError instanceof Error ? retryError.message : "\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F"
+              }
+            };
+          }
+        }
+      } else {
+        return refreshResult;
+      }
+    }
+    let rawUserinfo;
+    try {
+      rawUserinfo = await response.json();
+    } catch (parseError) {
+      logger.error("Parse error:", parseError, "Status:", response.status);
+      return {
+        error: {
+          code: FFID_ERROR_CODES.PARSE_ERROR,
+          message: `\u30B5\u30FC\u30D0\u30FC\u304B\u3089\u4E0D\u6B63\u306A\u30EC\u30B9\u30DD\u30F3\u30B9\u3092\u53D7\u4FE1\u3057\u307E\u3057\u305F (status: ${response.status})`
+        }
+      };
+    }
+    if (!response.ok) {
+      const errorBody = rawUserinfo;
+      return {
+        error: {
+          code: errorBody.code ?? FFID_ERROR_CODES.UNKNOWN_ERROR,
+          message: errorBody.message ?? "\u4E0D\u660E\u306A\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F"
+        }
+      };
+    }
+    const userinfo = normalizeUserinfo(rawUserinfo);
+    const user = {
+      id: userinfo.sub,
+      email: userinfo.email ?? "",
+      displayName: userinfo.name ?? null,
+      avatarUrl: userinfo.picture ?? null,
+      locale: null,
+      timezone: null,
+      createdAt: ""
+    };
+    return {
+      data: {
+        user,
+        organizations: [],
+        subscriptions: mapUserinfoSubscriptionToSession(userinfo, config.serviceCode)
+      }
+    };
+  }
   async function signOut() {
+    if (authMode === "token") {
+      return signOutToken();
+    }
+    return signOutCookie();
+  }
+  async function signOutCookie() {
     const url = `${baseUrl}${LOGOUT_ENDPOINT}`;
     logger.debug("Fetching:", url);
     let response;
@@ -141,21 +472,196 @@ function createFFIDClient(config) {
     logger.debug("Response:", response.status);
     return { data: void 0 };
   }
+  async function signOutToken() {
+    const tokens = tokenStore.getTokens();
+    tokenStore.clearTokens();
+    if (!tokens) {
+      logger.debug("No tokens to revoke");
+      return { data: void 0 };
+    }
+    const url = `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`;
+    logger.debug("Revoking token:", url);
+    try {
+      await fetch(url, {
+        method: "POST",
+        credentials: "omit",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          token: tokens.accessToken,
+          client_id: clientId
+        }).toString()
+      });
+    } catch (error) {
+      logger.warn("Token revocation failed:", error);
+    }
+    logger.debug("Token sign-out completed");
+    return { data: void 0 };
+  }
+  async function exchangeCodeForTokens(code, codeVerifier) {
+    const url = `${baseUrl}${OAUTH_TOKEN_ENDPOINT}`;
+    logger.debug("Exchanging code for tokens:", url);
+    const body = {
+      grant_type: "authorization_code",
+      code,
+      client_id: clientId,
+      redirect_uri: typeof window !== "undefined" ? window.location.origin + window.location.pathname : ""
+    };
+    if (codeVerifier) {
+      body.code_verifier = codeVerifier;
+    }
+    let response;
+    try {
+      response = await fetch(url, {
+        method: "POST",
+        credentials: "omit",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams(body).toString()
+      });
+    } catch (error) {
+      logger.error("Network error during token exchange:", error);
+      return {
+        error: {
+          code: FFID_ERROR_CODES.NETWORK_ERROR,
+          message: error instanceof Error ? error.message : "\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F"
+        }
+      };
+    }
+    let tokenResponse;
+    try {
+      tokenResponse = await response.json();
+    } catch (parseError) {
+      logger.error("Parse error during token exchange:", parseError);
+      return {
+        error: {
+          code: FFID_ERROR_CODES.PARSE_ERROR,
+          message: `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F (status: ${response.status})`
+        }
+      };
+    }
+    if (!response.ok) {
+      const errorBody = tokenResponse;
+      return {
+        error: {
+          code: errorBody.error ?? FFID_ERROR_CODES.TOKEN_EXCHANGE_ERROR,
+          message: errorBody.error_description ?? "\u30C8\u30FC\u30AF\u30F3\u4EA4\u63DB\u306B\u5931\u6557\u3057\u307E\u3057\u305F"
+        }
+      };
+    }
+    tokenStore.setTokens({
+      accessToken: tokenResponse.access_token,
+      refreshToken: tokenResponse.refresh_token,
+      expiresAt: Date.now() + tokenResponse.expires_in * MS_PER_SECOND
+    });
+    logger.debug("Token exchange successful");
+    return { data: void 0 };
+  }
+  async function refreshAccessToken() {
+    const tokens = tokenStore.getTokens();
+    if (!tokens) {
+      return {
+        error: {
+          code: FFID_ERROR_CODES.NO_TOKENS,
+          message: "\u30EA\u30D5\u30EC\u30C3\u30B7\u30E5\u30C8\u30FC\u30AF\u30F3\u304C\u3042\u308A\u307E\u305B\u3093"
+        }
+      };
+    }
+    const url = `${baseUrl}${OAUTH_TOKEN_ENDPOINT}`;
+    logger.debug("Refreshing access token:", url);
+    let response;
+    try {
+      response = await fetch(url, {
+        method: "POST",
+        credentials: "omit",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          refresh_token: tokens.refreshToken,
+          client_id: clientId
+        }).toString()
+      });
+    } catch (error) {
+      logger.error("Network error during token refresh:", error);
+      return {
+        error: {
+          code: FFID_ERROR_CODES.NETWORK_ERROR,
+          message: error instanceof Error ? error.message : "\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F"
+        }
+      };
+    }
+    let tokenResponse;
+    try {
+      tokenResponse = await response.json();
+    } catch (parseError) {
+      logger.error("Parse error during token refresh:", parseError);
+      return {
+        error: {
+          code: FFID_ERROR_CODES.PARSE_ERROR,
+          message: `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F (status: ${response.status})`
+        }
+      };
+    }
+    if (!response.ok) {
+      const errorBody = tokenResponse;
+      logger.error("Token refresh failed:", errorBody);
+      return {
+        error: {
+          code: errorBody.error ?? FFID_ERROR_CODES.TOKEN_REFRESH_ERROR,
+          message: errorBody.error_description ?? "\u30C8\u30FC\u30AF\u30F3\u30EA\u30D5\u30EC\u30C3\u30B7\u30E5\u306B\u5931\u6557\u3057\u307E\u3057\u305F"
+        }
+      };
+    }
+    tokenStore.setTokens({
+      accessToken: tokenResponse.access_token,
+      refreshToken: tokenResponse.refresh_token,
+      expiresAt: Date.now() + tokenResponse.expires_in * MS_PER_SECOND
+    });
+    logger.debug("Token refresh successful");
+    return { data: void 0 };
+  }
   function redirectToLogin() {
     if (typeof window === "undefined") {
       logger.debug("Cannot redirect in SSR context");
       return false;
     }
+    if (authMode === "token") {
+      return redirectToAuthorize();
+    }
     const currentUrl = window.location.href;
     const loginUrl = `${baseUrl}/login?redirect=${encodeURIComponent(currentUrl)}&service=${encodeURIComponent(config.serviceCode)}`;
     logger.debug("Redirecting to login:", loginUrl);
     window.location.href = loginUrl;
     return true;
   }
+  function redirectToAuthorize() {
+    const verifier = generateCodeVerifier();
+    storeCodeVerifier(verifier);
+    generateCodeChallenge(verifier).then((challenge) => {
+      const state = generateRandomState();
+      const currentUrl = window.location.origin + window.location.pathname;
+      const params = new URLSearchParams({
+        response_type: "code",
+        client_id: clientId,
+        redirect_uri: currentUrl,
+        state,
+        code_challenge: challenge,
+        code_challenge_method: "S256"
+      });
+      const authorizeUrl = `${baseUrl}${OAUTH_AUTHORIZE_ENDPOINT}?${params.toString()}`;
+      logger.debug("Redirecting to authorize:", authorizeUrl);
+      window.location.href = authorizeUrl;
+    }).catch((error) => {
+      logger.error("Failed to generate code challenge:", error);
+    });
+    return true;
+  }
   function getLoginUrl(redirectUrl) {
     const redirect = redirectUrl ?? (typeof window !== "undefined" ? window.location.href : "");
     return `${baseUrl}/login?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(config.serviceCode)}`;
   }
+  function getSignupUrl(redirectUrl) {
+    const redirect = redirectUrl ?? (typeof window !== "undefined" ? window.location.href : "");
+    return `${baseUrl}/signup?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(config.serviceCode)}`;
+  }
   function createError(code, message) {
     return { code, message };
   }
@@ -164,14 +670,28 @@ function createFFIDClient(config) {
     signOut,
     redirectToLogin,
     getLoginUrl,
+    getSignupUrl,
     createError,
+    exchangeCodeForTokens,
+    refreshAccessToken,
+    /** Token store (token mode only) */
+    tokenStore,
+    /** Resolved auth mode */
+    authMode,
     /** Resolved logger instance */
     logger,
     baseUrl,
-    serviceCode: config.serviceCode
+    serviceCode: config.serviceCode,
+    clientId
   };
 }
-var DEFAULT_REFRESH_INTERVAL = 5 * 60 * 1e3;
+function generateRandomState() {
+  const array = new Uint8Array(STATE_RANDOM_BYTES);
+  crypto.getRandomValues(array);
+  return Array.from(array, (byte) => byte.toString(HEX_BASE).padStart(2, "0")).join("");
+}
+var DEFAULT_REFRESH_INTERVAL_MS = 5 * 60 * 1e3;
+var TOKEN_REFRESH_RATIO = 0.8;
 var FFIDContext = react.createContext(null);
 var FFIDClientContext = react.createContext(null);
 function FFIDProvider({
@@ -180,9 +700,11 @@ function FFIDProvider({
   apiBaseUrl,
   debug = false,
   logger,
-  refreshInterval = DEFAULT_REFRESH_INTERVAL,
+  refreshInterval = DEFAULT_REFRESH_INTERVAL_MS,
   onAuthStateChange,
-  onError
+  onError,
+  authMode,
+  clientId
 }) {
   const [user, setUser] = react.useState(null);
   const [organizations, setOrganizations] = react.useState([]);
@@ -203,9 +725,11 @@ function FFIDProvider({
       serviceCode,
       apiBaseUrl,
       debug,
-      logger
+      logger,
+      authMode,
+      clientId
     }),
-    [serviceCode, apiBaseUrl, debug, logger]
+    [serviceCode, apiBaseUrl, debug, logger, authMode, clientId]
   );
   const refresh = react.useCallback(async () => {
     client.logger.debug("Refreshing session...");
@@ -218,7 +742,7 @@ function FFIDProvider({
         setSubscriptions([]);
         setError(response.error);
         onAuthStateChangeRef.current?.(null);
-        if (response.error.code !== "SESSION_NOT_FOUND") {
+        if (response.error.code !== "SESSION_NOT_FOUND" && response.error.code !== "NO_TOKENS") {
           onErrorRef.current?.(response.error);
         }
         return;
@@ -307,15 +831,72 @@ function FFIDProvider({
     [organizations, client]
   );
   react.useEffect(() => {
+    if (client.authMode !== "token") return;
+    if (typeof window === "undefined") return;
+    const urlParams = new URLSearchParams(window.location.search);
+    const code = urlParams.get("code");
+    if (!code) return;
+    client.logger.debug("Authorization code detected, exchanging for tokens");
+    const codeVerifier = retrieveCodeVerifier();
+    client.exchangeCodeForTokens(code, codeVerifier ?? void 0).then((result) => {
+      if (result.error) {
+        client.logger.error("Token exchange failed:", result.error);
+        setError(result.error);
+        onErrorRef.current?.(result.error);
+        setIsLoading(false);
+        return;
+      }
+      const cleanUrl = new URL(window.location.href);
+      cleanUrl.searchParams.delete("code");
+      cleanUrl.searchParams.delete("state");
+      window.history.replaceState({}, "", cleanUrl.toString());
+      client.logger.debug("Token exchange successful, refreshing session");
+      return refresh();
+    }).catch((err) => {
+      client.logger.error("Token exchange error:", err);
+      setIsLoading(false);
+    });
+  }, [client]);
+  react.useEffect(() => {
+    if (client.authMode === "token") {
+      if (typeof window !== "undefined") {
+        const urlParams = new URLSearchParams(window.location.search);
+        if (urlParams.has("code")) {
+          return;
+        }
+      }
+      const tokens = client.tokenStore.getTokens();
+      if (tokens) {
+        refresh();
+      } else {
+        setIsLoading(false);
+      }
+      return;
+    }
     refresh();
-  }, [refresh]);
+  }, [refresh, client]);
   react.useEffect(() => {
-    if (!user || refreshInterval <= 0) return;
+    if (!user) return;
+    let intervalMs = refreshInterval;
+    if (client.authMode === "token") {
+      const tokens = client.tokenStore.getTokens();
+      if (tokens) {
+        const remainingMs = tokens.expiresAt - Date.now();
+        if (remainingMs > 0) {
+          intervalMs = Math.floor(remainingMs * TOKEN_REFRESH_RATIO);
+        }
+      }
+    }
+    if (intervalMs <= 0) return;
     const intervalId = setInterval(() => {
-      refresh();
-    }, refreshInterval);
+      if (client.authMode === "token") {
+        client.refreshAccessToken().then(() => refresh());
+      } else {
+        refresh();
+      }
+    }, intervalMs);
     return () => clearInterval(intervalId);
-  }, [user, refreshInterval, refresh]);
+  }, [user, refreshInterval, refresh, client]);
   const currentOrganization = react.useMemo(
     () => organizations.find((o) => o.id === currentOrganizationId) ?? null,
     [organizations, currentOrganizationId]
@@ -367,6 +948,7 @@ function useFFIDClient() {
 // src/hooks/useFFID.ts
 function useFFID() {
   const context = useFFIDContext();
+  const client = useFFIDClient();
   return {
     user: context.user,
     organizations: context.organizations,
@@ -377,7 +959,9 @@ function useFFID() {
     login: context.login,
     logout: context.logout,
     switchOrganization: context.switchOrganization,
-    refresh: context.refresh
+    refresh: context.refresh,
+    getLoginUrl: client.getLoginUrl,
+    getSignupUrl: client.getSignupUrl
   };
 }
 function FFIDLoginButton({
@@ -1391,6 +1975,11 @@ exports.FFIDSubscriptionBadge = FFIDSubscriptionBadge;
 exports.FFIDUserMenu = FFIDUserMenu;
 exports.FFID_ANNOUNCEMENTS_ERROR_CODES = FFID_ANNOUNCEMENTS_ERROR_CODES;
 exports.createFFIDAnnouncementsClient = createFFIDAnnouncementsClient;
+exports.createTokenStore = createTokenStore;
+exports.generateCodeChallenge = generateCodeChallenge;
+exports.generateCodeVerifier = generateCodeVerifier;
+exports.retrieveCodeVerifier = retrieveCodeVerifier;
+exports.storeCodeVerifier = storeCodeVerifier;
 exports.useFFID = useFFID;
 exports.useFFIDAnnouncements = useFFIDAnnouncements;
 exports.useFFIDContext = useFFIDContext;