@feelflow/ffid-sdk 10.0.0 → 10.1.0

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { F as FFIDOAuthUserInfoSubscription, a as FFIDAccountType, b as FFIDPrompt, c as FFIDConfig, d as FFIDApiResponse, e as FFIDSessionResponse, f as FFIDSignOutResult, g as FFIDError, h as FFIDSubscriptionCheckResponse, i as FFIDCheckServiceAccessParams, j as FFIDServiceAccessDecision, k as FFIDAnalyticsConfig, l as FFIDSeatsSummary, m as FFIDListPlansResponse, n as FFIDPublishedCatalog, o as FFIDSubscriptionDetail, p as FFIDSubscribeParams, q as FFIDSubscribeResponse, r as FFIDChangePlanParams, s as FFIDChangePlanResponse, t as FFIDCancelSubscriptionParams, u as FFIDCancelSubscriptionResponse, v as FFIDCancelPendingDowngradeResponse, w as FFIDPreviewPlanChangeParams, x as FFIDPlanChangePreviewResponse, y as FFIDPreviewSeatChangeParams, z as FFIDSeatChangePreviewResponse, A as FFIDVerifyAccessTokenOptions, B as FFIDOAuthUserInfo, C as FFIDInquiryCreateParams, D as FFIDInquiryCreateResponse, E as FFIDCreditBalance, G as FFIDListCreditHistoryOptions, H as FFIDCreditHistoryPage, I as FFIDCreditPackList, J as FFIDCreatePackCheckoutParams, K as FFIDCreditPackCheckout, L as FFIDCreditConsumeParams, M as FFIDCreditConsumeResult, N as FFIDBuyCreditsUrlParams, T as TokenStore, O as FFIDAuthMode, P as FFIDLogger, Q as FFIDCacheAdapter, R as FFIDUser, S as FFIDOrganization, U as FFIDSubscription, V as FFIDSubscriptionContextValue, W as EffectiveSubscriptionStatus, X as FFIDSubscriptionStatus, Y as FFIDCatalogEnvironment, Z as FFIDBillingInterval, _ as FFIDTaxBehavior, $ as FFIDAnnouncementsClientConfig, a0 as ListAnnouncementsOptions, a1 as FFIDAnnouncementsApiResponse, a2 as AnnouncementListResponse, a3 as FFIDAnnouncementsLogger } from './index-KjewcNn1.cjs';
-export { a4 as Announcement, a5 as AnnouncementStatus, a6 as AnnouncementType, a7 as EFFECTIVE_SUBSCRIPTION_STATUSES, a8 as FFIDAnnouncementBadge, a9 as FFIDAnnouncementList, aa as FFIDAnnouncementsError, ab as FFIDAnnouncementsErrorCode, ac as FFIDAnnouncementsServerResponse, ad as FFIDApiResponseMeta, ae as FFIDCacheConfig, af as FFIDCatalogPublication, ag as FFIDCatalogPublicationStatus, ah as FFIDContextValue, ai as FFIDCreditBreakdown, aj as FFIDCreditGrantKind, ak as FFIDCreditHistoryItem, al as FFIDCreditHistoryType, am as FFIDCreditPack, an as FFIDCreditsInsufficientDetails, ao as FFIDInquiryAcquisitionSource, ap as FFIDInquiryCategory, aq as FFIDInquiryCategorySite2026, ar as FFIDInquiryForm, as as FFIDInquiryFormCategoryItem, at as FFIDInquiryFormClassNames, au as FFIDInquiryFormLegalLayout, av as FFIDInquiryFormOrganization, aw as FFIDInquiryFormPlaceholderContext, ax as FFIDInquiryFormPrefill, ay as FFIDInquiryFormProps, az as FFIDInquiryFormSubmitData, aA as FFIDInquiryFormSubmitResult, aB as FFIDJwtClaims, aC as FFIDLoginButton, aD as FFIDOAuthUserInfoMemberRole, aE as FFIDOrganizationSwitcher, aF as FFIDPlanChangeLineItem, aG as FFIDPlanChangePreview, aH as FFIDPlanInfo, aI as FFIDPricingModel, aJ as FFIDPublishedPlan, aK as FFIDSeatAssignmentClaim, aL as FFIDSeatAssignmentStatus, aM as FFIDSeatChangeLineItem, aN as FFIDSeatChangePreview, aO as FFIDSeatModel, aP as FFIDServiceAccessDenialReason, aQ as FFIDServiceAccessFailPolicy, aR as FFIDServiceInfo, aS as FFIDSubscriptionBadge, aT as FFIDSubscriptionCheckCredits, aU as FFIDSubscriptionSummary, aV as FFIDSupportedCurrency, aW as FFIDUserMenu, aX as FFID_CATALOG_ENVIRONMENTS, aY as FFID_CATALOG_PUBLICATION_STATUSES, aZ as FFID_CREDITS_CONSUME_MAX_AMOUNT, a_ as FFID_CREDITS_CONSUME_MIN_AMOUNT, a$ as FFID_CREDITS_FEATURE_PATTERN, b0 as FFID_CREDITS_HISTORY_DEFAULT_LIMIT, b1 as FFID_CREDITS_HISTORY_MAX_LIMIT, b2 as FFID_CREDITS_HISTORY_MIN_LIMIT, b3 as FFID_CREDITS_IDEMPOTENCY_KEY_PATTERN, b4 as FFID_CREDITS_LOW_THRESHOLD_PERCENT, b5 as FFID_CREDITS_METADATA_MAX_BYTES, b6 as FFID_CREDIT_GRANT_KINDS, b7 as FFID_CREDIT_HISTORY_TYPES, b8 as FFID_CREDIT_PACK_MAX_QUANTITY, b9 as FFID_CREDIT_PACK_MIN_QUANTITY, ba as FFID_INQUIRY_ACQUISITION_SOURCES, bb as FFID_INQUIRY_CATEGORIES, bc as FFID_INQUIRY_CATEGORIES_SITE_2026, bd as TokenData, be as UseFFIDAnnouncementsOptions, bf as UseFFIDAnnouncementsReturn, bg as createTokenStore, bh as isFFIDInquiryAcquisitionSource, bi as isFFIDInquiryCategorySite2026, bj as useFFIDAnnouncements } from './index-KjewcNn1.cjs';
+import { F as FFIDOAuthUserInfoSubscription, a as FFIDAccountType, b as FFIDPrompt, c as FFIDConfig, d as FFIDApiResponse, e as FFIDSessionResponse, f as FFIDSignOutResult, g as FFIDError, h as FFIDSubscriptionCheckResponse, i as FFIDCheckServiceAccessParams, j as FFIDServiceAccessDecision, k as FFIDAnalyticsConfig, l as FFIDSeatsSummary, m as FFIDListPlansResponse, n as FFIDPublishedCatalog, o as FFIDSubscriptionDetail, p as FFIDSubscribeParams, q as FFIDSubscribeResponse, r as FFIDChangePlanParams, s as FFIDChangePlanResponse, t as FFIDCancelSubscriptionParams, u as FFIDCancelSubscriptionResponse, v as FFIDCancelPendingDowngradeResponse, w as FFIDPreviewPlanChangeParams, x as FFIDPlanChangePreviewResponse, y as FFIDPreviewSeatChangeParams, z as FFIDSeatChangePreviewResponse, A as FFIDVerifyAccessTokenOptions, B as FFIDOAuthUserInfo, C as FFIDInquiryCreateParams, D as FFIDInquiryCreateResponse, E as FFIDCreditBalance, G as FFIDListCreditHistoryOptions, H as FFIDCreditHistoryPage, I as FFIDCreditPackList, J as FFIDCreatePackCheckoutParams, K as FFIDCreditPackCheckout, L as FFIDCreditConsumeParams, M as FFIDCreditConsumeResult, N as FFIDBuyCreditsUrlParams, T as TokenStore, O as FFIDAuthMode, P as FFIDLogger, Q as FFIDCacheAdapter, R as FFIDUser, S as FFIDOrganization, U as FFIDSubscription, V as FFIDSubscriptionContextValue, W as EffectiveSubscriptionStatus, X as FFIDSubscriptionStatus, Y as FFIDCatalogEnvironment, Z as FFIDBillingInterval, _ as FFIDTaxBehavior, $ as FFIDAnnouncementsClientConfig, a0 as ListAnnouncementsOptions, a1 as FFIDAnnouncementsApiResponse, a2 as AnnouncementListResponse, a3 as FFIDAnnouncementsLogger } from './index-CWGoIgYL.cjs';
+export { a4 as Announcement, a5 as AnnouncementStatus, a6 as AnnouncementType, a7 as EFFECTIVE_SUBSCRIPTION_STATUSES, a8 as FFIDAnnouncementBadge, a9 as FFIDAnnouncementList, aa as FFIDAnnouncementsError, ab as FFIDAnnouncementsErrorCode, ac as FFIDAnnouncementsServerResponse, ad as FFIDApiResponseMeta, ae as FFIDCacheConfig, af as FFIDCatalogPublication, ag as FFIDCatalogPublicationStatus, ah as FFIDContextValue, ai as FFIDCreditBreakdown, aj as FFIDCreditGrantKind, ak as FFIDCreditHistoryItem, al as FFIDCreditHistoryType, am as FFIDCreditPack, an as FFIDCreditsInsufficientDetails, ao as FFIDInquiryAcquisitionSource, ap as FFIDInquiryCategory, aq as FFIDInquiryCategorySite2026, ar as FFIDInquiryForm, as as FFIDInquiryFormCategoryItem, at as FFIDInquiryFormClassNames, au as FFIDInquiryFormLegalLayout, av as FFIDInquiryFormOrganization, aw as FFIDInquiryFormPlaceholderContext, ax as FFIDInquiryFormPrefill, ay as FFIDInquiryFormProps, az as FFIDInquiryFormSubmitData, aA as FFIDInquiryFormSubmitResult, aB as FFIDJwtClaims, aC as FFIDLoginButton, aD as FFIDOAuthUserInfoMemberRole, aE as FFIDOrganizationSwitcher, aF as FFIDPlanChangeLineItem, aG as FFIDPlanChangePreview, aH as FFIDPlanInfo, aI as FFIDPricingModel, aJ as FFIDPublishedPlan, aK as FFIDSeatAssignmentClaim, aL as FFIDSeatAssignmentStatus, aM as FFIDSeatChangeLineItem, aN as FFIDSeatChangePreview, aO as FFIDSeatModel, aP as FFIDServiceAccessDenialReason, aQ as FFIDServiceAccessFailPolicy, aR as FFIDServiceInfo, aS as FFIDSubscriptionBadge, aT as FFIDSubscriptionCheckCredits, aU as FFIDSubscriptionSummary, aV as FFIDSupportedCurrency, aW as FFIDUserMenu, aX as FFID_CATALOG_ENVIRONMENTS, aY as FFID_CATALOG_PUBLICATION_STATUSES, aZ as FFID_CREDITS_CONSUME_MAX_AMOUNT, a_ as FFID_CREDITS_CONSUME_MIN_AMOUNT, a$ as FFID_CREDITS_FEATURE_PATTERN, b0 as FFID_CREDITS_HISTORY_DEFAULT_LIMIT, b1 as FFID_CREDITS_HISTORY_MAX_LIMIT, b2 as FFID_CREDITS_HISTORY_MIN_LIMIT, b3 as FFID_CREDITS_IDEMPOTENCY_KEY_PATTERN, b4 as FFID_CREDITS_LOW_THRESHOLD_PERCENT, b5 as FFID_CREDITS_METADATA_MAX_BYTES, b6 as FFID_CREDIT_GRANT_KINDS, b7 as FFID_CREDIT_HISTORY_TYPES, b8 as FFID_CREDIT_PACK_MAX_QUANTITY, b9 as FFID_CREDIT_PACK_MIN_QUANTITY, ba as FFID_INQUIRY_ACQUISITION_SOURCES, bb as FFID_INQUIRY_CATEGORIES, bc as FFID_INQUIRY_CATEGORIES_SITE_2026, bd as TokenData, be as UseFFIDAnnouncementsOptions, bf as UseFFIDAnnouncementsReturn, bg as createTokenStore, bh as isFFIDInquiryAcquisitionSource, bi as isFFIDInquiryCategorySite2026, bj as useFFIDAnnouncements } from './index-CWGoIgYL.cjs';
 export { A as ALL_DENIED_EXCEPT_NECESSARY, i as CONSENT_COOKIE_NAME, j as CONSENT_DISMISSAL_TIMESTAMP_KEY, l as COOKIE_VERSION, D as DEFAULT_CONSENT_ERROR_MESSAGES, n as FFIDAnalyticsProvider, o as FFIDAnalyticsProviderProps, c as FFIDConsentCategories, q as FFIDConsentCategoryCode, e as FFIDConsentCategoryMetadata, v as FFIDConsentError, w as FFIDConsentErrorCode, x as FFIDConsentMergeStrategy, z as FFIDConsentMergeWarning, B as FFIDConsentMergeWarningEvent, F as FFIDConsentResult, H as FFIDConsentSource, a as FFIDConsentState, d as FFIDConsentSyncResult, L as FFIDCookieBanner, M as FFIDCookieBannerClassNames, N as FFIDCookieBannerProps, O as FFIDCookieLink, Q as FFIDCookieLinkProps, f as FFIDCookiePolicy, S as FFIDCookieSettings, T as FFIDCookieSettingsClassNames, U as FFIDCookieSettingsProps, Z as FFID_CONSENT_ERROR_CODES, ad as UseFFIDConsentPreferencesReturn, ae as UseFFIDConsentReturn, af as clearConsentDismissalTimestamp, ai as decodeConsentCookie, ak as encodeConsentCookie, am as readConsentCookie, an as readConsentDismissalTimestamp, ap as useFFIDConsent, aq as useFFIDConsentPreferences, ar as writeConsentCookie, as as writeConsentDismissalTimestamp } from './FFIDCookieLink-yt5SUr-W.cjs';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode, ComponentType, FC } from 'react';
@@ -1604,6 +1604,10 @@ declare class FFIDSDKError extends Error {
  * validates the OAuth `state` against the value persisted at authorize time
  * (CSRF protection, RFC 6749 §10.12), retrieves the PKCE verifier, exchanges
  * the code for tokens, and cleans the params out of the URL on success.
+ *
+ * When FFID refused the user, the callback carries `error` (+ FFID's
+ * `denial_reason`) instead of `code` (#6523). After the same `state` check the
+ * error is returned as an authorization error (see `./authorization-error`).
  */
 
 /**
@@ -1621,8 +1625,9 @@ interface HandleRedirectCallbackOptions {
     url?: string | undefined;
     /**
      * Whether to remove `code` / `state` from the browser URL via
-     * `window.history.replaceState` after a successful exchange. Defaults to
-     * `true`.
+     * `window.history.replaceState` after a successful exchange — and, on an
+     * authorization error, `state` only (#6523; see {@link ERROR_CALLBACK_CONSUMED_PARAMS}).
+     * Defaults to `true`.
      *
      * Set to `false` to take over URL cleanup on the consumer side. This matters
      * on Next.js App Router: the App Router patches `history.replaceState`, so
@@ -1642,7 +1647,9 @@ interface HandleRedirectCallbackOptions {
  * Complete an OAuth authorization-code redirect.
  *
  * Behavior:
- * 1. Reads `code` + `state` from `options.url ?? window.location.search`.
+ * 1. Reads `code` + `state` (or `error`) from `options.url ?? window.location.search`.
+ *    A URL with no `code` — and no `error` carrying a `state` — returns
+ *    `MISSING_AUTHORIZATION_CODE` without touching the stored state.
  * 2. CSRF guard: if a `state` exists on EITHER side (a stored state from
  *    authorize OR a `state` on the callback URL), the two MUST match — mismatch,
  *    a missing stored state, or an **omitted** callback `state` all **fail closed**
@@ -1652,6 +1659,17 @@ interface HandleRedirectCallbackOptions {
  * 3. Retrieves the PKCE verifier and exchanges the code for tokens.
  * 4. On success, removes `code` + `state` from the browser URL (skipped when
  *    `options.cleanUrl` is `false` — the consumer then owns URL cleanup).
+ * 5. When the URL carries `error` **and** `state` (FFID refused the user),
+ *    returns it as an authorization error after step 2 instead of exchanging
+ *    anything. Unlike a code callback there is no no-state leniency: the URL
+ *    `state` must match a stored one, so a crafted `?error=...&error_description=`
+ *    link cannot be shown as a denial (content spoofing). `code` is
+ *    the OAuth `error` (e.g. `access_denied`) and `details` holds FFID's
+ *    `denial_reason` — read it with `getFFIDAuthorizationError`. The PKCE
+ *    verifier is discarded and the consumed `state` is removed from the URL
+ *    (same `cleanUrl` rule), so a reload does not re-process it. `error` /
+ *    `error_description` / `denial_reason` stay in the URL.
+ *    Do not call `login()` again on this error: FFID refuses the same way.
  *
  * SSR-safe: when there is no `window` and no `options.url`, no exchange is
  * attempted and an error result is returned.
@@ -1661,6 +1679,77 @@ interface HandleRedirectCallbackOptions {
  */
 declare function handleRedirectCallback(client: HandleRedirectCallbackClient, options?: HandleRedirectCallbackOptions): Promise<FFIDApiResponse<void>>;
 
+/**
+ * OAuth authorization errors returned to the service's `redirect_uri` (#6523)
+ *
+ * When FFID's `/oauth/authorize` refuses a user, it redirects back with
+ * `error=<OAuth error>&error_description=...&state=...` (RFC 6749 §4.1.2.1). For
+ * subscription / seat denials it also adds the FFID extension `denial_reason`
+ * (#6498), so a service can tell "no seat in this organization" from "no
+ * subscription" without parsing `error_description`.
+ *
+ * Both callback paths build the same {@link FFIDError} from those params:
+ * - `handleRedirectCallback` / token-mode `FFIDProvider` (browser, PKCE)
+ * - `createServerAuthClient().handleCallback` (confidential / BFF)
+ *
+ * `error.code` is the OAuth `error` value verbatim (e.g. `access_denied`), and
+ * `error.details` is {@link FFIDAuthorizationErrorDetails}. Read it with
+ * {@link getFFIDAuthorizationError}.
+ *
+ * This module has no browser dependency so the server entry can share it.
+ */
+
+/**
+ * Values of FFID's `denial_reason` (the authorize error redirect and the
+ * `/oauth/userinfo` 403; `/oauth/introspect` only answers `active: false`). Kept
+ * identical to the FFID server's `DENIAL_REASONS` by a test in the FFID repository.
+ *
+ * This is a different vocabulary from `FFIDServiceAccessDenialReason`
+ * (`checkServiceAccess()`), which is derived from the subscription status.
+ */
+declare const FFID_OAUTH_DENIAL_REASONS: readonly ["no_membership", "no_active_subscription", "no_seat_assignment", "subscription_expired", "member_limit_reached"];
+type FFIDOAuthDenialReason = (typeof FFID_OAUTH_DENIAL_REASONS)[number];
+/** Runtime guard for {@link FFIDOAuthDenialReason}. Unknown values are `false`. */
+declare function isFFIDOAuthDenialReason(value: unknown): value is FFIDOAuthDenialReason;
+/** `FFIDError.details` of an authorization error */
+interface FFIDAuthorizationErrorDetails {
+    /** Marks the error as an authorize redirect error (vs. token / network errors) */
+    source: 'authorization';
+    /**
+     * FFID's `denial_reason`. `null` when FFID did not send one (any OAuth error other
+     * than a subscription / seat denial) **or** sent a value this SDK version does not
+     * know — the error itself is still returned, only the reason is unknown.
+     */
+    denialReason: FFIDOAuthDenialReason | null;
+    /**
+     * `error_description` as sent — short ASCII English meant for logs. The same text
+     * is `error.message` (when FFID sent one), so show end users guidance chosen by
+     * `denialReason` rather than the message itself.
+     */
+    errorDescription: string | null;
+}
+/** An authorization error read back by {@link getFFIDAuthorizationError} */
+interface FFIDAuthorizationError {
+    /** The OAuth `error` value, e.g. `access_denied`, `login_required` */
+    oauthError: string;
+    denialReason: FFIDOAuthDenialReason | null;
+    errorDescription: string | null;
+}
+/**
+ * Read an authorization error (and FFID's `denial_reason`) from an {@link FFIDError},
+ * e.g. `useFFID().error` or the result of `handleRedirectCallback` /
+ * `createServerAuthClient().handleCallback`. Returns `null` for any other error.
+ *
+ * ```ts
+ * const denial = getFFIDAuthorizationError(error)
+ * if (denial?.denialReason === 'no_seat_assignment') {
+ *   // Ask an organization owner / admin to add the user. Do not call login() again:
+ *   // FFID would refuse the same way.
+ * }
+ * ```
+ */
+declare function getFFIDAuthorizationError(error: FFIDError | null | undefined): FFIDAuthorizationError | null;
+
 /**
  * Redirect URI normalization (SDK copy)
  *
@@ -1951,7 +2040,10 @@ interface FFIDProviderProps extends FFIDConfig {
      * Set to `false` on Next.js App Router when the patched history API
      * re-evaluating `useSearchParams()` (and re-running effects that depend on
      * it) is a problem — then remove `code` / `state` yourself (keeping other
-     * query params) after authentication completes. Consumed callback params
+     * query params) after authentication completes. When FFID refused the user
+     * (`?error=` callback, #6523), the provider removes only the consumed `state`
+     * under the same rule (`error` / `denial_reason` stay for the app to read), so
+     * with `false` remove `state` too. Consumed callback params
      * left in the URL fail on reload with `STATE_MISMATCH_ERROR` (the one-time
      * OAuth `state` was already consumed), which also leaves an authenticated
      * user rendered as signed-out until the URL is cleaned.
@@ -2866,4 +2958,4 @@ declare function createInquiryMethods(deps: InquiryMethodsDeps): {
 };
 type FFIDInquiryClient = ReturnType<typeof createInquiryMethods>;
 
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, AGENCY_INVITE_COOKIE_MAX_AGE_SEC, AGENCY_INVITE_COOKIE_NAME, AGENCY_INVITE_TOKEN_PARAM, AGENCY_INVITE_TOKEN_REDACTION, type AgencyInviteCookieOptions, AnnouncementListResponse, BLOCKING_EFFECTIVE_STATUSES, CATALOG_HASH_PATTERN, type CaptureAgencyInviteTokenOptions, type CaptureAgencyInviteTokenResult, type ComputeEffectiveStatusInput, type ContractWizardFlowType, type ContractWizardResubscribeOptions, type ContractWizardSubscribeOptions, type ContractWizardSubscriptionOptions, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EffectiveSubscriptionStatus, type ExchangeCodeForTokensOptions, FFIDAccountType, type FFIDAddMemberParams, type FFIDAddMemberRequest, type FFIDAddMemberResponse, type FFIDAllowedLogoMimeType, FFIDAnnouncementsApiResponse, type FFIDAnnouncementsClient, FFIDAnnouncementsClientConfig, FFIDAnnouncementsLogger, FFIDApiResponse, type FFIDAssignableMemberRole, FFIDBillingInterval, FFIDBuyCreditsUrlParams, FFIDCacheAdapter, FFIDCancelPendingDowngradeResponse, FFIDCancelSubscriptionParams, FFIDCancelSubscriptionResponse, type FFIDCanonicalJsonValue, FFIDCatalogEnvironment, FFIDCatalogHashError, FFIDChangePlanParams, FFIDChangePlanResponse, FFIDCheckServiceAccessParams, type FFIDCheckoutSessionResponse, type FFIDClient, type FFIDCompanySizeCode, FFIDConfig, type FFIDCreateCheckoutParams, FFIDCreatePackCheckoutParams, type FFIDCreatePortalParams, FFIDCreditBalance, FFIDCreditConsumeParams, FFIDCreditConsumeResult, FFIDCreditHistoryPage, FFIDCreditPackCheckout, FFIDCreditPackList, type FFIDCreditsClient, type FFIDCreditsErrorCode, FFIDError, type FFIDErrorCode, type FFIDIndustryCode, type FFIDInquiryClient, FFIDInquiryCreateParams, FFIDInquiryCreateResponse, type FFIDInvitationStatus, type FFIDInviteMemberRequest, type FFIDInviteMemberResponse, type FFIDLeaveOrganizationParams, type FFIDLeaveOrganizationResponse, FFIDListCreditHistoryOptions, type FFIDListMembersResponse, FFIDListPlansResponse, type FFIDListingConsentInput, FFIDLogger, type FFIDLoginHistoryEntry, type FFIDLoginHistoryResponse, type FFIDLogoWallEntry, type FFIDLogoWallResponse, type FFIDMemberRole, type FFIDMemberStatus, type FFIDNewsletterBodySource, type FFIDNewsletterCampaignStatus, type FFIDNewsletterClient, type FFIDNewsletterConfirmParams, type FFIDNewsletterConfirmResponse, type FFIDNewsletterDispatchParams, type FFIDNewsletterDispatchResponse, type FFIDNewsletterSegment, type FFIDNewsletterSubscribeParams, type FFIDNewsletterSubscribeResponse, type FFIDNewsletterType, type FFIDNewsletterUnsubscribeParams, type FFIDNewsletterUnsubscribeResponse, type FFIDOAuthTokenResponse, FFIDOAuthUserInfo, FFIDOAuthUserInfoSubscription, FFIDOrganization, type FFIDOrganizationDomain, type FFIDOrganizationDomainsResponse, type FFIDOrganizationLogoUploadResponse, type FFIDOrganizationMember, type FFIDOrganizationNotificationPreferences, type FFIDOrganizationNotificationPreferencesResponse, type FFIDOrganizationProfile, type FFIDOrganizationProfileErrorCode, type FFIDOrganizationProfileResponse, type FFIDOtpSendResponse, type FFIDOtpVerifyResponse, type FFIDPasswordResetConfirmResponse, type FFIDPasswordResetResponse, type FFIDPasswordResetVerifyResponse, type FFIDPaymentConfiguration, FFIDPlanChangePreviewResponse, type FFIDPortalSessionResponse, FFIDPreviewPlanChangeParams, FFIDPreviewSeatChangeParams, type FFIDProfileCallOptions, FFIDProvider, type FFIDProviderProps, type FFIDProvisionMemberPlan, type FFIDProvisionMemberPlanStatus, type FFIDProvisionMemberResult, type FFIDProvisionMemberStatus, type FFIDProvisionOrganizationDryRun, type FFIDProvisionOrganizationMemberInput, type FFIDProvisionOrganizationOutcome, type FFIDProvisionOrganizationParams, type FFIDProvisionOrganizationResponse, type FFIDProvisionUserDryRun, type FFIDProvisionUserOutcome, type FFIDProvisionUserParams, type FFIDProvisionUserProfileInput, type FFIDProvisionUserResponse, type FFIDProvisionedOrganization, type FFIDProvisionedUser, FFIDPublishedCatalog, type FFIDRedirectErrorCode, type FFIDRedirectResult, type FFIDRemoveMemberResponse, type FFIDResetSessionResponse, FFIDSDKError, type FFIDScopeHashInput, type FFIDScopeHashPlan, FFIDSeatChangePreviewResponse, FFIDSeatsSummary, FFIDServiceAccessDecision, FFIDSessionResponse, FFIDSignOutResult, FFIDSubscribeParams, FFIDSubscribeResponse, FFIDSubscription, FFIDSubscriptionCheckResponse, FFIDSubscriptionContextValue, FFIDSubscriptionDetail, type FFIDSubscriptionErrorCode, FFIDSubscriptionStatus, FFIDTaxBehavior, type FFIDTaxConfiguration, type FFIDTokenIntrospectionResponse, type FFIDUpdateMemberRoleResponse, type FFIDUpdateNotificationPreferencesRequest, type FFIDUpdateUserProfileRequest, type FFIDUploadOrganizationLogoParams, type FFIDUpsertOrganizationProfileParams, type FFIDUpsertOrganizationProfileRequest, FFIDUser, type FFIDUserProfile, FFIDVerifyAccessTokenOptions, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_COMPANY_SIZE_CODES, FFID_CREDITS_ERROR_CODES, FFID_ERROR_CODES, FFID_INDUSTRY_CODES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, FFID_NEWSLETTER_DISPATCH_MAX_RECIPIENTS, FFID_NEWSLETTER_TYPES, FFID_ORGANIZATION_PROFILE_ERROR_CODES, FFID_SUBSCRIPTION_ERROR_CODES, type HandleRedirectCallbackClient, type HandleRedirectCallbackOptions, type KVNamespaceLike, ListAnnouncementsOptions, type NormalizeRedirectUriResult, type ReadAgencyInviteTokenOptions, type RedirectToAuthorizeOptions, TokenStore, type UseFFIDReturn, type UseRequireActiveSubscriptionOptions, type UseRequireActiveSubscriptionReturn, type WithFFIDAuthOptions, type WithSubscriptionOptions, canonicalizeCatalogValue, captureAgencyInviteToken, clearAgencyInviteToken, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createFFIDAnnouncementsClient, createFFIDClient, createKVCacheAdapter, createMemoryCacheAdapter, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, hashCanonicalJson, isBlockedFromUserinfo, normalizeRedirectUri, readAgencyInviteCookie, readAgencyInviteToken, redactAgencyInviteToken, retrieveCodeVerifier, retrieveState, sha256Hex, storeCodeVerifier, storeState, useFFID, useRequireActiveSubscription, useSubscription, validatePublishedCatalog, withFFIDAuth, withSubscription };
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, AGENCY_INVITE_COOKIE_MAX_AGE_SEC, AGENCY_INVITE_COOKIE_NAME, AGENCY_INVITE_TOKEN_PARAM, AGENCY_INVITE_TOKEN_REDACTION, type AgencyInviteCookieOptions, AnnouncementListResponse, BLOCKING_EFFECTIVE_STATUSES, CATALOG_HASH_PATTERN, type CaptureAgencyInviteTokenOptions, type CaptureAgencyInviteTokenResult, type ComputeEffectiveStatusInput, type ContractWizardFlowType, type ContractWizardResubscribeOptions, type ContractWizardSubscribeOptions, type ContractWizardSubscriptionOptions, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EffectiveSubscriptionStatus, type ExchangeCodeForTokensOptions, FFIDAccountType, type FFIDAddMemberParams, type FFIDAddMemberRequest, type FFIDAddMemberResponse, type FFIDAllowedLogoMimeType, FFIDAnnouncementsApiResponse, type FFIDAnnouncementsClient, FFIDAnnouncementsClientConfig, FFIDAnnouncementsLogger, FFIDApiResponse, type FFIDAssignableMemberRole, type FFIDAuthorizationError, type FFIDAuthorizationErrorDetails, FFIDBillingInterval, FFIDBuyCreditsUrlParams, FFIDCacheAdapter, FFIDCancelPendingDowngradeResponse, FFIDCancelSubscriptionParams, FFIDCancelSubscriptionResponse, type FFIDCanonicalJsonValue, FFIDCatalogEnvironment, FFIDCatalogHashError, FFIDChangePlanParams, FFIDChangePlanResponse, FFIDCheckServiceAccessParams, type FFIDCheckoutSessionResponse, type FFIDClient, type FFIDCompanySizeCode, FFIDConfig, type FFIDCreateCheckoutParams, FFIDCreatePackCheckoutParams, type FFIDCreatePortalParams, FFIDCreditBalance, FFIDCreditConsumeParams, FFIDCreditConsumeResult, FFIDCreditHistoryPage, FFIDCreditPackCheckout, FFIDCreditPackList, type FFIDCreditsClient, type FFIDCreditsErrorCode, FFIDError, type FFIDErrorCode, type FFIDIndustryCode, type FFIDInquiryClient, FFIDInquiryCreateParams, FFIDInquiryCreateResponse, type FFIDInvitationStatus, type FFIDInviteMemberRequest, type FFIDInviteMemberResponse, type FFIDLeaveOrganizationParams, type FFIDLeaveOrganizationResponse, FFIDListCreditHistoryOptions, type FFIDListMembersResponse, FFIDListPlansResponse, type FFIDListingConsentInput, FFIDLogger, type FFIDLoginHistoryEntry, type FFIDLoginHistoryResponse, type FFIDLogoWallEntry, type FFIDLogoWallResponse, type FFIDMemberRole, type FFIDMemberStatus, type FFIDNewsletterBodySource, type FFIDNewsletterCampaignStatus, type FFIDNewsletterClient, type FFIDNewsletterConfirmParams, type FFIDNewsletterConfirmResponse, type FFIDNewsletterDispatchParams, type FFIDNewsletterDispatchResponse, type FFIDNewsletterSegment, type FFIDNewsletterSubscribeParams, type FFIDNewsletterSubscribeResponse, type FFIDNewsletterType, type FFIDNewsletterUnsubscribeParams, type FFIDNewsletterUnsubscribeResponse, type FFIDOAuthDenialReason, type FFIDOAuthTokenResponse, FFIDOAuthUserInfo, FFIDOAuthUserInfoSubscription, FFIDOrganization, type FFIDOrganizationDomain, type FFIDOrganizationDomainsResponse, type FFIDOrganizationLogoUploadResponse, type FFIDOrganizationMember, type FFIDOrganizationNotificationPreferences, type FFIDOrganizationNotificationPreferencesResponse, type FFIDOrganizationProfile, type FFIDOrganizationProfileErrorCode, type FFIDOrganizationProfileResponse, type FFIDOtpSendResponse, type FFIDOtpVerifyResponse, type FFIDPasswordResetConfirmResponse, type FFIDPasswordResetResponse, type FFIDPasswordResetVerifyResponse, type FFIDPaymentConfiguration, FFIDPlanChangePreviewResponse, type FFIDPortalSessionResponse, FFIDPreviewPlanChangeParams, FFIDPreviewSeatChangeParams, type FFIDProfileCallOptions, FFIDProvider, type FFIDProviderProps, type FFIDProvisionMemberPlan, type FFIDProvisionMemberPlanStatus, type FFIDProvisionMemberResult, type FFIDProvisionMemberStatus, type FFIDProvisionOrganizationDryRun, type FFIDProvisionOrganizationMemberInput, type FFIDProvisionOrganizationOutcome, type FFIDProvisionOrganizationParams, type FFIDProvisionOrganizationResponse, type FFIDProvisionUserDryRun, type FFIDProvisionUserOutcome, type FFIDProvisionUserParams, type FFIDProvisionUserProfileInput, type FFIDProvisionUserResponse, type FFIDProvisionedOrganization, type FFIDProvisionedUser, FFIDPublishedCatalog, type FFIDRedirectErrorCode, type FFIDRedirectResult, type FFIDRemoveMemberResponse, type FFIDResetSessionResponse, FFIDSDKError, type FFIDScopeHashInput, type FFIDScopeHashPlan, FFIDSeatChangePreviewResponse, FFIDSeatsSummary, FFIDServiceAccessDecision, FFIDSessionResponse, FFIDSignOutResult, FFIDSubscribeParams, FFIDSubscribeResponse, FFIDSubscription, FFIDSubscriptionCheckResponse, FFIDSubscriptionContextValue, FFIDSubscriptionDetail, type FFIDSubscriptionErrorCode, FFIDSubscriptionStatus, FFIDTaxBehavior, type FFIDTaxConfiguration, type FFIDTokenIntrospectionResponse, type FFIDUpdateMemberRoleResponse, type FFIDUpdateNotificationPreferencesRequest, type FFIDUpdateUserProfileRequest, type FFIDUploadOrganizationLogoParams, type FFIDUpsertOrganizationProfileParams, type FFIDUpsertOrganizationProfileRequest, FFIDUser, type FFIDUserProfile, FFIDVerifyAccessTokenOptions, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_COMPANY_SIZE_CODES, FFID_CREDITS_ERROR_CODES, FFID_ERROR_CODES, FFID_INDUSTRY_CODES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, FFID_NEWSLETTER_DISPATCH_MAX_RECIPIENTS, FFID_NEWSLETTER_TYPES, FFID_OAUTH_DENIAL_REASONS, FFID_ORGANIZATION_PROFILE_ERROR_CODES, FFID_SUBSCRIPTION_ERROR_CODES, type HandleRedirectCallbackClient, type HandleRedirectCallbackOptions, type KVNamespaceLike, ListAnnouncementsOptions, type NormalizeRedirectUriResult, type ReadAgencyInviteTokenOptions, type RedirectToAuthorizeOptions, TokenStore, type UseFFIDReturn, type UseRequireActiveSubscriptionOptions, type UseRequireActiveSubscriptionReturn, type WithFFIDAuthOptions, type WithSubscriptionOptions, canonicalizeCatalogValue, captureAgencyInviteToken, clearAgencyInviteToken, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createFFIDAnnouncementsClient, createFFIDClient, createKVCacheAdapter, createMemoryCacheAdapter, generateCodeChallenge, generateCodeVerifier, getFFIDAuthorizationError, handleRedirectCallback, hasAccessFromUserinfo, hashCanonicalJson, isBlockedFromUserinfo, isFFIDOAuthDenialReason, normalizeRedirectUri, readAgencyInviteCookie, readAgencyInviteToken, redactAgencyInviteToken, retrieveCodeVerifier, retrieveState, sha256Hex, storeCodeVerifier, storeState, useFFID, useRequireActiveSubscription, useSubscription, validatePublishedCatalog, withFFIDAuth, withSubscription };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { F as FFIDOAuthUserInfoSubscription, a as FFIDAccountType, b as FFIDPrompt, c as FFIDConfig, d as FFIDApiResponse, e as FFIDSessionResponse, f as FFIDSignOutResult, g as FFIDError, h as FFIDSubscriptionCheckResponse, i as FFIDCheckServiceAccessParams, j as FFIDServiceAccessDecision, k as FFIDAnalyticsConfig, l as FFIDSeatsSummary, m as FFIDListPlansResponse, n as FFIDPublishedCatalog, o as FFIDSubscriptionDetail, p as FFIDSubscribeParams, q as FFIDSubscribeResponse, r as FFIDChangePlanParams, s as FFIDChangePlanResponse, t as FFIDCancelSubscriptionParams, u as FFIDCancelSubscriptionResponse, v as FFIDCancelPendingDowngradeResponse, w as FFIDPreviewPlanChangeParams, x as FFIDPlanChangePreviewResponse, y as FFIDPreviewSeatChangeParams, z as FFIDSeatChangePreviewResponse, A as FFIDVerifyAccessTokenOptions, B as FFIDOAuthUserInfo, C as FFIDInquiryCreateParams, D as FFIDInquiryCreateResponse, E as FFIDCreditBalance, G as FFIDListCreditHistoryOptions, H as FFIDCreditHistoryPage, I as FFIDCreditPackList, J as FFIDCreatePackCheckoutParams, K as FFIDCreditPackCheckout, L as FFIDCreditConsumeParams, M as FFIDCreditConsumeResult, N as FFIDBuyCreditsUrlParams, T as TokenStore, O as FFIDAuthMode, P as FFIDLogger, Q as FFIDCacheAdapter, R as FFIDUser, S as FFIDOrganization, U as FFIDSubscription, V as FFIDSubscriptionContextValue, W as EffectiveSubscriptionStatus, X as FFIDSubscriptionStatus, Y as FFIDCatalogEnvironment, Z as FFIDBillingInterval, _ as FFIDTaxBehavior, $ as FFIDAnnouncementsClientConfig, a0 as ListAnnouncementsOptions, a1 as FFIDAnnouncementsApiResponse, a2 as AnnouncementListResponse, a3 as FFIDAnnouncementsLogger } from './index-KjewcNn1.js';
-export { a4 as Announcement, a5 as AnnouncementStatus, a6 as AnnouncementType, a7 as EFFECTIVE_SUBSCRIPTION_STATUSES, a8 as FFIDAnnouncementBadge, a9 as FFIDAnnouncementList, aa as FFIDAnnouncementsError, ab as FFIDAnnouncementsErrorCode, ac as FFIDAnnouncementsServerResponse, ad as FFIDApiResponseMeta, ae as FFIDCacheConfig, af as FFIDCatalogPublication, ag as FFIDCatalogPublicationStatus, ah as FFIDContextValue, ai as FFIDCreditBreakdown, aj as FFIDCreditGrantKind, ak as FFIDCreditHistoryItem, al as FFIDCreditHistoryType, am as FFIDCreditPack, an as FFIDCreditsInsufficientDetails, ao as FFIDInquiryAcquisitionSource, ap as FFIDInquiryCategory, aq as FFIDInquiryCategorySite2026, ar as FFIDInquiryForm, as as FFIDInquiryFormCategoryItem, at as FFIDInquiryFormClassNames, au as FFIDInquiryFormLegalLayout, av as FFIDInquiryFormOrganization, aw as FFIDInquiryFormPlaceholderContext, ax as FFIDInquiryFormPrefill, ay as FFIDInquiryFormProps, az as FFIDInquiryFormSubmitData, aA as FFIDInquiryFormSubmitResult, aB as FFIDJwtClaims, aC as FFIDLoginButton, aD as FFIDOAuthUserInfoMemberRole, aE as FFIDOrganizationSwitcher, aF as FFIDPlanChangeLineItem, aG as FFIDPlanChangePreview, aH as FFIDPlanInfo, aI as FFIDPricingModel, aJ as FFIDPublishedPlan, aK as FFIDSeatAssignmentClaim, aL as FFIDSeatAssignmentStatus, aM as FFIDSeatChangeLineItem, aN as FFIDSeatChangePreview, aO as FFIDSeatModel, aP as FFIDServiceAccessDenialReason, aQ as FFIDServiceAccessFailPolicy, aR as FFIDServiceInfo, aS as FFIDSubscriptionBadge, aT as FFIDSubscriptionCheckCredits, aU as FFIDSubscriptionSummary, aV as FFIDSupportedCurrency, aW as FFIDUserMenu, aX as FFID_CATALOG_ENVIRONMENTS, aY as FFID_CATALOG_PUBLICATION_STATUSES, aZ as FFID_CREDITS_CONSUME_MAX_AMOUNT, a_ as FFID_CREDITS_CONSUME_MIN_AMOUNT, a$ as FFID_CREDITS_FEATURE_PATTERN, b0 as FFID_CREDITS_HISTORY_DEFAULT_LIMIT, b1 as FFID_CREDITS_HISTORY_MAX_LIMIT, b2 as FFID_CREDITS_HISTORY_MIN_LIMIT, b3 as FFID_CREDITS_IDEMPOTENCY_KEY_PATTERN, b4 as FFID_CREDITS_LOW_THRESHOLD_PERCENT, b5 as FFID_CREDITS_METADATA_MAX_BYTES, b6 as FFID_CREDIT_GRANT_KINDS, b7 as FFID_CREDIT_HISTORY_TYPES, b8 as FFID_CREDIT_PACK_MAX_QUANTITY, b9 as FFID_CREDIT_PACK_MIN_QUANTITY, ba as FFID_INQUIRY_ACQUISITION_SOURCES, bb as FFID_INQUIRY_CATEGORIES, bc as FFID_INQUIRY_CATEGORIES_SITE_2026, bd as TokenData, be as UseFFIDAnnouncementsOptions, bf as UseFFIDAnnouncementsReturn, bg as createTokenStore, bh as isFFIDInquiryAcquisitionSource, bi as isFFIDInquiryCategorySite2026, bj as useFFIDAnnouncements } from './index-KjewcNn1.js';
+import { F as FFIDOAuthUserInfoSubscription, a as FFIDAccountType, b as FFIDPrompt, c as FFIDConfig, d as FFIDApiResponse, e as FFIDSessionResponse, f as FFIDSignOutResult, g as FFIDError, h as FFIDSubscriptionCheckResponse, i as FFIDCheckServiceAccessParams, j as FFIDServiceAccessDecision, k as FFIDAnalyticsConfig, l as FFIDSeatsSummary, m as FFIDListPlansResponse, n as FFIDPublishedCatalog, o as FFIDSubscriptionDetail, p as FFIDSubscribeParams, q as FFIDSubscribeResponse, r as FFIDChangePlanParams, s as FFIDChangePlanResponse, t as FFIDCancelSubscriptionParams, u as FFIDCancelSubscriptionResponse, v as FFIDCancelPendingDowngradeResponse, w as FFIDPreviewPlanChangeParams, x as FFIDPlanChangePreviewResponse, y as FFIDPreviewSeatChangeParams, z as FFIDSeatChangePreviewResponse, A as FFIDVerifyAccessTokenOptions, B as FFIDOAuthUserInfo, C as FFIDInquiryCreateParams, D as FFIDInquiryCreateResponse, E as FFIDCreditBalance, G as FFIDListCreditHistoryOptions, H as FFIDCreditHistoryPage, I as FFIDCreditPackList, J as FFIDCreatePackCheckoutParams, K as FFIDCreditPackCheckout, L as FFIDCreditConsumeParams, M as FFIDCreditConsumeResult, N as FFIDBuyCreditsUrlParams, T as TokenStore, O as FFIDAuthMode, P as FFIDLogger, Q as FFIDCacheAdapter, R as FFIDUser, S as FFIDOrganization, U as FFIDSubscription, V as FFIDSubscriptionContextValue, W as EffectiveSubscriptionStatus, X as FFIDSubscriptionStatus, Y as FFIDCatalogEnvironment, Z as FFIDBillingInterval, _ as FFIDTaxBehavior, $ as FFIDAnnouncementsClientConfig, a0 as ListAnnouncementsOptions, a1 as FFIDAnnouncementsApiResponse, a2 as AnnouncementListResponse, a3 as FFIDAnnouncementsLogger } from './index-CWGoIgYL.js';
+export { a4 as Announcement, a5 as AnnouncementStatus, a6 as AnnouncementType, a7 as EFFECTIVE_SUBSCRIPTION_STATUSES, a8 as FFIDAnnouncementBadge, a9 as FFIDAnnouncementList, aa as FFIDAnnouncementsError, ab as FFIDAnnouncementsErrorCode, ac as FFIDAnnouncementsServerResponse, ad as FFIDApiResponseMeta, ae as FFIDCacheConfig, af as FFIDCatalogPublication, ag as FFIDCatalogPublicationStatus, ah as FFIDContextValue, ai as FFIDCreditBreakdown, aj as FFIDCreditGrantKind, ak as FFIDCreditHistoryItem, al as FFIDCreditHistoryType, am as FFIDCreditPack, an as FFIDCreditsInsufficientDetails, ao as FFIDInquiryAcquisitionSource, ap as FFIDInquiryCategory, aq as FFIDInquiryCategorySite2026, ar as FFIDInquiryForm, as as FFIDInquiryFormCategoryItem, at as FFIDInquiryFormClassNames, au as FFIDInquiryFormLegalLayout, av as FFIDInquiryFormOrganization, aw as FFIDInquiryFormPlaceholderContext, ax as FFIDInquiryFormPrefill, ay as FFIDInquiryFormProps, az as FFIDInquiryFormSubmitData, aA as FFIDInquiryFormSubmitResult, aB as FFIDJwtClaims, aC as FFIDLoginButton, aD as FFIDOAuthUserInfoMemberRole, aE as FFIDOrganizationSwitcher, aF as FFIDPlanChangeLineItem, aG as FFIDPlanChangePreview, aH as FFIDPlanInfo, aI as FFIDPricingModel, aJ as FFIDPublishedPlan, aK as FFIDSeatAssignmentClaim, aL as FFIDSeatAssignmentStatus, aM as FFIDSeatChangeLineItem, aN as FFIDSeatChangePreview, aO as FFIDSeatModel, aP as FFIDServiceAccessDenialReason, aQ as FFIDServiceAccessFailPolicy, aR as FFIDServiceInfo, aS as FFIDSubscriptionBadge, aT as FFIDSubscriptionCheckCredits, aU as FFIDSubscriptionSummary, aV as FFIDSupportedCurrency, aW as FFIDUserMenu, aX as FFID_CATALOG_ENVIRONMENTS, aY as FFID_CATALOG_PUBLICATION_STATUSES, aZ as FFID_CREDITS_CONSUME_MAX_AMOUNT, a_ as FFID_CREDITS_CONSUME_MIN_AMOUNT, a$ as FFID_CREDITS_FEATURE_PATTERN, b0 as FFID_CREDITS_HISTORY_DEFAULT_LIMIT, b1 as FFID_CREDITS_HISTORY_MAX_LIMIT, b2 as FFID_CREDITS_HISTORY_MIN_LIMIT, b3 as FFID_CREDITS_IDEMPOTENCY_KEY_PATTERN, b4 as FFID_CREDITS_LOW_THRESHOLD_PERCENT, b5 as FFID_CREDITS_METADATA_MAX_BYTES, b6 as FFID_CREDIT_GRANT_KINDS, b7 as FFID_CREDIT_HISTORY_TYPES, b8 as FFID_CREDIT_PACK_MAX_QUANTITY, b9 as FFID_CREDIT_PACK_MIN_QUANTITY, ba as FFID_INQUIRY_ACQUISITION_SOURCES, bb as FFID_INQUIRY_CATEGORIES, bc as FFID_INQUIRY_CATEGORIES_SITE_2026, bd as TokenData, be as UseFFIDAnnouncementsOptions, bf as UseFFIDAnnouncementsReturn, bg as createTokenStore, bh as isFFIDInquiryAcquisitionSource, bi as isFFIDInquiryCategorySite2026, bj as useFFIDAnnouncements } from './index-CWGoIgYL.js';
 export { A as ALL_DENIED_EXCEPT_NECESSARY, i as CONSENT_COOKIE_NAME, j as CONSENT_DISMISSAL_TIMESTAMP_KEY, l as COOKIE_VERSION, D as DEFAULT_CONSENT_ERROR_MESSAGES, n as FFIDAnalyticsProvider, o as FFIDAnalyticsProviderProps, c as FFIDConsentCategories, q as FFIDConsentCategoryCode, e as FFIDConsentCategoryMetadata, v as FFIDConsentError, w as FFIDConsentErrorCode, x as FFIDConsentMergeStrategy, z as FFIDConsentMergeWarning, B as FFIDConsentMergeWarningEvent, F as FFIDConsentResult, H as FFIDConsentSource, a as FFIDConsentState, d as FFIDConsentSyncResult, L as FFIDCookieBanner, M as FFIDCookieBannerClassNames, N as FFIDCookieBannerProps, O as FFIDCookieLink, Q as FFIDCookieLinkProps, f as FFIDCookiePolicy, S as FFIDCookieSettings, T as FFIDCookieSettingsClassNames, U as FFIDCookieSettingsProps, Z as FFID_CONSENT_ERROR_CODES, ad as UseFFIDConsentPreferencesReturn, ae as UseFFIDConsentReturn, af as clearConsentDismissalTimestamp, ai as decodeConsentCookie, ak as encodeConsentCookie, am as readConsentCookie, an as readConsentDismissalTimestamp, ap as useFFIDConsent, aq as useFFIDConsentPreferences, ar as writeConsentCookie, as as writeConsentDismissalTimestamp } from './FFIDCookieLink-yt5SUr-W.js';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode, ComponentType, FC } from 'react';
@@ -1604,6 +1604,10 @@ declare class FFIDSDKError extends Error {
  * validates the OAuth `state` against the value persisted at authorize time
  * (CSRF protection, RFC 6749 §10.12), retrieves the PKCE verifier, exchanges
  * the code for tokens, and cleans the params out of the URL on success.
+ *
+ * When FFID refused the user, the callback carries `error` (+ FFID's
+ * `denial_reason`) instead of `code` (#6523). After the same `state` check the
+ * error is returned as an authorization error (see `./authorization-error`).
  */
 
 /**
@@ -1621,8 +1625,9 @@ interface HandleRedirectCallbackOptions {
     url?: string | undefined;
     /**
      * Whether to remove `code` / `state` from the browser URL via
-     * `window.history.replaceState` after a successful exchange. Defaults to
-     * `true`.
+     * `window.history.replaceState` after a successful exchange — and, on an
+     * authorization error, `state` only (#6523; see {@link ERROR_CALLBACK_CONSUMED_PARAMS}).
+     * Defaults to `true`.
      *
      * Set to `false` to take over URL cleanup on the consumer side. This matters
      * on Next.js App Router: the App Router patches `history.replaceState`, so
@@ -1642,7 +1647,9 @@ interface HandleRedirectCallbackOptions {
  * Complete an OAuth authorization-code redirect.
  *
  * Behavior:
- * 1. Reads `code` + `state` from `options.url ?? window.location.search`.
+ * 1. Reads `code` + `state` (or `error`) from `options.url ?? window.location.search`.
+ *    A URL with no `code` — and no `error` carrying a `state` — returns
+ *    `MISSING_AUTHORIZATION_CODE` without touching the stored state.
  * 2. CSRF guard: if a `state` exists on EITHER side (a stored state from
  *    authorize OR a `state` on the callback URL), the two MUST match — mismatch,
  *    a missing stored state, or an **omitted** callback `state` all **fail closed**
@@ -1652,6 +1659,17 @@ interface HandleRedirectCallbackOptions {
  * 3. Retrieves the PKCE verifier and exchanges the code for tokens.
  * 4. On success, removes `code` + `state` from the browser URL (skipped when
  *    `options.cleanUrl` is `false` — the consumer then owns URL cleanup).
+ * 5. When the URL carries `error` **and** `state` (FFID refused the user),
+ *    returns it as an authorization error after step 2 instead of exchanging
+ *    anything. Unlike a code callback there is no no-state leniency: the URL
+ *    `state` must match a stored one, so a crafted `?error=...&error_description=`
+ *    link cannot be shown as a denial (content spoofing). `code` is
+ *    the OAuth `error` (e.g. `access_denied`) and `details` holds FFID's
+ *    `denial_reason` — read it with `getFFIDAuthorizationError`. The PKCE
+ *    verifier is discarded and the consumed `state` is removed from the URL
+ *    (same `cleanUrl` rule), so a reload does not re-process it. `error` /
+ *    `error_description` / `denial_reason` stay in the URL.
+ *    Do not call `login()` again on this error: FFID refuses the same way.
  *
  * SSR-safe: when there is no `window` and no `options.url`, no exchange is
  * attempted and an error result is returned.
@@ -1661,6 +1679,77 @@ interface HandleRedirectCallbackOptions {
  */
 declare function handleRedirectCallback(client: HandleRedirectCallbackClient, options?: HandleRedirectCallbackOptions): Promise<FFIDApiResponse<void>>;
 
+/**
+ * OAuth authorization errors returned to the service's `redirect_uri` (#6523)
+ *
+ * When FFID's `/oauth/authorize` refuses a user, it redirects back with
+ * `error=<OAuth error>&error_description=...&state=...` (RFC 6749 §4.1.2.1). For
+ * subscription / seat denials it also adds the FFID extension `denial_reason`
+ * (#6498), so a service can tell "no seat in this organization" from "no
+ * subscription" without parsing `error_description`.
+ *
+ * Both callback paths build the same {@link FFIDError} from those params:
+ * - `handleRedirectCallback` / token-mode `FFIDProvider` (browser, PKCE)
+ * - `createServerAuthClient().handleCallback` (confidential / BFF)
+ *
+ * `error.code` is the OAuth `error` value verbatim (e.g. `access_denied`), and
+ * `error.details` is {@link FFIDAuthorizationErrorDetails}. Read it with
+ * {@link getFFIDAuthorizationError}.
+ *
+ * This module has no browser dependency so the server entry can share it.
+ */
+
+/**
+ * Values of FFID's `denial_reason` (the authorize error redirect and the
+ * `/oauth/userinfo` 403; `/oauth/introspect` only answers `active: false`). Kept
+ * identical to the FFID server's `DENIAL_REASONS` by a test in the FFID repository.
+ *
+ * This is a different vocabulary from `FFIDServiceAccessDenialReason`
+ * (`checkServiceAccess()`), which is derived from the subscription status.
+ */
+declare const FFID_OAUTH_DENIAL_REASONS: readonly ["no_membership", "no_active_subscription", "no_seat_assignment", "subscription_expired", "member_limit_reached"];
+type FFIDOAuthDenialReason = (typeof FFID_OAUTH_DENIAL_REASONS)[number];
+/** Runtime guard for {@link FFIDOAuthDenialReason}. Unknown values are `false`. */
+declare function isFFIDOAuthDenialReason(value: unknown): value is FFIDOAuthDenialReason;
+/** `FFIDError.details` of an authorization error */
+interface FFIDAuthorizationErrorDetails {
+    /** Marks the error as an authorize redirect error (vs. token / network errors) */
+    source: 'authorization';
+    /**
+     * FFID's `denial_reason`. `null` when FFID did not send one (any OAuth error other
+     * than a subscription / seat denial) **or** sent a value this SDK version does not
+     * know — the error itself is still returned, only the reason is unknown.
+     */
+    denialReason: FFIDOAuthDenialReason | null;
+    /**
+     * `error_description` as sent — short ASCII English meant for logs. The same text
+     * is `error.message` (when FFID sent one), so show end users guidance chosen by
+     * `denialReason` rather than the message itself.
+     */
+    errorDescription: string | null;
+}
+/** An authorization error read back by {@link getFFIDAuthorizationError} */
+interface FFIDAuthorizationError {
+    /** The OAuth `error` value, e.g. `access_denied`, `login_required` */
+    oauthError: string;
+    denialReason: FFIDOAuthDenialReason | null;
+    errorDescription: string | null;
+}
+/**
+ * Read an authorization error (and FFID's `denial_reason`) from an {@link FFIDError},
+ * e.g. `useFFID().error` or the result of `handleRedirectCallback` /
+ * `createServerAuthClient().handleCallback`. Returns `null` for any other error.
+ *
+ * ```ts
+ * const denial = getFFIDAuthorizationError(error)
+ * if (denial?.denialReason === 'no_seat_assignment') {
+ *   // Ask an organization owner / admin to add the user. Do not call login() again:
+ *   // FFID would refuse the same way.
+ * }
+ * ```
+ */
+declare function getFFIDAuthorizationError(error: FFIDError | null | undefined): FFIDAuthorizationError | null;
+
 /**
  * Redirect URI normalization (SDK copy)
  *
@@ -1951,7 +2040,10 @@ interface FFIDProviderProps extends FFIDConfig {
      * Set to `false` on Next.js App Router when the patched history API
      * re-evaluating `useSearchParams()` (and re-running effects that depend on
      * it) is a problem — then remove `code` / `state` yourself (keeping other
-     * query params) after authentication completes. Consumed callback params
+     * query params) after authentication completes. When FFID refused the user
+     * (`?error=` callback, #6523), the provider removes only the consumed `state`
+     * under the same rule (`error` / `denial_reason` stay for the app to read), so
+     * with `false` remove `state` too. Consumed callback params
      * left in the URL fail on reload with `STATE_MISMATCH_ERROR` (the one-time
      * OAuth `state` was already consumed), which also leaves an authenticated
      * user rendered as signed-out until the URL is cleaned.
@@ -2866,4 +2958,4 @@ declare function createInquiryMethods(deps: InquiryMethodsDeps): {
 };
 type FFIDInquiryClient = ReturnType<typeof createInquiryMethods>;
 
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, AGENCY_INVITE_COOKIE_MAX_AGE_SEC, AGENCY_INVITE_COOKIE_NAME, AGENCY_INVITE_TOKEN_PARAM, AGENCY_INVITE_TOKEN_REDACTION, type AgencyInviteCookieOptions, AnnouncementListResponse, BLOCKING_EFFECTIVE_STATUSES, CATALOG_HASH_PATTERN, type CaptureAgencyInviteTokenOptions, type CaptureAgencyInviteTokenResult, type ComputeEffectiveStatusInput, type ContractWizardFlowType, type ContractWizardResubscribeOptions, type ContractWizardSubscribeOptions, type ContractWizardSubscriptionOptions, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EffectiveSubscriptionStatus, type ExchangeCodeForTokensOptions, FFIDAccountType, type FFIDAddMemberParams, type FFIDAddMemberRequest, type FFIDAddMemberResponse, type FFIDAllowedLogoMimeType, FFIDAnnouncementsApiResponse, type FFIDAnnouncementsClient, FFIDAnnouncementsClientConfig, FFIDAnnouncementsLogger, FFIDApiResponse, type FFIDAssignableMemberRole, FFIDBillingInterval, FFIDBuyCreditsUrlParams, FFIDCacheAdapter, FFIDCancelPendingDowngradeResponse, FFIDCancelSubscriptionParams, FFIDCancelSubscriptionResponse, type FFIDCanonicalJsonValue, FFIDCatalogEnvironment, FFIDCatalogHashError, FFIDChangePlanParams, FFIDChangePlanResponse, FFIDCheckServiceAccessParams, type FFIDCheckoutSessionResponse, type FFIDClient, type FFIDCompanySizeCode, FFIDConfig, type FFIDCreateCheckoutParams, FFIDCreatePackCheckoutParams, type FFIDCreatePortalParams, FFIDCreditBalance, FFIDCreditConsumeParams, FFIDCreditConsumeResult, FFIDCreditHistoryPage, FFIDCreditPackCheckout, FFIDCreditPackList, type FFIDCreditsClient, type FFIDCreditsErrorCode, FFIDError, type FFIDErrorCode, type FFIDIndustryCode, type FFIDInquiryClient, FFIDInquiryCreateParams, FFIDInquiryCreateResponse, type FFIDInvitationStatus, type FFIDInviteMemberRequest, type FFIDInviteMemberResponse, type FFIDLeaveOrganizationParams, type FFIDLeaveOrganizationResponse, FFIDListCreditHistoryOptions, type FFIDListMembersResponse, FFIDListPlansResponse, type FFIDListingConsentInput, FFIDLogger, type FFIDLoginHistoryEntry, type FFIDLoginHistoryResponse, type FFIDLogoWallEntry, type FFIDLogoWallResponse, type FFIDMemberRole, type FFIDMemberStatus, type FFIDNewsletterBodySource, type FFIDNewsletterCampaignStatus, type FFIDNewsletterClient, type FFIDNewsletterConfirmParams, type FFIDNewsletterConfirmResponse, type FFIDNewsletterDispatchParams, type FFIDNewsletterDispatchResponse, type FFIDNewsletterSegment, type FFIDNewsletterSubscribeParams, type FFIDNewsletterSubscribeResponse, type FFIDNewsletterType, type FFIDNewsletterUnsubscribeParams, type FFIDNewsletterUnsubscribeResponse, type FFIDOAuthTokenResponse, FFIDOAuthUserInfo, FFIDOAuthUserInfoSubscription, FFIDOrganization, type FFIDOrganizationDomain, type FFIDOrganizationDomainsResponse, type FFIDOrganizationLogoUploadResponse, type FFIDOrganizationMember, type FFIDOrganizationNotificationPreferences, type FFIDOrganizationNotificationPreferencesResponse, type FFIDOrganizationProfile, type FFIDOrganizationProfileErrorCode, type FFIDOrganizationProfileResponse, type FFIDOtpSendResponse, type FFIDOtpVerifyResponse, type FFIDPasswordResetConfirmResponse, type FFIDPasswordResetResponse, type FFIDPasswordResetVerifyResponse, type FFIDPaymentConfiguration, FFIDPlanChangePreviewResponse, type FFIDPortalSessionResponse, FFIDPreviewPlanChangeParams, FFIDPreviewSeatChangeParams, type FFIDProfileCallOptions, FFIDProvider, type FFIDProviderProps, type FFIDProvisionMemberPlan, type FFIDProvisionMemberPlanStatus, type FFIDProvisionMemberResult, type FFIDProvisionMemberStatus, type FFIDProvisionOrganizationDryRun, type FFIDProvisionOrganizationMemberInput, type FFIDProvisionOrganizationOutcome, type FFIDProvisionOrganizationParams, type FFIDProvisionOrganizationResponse, type FFIDProvisionUserDryRun, type FFIDProvisionUserOutcome, type FFIDProvisionUserParams, type FFIDProvisionUserProfileInput, type FFIDProvisionUserResponse, type FFIDProvisionedOrganization, type FFIDProvisionedUser, FFIDPublishedCatalog, type FFIDRedirectErrorCode, type FFIDRedirectResult, type FFIDRemoveMemberResponse, type FFIDResetSessionResponse, FFIDSDKError, type FFIDScopeHashInput, type FFIDScopeHashPlan, FFIDSeatChangePreviewResponse, FFIDSeatsSummary, FFIDServiceAccessDecision, FFIDSessionResponse, FFIDSignOutResult, FFIDSubscribeParams, FFIDSubscribeResponse, FFIDSubscription, FFIDSubscriptionCheckResponse, FFIDSubscriptionContextValue, FFIDSubscriptionDetail, type FFIDSubscriptionErrorCode, FFIDSubscriptionStatus, FFIDTaxBehavior, type FFIDTaxConfiguration, type FFIDTokenIntrospectionResponse, type FFIDUpdateMemberRoleResponse, type FFIDUpdateNotificationPreferencesRequest, type FFIDUpdateUserProfileRequest, type FFIDUploadOrganizationLogoParams, type FFIDUpsertOrganizationProfileParams, type FFIDUpsertOrganizationProfileRequest, FFIDUser, type FFIDUserProfile, FFIDVerifyAccessTokenOptions, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_COMPANY_SIZE_CODES, FFID_CREDITS_ERROR_CODES, FFID_ERROR_CODES, FFID_INDUSTRY_CODES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, FFID_NEWSLETTER_DISPATCH_MAX_RECIPIENTS, FFID_NEWSLETTER_TYPES, FFID_ORGANIZATION_PROFILE_ERROR_CODES, FFID_SUBSCRIPTION_ERROR_CODES, type HandleRedirectCallbackClient, type HandleRedirectCallbackOptions, type KVNamespaceLike, ListAnnouncementsOptions, type NormalizeRedirectUriResult, type ReadAgencyInviteTokenOptions, type RedirectToAuthorizeOptions, TokenStore, type UseFFIDReturn, type UseRequireActiveSubscriptionOptions, type UseRequireActiveSubscriptionReturn, type WithFFIDAuthOptions, type WithSubscriptionOptions, canonicalizeCatalogValue, captureAgencyInviteToken, clearAgencyInviteToken, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createFFIDAnnouncementsClient, createFFIDClient, createKVCacheAdapter, createMemoryCacheAdapter, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, hashCanonicalJson, isBlockedFromUserinfo, normalizeRedirectUri, readAgencyInviteCookie, readAgencyInviteToken, redactAgencyInviteToken, retrieveCodeVerifier, retrieveState, sha256Hex, storeCodeVerifier, storeState, useFFID, useRequireActiveSubscription, useSubscription, validatePublishedCatalog, withFFIDAuth, withSubscription };
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, AGENCY_INVITE_COOKIE_MAX_AGE_SEC, AGENCY_INVITE_COOKIE_NAME, AGENCY_INVITE_TOKEN_PARAM, AGENCY_INVITE_TOKEN_REDACTION, type AgencyInviteCookieOptions, AnnouncementListResponse, BLOCKING_EFFECTIVE_STATUSES, CATALOG_HASH_PATTERN, type CaptureAgencyInviteTokenOptions, type CaptureAgencyInviteTokenResult, type ComputeEffectiveStatusInput, type ContractWizardFlowType, type ContractWizardResubscribeOptions, type ContractWizardSubscribeOptions, type ContractWizardSubscriptionOptions, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EffectiveSubscriptionStatus, type ExchangeCodeForTokensOptions, FFIDAccountType, type FFIDAddMemberParams, type FFIDAddMemberRequest, type FFIDAddMemberResponse, type FFIDAllowedLogoMimeType, FFIDAnnouncementsApiResponse, type FFIDAnnouncementsClient, FFIDAnnouncementsClientConfig, FFIDAnnouncementsLogger, FFIDApiResponse, type FFIDAssignableMemberRole, type FFIDAuthorizationError, type FFIDAuthorizationErrorDetails, FFIDBillingInterval, FFIDBuyCreditsUrlParams, FFIDCacheAdapter, FFIDCancelPendingDowngradeResponse, FFIDCancelSubscriptionParams, FFIDCancelSubscriptionResponse, type FFIDCanonicalJsonValue, FFIDCatalogEnvironment, FFIDCatalogHashError, FFIDChangePlanParams, FFIDChangePlanResponse, FFIDCheckServiceAccessParams, type FFIDCheckoutSessionResponse, type FFIDClient, type FFIDCompanySizeCode, FFIDConfig, type FFIDCreateCheckoutParams, FFIDCreatePackCheckoutParams, type FFIDCreatePortalParams, FFIDCreditBalance, FFIDCreditConsumeParams, FFIDCreditConsumeResult, FFIDCreditHistoryPage, FFIDCreditPackCheckout, FFIDCreditPackList, type FFIDCreditsClient, type FFIDCreditsErrorCode, FFIDError, type FFIDErrorCode, type FFIDIndustryCode, type FFIDInquiryClient, FFIDInquiryCreateParams, FFIDInquiryCreateResponse, type FFIDInvitationStatus, type FFIDInviteMemberRequest, type FFIDInviteMemberResponse, type FFIDLeaveOrganizationParams, type FFIDLeaveOrganizationResponse, FFIDListCreditHistoryOptions, type FFIDListMembersResponse, FFIDListPlansResponse, type FFIDListingConsentInput, FFIDLogger, type FFIDLoginHistoryEntry, type FFIDLoginHistoryResponse, type FFIDLogoWallEntry, type FFIDLogoWallResponse, type FFIDMemberRole, type FFIDMemberStatus, type FFIDNewsletterBodySource, type FFIDNewsletterCampaignStatus, type FFIDNewsletterClient, type FFIDNewsletterConfirmParams, type FFIDNewsletterConfirmResponse, type FFIDNewsletterDispatchParams, type FFIDNewsletterDispatchResponse, type FFIDNewsletterSegment, type FFIDNewsletterSubscribeParams, type FFIDNewsletterSubscribeResponse, type FFIDNewsletterType, type FFIDNewsletterUnsubscribeParams, type FFIDNewsletterUnsubscribeResponse, type FFIDOAuthDenialReason, type FFIDOAuthTokenResponse, FFIDOAuthUserInfo, FFIDOAuthUserInfoSubscription, FFIDOrganization, type FFIDOrganizationDomain, type FFIDOrganizationDomainsResponse, type FFIDOrganizationLogoUploadResponse, type FFIDOrganizationMember, type FFIDOrganizationNotificationPreferences, type FFIDOrganizationNotificationPreferencesResponse, type FFIDOrganizationProfile, type FFIDOrganizationProfileErrorCode, type FFIDOrganizationProfileResponse, type FFIDOtpSendResponse, type FFIDOtpVerifyResponse, type FFIDPasswordResetConfirmResponse, type FFIDPasswordResetResponse, type FFIDPasswordResetVerifyResponse, type FFIDPaymentConfiguration, FFIDPlanChangePreviewResponse, type FFIDPortalSessionResponse, FFIDPreviewPlanChangeParams, FFIDPreviewSeatChangeParams, type FFIDProfileCallOptions, FFIDProvider, type FFIDProviderProps, type FFIDProvisionMemberPlan, type FFIDProvisionMemberPlanStatus, type FFIDProvisionMemberResult, type FFIDProvisionMemberStatus, type FFIDProvisionOrganizationDryRun, type FFIDProvisionOrganizationMemberInput, type FFIDProvisionOrganizationOutcome, type FFIDProvisionOrganizationParams, type FFIDProvisionOrganizationResponse, type FFIDProvisionUserDryRun, type FFIDProvisionUserOutcome, type FFIDProvisionUserParams, type FFIDProvisionUserProfileInput, type FFIDProvisionUserResponse, type FFIDProvisionedOrganization, type FFIDProvisionedUser, FFIDPublishedCatalog, type FFIDRedirectErrorCode, type FFIDRedirectResult, type FFIDRemoveMemberResponse, type FFIDResetSessionResponse, FFIDSDKError, type FFIDScopeHashInput, type FFIDScopeHashPlan, FFIDSeatChangePreviewResponse, FFIDSeatsSummary, FFIDServiceAccessDecision, FFIDSessionResponse, FFIDSignOutResult, FFIDSubscribeParams, FFIDSubscribeResponse, FFIDSubscription, FFIDSubscriptionCheckResponse, FFIDSubscriptionContextValue, FFIDSubscriptionDetail, type FFIDSubscriptionErrorCode, FFIDSubscriptionStatus, FFIDTaxBehavior, type FFIDTaxConfiguration, type FFIDTokenIntrospectionResponse, type FFIDUpdateMemberRoleResponse, type FFIDUpdateNotificationPreferencesRequest, type FFIDUpdateUserProfileRequest, type FFIDUploadOrganizationLogoParams, type FFIDUpsertOrganizationProfileParams, type FFIDUpsertOrganizationProfileRequest, FFIDUser, type FFIDUserProfile, FFIDVerifyAccessTokenOptions, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_COMPANY_SIZE_CODES, FFID_CREDITS_ERROR_CODES, FFID_ERROR_CODES, FFID_INDUSTRY_CODES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, FFID_NEWSLETTER_DISPATCH_MAX_RECIPIENTS, FFID_NEWSLETTER_TYPES, FFID_OAUTH_DENIAL_REASONS, FFID_ORGANIZATION_PROFILE_ERROR_CODES, FFID_SUBSCRIPTION_ERROR_CODES, type HandleRedirectCallbackClient, type HandleRedirectCallbackOptions, type KVNamespaceLike, ListAnnouncementsOptions, type NormalizeRedirectUriResult, type ReadAgencyInviteTokenOptions, type RedirectToAuthorizeOptions, TokenStore, type UseFFIDReturn, type UseRequireActiveSubscriptionOptions, type UseRequireActiveSubscriptionReturn, type WithFFIDAuthOptions, type WithSubscriptionOptions, canonicalizeCatalogValue, captureAgencyInviteToken, clearAgencyInviteToken, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createFFIDAnnouncementsClient, createFFIDClient, createKVCacheAdapter, createMemoryCacheAdapter, generateCodeChallenge, generateCodeVerifier, getFFIDAuthorizationError, handleRedirectCallback, hasAccessFromUserinfo, hashCanonicalJson, isBlockedFromUserinfo, isFFIDOAuthDenialReason, normalizeRedirectUri, readAgencyInviteCookie, readAgencyInviteToken, redactAgencyInviteToken, retrieveCodeVerifier, retrieveState, sha256Hex, storeCodeVerifier, storeState, useFFID, useRequireActiveSubscription, useSubscription, validatePublishedCatalog, withFFIDAuth, withSubscription };

package/dist/index.js

@@ -1,5 +1,5 @@
-import { useFFIDContext, useSubscription } from './chunk-OXW6QSTO.js';
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, AGENCY_INVITE_COOKIE_MAX_AGE_SEC, AGENCY_INVITE_COOKIE_NAME, AGENCY_INVITE_TOKEN_PARAM, AGENCY_INVITE_TOKEN_REDACTION, BLOCKING_EFFECTIVE_STATUSES, CATALOG_HASH_PATTERN, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDCatalogHashError, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_CATALOG_ENVIRONMENTS, FFID_CATALOG_PUBLICATION_STATUSES, FFID_COMPANY_SIZE_CODES, FFID_CREDITS_CONSUME_MAX_AMOUNT, FFID_CREDITS_CONSUME_MIN_AMOUNT, FFID_CREDITS_ERROR_CODES, FFID_CREDITS_FEATURE_PATTERN, FFID_CREDITS_HISTORY_DEFAULT_LIMIT, FFID_CREDITS_HISTORY_MAX_LIMIT, FFID_CREDITS_HISTORY_MIN_LIMIT, FFID_CREDITS_IDEMPOTENCY_KEY_PATTERN, FFID_CREDITS_LOW_THRESHOLD_PERCENT, FFID_CREDITS_METADATA_MAX_BYTES, FFID_CREDIT_GRANT_KINDS, FFID_CREDIT_HISTORY_TYPES, FFID_CREDIT_PACK_MAX_QUANTITY, FFID_CREDIT_PACK_MIN_QUANTITY, FFID_ERROR_CODES, FFID_INDUSTRY_CODES, FFID_INQUIRY_ACQUISITION_SOURCES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, FFID_ORGANIZATION_PROFILE_ERROR_CODES, FFID_SUBSCRIPTION_ERROR_CODES, canonicalizeCatalogValue, captureAgencyInviteToken, clearAgencyInviteToken, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, hashCanonicalJson, isBlockedFromUserinfo, isFFIDInquiryAcquisitionSource, isFFIDInquiryCategorySite2026, normalizeRedirectUri, readAgencyInviteCookie, readAgencyInviteToken, redactAgencyInviteToken, retrieveCodeVerifier, retrieveState, sha256Hex, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useSubscription, validatePublishedCatalog, withSubscription } from './chunk-OXW6QSTO.js';
+import { useFFIDContext, useSubscription } from './chunk-ITSQIAO5.js';
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, AGENCY_INVITE_COOKIE_MAX_AGE_SEC, AGENCY_INVITE_COOKIE_NAME, AGENCY_INVITE_TOKEN_PARAM, AGENCY_INVITE_TOKEN_REDACTION, BLOCKING_EFFECTIVE_STATUSES, CATALOG_HASH_PATTERN, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDCatalogHashError, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_CATALOG_ENVIRONMENTS, FFID_CATALOG_PUBLICATION_STATUSES, FFID_COMPANY_SIZE_CODES, FFID_CREDITS_CONSUME_MAX_AMOUNT, FFID_CREDITS_CONSUME_MIN_AMOUNT, FFID_CREDITS_ERROR_CODES, FFID_CREDITS_FEATURE_PATTERN, FFID_CREDITS_HISTORY_DEFAULT_LIMIT, FFID_CREDITS_HISTORY_MAX_LIMIT, FFID_CREDITS_HISTORY_MIN_LIMIT, FFID_CREDITS_IDEMPOTENCY_KEY_PATTERN, FFID_CREDITS_LOW_THRESHOLD_PERCENT, FFID_CREDITS_METADATA_MAX_BYTES, FFID_CREDIT_GRANT_KINDS, FFID_CREDIT_HISTORY_TYPES, FFID_CREDIT_PACK_MAX_QUANTITY, FFID_CREDIT_PACK_MIN_QUANTITY, FFID_ERROR_CODES, FFID_INDUSTRY_CODES, FFID_INQUIRY_ACQUISITION_SOURCES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, FFID_OAUTH_DENIAL_REASONS, FFID_ORGANIZATION_PROFILE_ERROR_CODES, FFID_SUBSCRIPTION_ERROR_CODES, canonicalizeCatalogValue, captureAgencyInviteToken, clearAgencyInviteToken, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, getFFIDAuthorizationError, handleRedirectCallback, hasAccessFromUserinfo, hashCanonicalJson, isBlockedFromUserinfo, isFFIDInquiryAcquisitionSource, isFFIDInquiryCategorySite2026, isFFIDOAuthDenialReason, normalizeRedirectUri, readAgencyInviteCookie, readAgencyInviteToken, redactAgencyInviteToken, retrieveCodeVerifier, retrieveState, sha256Hex, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useSubscription, validatePublishedCatalog, withSubscription } from './chunk-ITSQIAO5.js';
 export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, CONSENT_DISMISSAL_TIMESTAMP_KEY, COOKIE_VERSION, DEFAULT_CONSENT_ERROR_MESSAGES, FFIDAnalyticsProvider, FFIDConsentError, FFIDCookieBanner, FFIDCookieLink, FFIDCookieSettings, FFID_CONSENT_ERROR_CODES, clearConsentDismissalTimestamp, decodeConsentCookie, encodeConsentCookie, readConsentCookie, readConsentDismissalTimestamp, useFFIDConsent, useFFIDConsentPreferences, writeConsentCookie, writeConsentDismissalTimestamp } from './chunk-S2AEBJRX.js';
 import { useEffect, useRef } from 'react';
 import { jsx, Fragment } from 'react/jsx-runtime';

package/dist/server/index.cjs

@@ -1371,7 +1371,7 @@ var FFID_ORGANIZATION_PROFILE_ERROR_CODES = {
 };
 
 // src/client/version-check.ts
-var SDK_VERSION = "10.0.0";
+var SDK_VERSION = "10.1.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -4365,6 +4365,50 @@ function createFFIDClient(config) {
   };
 }
 
+// src/client/authorization-error.ts
+var FFID_OAUTH_DENIAL_REASONS = [
+  /** The user is not a member of the organization */
+  "no_membership",
+  /** The organization has no usable subscription for the service */
+  "no_active_subscription",
+  /** The organization has a subscription, but the user has no seat in it */
+  "no_seat_assignment",
+  /** The subscription has expired (canceled / past due beyond grace) */
+  "subscription_expired",
+  /** The flat plan's member limit is full, so no seat could be given */
+  "member_limit_reached"
+];
+function isFFIDOAuthDenialReason(value) {
+  return typeof value === "string" && FFID_OAUTH_DENIAL_REASONS.includes(value);
+}
+var DEFAULT_AUTHORIZATION_ERROR_MESSAGE = "\u8A8D\u53EF\u30B5\u30FC\u30D0\u30FC\u304C\u30A8\u30E9\u30FC\u3092\u8FD4\u3057\u307E\u3057\u305F";
+function buildAuthorizationError(params) {
+  const oauthError = params.get("error");
+  if (!oauthError) return null;
+  const rawReason = params.get("denial_reason");
+  const errorDescription = params.get("error_description");
+  const details = {
+    source: "authorization",
+    denialReason: isFFIDOAuthDenialReason(rawReason) ? rawReason : null,
+    errorDescription
+  };
+  return {
+    code: oauthError,
+    message: errorDescription ?? DEFAULT_AUTHORIZATION_ERROR_MESSAGE,
+    details: { ...details }
+  };
+}
+function getFFIDAuthorizationError(error) {
+  const details = error?.details;
+  if (!error || !details || details.source !== "authorization") return null;
+  const description = details.errorDescription;
+  return {
+    oauthError: error.code,
+    denialReason: isFFIDOAuthDenialReason(details.denialReason) ? details.denialReason : null,
+    errorDescription: typeof description === "string" ? description : null
+  };
+}
+
 // src/client/cache/memory-cache-adapter.ts
 var MS_PER_SECOND2 = 1e3;
 function createMemoryCacheAdapter() {
@@ -4655,14 +4699,9 @@ function createServerAuthClient(config) {
         }
       };
     }
-    const errorParam = url.searchParams.get("error");
-    if (errorParam) {
-      return {
-        error: {
-          code: errorParam,
-          message: url.searchParams.get("error_description") ?? "\u8A8D\u53EF\u30B5\u30FC\u30D0\u30FC\u304C\u30A8\u30E9\u30FC\u3092\u8FD4\u3057\u307E\u3057\u305F"
-        }
-      };
+    const authorizationError = buildAuthorizationError(url.searchParams);
+    if (authorizationError) {
+      return { error: authorizationError };
     }
     const code = url.searchParams.get("code");
     if (!code) {
@@ -4774,6 +4813,7 @@ exports.FFID_ERROR_CODES = FFID_ERROR_CODES;
 exports.FFID_INDUSTRY_CODES = FFID_INDUSTRY_CODES;
 exports.FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES = FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES;
 exports.FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB = FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB;
+exports.FFID_OAUTH_DENIAL_REASONS = FFID_OAUTH_DENIAL_REASONS;
 exports.FFID_ORGANIZATION_PROFILE_ERROR_CODES = FFID_ORGANIZATION_PROFILE_ERROR_CODES;
 exports.FFID_SESSION_COOKIE_NAME = FFID_SESSION_COOKIE_NAME;
 exports.canonicalizeCatalogValue = canonicalizeCatalogValue;
@@ -4792,9 +4832,11 @@ exports.createVerifyAccessToken = createVerifyAccessToken;
 exports.decodeConsentCookie = decodeConsentCookie;
 exports.encodeConsentCookie = encodeConsentCookie;
 exports.generateServerState = generateServerState;
+exports.getFFIDAuthorizationError = getFFIDAuthorizationError;
 exports.getFFIDConsentFromCookieHeader = getFFIDConsentFromCookieHeader;
 exports.getFFIDConsentFromCookies = getFFIDConsentFromCookies;
 exports.hashCanonicalJson = hashCanonicalJson;
+exports.isFFIDOAuthDenialReason = isFFIDOAuthDenialReason;
 exports.sessionCookies = sessionCookies;
 exports.sha256Hex = sha256Hex;
 exports.validatePublishedCatalog = validatePublishedCatalog;

package/dist/server/index.d.cts

@@ -1,5 +1,5 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo, f as FFIDCatalogEnvironment, g as FFIDBillingInterval, h as FFIDTaxBehavior, i as FFIDPublishedCatalog } from '../ffid-client-CumygXXz.cjs';
-export { j as FFIDAddMemberParams, k as FFIDAddMemberRequest, l as FFIDAddMemberResponse, m as FFIDAllowedLogoMimeType, n as FFIDAssignableMemberRole, o as FFIDCacheConfig, p as FFIDCatalogPublication, q as FFIDCatalogPublicationStatus, r as FFIDClient, s as FFIDCompanySizeCode, t as FFIDConfig, u as FFIDIndustryCode, v as FFIDListMembersResponse, w as FFIDListingConsentInput, x as FFIDLogoWallEntry, y as FFIDLogoWallResponse, z as FFIDMemberRole, A as FFIDOrganization, B as FFIDOrganizationLogoUploadResponse, C as FFIDOrganizationMember, D as FFIDOrganizationProfile, E as FFIDOrganizationProfileErrorCode, G as FFIDOrganizationProfileResponse, H as FFIDOtpSendResponse, I as FFIDOtpVerifyResponse, J as FFIDPasswordResetConfirmResponse, K as FFIDPasswordResetResponse, L as FFIDPasswordResetVerifyResponse, M as FFIDProfileCallOptions, N as FFIDProvisionMemberPlan, O as FFIDProvisionMemberPlanStatus, P as FFIDProvisionMemberResult, Q as FFIDProvisionMemberStatus, R as FFIDProvisionOrganizationDryRun, S as FFIDProvisionOrganizationMemberInput, T as FFIDProvisionOrganizationOutcome, U as FFIDProvisionOrganizationParams, V as FFIDProvisionOrganizationResponse, W as FFIDProvisionUserDryRun, X as FFIDProvisionUserOutcome, Y as FFIDProvisionUserParams, Z as FFIDProvisionUserProfileInput, _ as FFIDProvisionUserResponse, $ as FFIDProvisionedOrganization, a0 as FFIDProvisionedUser, a1 as FFIDPublishedPlan, a2 as FFIDRemoveMemberResponse, a3 as FFIDResetSessionResponse, a4 as FFIDSubscription, a5 as FFIDUpdateMemberRoleResponse, a6 as FFIDUpdateUserProfileRequest, a7 as FFIDUploadOrganizationLogoParams, a8 as FFIDUpsertOrganizationProfileParams, a9 as FFIDUpsertOrganizationProfileRequest, aa as FFIDUser, ab as FFIDUserProfile, ac as FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, ad as FFID_CATALOG_ENVIRONMENTS, ae as FFID_CATALOG_PUBLICATION_STATUSES, af as FFID_COMPANY_SIZE_CODES, ag as FFID_INDUSTRY_CODES, ah as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, ai as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, aj as FFID_ORGANIZATION_PROFILE_ERROR_CODES, ak as TokenData, al as TokenStore, am as createFFIDClient, an as createTokenStore } from '../ffid-client-CumygXXz.cjs';
+import { F as FFIDError, a as FFIDLogger, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo, f as FFIDCatalogEnvironment, g as FFIDBillingInterval, h as FFIDTaxBehavior, i as FFIDPublishedCatalog } from '../ffid-client-qcfCWLfs.cjs';
+export { j as FFIDAddMemberParams, k as FFIDAddMemberRequest, l as FFIDAddMemberResponse, m as FFIDAllowedLogoMimeType, n as FFIDAssignableMemberRole, o as FFIDCacheConfig, p as FFIDCatalogPublication, q as FFIDCatalogPublicationStatus, r as FFIDClient, s as FFIDCompanySizeCode, t as FFIDConfig, u as FFIDIndustryCode, v as FFIDListMembersResponse, w as FFIDListingConsentInput, x as FFIDLogoWallEntry, y as FFIDLogoWallResponse, z as FFIDMemberRole, A as FFIDOrganization, B as FFIDOrganizationLogoUploadResponse, C as FFIDOrganizationMember, D as FFIDOrganizationProfile, E as FFIDOrganizationProfileErrorCode, G as FFIDOrganizationProfileResponse, H as FFIDOtpSendResponse, I as FFIDOtpVerifyResponse, J as FFIDPasswordResetConfirmResponse, K as FFIDPasswordResetResponse, L as FFIDPasswordResetVerifyResponse, M as FFIDProfileCallOptions, N as FFIDProvisionMemberPlan, O as FFIDProvisionMemberPlanStatus, P as FFIDProvisionMemberResult, Q as FFIDProvisionMemberStatus, R as FFIDProvisionOrganizationDryRun, S as FFIDProvisionOrganizationMemberInput, T as FFIDProvisionOrganizationOutcome, U as FFIDProvisionOrganizationParams, V as FFIDProvisionOrganizationResponse, W as FFIDProvisionUserDryRun, X as FFIDProvisionUserOutcome, Y as FFIDProvisionUserParams, Z as FFIDProvisionUserProfileInput, _ as FFIDProvisionUserResponse, $ as FFIDProvisionedOrganization, a0 as FFIDProvisionedUser, a1 as FFIDPublishedPlan, a2 as FFIDRemoveMemberResponse, a3 as FFIDResetSessionResponse, a4 as FFIDSubscription, a5 as FFIDUpdateMemberRoleResponse, a6 as FFIDUpdateUserProfileRequest, a7 as FFIDUploadOrganizationLogoParams, a8 as FFIDUpsertOrganizationProfileParams, a9 as FFIDUpsertOrganizationProfileRequest, aa as FFIDUser, ab as FFIDUserProfile, ac as FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, ad as FFID_CATALOG_ENVIRONMENTS, ae as FFID_CATALOG_PUBLICATION_STATUSES, af as FFID_COMPANY_SIZE_CODES, ag as FFID_INDUSTRY_CODES, ah as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, ai as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, aj as FFID_ORGANIZATION_PROFILE_ERROR_CODES, ak as TokenData, al as TokenStore, am as createFFIDClient, an as createTokenStore } from '../ffid-client-qcfCWLfs.cjs';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-Ce2eXQtB.cjs';
 import { z } from 'zod';
 import '../types-Cjb9J0rL.cjs';
@@ -31,6 +31,77 @@ declare const FFID_ERROR_CODES: {
  */
 type FFIDErrorCode = (typeof FFID_ERROR_CODES)[keyof typeof FFID_ERROR_CODES];
 
+/**
+ * OAuth authorization errors returned to the service's `redirect_uri` (#6523)
+ *
+ * When FFID's `/oauth/authorize` refuses a user, it redirects back with
+ * `error=<OAuth error>&error_description=...&state=...` (RFC 6749 §4.1.2.1). For
+ * subscription / seat denials it also adds the FFID extension `denial_reason`
+ * (#6498), so a service can tell "no seat in this organization" from "no
+ * subscription" without parsing `error_description`.
+ *
+ * Both callback paths build the same {@link FFIDError} from those params:
+ * - `handleRedirectCallback` / token-mode `FFIDProvider` (browser, PKCE)
+ * - `createServerAuthClient().handleCallback` (confidential / BFF)
+ *
+ * `error.code` is the OAuth `error` value verbatim (e.g. `access_denied`), and
+ * `error.details` is {@link FFIDAuthorizationErrorDetails}. Read it with
+ * {@link getFFIDAuthorizationError}.
+ *
+ * This module has no browser dependency so the server entry can share it.
+ */
+
+/**
+ * Values of FFID's `denial_reason` (the authorize error redirect and the
+ * `/oauth/userinfo` 403; `/oauth/introspect` only answers `active: false`). Kept
+ * identical to the FFID server's `DENIAL_REASONS` by a test in the FFID repository.
+ *
+ * This is a different vocabulary from `FFIDServiceAccessDenialReason`
+ * (`checkServiceAccess()`), which is derived from the subscription status.
+ */
+declare const FFID_OAUTH_DENIAL_REASONS: readonly ["no_membership", "no_active_subscription", "no_seat_assignment", "subscription_expired", "member_limit_reached"];
+type FFIDOAuthDenialReason = (typeof FFID_OAUTH_DENIAL_REASONS)[number];
+/** Runtime guard for {@link FFIDOAuthDenialReason}. Unknown values are `false`. */
+declare function isFFIDOAuthDenialReason(value: unknown): value is FFIDOAuthDenialReason;
+/** `FFIDError.details` of an authorization error */
+interface FFIDAuthorizationErrorDetails {
+    /** Marks the error as an authorize redirect error (vs. token / network errors) */
+    source: 'authorization';
+    /**
+     * FFID's `denial_reason`. `null` when FFID did not send one (any OAuth error other
+     * than a subscription / seat denial) **or** sent a value this SDK version does not
+     * know — the error itself is still returned, only the reason is unknown.
+     */
+    denialReason: FFIDOAuthDenialReason | null;
+    /**
+     * `error_description` as sent — short ASCII English meant for logs. The same text
+     * is `error.message` (when FFID sent one), so show end users guidance chosen by
+     * `denialReason` rather than the message itself.
+     */
+    errorDescription: string | null;
+}
+/** An authorization error read back by {@link getFFIDAuthorizationError} */
+interface FFIDAuthorizationError {
+    /** The OAuth `error` value, e.g. `access_denied`, `login_required` */
+    oauthError: string;
+    denialReason: FFIDOAuthDenialReason | null;
+    errorDescription: string | null;
+}
+/**
+ * Read an authorization error (and FFID's `denial_reason`) from an {@link FFIDError},
+ * e.g. `useFFID().error` or the result of `handleRedirectCallback` /
+ * `createServerAuthClient().handleCallback`. Returns `null` for any other error.
+ *
+ * ```ts
+ * const denial = getFFIDAuthorizationError(error)
+ * if (denial?.denialReason === 'no_seat_assignment') {
+ *   // Ask an organization owner / admin to add the user. Do not call login() again:
+ *   // FFID would refuse the same way.
+ * }
+ * ```
+ */
+declare function getFFIDAuthorizationError(error: FFIDError | null | undefined): FFIDAuthorizationError | null;
+
 /** Token verification - verifyAccessToken() implementation */
 
 /** Dependencies required by verifyAccessToken */
@@ -566,4 +637,4 @@ declare function computeScopeHash(input: FFIDScopeHashInput): Promise<string>;
  */
 declare function validatePublishedCatalog(catalog: unknown): asserts catalog is FFIDPublishedCatalog;
 
-export { ALL_DENIED_EXCEPT_NECESSARY, type BuildAuthorizeUrlOptions, type BuildAuthorizeUrlResult, CATALOG_HASH_PATTERN, CONSENT_COOKIE_NAME, COOKIE_VERSION, type CookieOptions, FFIDCacheAdapter, type FFIDCanonicalJsonValue, FFIDCatalogEnvironment, FFIDCatalogHashError, type FFIDConsentCategories, type FFIDConsentCategoryCode, type FFIDCookieStoreLike, type FFIDErrorCode, FFIDOAuthUserInfo, type FFIDPaymentConfiguration, FFIDPublishedCatalog, type FFIDScopeHashInput, type FFIDScopeHashPlan, FFIDTaxBehavior, type FFIDTaxConfiguration, FFIDVerifyAccessTokenOptions, FFID_ERROR_CODES, FFID_SESSION_COOKIE_NAME, type HandleCallbackInput, type KVNamespaceLike, type ServerAuthClient, type ServerAuthConfig, type ServerSessionTokens, type ServerTokenResult, canonicalizeCatalogValue, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createKVCacheAdapter, createMemoryCacheAdapter, createServerAuthClient, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, generateServerState, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies, hashCanonicalJson, sessionCookies, sha256Hex, validatePublishedCatalog };
+export { ALL_DENIED_EXCEPT_NECESSARY, type BuildAuthorizeUrlOptions, type BuildAuthorizeUrlResult, CATALOG_HASH_PATTERN, CONSENT_COOKIE_NAME, COOKIE_VERSION, type CookieOptions, type FFIDAuthorizationError, type FFIDAuthorizationErrorDetails, FFIDCacheAdapter, type FFIDCanonicalJsonValue, FFIDCatalogEnvironment, FFIDCatalogHashError, type FFIDConsentCategories, type FFIDConsentCategoryCode, type FFIDCookieStoreLike, type FFIDErrorCode, type FFIDOAuthDenialReason, FFIDOAuthUserInfo, type FFIDPaymentConfiguration, FFIDPublishedCatalog, type FFIDScopeHashInput, type FFIDScopeHashPlan, FFIDTaxBehavior, type FFIDTaxConfiguration, FFIDVerifyAccessTokenOptions, FFID_ERROR_CODES, FFID_OAUTH_DENIAL_REASONS, FFID_SESSION_COOKIE_NAME, type HandleCallbackInput, type KVNamespaceLike, type ServerAuthClient, type ServerAuthConfig, type ServerSessionTokens, type ServerTokenResult, canonicalizeCatalogValue, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createKVCacheAdapter, createMemoryCacheAdapter, createServerAuthClient, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, generateServerState, getFFIDAuthorizationError, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies, hashCanonicalJson, isFFIDOAuthDenialReason, sessionCookies, sha256Hex, validatePublishedCatalog };