@feelflow/ffid-sdk 10.0.0 → 10.1.0

package/dist/{chunk-OXW6QSTO.js → chunk-ITSQIAO5.js}

@@ -1374,7 +1374,7 @@ var FFID_ORGANIZATION_PROFILE_ERROR_CODES = {
 };
 
 // src/client/version-check.ts
-var SDK_VERSION = "10.0.0";
+var SDK_VERSION = "10.1.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -4609,6 +4609,50 @@ function createFFIDClient(config) {
   };
 }
 
+// src/client/authorization-error.ts
+var FFID_OAUTH_DENIAL_REASONS = [
+  /** The user is not a member of the organization */
+  "no_membership",
+  /** The organization has no usable subscription for the service */
+  "no_active_subscription",
+  /** The organization has a subscription, but the user has no seat in it */
+  "no_seat_assignment",
+  /** The subscription has expired (canceled / past due beyond grace) */
+  "subscription_expired",
+  /** The flat plan's member limit is full, so no seat could be given */
+  "member_limit_reached"
+];
+function isFFIDOAuthDenialReason(value) {
+  return typeof value === "string" && FFID_OAUTH_DENIAL_REASONS.includes(value);
+}
+var DEFAULT_AUTHORIZATION_ERROR_MESSAGE = "\u8A8D\u53EF\u30B5\u30FC\u30D0\u30FC\u304C\u30A8\u30E9\u30FC\u3092\u8FD4\u3057\u307E\u3057\u305F";
+function buildAuthorizationError(params) {
+  const oauthError = params.get("error");
+  if (!oauthError) return null;
+  const rawReason = params.get("denial_reason");
+  const errorDescription = params.get("error_description");
+  const details = {
+    source: "authorization",
+    denialReason: isFFIDOAuthDenialReason(rawReason) ? rawReason : null,
+    errorDescription
+  };
+  return {
+    code: oauthError,
+    message: errorDescription ?? DEFAULT_AUTHORIZATION_ERROR_MESSAGE,
+    details: { ...details }
+  };
+}
+function getFFIDAuthorizationError(error) {
+  const details = error?.details;
+  if (!error || !details || details.source !== "authorization") return null;
+  const description = details.errorDescription;
+  return {
+    oauthError: error.code,
+    denialReason: isFFIDOAuthDenialReason(details.denialReason) ? details.denialReason : null,
+    errorDescription: typeof description === "string" ? description : null
+  };
+}
+
 // src/client/callback.ts
 var CALLBACK_ERROR_CODES = {
   /** Stored state missing or did not match the callback `state` (CSRF guard) */
@@ -4633,16 +4677,43 @@ function extractSearchParams(source) {
     return new URLSearchParams(query);
   }
 }
-function cleanCallbackUrlParams(logger) {
+var CODE_CALLBACK_PARAMS = ["code", "state"];
+var ERROR_CALLBACK_CONSUMED_PARAMS = ["state"];
+function cleanCallbackUrlParams(logger, names) {
   try {
     const cleanUrl = new URL(window.location.href);
-    cleanUrl.searchParams.delete("code");
-    cleanUrl.searchParams.delete("state");
+    for (const name of names) cleanUrl.searchParams.delete(name);
     window.history.replaceState({}, "", cleanUrl.toString());
   } catch (error) {
     logger.warn("handleRedirectCallback: URL \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
   }
 }
+function validateCallbackState(client, urlState) {
+  const { logger } = client;
+  const storedState = retrieveState(logger);
+  if (storedState === null && urlState === null) return null;
+  if (storedState !== null && storedState === urlState) return null;
+  if (storedState === null && !isStateStorageAvailable()) {
+    logger.error(
+      "handleRedirectCallback: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u308B storage \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081 CSRF \u691C\u8A3C\u304C\u3067\u304D\u307E\u305B\u3093\uFF08iOS private mode \u7B49\uFF09"
+    );
+    return {
+      error: client.createError(
+        CALLBACK_ERROR_CODES.STATE_UNAVAILABLE,
+        "OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u308B storage \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081\u8A8D\u8A3C\u3092\u5B8C\u4E86\u3067\u304D\u307E\u305B\u3093\u3002\u30D6\u30E9\u30A6\u30B6\u306E\u30D7\u30E9\u30A4\u30D9\u30FC\u30C8\u30E2\u30FC\u30C9\u3084\u30B9\u30C8\u30EC\u30FC\u30B8\u8A2D\u5B9A\u3092\u3054\u78BA\u8A8D\u304F\u3060\u3055\u3044"
+      )
+    };
+  }
+  logger.error(
+    "handleRedirectCallback: OAuth state mismatch or omitted (possible CSRF) \u2014 \u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F\u3002\u6D88\u8CBB\u6E08\u307F callback \u30D1\u30E9\u30E1\u30FC\u30BF\u306E\u518D\u51E6\u7406\uFF08`cleanUrl: false` \u5229\u7528\u6642\u306E cleanup \u6F0F\u308C\u3084 reload \u7B49\uFF09\u3067\u3082\u767A\u751F\u3057\u307E\u3059"
+  );
+  return {
+    error: client.createError(
+      CALLBACK_ERROR_CODES.STATE_MISMATCH,
+      "OAuth state \u304C\u4E00\u81F4\u3057\u307E\u305B\u3093\u3002CSRF \u306E\u53EF\u80FD\u6027\u304C\u3042\u308B\u305F\u3081\u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+    )
+  };
+}
 async function handleRedirectCallback(client, options) {
   const { logger } = client;
   const hasWindow = typeof window !== "undefined";
@@ -4659,6 +4730,24 @@ async function handleRedirectCallback(client, options) {
   const params = extractSearchParams(source);
   const code = params.get("code");
   const urlState = params.get("state");
+  const authorizationError = buildAuthorizationError(params);
+  if (authorizationError && urlState !== null) {
+    const stateError2 = validateCallbackState(client, urlState);
+    if (stateError2) return stateError2;
+    retrieveCodeVerifier(logger);
+    logger.warn("handleRedirectCallback: \u8A8D\u53EF\u30B5\u30FC\u30D0\u30FC\u304C\u30A8\u30E9\u30FC\u3092\u8FD4\u3057\u307E\u3057\u305F:", {
+      error: authorizationError.code,
+      denialReason: params.get("denial_reason")
+    });
+    if (hasWindow) {
+      if (options?.cleanUrl !== false) {
+        cleanCallbackUrlParams(logger, ERROR_CALLBACK_CONSUMED_PARAMS);
+      } else {
+        logger.debug("handleRedirectCallback: cleanUrl=false \u306E\u305F\u3081 URL cleanup \u3092 consumer \u306B\u59D4\u8B72\u3057\u307E\u3057\u305F");
+      }
+    }
+    return { error: authorizationError };
+  }
   if (!code) {
     logger.warn("handleRedirectCallback: \u8A8D\u53EF\u30B3\u30FC\u30C9\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093");
     return {
@@ -4668,37 +4757,13 @@ async function handleRedirectCallback(client, options) {
       )
     };
   }
-  const storedState = retrieveState(logger);
-  if (storedState !== null || urlState !== null) {
-    const stateMatches = storedState !== null && storedState === urlState;
-    if (!stateMatches) {
-      if (storedState === null && !isStateStorageAvailable()) {
-        logger.error(
-          "handleRedirectCallback: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u308B storage \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081 CSRF \u691C\u8A3C\u304C\u3067\u304D\u307E\u305B\u3093\uFF08iOS private mode \u7B49\uFF09"
-        );
-        return {
-          error: client.createError(
-            CALLBACK_ERROR_CODES.STATE_UNAVAILABLE,
-            "OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u308B storage \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081\u8A8D\u8A3C\u3092\u5B8C\u4E86\u3067\u304D\u307E\u305B\u3093\u3002\u30D6\u30E9\u30A6\u30B6\u306E\u30D7\u30E9\u30A4\u30D9\u30FC\u30C8\u30E2\u30FC\u30C9\u3084\u30B9\u30C8\u30EC\u30FC\u30B8\u8A2D\u5B9A\u3092\u3054\u78BA\u8A8D\u304F\u3060\u3055\u3044"
-          )
-        };
-      }
-      logger.error(
-        "handleRedirectCallback: OAuth state mismatch or omitted (possible CSRF) \u2014 \u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F\u3002\u6D88\u8CBB\u6E08\u307F callback \u30D1\u30E9\u30E1\u30FC\u30BF\u306E\u518D\u51E6\u7406\uFF08`cleanUrl: false` \u5229\u7528\u6642\u306E cleanup \u6F0F\u308C\u3084 reload \u7B49\uFF09\u3067\u3082\u767A\u751F\u3057\u307E\u3059"
-      );
-      return {
-        error: client.createError(
-          CALLBACK_ERROR_CODES.STATE_MISMATCH,
-          "OAuth state \u304C\u4E00\u81F4\u3057\u307E\u305B\u3093\u3002CSRF \u306E\u53EF\u80FD\u6027\u304C\u3042\u308B\u305F\u3081\u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
-        )
-      };
-    }
-  }
+  const stateError = validateCallbackState(client, urlState);
+  if (stateError) return stateError;
   const verifier = retrieveCodeVerifier(logger);
   const result = await client.exchangeCodeForTokens(code, verifier ?? void 0);
   if (!result.error && hasWindow) {
     if (options?.cleanUrl !== false) {
-      cleanCallbackUrlParams(logger);
+      cleanCallbackUrlParams(logger, CODE_CALLBACK_PARAMS);
     } else {
       logger.debug("handleRedirectCallback: cleanUrl=false \u306E\u305F\u3081 URL cleanup \u3092 consumer \u306B\u59D4\u8B72\u3057\u307E\u3057\u305F");
     }
@@ -4707,6 +4772,13 @@ async function handleRedirectCallback(client, options) {
 }
 var DEFAULT_REFRESH_INTERVAL_MS = 5 * 60 * 1e3;
 var TOKEN_REFRESH_RATIO = 0.8;
+function resolveCallbackKey(params) {
+  const code = params.get("code");
+  if (code) return code;
+  const error = params.get("error");
+  const state = params.get("state");
+  return error && state ? `error:${error}:${state}` : null;
+}
 var FFIDContext = createContext(null);
 var FFIDClientContext = createContext(null);
 function FFIDProvider({
@@ -4886,19 +4958,26 @@ function FFIDProvider({
     },
     [organizations, client]
   );
-  const handledCodeRef = useRef(null);
+  const handledCallbackRef = useRef(null);
+  const callbackPendingRef = useRef(false);
+  const authorizationDeniedRef = useRef(false);
   useEffect(() => {
     if (client.authMode !== "token") return;
     if (typeof window === "undefined") return;
-    const urlParams = new URLSearchParams(window.location.search);
-    const code = urlParams.get("code");
-    if (!code) return;
-    if (handledCodeRef.current === code) return;
-    handledCodeRef.current = code;
-    client.logger.debug("Authorization code detected, exchanging for tokens");
+    const callbackKey = resolveCallbackKey(new URLSearchParams(window.location.search));
+    if (!callbackKey) return;
+    if (handledCallbackRef.current === callbackKey) return;
+    handledCallbackRef.current = callbackKey;
+    callbackPendingRef.current = true;
+    client.logger.debug("OAuth callback detected, handling it");
     handleRedirectCallback(client, { cleanUrl: cleanCallbackUrl }).then((result) => {
       if (result.error) {
-        client.logger.error("Token exchange failed:", result.error);
+        if (getFFIDAuthorizationError(result.error)) {
+          client.logger.warn("FFID \u304C\u30ED\u30B0\u30A4\u30F3\u3092\u62D2\u5426\u3057\u307E\u3057\u305F:", result.error);
+          authorizationDeniedRef.current = true;
+        } else {
+          client.logger.error("Token exchange failed:", result.error);
+        }
         if (result.error.code === FFID_ERROR_CODES.STATE_MISMATCH_ERROR && client.tokenStore.getTokens()) {
           client.logger.debug(
             "Stale callback rejected but stored tokens present, restoring session via refresh"
@@ -4916,13 +4995,15 @@ function FFIDProvider({
     }).catch((err) => {
       client.logger.error("Token exchange error:", err);
       setIsLoading(false);
+    }).finally(() => {
+      callbackPendingRef.current = false;
     });
   }, [client]);
   useEffect(() => {
     if (client.authMode === "token") {
+      if (callbackPendingRef.current || authorizationDeniedRef.current) return;
       if (typeof window !== "undefined") {
-        const urlParams = new URLSearchParams(window.location.search);
-        if (urlParams.has("code")) {
+        if (resolveCallbackKey(new URLSearchParams(window.location.search))) {
           return;
         }
       }
@@ -6737,4 +6818,4 @@ function FFIDInquiryForm({
   );
 }
 
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, AGENCY_INVITE_COOKIE_MAX_AGE_SEC, AGENCY_INVITE_COOKIE_NAME, AGENCY_INVITE_TOKEN_PARAM, AGENCY_INVITE_TOKEN_REDACTION, BLOCKING_EFFECTIVE_STATUSES, CATALOG_HASH_PATTERN, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDCatalogHashError, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_CATALOG_ENVIRONMENTS, FFID_CATALOG_PUBLICATION_STATUSES, FFID_COMPANY_SIZE_CODES, FFID_CREDITS_CONSUME_MAX_AMOUNT, FFID_CREDITS_CONSUME_MIN_AMOUNT, FFID_CREDITS_ERROR_CODES, FFID_CREDITS_FEATURE_PATTERN, FFID_CREDITS_HISTORY_DEFAULT_LIMIT, FFID_CREDITS_HISTORY_MAX_LIMIT, FFID_CREDITS_HISTORY_MIN_LIMIT, FFID_CREDITS_IDEMPOTENCY_KEY_PATTERN, FFID_CREDITS_LOW_THRESHOLD_PERCENT, FFID_CREDITS_METADATA_MAX_BYTES, FFID_CREDIT_GRANT_KINDS, FFID_CREDIT_HISTORY_TYPES, FFID_CREDIT_PACK_MAX_QUANTITY, FFID_CREDIT_PACK_MIN_QUANTITY, FFID_ERROR_CODES, FFID_INDUSTRY_CODES, FFID_INQUIRY_ACQUISITION_SOURCES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, FFID_ORGANIZATION_PROFILE_ERROR_CODES, FFID_SUBSCRIPTION_ERROR_CODES, canonicalizeCatalogValue, captureAgencyInviteToken, cleanupStateStorage, clearAgencyInviteToken, computeEffectiveStatusFromSession, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, hashCanonicalJson, isBlockedFromUserinfo, isFFIDInquiryAcquisitionSource, isFFIDInquiryCategorySite2026, normalizeRedirectUri, readAgencyInviteCookie, readAgencyInviteToken, redactAgencyInviteToken, retrieveCodeVerifier, retrieveState, sha256Hex, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useFFIDContext, useSubscription, validatePublishedCatalog, withSubscription };
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, AGENCY_INVITE_COOKIE_MAX_AGE_SEC, AGENCY_INVITE_COOKIE_NAME, AGENCY_INVITE_TOKEN_PARAM, AGENCY_INVITE_TOKEN_REDACTION, BLOCKING_EFFECTIVE_STATUSES, CATALOG_HASH_PATTERN, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDCatalogHashError, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_CATALOG_ENVIRONMENTS, FFID_CATALOG_PUBLICATION_STATUSES, FFID_COMPANY_SIZE_CODES, FFID_CREDITS_CONSUME_MAX_AMOUNT, FFID_CREDITS_CONSUME_MIN_AMOUNT, FFID_CREDITS_ERROR_CODES, FFID_CREDITS_FEATURE_PATTERN, FFID_CREDITS_HISTORY_DEFAULT_LIMIT, FFID_CREDITS_HISTORY_MAX_LIMIT, FFID_CREDITS_HISTORY_MIN_LIMIT, FFID_CREDITS_IDEMPOTENCY_KEY_PATTERN, FFID_CREDITS_LOW_THRESHOLD_PERCENT, FFID_CREDITS_METADATA_MAX_BYTES, FFID_CREDIT_GRANT_KINDS, FFID_CREDIT_HISTORY_TYPES, FFID_CREDIT_PACK_MAX_QUANTITY, FFID_CREDIT_PACK_MIN_QUANTITY, FFID_ERROR_CODES, FFID_INDUSTRY_CODES, FFID_INQUIRY_ACQUISITION_SOURCES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, FFID_OAUTH_DENIAL_REASONS, FFID_ORGANIZATION_PROFILE_ERROR_CODES, FFID_SUBSCRIPTION_ERROR_CODES, canonicalizeCatalogValue, captureAgencyInviteToken, cleanupStateStorage, clearAgencyInviteToken, computeEffectiveStatusFromSession, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, getFFIDAuthorizationError, handleRedirectCallback, hasAccessFromUserinfo, hashCanonicalJson, isBlockedFromUserinfo, isFFIDInquiryAcquisitionSource, isFFIDInquiryCategorySite2026, isFFIDOAuthDenialReason, normalizeRedirectUri, readAgencyInviteCookie, readAgencyInviteToken, redactAgencyInviteToken, retrieveCodeVerifier, retrieveState, sha256Hex, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useFFIDContext, useSubscription, validatePublishedCatalog, withSubscription };

package/dist/{chunk-2LU2F3F2.cjs → chunk-VHOIA25Y.cjs}

@@ -1376,7 +1376,7 @@ var FFID_ORGANIZATION_PROFILE_ERROR_CODES = {
 };
 
 // src/client/version-check.ts
-var SDK_VERSION = "10.0.0";
+var SDK_VERSION = "10.1.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -4611,6 +4611,50 @@ function createFFIDClient(config) {
   };
 }
 
+// src/client/authorization-error.ts
+var FFID_OAUTH_DENIAL_REASONS = [
+  /** The user is not a member of the organization */
+  "no_membership",
+  /** The organization has no usable subscription for the service */
+  "no_active_subscription",
+  /** The organization has a subscription, but the user has no seat in it */
+  "no_seat_assignment",
+  /** The subscription has expired (canceled / past due beyond grace) */
+  "subscription_expired",
+  /** The flat plan's member limit is full, so no seat could be given */
+  "member_limit_reached"
+];
+function isFFIDOAuthDenialReason(value) {
+  return typeof value === "string" && FFID_OAUTH_DENIAL_REASONS.includes(value);
+}
+var DEFAULT_AUTHORIZATION_ERROR_MESSAGE = "\u8A8D\u53EF\u30B5\u30FC\u30D0\u30FC\u304C\u30A8\u30E9\u30FC\u3092\u8FD4\u3057\u307E\u3057\u305F";
+function buildAuthorizationError(params) {
+  const oauthError = params.get("error");
+  if (!oauthError) return null;
+  const rawReason = params.get("denial_reason");
+  const errorDescription = params.get("error_description");
+  const details = {
+    source: "authorization",
+    denialReason: isFFIDOAuthDenialReason(rawReason) ? rawReason : null,
+    errorDescription
+  };
+  return {
+    code: oauthError,
+    message: errorDescription ?? DEFAULT_AUTHORIZATION_ERROR_MESSAGE,
+    details: { ...details }
+  };
+}
+function getFFIDAuthorizationError(error) {
+  const details = error?.details;
+  if (!error || !details || details.source !== "authorization") return null;
+  const description = details.errorDescription;
+  return {
+    oauthError: error.code,
+    denialReason: isFFIDOAuthDenialReason(details.denialReason) ? details.denialReason : null,
+    errorDescription: typeof description === "string" ? description : null
+  };
+}
+
 // src/client/callback.ts
 var CALLBACK_ERROR_CODES = {
   /** Stored state missing or did not match the callback `state` (CSRF guard) */
@@ -4635,16 +4679,43 @@ function extractSearchParams(source) {
     return new URLSearchParams(query);
   }
 }
-function cleanCallbackUrlParams(logger) {
+var CODE_CALLBACK_PARAMS = ["code", "state"];
+var ERROR_CALLBACK_CONSUMED_PARAMS = ["state"];
+function cleanCallbackUrlParams(logger, names) {
   try {
     const cleanUrl = new URL(window.location.href);
-    cleanUrl.searchParams.delete("code");
-    cleanUrl.searchParams.delete("state");
+    for (const name of names) cleanUrl.searchParams.delete(name);
     window.history.replaceState({}, "", cleanUrl.toString());
   } catch (error) {
     logger.warn("handleRedirectCallback: URL \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
   }
 }
+function validateCallbackState(client, urlState) {
+  const { logger } = client;
+  const storedState = retrieveState(logger);
+  if (storedState === null && urlState === null) return null;
+  if (storedState !== null && storedState === urlState) return null;
+  if (storedState === null && !isStateStorageAvailable()) {
+    logger.error(
+      "handleRedirectCallback: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u308B storage \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081 CSRF \u691C\u8A3C\u304C\u3067\u304D\u307E\u305B\u3093\uFF08iOS private mode \u7B49\uFF09"
+    );
+    return {
+      error: client.createError(
+        CALLBACK_ERROR_CODES.STATE_UNAVAILABLE,
+        "OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u308B storage \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081\u8A8D\u8A3C\u3092\u5B8C\u4E86\u3067\u304D\u307E\u305B\u3093\u3002\u30D6\u30E9\u30A6\u30B6\u306E\u30D7\u30E9\u30A4\u30D9\u30FC\u30C8\u30E2\u30FC\u30C9\u3084\u30B9\u30C8\u30EC\u30FC\u30B8\u8A2D\u5B9A\u3092\u3054\u78BA\u8A8D\u304F\u3060\u3055\u3044"
+      )
+    };
+  }
+  logger.error(
+    "handleRedirectCallback: OAuth state mismatch or omitted (possible CSRF) \u2014 \u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F\u3002\u6D88\u8CBB\u6E08\u307F callback \u30D1\u30E9\u30E1\u30FC\u30BF\u306E\u518D\u51E6\u7406\uFF08`cleanUrl: false` \u5229\u7528\u6642\u306E cleanup \u6F0F\u308C\u3084 reload \u7B49\uFF09\u3067\u3082\u767A\u751F\u3057\u307E\u3059"
+  );
+  return {
+    error: client.createError(
+      CALLBACK_ERROR_CODES.STATE_MISMATCH,
+      "OAuth state \u304C\u4E00\u81F4\u3057\u307E\u305B\u3093\u3002CSRF \u306E\u53EF\u80FD\u6027\u304C\u3042\u308B\u305F\u3081\u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+    )
+  };
+}
 async function handleRedirectCallback(client, options) {
   const { logger } = client;
   const hasWindow = typeof window !== "undefined";
@@ -4661,6 +4732,24 @@ async function handleRedirectCallback(client, options) {
   const params = extractSearchParams(source);
   const code = params.get("code");
   const urlState = params.get("state");
+  const authorizationError = buildAuthorizationError(params);
+  if (authorizationError && urlState !== null) {
+    const stateError2 = validateCallbackState(client, urlState);
+    if (stateError2) return stateError2;
+    retrieveCodeVerifier(logger);
+    logger.warn("handleRedirectCallback: \u8A8D\u53EF\u30B5\u30FC\u30D0\u30FC\u304C\u30A8\u30E9\u30FC\u3092\u8FD4\u3057\u307E\u3057\u305F:", {
+      error: authorizationError.code,
+      denialReason: params.get("denial_reason")
+    });
+    if (hasWindow) {
+      if (options?.cleanUrl !== false) {
+        cleanCallbackUrlParams(logger, ERROR_CALLBACK_CONSUMED_PARAMS);
+      } else {
+        logger.debug("handleRedirectCallback: cleanUrl=false \u306E\u305F\u3081 URL cleanup \u3092 consumer \u306B\u59D4\u8B72\u3057\u307E\u3057\u305F");
+      }
+    }
+    return { error: authorizationError };
+  }
   if (!code) {
     logger.warn("handleRedirectCallback: \u8A8D\u53EF\u30B3\u30FC\u30C9\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093");
     return {
@@ -4670,37 +4759,13 @@ async function handleRedirectCallback(client, options) {
       )
     };
   }
-  const storedState = retrieveState(logger);
-  if (storedState !== null || urlState !== null) {
-    const stateMatches = storedState !== null && storedState === urlState;
-    if (!stateMatches) {
-      if (storedState === null && !isStateStorageAvailable()) {
-        logger.error(
-          "handleRedirectCallback: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u308B storage \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081 CSRF \u691C\u8A3C\u304C\u3067\u304D\u307E\u305B\u3093\uFF08iOS private mode \u7B49\uFF09"
-        );
-        return {
-          error: client.createError(
-            CALLBACK_ERROR_CODES.STATE_UNAVAILABLE,
-            "OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u308B storage \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081\u8A8D\u8A3C\u3092\u5B8C\u4E86\u3067\u304D\u307E\u305B\u3093\u3002\u30D6\u30E9\u30A6\u30B6\u306E\u30D7\u30E9\u30A4\u30D9\u30FC\u30C8\u30E2\u30FC\u30C9\u3084\u30B9\u30C8\u30EC\u30FC\u30B8\u8A2D\u5B9A\u3092\u3054\u78BA\u8A8D\u304F\u3060\u3055\u3044"
-          )
-        };
-      }
-      logger.error(
-        "handleRedirectCallback: OAuth state mismatch or omitted (possible CSRF) \u2014 \u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F\u3002\u6D88\u8CBB\u6E08\u307F callback \u30D1\u30E9\u30E1\u30FC\u30BF\u306E\u518D\u51E6\u7406\uFF08`cleanUrl: false` \u5229\u7528\u6642\u306E cleanup \u6F0F\u308C\u3084 reload \u7B49\uFF09\u3067\u3082\u767A\u751F\u3057\u307E\u3059"
-      );
-      return {
-        error: client.createError(
-          CALLBACK_ERROR_CODES.STATE_MISMATCH,
-          "OAuth state \u304C\u4E00\u81F4\u3057\u307E\u305B\u3093\u3002CSRF \u306E\u53EF\u80FD\u6027\u304C\u3042\u308B\u305F\u3081\u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
-        )
-      };
-    }
-  }
+  const stateError = validateCallbackState(client, urlState);
+  if (stateError) return stateError;
   const verifier = retrieveCodeVerifier(logger);
   const result = await client.exchangeCodeForTokens(code, verifier ?? void 0);
   if (!result.error && hasWindow) {
     if (options?.cleanUrl !== false) {
-      cleanCallbackUrlParams(logger);
+      cleanCallbackUrlParams(logger, CODE_CALLBACK_PARAMS);
     } else {
       logger.debug("handleRedirectCallback: cleanUrl=false \u306E\u305F\u3081 URL cleanup \u3092 consumer \u306B\u59D4\u8B72\u3057\u307E\u3057\u305F");
     }
@@ -4709,6 +4774,13 @@ async function handleRedirectCallback(client, options) {
 }
 var DEFAULT_REFRESH_INTERVAL_MS = 5 * 60 * 1e3;
 var TOKEN_REFRESH_RATIO = 0.8;
+function resolveCallbackKey(params) {
+  const code = params.get("code");
+  if (code) return code;
+  const error = params.get("error");
+  const state = params.get("state");
+  return error && state ? `error:${error}:${state}` : null;
+}
 var FFIDContext = react.createContext(null);
 var FFIDClientContext = react.createContext(null);
 function FFIDProvider({
@@ -4888,19 +4960,26 @@ function FFIDProvider({
     },
     [organizations, client]
   );
-  const handledCodeRef = react.useRef(null);
+  const handledCallbackRef = react.useRef(null);
+  const callbackPendingRef = react.useRef(false);
+  const authorizationDeniedRef = react.useRef(false);
   react.useEffect(() => {
     if (client.authMode !== "token") return;
     if (typeof window === "undefined") return;
-    const urlParams = new URLSearchParams(window.location.search);
-    const code = urlParams.get("code");
-    if (!code) return;
-    if (handledCodeRef.current === code) return;
-    handledCodeRef.current = code;
-    client.logger.debug("Authorization code detected, exchanging for tokens");
+    const callbackKey = resolveCallbackKey(new URLSearchParams(window.location.search));
+    if (!callbackKey) return;
+    if (handledCallbackRef.current === callbackKey) return;
+    handledCallbackRef.current = callbackKey;
+    callbackPendingRef.current = true;
+    client.logger.debug("OAuth callback detected, handling it");
     handleRedirectCallback(client, { cleanUrl: cleanCallbackUrl }).then((result) => {
       if (result.error) {
-        client.logger.error("Token exchange failed:", result.error);
+        if (getFFIDAuthorizationError(result.error)) {
+          client.logger.warn("FFID \u304C\u30ED\u30B0\u30A4\u30F3\u3092\u62D2\u5426\u3057\u307E\u3057\u305F:", result.error);
+          authorizationDeniedRef.current = true;
+        } else {
+          client.logger.error("Token exchange failed:", result.error);
+        }
         if (result.error.code === FFID_ERROR_CODES.STATE_MISMATCH_ERROR && client.tokenStore.getTokens()) {
           client.logger.debug(
             "Stale callback rejected but stored tokens present, restoring session via refresh"
@@ -4918,13 +4997,15 @@ function FFIDProvider({
     }).catch((err) => {
       client.logger.error("Token exchange error:", err);
       setIsLoading(false);
+    }).finally(() => {
+      callbackPendingRef.current = false;
     });
   }, [client]);
   react.useEffect(() => {
     if (client.authMode === "token") {
+      if (callbackPendingRef.current || authorizationDeniedRef.current) return;
       if (typeof window !== "undefined") {
-        const urlParams = new URLSearchParams(window.location.search);
-        if (urlParams.has("code")) {
+        if (resolveCallbackKey(new URLSearchParams(window.location.search))) {
           return;
         }
       }
@@ -6785,6 +6866,7 @@ exports.FFID_INQUIRY_CATEGORIES = FFID_INQUIRY_CATEGORIES;
 exports.FFID_INQUIRY_CATEGORIES_SITE_2026 = FFID_INQUIRY_CATEGORIES_SITE_2026;
 exports.FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES = FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES;
 exports.FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB = FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB;
+exports.FFID_OAUTH_DENIAL_REASONS = FFID_OAUTH_DENIAL_REASONS;
 exports.FFID_ORGANIZATION_PROFILE_ERROR_CODES = FFID_ORGANIZATION_PROFILE_ERROR_CODES;
 exports.FFID_SUBSCRIPTION_ERROR_CODES = FFID_SUBSCRIPTION_ERROR_CODES;
 exports.canonicalizeCatalogValue = canonicalizeCatalogValue;
@@ -6803,12 +6885,14 @@ exports.createFFIDClient = createFFIDClient;
 exports.createTokenStore = createTokenStore;
 exports.generateCodeChallenge = generateCodeChallenge;
 exports.generateCodeVerifier = generateCodeVerifier;
+exports.getFFIDAuthorizationError = getFFIDAuthorizationError;
 exports.handleRedirectCallback = handleRedirectCallback;
 exports.hasAccessFromUserinfo = hasAccessFromUserinfo;
 exports.hashCanonicalJson = hashCanonicalJson;
 exports.isBlockedFromUserinfo = isBlockedFromUserinfo;
 exports.isFFIDInquiryAcquisitionSource = isFFIDInquiryAcquisitionSource;
 exports.isFFIDInquiryCategorySite2026 = isFFIDInquiryCategorySite2026;
+exports.isFFIDOAuthDenialReason = isFFIDOAuthDenialReason;
 exports.normalizeRedirectUri = normalizeRedirectUri;
 exports.readAgencyInviteCookie = readAgencyInviteCookie;
 exports.readAgencyInviteToken = readAgencyInviteToken;

package/dist/components/index.cjs

@@ -1,34 +1,34 @@
 'use strict';
 
-var chunk2LU2F3F2_cjs = require('../chunk-2LU2F3F2.cjs');
+var chunkVHOIA25Y_cjs = require('../chunk-VHOIA25Y.cjs');
 
 
 
 Object.defineProperty(exports, "FFIDAnnouncementBadge", {
   enumerable: true,
-  get: function () { return chunk2LU2F3F2_cjs.FFIDAnnouncementBadge; }
+  get: function () { return chunkVHOIA25Y_cjs.FFIDAnnouncementBadge; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementList", {
   enumerable: true,
-  get: function () { return chunk2LU2F3F2_cjs.FFIDAnnouncementList; }
+  get: function () { return chunkVHOIA25Y_cjs.FFIDAnnouncementList; }
 });
 Object.defineProperty(exports, "FFIDInquiryForm", {
   enumerable: true,
-  get: function () { return chunk2LU2F3F2_cjs.FFIDInquiryForm; }
+  get: function () { return chunkVHOIA25Y_cjs.FFIDInquiryForm; }
 });
 Object.defineProperty(exports, "FFIDLoginButton", {
   enumerable: true,
-  get: function () { return chunk2LU2F3F2_cjs.FFIDLoginButton; }
+  get: function () { return chunkVHOIA25Y_cjs.FFIDLoginButton; }
 });
 Object.defineProperty(exports, "FFIDOrganizationSwitcher", {
   enumerable: true,
-  get: function () { return chunk2LU2F3F2_cjs.FFIDOrganizationSwitcher; }
+  get: function () { return chunkVHOIA25Y_cjs.FFIDOrganizationSwitcher; }
 });
 Object.defineProperty(exports, "FFIDSubscriptionBadge", {
   enumerable: true,
-  get: function () { return chunk2LU2F3F2_cjs.FFIDSubscriptionBadge; }
+  get: function () { return chunkVHOIA25Y_cjs.FFIDSubscriptionBadge; }
 });
 Object.defineProperty(exports, "FFIDUserMenu", {
   enumerable: true,
-  get: function () { return chunk2LU2F3F2_cjs.FFIDUserMenu; }
+  get: function () { return chunkVHOIA25Y_cjs.FFIDUserMenu; }
 });

package/dist/components/index.d.cts

@@ -1,3 +1,3 @@
-export { a8 as FFIDAnnouncementBadge, bk as FFIDAnnouncementBadgeClassNames, bl as FFIDAnnouncementBadgeProps, a9 as FFIDAnnouncementList, bm as FFIDAnnouncementListClassNames, bn as FFIDAnnouncementListProps, ar as FFIDInquiryForm, as as FFIDInquiryFormCategoryItem, at as FFIDInquiryFormClassNames, au as FFIDInquiryFormLegalLayout, av as FFIDInquiryFormOrganization, aw as FFIDInquiryFormPlaceholderContext, ax as FFIDInquiryFormPrefill, ay as FFIDInquiryFormProps, az as FFIDInquiryFormSubmitData, aA as FFIDInquiryFormSubmitResult, aC as FFIDLoginButton, bo as FFIDLoginButtonProps, aE as FFIDOrganizationSwitcher, bp as FFIDOrganizationSwitcherClassNames, bq as FFIDOrganizationSwitcherProps, aS as FFIDSubscriptionBadge, br as FFIDSubscriptionBadgeClassNames, bs as FFIDSubscriptionBadgeProps, aW as FFIDUserMenu, bt as FFIDUserMenuClassNames, bu as FFIDUserMenuProps } from '../index-KjewcNn1.cjs';
+export { a8 as FFIDAnnouncementBadge, bk as FFIDAnnouncementBadgeClassNames, bl as FFIDAnnouncementBadgeProps, a9 as FFIDAnnouncementList, bm as FFIDAnnouncementListClassNames, bn as FFIDAnnouncementListProps, ar as FFIDInquiryForm, as as FFIDInquiryFormCategoryItem, at as FFIDInquiryFormClassNames, au as FFIDInquiryFormLegalLayout, av as FFIDInquiryFormOrganization, aw as FFIDInquiryFormPlaceholderContext, ax as FFIDInquiryFormPrefill, ay as FFIDInquiryFormProps, az as FFIDInquiryFormSubmitData, aA as FFIDInquiryFormSubmitResult, aC as FFIDLoginButton, bo as FFIDLoginButtonProps, aE as FFIDOrganizationSwitcher, bp as FFIDOrganizationSwitcherClassNames, bq as FFIDOrganizationSwitcherProps, aS as FFIDSubscriptionBadge, br as FFIDSubscriptionBadgeClassNames, bs as FFIDSubscriptionBadgeProps, aW as FFIDUserMenu, bt as FFIDUserMenuClassNames, bu as FFIDUserMenuProps } from '../index-CWGoIgYL.cjs';
 import 'react/jsx-runtime';
 import 'react';

package/dist/components/index.d.ts

@@ -1,3 +1,3 @@
-export { a8 as FFIDAnnouncementBadge, bk as FFIDAnnouncementBadgeClassNames, bl as FFIDAnnouncementBadgeProps, a9 as FFIDAnnouncementList, bm as FFIDAnnouncementListClassNames, bn as FFIDAnnouncementListProps, ar as FFIDInquiryForm, as as FFIDInquiryFormCategoryItem, at as FFIDInquiryFormClassNames, au as FFIDInquiryFormLegalLayout, av as FFIDInquiryFormOrganization, aw as FFIDInquiryFormPlaceholderContext, ax as FFIDInquiryFormPrefill, ay as FFIDInquiryFormProps, az as FFIDInquiryFormSubmitData, aA as FFIDInquiryFormSubmitResult, aC as FFIDLoginButton, bo as FFIDLoginButtonProps, aE as FFIDOrganizationSwitcher, bp as FFIDOrganizationSwitcherClassNames, bq as FFIDOrganizationSwitcherProps, aS as FFIDSubscriptionBadge, br as FFIDSubscriptionBadgeClassNames, bs as FFIDSubscriptionBadgeProps, aW as FFIDUserMenu, bt as FFIDUserMenuClassNames, bu as FFIDUserMenuProps } from '../index-KjewcNn1.js';
+export { a8 as FFIDAnnouncementBadge, bk as FFIDAnnouncementBadgeClassNames, bl as FFIDAnnouncementBadgeProps, a9 as FFIDAnnouncementList, bm as FFIDAnnouncementListClassNames, bn as FFIDAnnouncementListProps, ar as FFIDInquiryForm, as as FFIDInquiryFormCategoryItem, at as FFIDInquiryFormClassNames, au as FFIDInquiryFormLegalLayout, av as FFIDInquiryFormOrganization, aw as FFIDInquiryFormPlaceholderContext, ax as FFIDInquiryFormPrefill, ay as FFIDInquiryFormProps, az as FFIDInquiryFormSubmitData, aA as FFIDInquiryFormSubmitResult, aC as FFIDLoginButton, bo as FFIDLoginButtonProps, aE as FFIDOrganizationSwitcher, bp as FFIDOrganizationSwitcherClassNames, bq as FFIDOrganizationSwitcherProps, aS as FFIDSubscriptionBadge, br as FFIDSubscriptionBadgeClassNames, bs as FFIDSubscriptionBadgeProps, aW as FFIDUserMenu, bt as FFIDUserMenuClassNames, bu as FFIDUserMenuProps } from '../index-CWGoIgYL.js';
 import 'react/jsx-runtime';
 import 'react';

package/dist/components/index.js

@@ -1 +1 @@
-export { FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDSubscriptionBadge, FFIDUserMenu } from '../chunk-OXW6QSTO.js';
+export { FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDSubscriptionBadge, FFIDUserMenu } from '../chunk-ITSQIAO5.js';

package/dist/{ffid-client-5uxXRgIO.d.ts → ffid-client-DUbQLYTN.d.ts}

@@ -1014,7 +1014,8 @@ type FFIDServiceAccessFailPolicy = 'failClosed';
  *
  * `member_limit_reached` (10.0.0) is FFID's denial reason when a flat plan's member
  * limit is full and the user has no seat. It reaches you through OAuth
- * (`denial_reason` on authorize / userinfo / introspect); `checkServiceAccess()`
+ * (`denial_reason` on the authorize redirect / userinfo 403; see
+ * `FFIDOAuthDenialReason` for that vocabulary); `checkServiceAccess()`
  * derives its decision from `effectiveStatus` and never returns it, because a full
  * member limit does not change `hasAccess` (CREDITS_API §1-5). It is in this union so
  * one exhaustive `switch` over denial reasons covers both paths.
@@ -2886,4 +2887,4 @@ declare function createFFIDClient(config: FFIDConfig): {
 /** Type of the FFID client */
 type FFIDClient = ReturnType<typeof createFFIDClient>;
 
-export { type FFIDProvisionedOrganization as $, type FFIDOrganization as A, type FFIDOrganizationLogoUploadResponse as B, type FFIDOrganizationMember as C, type FFIDOrganizationProfile as D, type FFIDOrganizationProfileErrorCode as E, type FFIDLogger as F, type FFIDOrganizationProfileResponse as G, type FFIDOtpSendResponse as H, type FFIDOtpVerifyResponse as I, type FFIDPasswordResetConfirmResponse as J, type FFIDPasswordResetResponse as K, type FFIDPasswordResetVerifyResponse as L, type FFIDProfileCallOptions as M, type FFIDProvisionMemberPlan as N, type FFIDProvisionMemberPlanStatus as O, type FFIDProvisionMemberResult as P, type FFIDProvisionMemberStatus as Q, type FFIDProvisionOrganizationDryRun as R, type FFIDProvisionOrganizationMemberInput as S, type FFIDProvisionOrganizationOutcome as T, type FFIDProvisionOrganizationParams as U, type FFIDProvisionOrganizationResponse as V, type FFIDProvisionUserDryRun as W, type FFIDProvisionUserOutcome as X, type FFIDProvisionUserParams as Y, type FFIDProvisionUserProfileInput as Z, type FFIDProvisionUserResponse as _, type FFIDError as a, type FFIDProvisionedUser as a0, type FFIDPublishedPlan as a1, type FFIDRemoveMemberResponse as a2, type FFIDResetSessionResponse as a3, type FFIDSubscription as a4, type FFIDUpdateMemberRoleResponse as a5, type FFIDUpdateUserProfileRequest as a6, type FFIDUploadOrganizationLogoParams as a7, type FFIDUpsertOrganizationProfileParams as a8, type FFIDUpsertOrganizationProfileRequest as a9, type FFIDUser as aa, type FFIDUserProfile as ab, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES as ac, FFID_CATALOG_ENVIRONMENTS as ad, FFID_CATALOG_PUBLICATION_STATUSES as ae, FFID_COMPANY_SIZE_CODES as af, FFID_INDUSTRY_CODES as ag, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES as ah, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB as ai, FFID_ORGANIZATION_PROFILE_ERROR_CODES as aj, type TokenData as ak, type TokenStore as al, createFFIDClient as am, createTokenStore as an, type FFIDCacheAdapter as b, type FFIDVerifyAccessTokenOptions as c, type FFIDApiResponse as d, type FFIDOAuthUserInfo as e, type FFIDCatalogEnvironment as f, type FFIDBillingInterval as g, type FFIDTaxBehavior as h, type FFIDPublishedCatalog as i, type FFIDAddMemberParams as j, type FFIDAddMemberRequest as k, type FFIDAddMemberResponse as l, type FFIDAllowedLogoMimeType as m, type FFIDAssignableMemberRole as n, type FFIDCacheConfig as o, type FFIDCatalogPublication as p, type FFIDCatalogPublicationStatus as q, type FFIDClient as r, type FFIDCompanySizeCode as s, type FFIDConfig as t, type FFIDIndustryCode as u, type FFIDListMembersResponse as v, type FFIDListingConsentInput as w, type FFIDLogoWallEntry as x, type FFIDLogoWallResponse as y, type FFIDMemberRole as z };
+export { type FFIDProvisionedOrganization as $, type FFIDOrganization as A, type FFIDOrganizationLogoUploadResponse as B, type FFIDOrganizationMember as C, type FFIDOrganizationProfile as D, type FFIDOrganizationProfileErrorCode as E, type FFIDError as F, type FFIDOrganizationProfileResponse as G, type FFIDOtpSendResponse as H, type FFIDOtpVerifyResponse as I, type FFIDPasswordResetConfirmResponse as J, type FFIDPasswordResetResponse as K, type FFIDPasswordResetVerifyResponse as L, type FFIDProfileCallOptions as M, type FFIDProvisionMemberPlan as N, type FFIDProvisionMemberPlanStatus as O, type FFIDProvisionMemberResult as P, type FFIDProvisionMemberStatus as Q, type FFIDProvisionOrganizationDryRun as R, type FFIDProvisionOrganizationMemberInput as S, type FFIDProvisionOrganizationOutcome as T, type FFIDProvisionOrganizationParams as U, type FFIDProvisionOrganizationResponse as V, type FFIDProvisionUserDryRun as W, type FFIDProvisionUserOutcome as X, type FFIDProvisionUserParams as Y, type FFIDProvisionUserProfileInput as Z, type FFIDProvisionUserResponse as _, type FFIDLogger as a, type FFIDProvisionedUser as a0, type FFIDPublishedPlan as a1, type FFIDRemoveMemberResponse as a2, type FFIDResetSessionResponse as a3, type FFIDSubscription as a4, type FFIDUpdateMemberRoleResponse as a5, type FFIDUpdateUserProfileRequest as a6, type FFIDUploadOrganizationLogoParams as a7, type FFIDUpsertOrganizationProfileParams as a8, type FFIDUpsertOrganizationProfileRequest as a9, type FFIDUser as aa, type FFIDUserProfile as ab, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES as ac, FFID_CATALOG_ENVIRONMENTS as ad, FFID_CATALOG_PUBLICATION_STATUSES as ae, FFID_COMPANY_SIZE_CODES as af, FFID_INDUSTRY_CODES as ag, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES as ah, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB as ai, FFID_ORGANIZATION_PROFILE_ERROR_CODES as aj, type TokenData as ak, type TokenStore as al, createFFIDClient as am, createTokenStore as an, type FFIDCacheAdapter as b, type FFIDVerifyAccessTokenOptions as c, type FFIDApiResponse as d, type FFIDOAuthUserInfo as e, type FFIDCatalogEnvironment as f, type FFIDBillingInterval as g, type FFIDTaxBehavior as h, type FFIDPublishedCatalog as i, type FFIDAddMemberParams as j, type FFIDAddMemberRequest as k, type FFIDAddMemberResponse as l, type FFIDAllowedLogoMimeType as m, type FFIDAssignableMemberRole as n, type FFIDCacheConfig as o, type FFIDCatalogPublication as p, type FFIDCatalogPublicationStatus as q, type FFIDClient as r, type FFIDCompanySizeCode as s, type FFIDConfig as t, type FFIDIndustryCode as u, type FFIDListMembersResponse as v, type FFIDListingConsentInput as w, type FFIDLogoWallEntry as x, type FFIDLogoWallResponse as y, type FFIDMemberRole as z };

package/dist/{ffid-client-CumygXXz.d.cts → ffid-client-qcfCWLfs.d.cts}

@@ -1014,7 +1014,8 @@ type FFIDServiceAccessFailPolicy = 'failClosed';
  *
  * `member_limit_reached` (10.0.0) is FFID's denial reason when a flat plan's member
  * limit is full and the user has no seat. It reaches you through OAuth
- * (`denial_reason` on authorize / userinfo / introspect); `checkServiceAccess()`
+ * (`denial_reason` on the authorize redirect / userinfo 403; see
+ * `FFIDOAuthDenialReason` for that vocabulary); `checkServiceAccess()`
  * derives its decision from `effectiveStatus` and never returns it, because a full
  * member limit does not change `hasAccess` (CREDITS_API §1-5). It is in this union so
  * one exhaustive `switch` over denial reasons covers both paths.
@@ -2886,4 +2887,4 @@ declare function createFFIDClient(config: FFIDConfig): {
 /** Type of the FFID client */
 type FFIDClient = ReturnType<typeof createFFIDClient>;
 
-export { type FFIDProvisionedOrganization as $, type FFIDOrganization as A, type FFIDOrganizationLogoUploadResponse as B, type FFIDOrganizationMember as C, type FFIDOrganizationProfile as D, type FFIDOrganizationProfileErrorCode as E, type FFIDLogger as F, type FFIDOrganizationProfileResponse as G, type FFIDOtpSendResponse as H, type FFIDOtpVerifyResponse as I, type FFIDPasswordResetConfirmResponse as J, type FFIDPasswordResetResponse as K, type FFIDPasswordResetVerifyResponse as L, type FFIDProfileCallOptions as M, type FFIDProvisionMemberPlan as N, type FFIDProvisionMemberPlanStatus as O, type FFIDProvisionMemberResult as P, type FFIDProvisionMemberStatus as Q, type FFIDProvisionOrganizationDryRun as R, type FFIDProvisionOrganizationMemberInput as S, type FFIDProvisionOrganizationOutcome as T, type FFIDProvisionOrganizationParams as U, type FFIDProvisionOrganizationResponse as V, type FFIDProvisionUserDryRun as W, type FFIDProvisionUserOutcome as X, type FFIDProvisionUserParams as Y, type FFIDProvisionUserProfileInput as Z, type FFIDProvisionUserResponse as _, type FFIDError as a, type FFIDProvisionedUser as a0, type FFIDPublishedPlan as a1, type FFIDRemoveMemberResponse as a2, type FFIDResetSessionResponse as a3, type FFIDSubscription as a4, type FFIDUpdateMemberRoleResponse as a5, type FFIDUpdateUserProfileRequest as a6, type FFIDUploadOrganizationLogoParams as a7, type FFIDUpsertOrganizationProfileParams as a8, type FFIDUpsertOrganizationProfileRequest as a9, type FFIDUser as aa, type FFIDUserProfile as ab, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES as ac, FFID_CATALOG_ENVIRONMENTS as ad, FFID_CATALOG_PUBLICATION_STATUSES as ae, FFID_COMPANY_SIZE_CODES as af, FFID_INDUSTRY_CODES as ag, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES as ah, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB as ai, FFID_ORGANIZATION_PROFILE_ERROR_CODES as aj, type TokenData as ak, type TokenStore as al, createFFIDClient as am, createTokenStore as an, type FFIDCacheAdapter as b, type FFIDVerifyAccessTokenOptions as c, type FFIDApiResponse as d, type FFIDOAuthUserInfo as e, type FFIDCatalogEnvironment as f, type FFIDBillingInterval as g, type FFIDTaxBehavior as h, type FFIDPublishedCatalog as i, type FFIDAddMemberParams as j, type FFIDAddMemberRequest as k, type FFIDAddMemberResponse as l, type FFIDAllowedLogoMimeType as m, type FFIDAssignableMemberRole as n, type FFIDCacheConfig as o, type FFIDCatalogPublication as p, type FFIDCatalogPublicationStatus as q, type FFIDClient as r, type FFIDCompanySizeCode as s, type FFIDConfig as t, type FFIDIndustryCode as u, type FFIDListMembersResponse as v, type FFIDListingConsentInput as w, type FFIDLogoWallEntry as x, type FFIDLogoWallResponse as y, type FFIDMemberRole as z };
+export { type FFIDProvisionedOrganization as $, type FFIDOrganization as A, type FFIDOrganizationLogoUploadResponse as B, type FFIDOrganizationMember as C, type FFIDOrganizationProfile as D, type FFIDOrganizationProfileErrorCode as E, type FFIDError as F, type FFIDOrganizationProfileResponse as G, type FFIDOtpSendResponse as H, type FFIDOtpVerifyResponse as I, type FFIDPasswordResetConfirmResponse as J, type FFIDPasswordResetResponse as K, type FFIDPasswordResetVerifyResponse as L, type FFIDProfileCallOptions as M, type FFIDProvisionMemberPlan as N, type FFIDProvisionMemberPlanStatus as O, type FFIDProvisionMemberResult as P, type FFIDProvisionMemberStatus as Q, type FFIDProvisionOrganizationDryRun as R, type FFIDProvisionOrganizationMemberInput as S, type FFIDProvisionOrganizationOutcome as T, type FFIDProvisionOrganizationParams as U, type FFIDProvisionOrganizationResponse as V, type FFIDProvisionUserDryRun as W, type FFIDProvisionUserOutcome as X, type FFIDProvisionUserParams as Y, type FFIDProvisionUserProfileInput as Z, type FFIDProvisionUserResponse as _, type FFIDLogger as a, type FFIDProvisionedUser as a0, type FFIDPublishedPlan as a1, type FFIDRemoveMemberResponse as a2, type FFIDResetSessionResponse as a3, type FFIDSubscription as a4, type FFIDUpdateMemberRoleResponse as a5, type FFIDUpdateUserProfileRequest as a6, type FFIDUploadOrganizationLogoParams as a7, type FFIDUpsertOrganizationProfileParams as a8, type FFIDUpsertOrganizationProfileRequest as a9, type FFIDUser as aa, type FFIDUserProfile as ab, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES as ac, FFID_CATALOG_ENVIRONMENTS as ad, FFID_CATALOG_PUBLICATION_STATUSES as ae, FFID_COMPANY_SIZE_CODES as af, FFID_INDUSTRY_CODES as ag, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES as ah, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB as ai, FFID_ORGANIZATION_PROFILE_ERROR_CODES as aj, type TokenData as ak, type TokenStore as al, createFFIDClient as am, createTokenStore as an, type FFIDCacheAdapter as b, type FFIDVerifyAccessTokenOptions as c, type FFIDApiResponse as d, type FFIDOAuthUserInfo as e, type FFIDCatalogEnvironment as f, type FFIDBillingInterval as g, type FFIDTaxBehavior as h, type FFIDPublishedCatalog as i, type FFIDAddMemberParams as j, type FFIDAddMemberRequest as k, type FFIDAddMemberResponse as l, type FFIDAllowedLogoMimeType as m, type FFIDAssignableMemberRole as n, type FFIDCacheConfig as o, type FFIDCatalogPublication as p, type FFIDCatalogPublicationStatus as q, type FFIDClient as r, type FFIDCompanySizeCode as s, type FFIDConfig as t, type FFIDIndustryCode as u, type FFIDListMembersResponse as v, type FFIDListingConsentInput as w, type FFIDLogoWallEntry as x, type FFIDLogoWallResponse as y, type FFIDMemberRole as z };

package/dist/{index-KjewcNn1.d.cts → index-CWGoIgYL.d.cts}

@@ -962,7 +962,8 @@ type FFIDServiceAccessFailPolicy = 'failClosed';
  *
  * `member_limit_reached` (10.0.0) is FFID's denial reason when a flat plan's member
  * limit is full and the user has no seat. It reaches you through OAuth
- * (`denial_reason` on authorize / userinfo / introspect); `checkServiceAccess()`
+ * (`denial_reason` on the authorize redirect / userinfo 403; see
+ * `FFIDOAuthDenialReason` for that vocabulary); `checkServiceAccess()`
  * derives its decision from `effectiveStatus` and never returns it, because a full
  * member limit does not change `hasAccess` (CREDITS_API §1-5). It is in this union so
  * one exhaustive `switch` over denial reasons covers both paths.