@feelflow/ffid-sdk 10.0.0 → 11.0.0

package/dist/server/index.cjs

@@ -305,6 +305,9 @@ var OAUTH_INTROSPECT_ENDPOINT = "/api/v1/oauth/introspect";
 var CACHE_KEY_PREFIX = "ffid:introspect:";
 var HEX_BASE = 16;
 var HEX_BYTE_WIDTH = 2;
+var HTTP_TOO_MANY_REQUESTS = 429;
+var HTTP_SERVER_ERROR_MIN = 500;
+var HTTP_SERVER_ERROR_LIMIT = 600;
 function createVerifyAccessToken(deps) {
   const { authMode, baseUrl, serviceCode, serviceApiKey, verifyStrategy, logger, createError, errorCodes, cache, timeout } = deps;
   let jwtVerify2 = null;
@@ -359,6 +362,16 @@ function createVerifyAccessToken(deps) {
     }
     return verifyViaIntrospect(accessToken);
   }
+  function introspectionUnavailable(status) {
+    logger.error("Token introspection unavailable", { status });
+    return {
+      error: {
+        code: errorCodes.NETWORK_ERROR,
+        message: `\u30C8\u30FC\u30AF\u30F3\u691C\u8A3C\u30B5\u30FC\u30D3\u30B9\u304C\u4E00\u6642\u7684\u306B\u5229\u7528\u3067\u304D\u307E\u305B\u3093 (status: ${status})`,
+        details: { status }
+      }
+    };
+  }
   async function verifyViaIntrospect(accessToken, cacheKeySuffix) {
     if (!serviceApiKey) {
       return {
@@ -416,10 +429,12 @@ function createVerifyAccessToken(deps) {
         }
       };
     }
+    const upstreamUnavailable = response.status === HTTP_TOO_MANY_REQUESTS || response.status >= HTTP_SERVER_ERROR_MIN && response.status < HTTP_SERVER_ERROR_LIMIT;
     let introspectResponse;
     try {
       introspectResponse = await response.json();
     } catch (parseError) {
+      if (upstreamUnavailable) return introspectionUnavailable(response.status);
       logger.error("Parse error during token verification:", parseError);
       return {
         error: {
@@ -428,6 +443,7 @@ function createVerifyAccessToken(deps) {
         }
       };
     }
+    if (upstreamUnavailable) return introspectionUnavailable(response.status);
     if (!response.ok) {
       const errorBody = introspectResponse;
       return {
@@ -1371,7 +1387,7 @@ var FFID_ORGANIZATION_PROFILE_ERROR_CODES = {
 };
 
 // src/client/version-check.ts
-var SDK_VERSION = "10.0.0";
+var SDK_VERSION = "11.0.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1939,7 +1955,7 @@ function createInviteMethods(deps) {
     }).toString();
     return fetchWithAuth(`${EXT_INVITE_ENDPOINT}?${query}`, {
       method: "POST",
-      body: JSON.stringify({ email: params.email, role: params.role })
+      body: JSON.stringify({ email: params.email, role: params.role, inviterUserId: params.inviterUserId })
     });
   }
   return { inviteMember };
@@ -2242,6 +2258,25 @@ function createOAuthTokenMethods(deps) {
   return { exchangeCodeForTokens, refreshAccessToken, signOutToken };
 }
 
+// src/client/request-timeout.ts
+function withRequestTimeout(options, timeout) {
+  if (timeout === void 0 || options.signal?.aborted) return options;
+  const deadline = AbortSignal.timeout(timeout);
+  if (!options.signal) return { ...options, signal: deadline };
+  const callerSignal = options.signal;
+  const controller = new AbortController();
+  const abortFromCaller = () => abort(callerSignal.reason);
+  const abortFromDeadline = () => abort(deadline.reason);
+  function abort(reason) {
+    callerSignal.removeEventListener("abort", abortFromCaller);
+    deadline.removeEventListener("abort", abortFromDeadline);
+    controller.abort(reason);
+  }
+  callerSignal.addEventListener("abort", abortFromCaller, { once: true });
+  deadline.addEventListener("abort", abortFromDeadline, { once: true });
+  return { ...options, signal: controller.signal };
+}
+
 // src/client/session.ts
 var SESSION_ENDPOINT = "/api/v1/auth/session";
 var LOGOUT_ENDPOINT = "/api/v1/auth/signout";
@@ -3760,6 +3795,7 @@ function toServiceAccessDecision(response, allowGrace) {
   const isBlocked = response.isBlocked ?? (effectiveStatus === null || effectiveStatus !== null && BLOCKING_EFFECTIVE_STATUSES.includes(effectiveStatus));
   return {
     hasAccess,
+    ...response.seatAssigned !== void 0 ? { seatAssigned: response.seatAssigned } : {},
     effectiveStatus,
     isGrace,
     isBlocked: isBlocked || !hasAccess,
@@ -3966,9 +4002,10 @@ function createFFIDClient(config) {
   async function fetchWithAuth(endpoint, options = {}, authOverride) {
     const url = `${baseUrl}${endpoint}`;
     logger.debug("Fetching:", url);
-    const fetchOptions = buildFetchOptions(options, authOverride);
+    let fetchOptions = buildFetchOptions(options, authOverride);
     let response;
     try {
+      fetchOptions = withRequestTimeout(fetchOptions, timeout);
       response = await fetch(url, fetchOptions);
     } catch (error) {
       logger.error("Network error:", error);
@@ -3983,9 +4020,9 @@ function createFFIDClient(config) {
       const refreshResult = await refreshAccessToken();
       if (!refreshResult.error) {
         logger.debug("Token refreshed, retrying request");
-        const retryOptions = buildFetchOptions(options);
         try {
-          response = await fetch(url, retryOptions);
+          fetchOptions = withRequestTimeout(buildFetchOptions(options), timeout);
+          response = await fetch(url, fetchOptions);
         } catch (retryError) {
           logger.error("Network error on retry:", retryError);
           return {
@@ -4004,6 +4041,15 @@ function createFFIDClient(config) {
     try {
       raw = await response.json();
     } catch (parseError) {
+      if (fetchOptions.signal?.aborted) {
+        logger.error("Response body aborted:", parseError);
+        return {
+          error: {
+            code: FFID_ERROR_CODES.NETWORK_ERROR,
+            message: "\u30EC\u30B9\u30DD\u30F3\u30B9\u306E\u53D7\u4FE1\u304C\u4E2D\u65AD\u3055\u308C\u307E\u3057\u305F"
+          }
+        };
+      }
       logger.error("Parse error:", parseError, "Status:", response.status);
       return {
         error: {
@@ -4365,6 +4411,50 @@ function createFFIDClient(config) {
   };
 }
 
+// src/client/authorization-error.ts
+var FFID_OAUTH_DENIAL_REASONS = [
+  /** The user is not a member of the organization */
+  "no_membership",
+  /** The organization has no usable subscription for the service */
+  "no_active_subscription",
+  /** The organization has a subscription, but the user has no seat in it */
+  "no_seat_assignment",
+  /** The subscription has expired (canceled / past due beyond grace) */
+  "subscription_expired",
+  /** The flat plan's member limit is full, so no seat could be given */
+  "member_limit_reached"
+];
+function isFFIDOAuthDenialReason(value) {
+  return typeof value === "string" && FFID_OAUTH_DENIAL_REASONS.includes(value);
+}
+var DEFAULT_AUTHORIZATION_ERROR_MESSAGE = "\u8A8D\u53EF\u30B5\u30FC\u30D0\u30FC\u304C\u30A8\u30E9\u30FC\u3092\u8FD4\u3057\u307E\u3057\u305F";
+function buildAuthorizationError(params) {
+  const oauthError = params.get("error");
+  if (!oauthError) return null;
+  const rawReason = params.get("denial_reason");
+  const errorDescription = params.get("error_description");
+  const details = {
+    source: "authorization",
+    denialReason: isFFIDOAuthDenialReason(rawReason) ? rawReason : null,
+    errorDescription
+  };
+  return {
+    code: oauthError,
+    message: errorDescription ?? DEFAULT_AUTHORIZATION_ERROR_MESSAGE,
+    details: { ...details }
+  };
+}
+function getFFIDAuthorizationError(error) {
+  const details = error?.details;
+  if (!error || !details || details.source !== "authorization") return null;
+  const description = details.errorDescription;
+  return {
+    oauthError: error.code,
+    denialReason: isFFIDOAuthDenialReason(details.denialReason) ? details.denialReason : null,
+    errorDescription: typeof description === "string" ? description : null
+  };
+}
+
 // src/client/cache/memory-cache-adapter.ts
 var MS_PER_SECOND2 = 1e3;
 function createMemoryCacheAdapter() {
@@ -4655,14 +4745,9 @@ function createServerAuthClient(config) {
         }
       };
     }
-    const errorParam = url.searchParams.get("error");
-    if (errorParam) {
-      return {
-        error: {
-          code: errorParam,
-          message: url.searchParams.get("error_description") ?? "\u8A8D\u53EF\u30B5\u30FC\u30D0\u30FC\u304C\u30A8\u30E9\u30FC\u3092\u8FD4\u3057\u307E\u3057\u305F"
-        }
-      };
+    const authorizationError = buildAuthorizationError(url.searchParams);
+    if (authorizationError) {
+      return { error: authorizationError };
     }
     const code = url.searchParams.get("code");
     if (!code) {
@@ -4774,6 +4859,7 @@ exports.FFID_ERROR_CODES = FFID_ERROR_CODES;
 exports.FFID_INDUSTRY_CODES = FFID_INDUSTRY_CODES;
 exports.FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES = FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES;
 exports.FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB = FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB;
+exports.FFID_OAUTH_DENIAL_REASONS = FFID_OAUTH_DENIAL_REASONS;
 exports.FFID_ORGANIZATION_PROFILE_ERROR_CODES = FFID_ORGANIZATION_PROFILE_ERROR_CODES;
 exports.FFID_SESSION_COOKIE_NAME = FFID_SESSION_COOKIE_NAME;
 exports.canonicalizeCatalogValue = canonicalizeCatalogValue;
@@ -4792,9 +4878,11 @@ exports.createVerifyAccessToken = createVerifyAccessToken;
 exports.decodeConsentCookie = decodeConsentCookie;
 exports.encodeConsentCookie = encodeConsentCookie;
 exports.generateServerState = generateServerState;
+exports.getFFIDAuthorizationError = getFFIDAuthorizationError;
 exports.getFFIDConsentFromCookieHeader = getFFIDConsentFromCookieHeader;
 exports.getFFIDConsentFromCookies = getFFIDConsentFromCookies;
 exports.hashCanonicalJson = hashCanonicalJson;
+exports.isFFIDOAuthDenialReason = isFFIDOAuthDenialReason;
 exports.sessionCookies = sessionCookies;
 exports.sha256Hex = sha256Hex;
 exports.validatePublishedCatalog = validatePublishedCatalog;

package/dist/server/index.d.cts

@@ -1,5 +1,5 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo, f as FFIDCatalogEnvironment, g as FFIDBillingInterval, h as FFIDTaxBehavior, i as FFIDPublishedCatalog } from '../ffid-client-CumygXXz.cjs';
-export { j as FFIDAddMemberParams, k as FFIDAddMemberRequest, l as FFIDAddMemberResponse, m as FFIDAllowedLogoMimeType, n as FFIDAssignableMemberRole, o as FFIDCacheConfig, p as FFIDCatalogPublication, q as FFIDCatalogPublicationStatus, r as FFIDClient, s as FFIDCompanySizeCode, t as FFIDConfig, u as FFIDIndustryCode, v as FFIDListMembersResponse, w as FFIDListingConsentInput, x as FFIDLogoWallEntry, y as FFIDLogoWallResponse, z as FFIDMemberRole, A as FFIDOrganization, B as FFIDOrganizationLogoUploadResponse, C as FFIDOrganizationMember, D as FFIDOrganizationProfile, E as FFIDOrganizationProfileErrorCode, G as FFIDOrganizationProfileResponse, H as FFIDOtpSendResponse, I as FFIDOtpVerifyResponse, J as FFIDPasswordResetConfirmResponse, K as FFIDPasswordResetResponse, L as FFIDPasswordResetVerifyResponse, M as FFIDProfileCallOptions, N as FFIDProvisionMemberPlan, O as FFIDProvisionMemberPlanStatus, P as FFIDProvisionMemberResult, Q as FFIDProvisionMemberStatus, R as FFIDProvisionOrganizationDryRun, S as FFIDProvisionOrganizationMemberInput, T as FFIDProvisionOrganizationOutcome, U as FFIDProvisionOrganizationParams, V as FFIDProvisionOrganizationResponse, W as FFIDProvisionUserDryRun, X as FFIDProvisionUserOutcome, Y as FFIDProvisionUserParams, Z as FFIDProvisionUserProfileInput, _ as FFIDProvisionUserResponse, $ as FFIDProvisionedOrganization, a0 as FFIDProvisionedUser, a1 as FFIDPublishedPlan, a2 as FFIDRemoveMemberResponse, a3 as FFIDResetSessionResponse, a4 as FFIDSubscription, a5 as FFIDUpdateMemberRoleResponse, a6 as FFIDUpdateUserProfileRequest, a7 as FFIDUploadOrganizationLogoParams, a8 as FFIDUpsertOrganizationProfileParams, a9 as FFIDUpsertOrganizationProfileRequest, aa as FFIDUser, ab as FFIDUserProfile, ac as FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, ad as FFID_CATALOG_ENVIRONMENTS, ae as FFID_CATALOG_PUBLICATION_STATUSES, af as FFID_COMPANY_SIZE_CODES, ag as FFID_INDUSTRY_CODES, ah as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, ai as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, aj as FFID_ORGANIZATION_PROFILE_ERROR_CODES, ak as TokenData, al as TokenStore, am as createFFIDClient, an as createTokenStore } from '../ffid-client-CumygXXz.cjs';
+import { F as FFIDError, a as FFIDLogger, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo, f as FFIDCatalogEnvironment, g as FFIDBillingInterval, h as FFIDTaxBehavior, i as FFIDPublishedCatalog } from '../ffid-client-C3A8L9uW.cjs';
+export { j as FFIDAddMemberParams, k as FFIDAddMemberRequest, l as FFIDAddMemberResponse, m as FFIDAllowedLogoMimeType, n as FFIDAssignableMemberRole, o as FFIDCacheConfig, p as FFIDCatalogPublication, q as FFIDCatalogPublicationStatus, r as FFIDClient, s as FFIDCompanySizeCode, t as FFIDConfig, u as FFIDIndustryCode, v as FFIDListMembersResponse, w as FFIDListingConsentInput, x as FFIDLogoWallEntry, y as FFIDLogoWallResponse, z as FFIDMemberRole, A as FFIDMemberSeatAssignmentResult, B as FFIDOrganization, C as FFIDOrganizationLogoUploadResponse, D as FFIDOrganizationMember, E as FFIDOrganizationProfile, G as FFIDOrganizationProfileErrorCode, H as FFIDOrganizationProfileResponse, I as FFIDOtpSendResponse, J as FFIDOtpVerifyResponse, K as FFIDPasswordResetConfirmResponse, L as FFIDPasswordResetResponse, M as FFIDPasswordResetVerifyResponse, N as FFIDProfileCallOptions, O as FFIDProvisionMemberPlan, P as FFIDProvisionMemberPlanStatus, Q as FFIDProvisionMemberResult, R as FFIDProvisionMemberStatus, S as FFIDProvisionOrganizationDryRun, T as FFIDProvisionOrganizationMemberInput, U as FFIDProvisionOrganizationOutcome, V as FFIDProvisionOrganizationParams, W as FFIDProvisionOrganizationResponse, X as FFIDProvisionUserDryRun, Y as FFIDProvisionUserOutcome, Z as FFIDProvisionUserParams, _ as FFIDProvisionUserProfileInput, $ as FFIDProvisionUserResponse, a0 as FFIDProvisionedOrganization, a1 as FFIDProvisionedUser, a2 as FFIDPublishedPlan, a3 as FFIDRemoveMemberResponse, a4 as FFIDResetSessionResponse, a5 as FFIDSubscription, a6 as FFIDUpdateMemberRoleResponse, a7 as FFIDUpdateUserProfileRequest, a8 as FFIDUploadOrganizationLogoParams, a9 as FFIDUpsertOrganizationProfileParams, aa as FFIDUpsertOrganizationProfileRequest, ab as FFIDUser, ac as FFIDUserProfile, ad as FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, ae as FFID_CATALOG_ENVIRONMENTS, af as FFID_CATALOG_PUBLICATION_STATUSES, ag as FFID_COMPANY_SIZE_CODES, ah as FFID_INDUSTRY_CODES, ai as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, aj as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, ak as FFID_ORGANIZATION_PROFILE_ERROR_CODES, al as TokenData, am as TokenStore, an as createFFIDClient, ao as createTokenStore } from '../ffid-client-C3A8L9uW.cjs';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-Ce2eXQtB.cjs';
 import { z } from 'zod';
 import '../types-Cjb9J0rL.cjs';
@@ -31,6 +31,77 @@ declare const FFID_ERROR_CODES: {
  */
 type FFIDErrorCode = (typeof FFID_ERROR_CODES)[keyof typeof FFID_ERROR_CODES];
 
+/**
+ * OAuth authorization errors returned to the service's `redirect_uri` (#6523)
+ *
+ * When FFID's `/oauth/authorize` refuses a user, it redirects back with
+ * `error=<OAuth error>&error_description=...&state=...` (RFC 6749 §4.1.2.1). For
+ * subscription / seat denials it also adds the FFID extension `denial_reason`
+ * (#6498), so a service can tell "no seat in this organization" from "no
+ * subscription" without parsing `error_description`.
+ *
+ * Both callback paths build the same {@link FFIDError} from those params:
+ * - `handleRedirectCallback` / token-mode `FFIDProvider` (browser, PKCE)
+ * - `createServerAuthClient().handleCallback` (confidential / BFF)
+ *
+ * `error.code` is the OAuth `error` value verbatim (e.g. `access_denied`), and
+ * `error.details` is {@link FFIDAuthorizationErrorDetails}. Read it with
+ * {@link getFFIDAuthorizationError}.
+ *
+ * This module has no browser dependency so the server entry can share it.
+ */
+
+/**
+ * Values of FFID's `denial_reason` (the authorize error redirect and the
+ * `/oauth/userinfo` 403; `/oauth/introspect` only answers `active: false`). Kept
+ * identical to the FFID server's `DENIAL_REASONS` by a test in the FFID repository.
+ *
+ * This is a different vocabulary from `FFIDServiceAccessDenialReason`
+ * (`checkServiceAccess()`), which is derived from the subscription status.
+ */
+declare const FFID_OAUTH_DENIAL_REASONS: readonly ["no_membership", "no_active_subscription", "no_seat_assignment", "subscription_expired", "member_limit_reached"];
+type FFIDOAuthDenialReason = (typeof FFID_OAUTH_DENIAL_REASONS)[number];
+/** Runtime guard for {@link FFIDOAuthDenialReason}. Unknown values are `false`. */
+declare function isFFIDOAuthDenialReason(value: unknown): value is FFIDOAuthDenialReason;
+/** `FFIDError.details` of an authorization error */
+interface FFIDAuthorizationErrorDetails {
+    /** Marks the error as an authorize redirect error (vs. token / network errors) */
+    source: 'authorization';
+    /**
+     * FFID's `denial_reason`. `null` when FFID did not send one (any OAuth error other
+     * than a subscription / seat denial) **or** sent a value this SDK version does not
+     * know — the error itself is still returned, only the reason is unknown.
+     */
+    denialReason: FFIDOAuthDenialReason | null;
+    /**
+     * `error_description` as sent — short ASCII English meant for logs. The same text
+     * is `error.message` (when FFID sent one), so show end users guidance chosen by
+     * `denialReason` rather than the message itself.
+     */
+    errorDescription: string | null;
+}
+/** An authorization error read back by {@link getFFIDAuthorizationError} */
+interface FFIDAuthorizationError {
+    /** The OAuth `error` value, e.g. `access_denied`, `login_required` */
+    oauthError: string;
+    denialReason: FFIDOAuthDenialReason | null;
+    errorDescription: string | null;
+}
+/**
+ * Read an authorization error (and FFID's `denial_reason`) from an {@link FFIDError},
+ * e.g. `useFFID().error` or the result of `handleRedirectCallback` /
+ * `createServerAuthClient().handleCallback`. Returns `null` for any other error.
+ *
+ * ```ts
+ * const denial = getFFIDAuthorizationError(error)
+ * if (denial?.denialReason === 'no_seat_assignment') {
+ *   // Ask an organization owner / admin to add the user. Do not call login() again:
+ *   // FFID would refuse the same way.
+ * }
+ * ```
+ */
+declare function getFFIDAuthorizationError(error: FFIDError | null | undefined): FFIDAuthorizationError | null;
+
 /** Token verification - verifyAccessToken() implementation */
 
 /** Dependencies required by verifyAccessToken */
@@ -566,4 +637,4 @@ declare function computeScopeHash(input: FFIDScopeHashInput): Promise<string>;
  */
 declare function validatePublishedCatalog(catalog: unknown): asserts catalog is FFIDPublishedCatalog;
 
-export { ALL_DENIED_EXCEPT_NECESSARY, type BuildAuthorizeUrlOptions, type BuildAuthorizeUrlResult, CATALOG_HASH_PATTERN, CONSENT_COOKIE_NAME, COOKIE_VERSION, type CookieOptions, FFIDCacheAdapter, type FFIDCanonicalJsonValue, FFIDCatalogEnvironment, FFIDCatalogHashError, type FFIDConsentCategories, type FFIDConsentCategoryCode, type FFIDCookieStoreLike, type FFIDErrorCode, FFIDOAuthUserInfo, type FFIDPaymentConfiguration, FFIDPublishedCatalog, type FFIDScopeHashInput, type FFIDScopeHashPlan, FFIDTaxBehavior, type FFIDTaxConfiguration, FFIDVerifyAccessTokenOptions, FFID_ERROR_CODES, FFID_SESSION_COOKIE_NAME, type HandleCallbackInput, type KVNamespaceLike, type ServerAuthClient, type ServerAuthConfig, type ServerSessionTokens, type ServerTokenResult, canonicalizeCatalogValue, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createKVCacheAdapter, createMemoryCacheAdapter, createServerAuthClient, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, generateServerState, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies, hashCanonicalJson, sessionCookies, sha256Hex, validatePublishedCatalog };
+export { ALL_DENIED_EXCEPT_NECESSARY, type BuildAuthorizeUrlOptions, type BuildAuthorizeUrlResult, CATALOG_HASH_PATTERN, CONSENT_COOKIE_NAME, COOKIE_VERSION, type CookieOptions, type FFIDAuthorizationError, type FFIDAuthorizationErrorDetails, FFIDCacheAdapter, type FFIDCanonicalJsonValue, FFIDCatalogEnvironment, FFIDCatalogHashError, type FFIDConsentCategories, type FFIDConsentCategoryCode, type FFIDCookieStoreLike, type FFIDErrorCode, type FFIDOAuthDenialReason, FFIDOAuthUserInfo, type FFIDPaymentConfiguration, FFIDPublishedCatalog, type FFIDScopeHashInput, type FFIDScopeHashPlan, FFIDTaxBehavior, type FFIDTaxConfiguration, FFIDVerifyAccessTokenOptions, FFID_ERROR_CODES, FFID_OAUTH_DENIAL_REASONS, FFID_SESSION_COOKIE_NAME, type HandleCallbackInput, type KVNamespaceLike, type ServerAuthClient, type ServerAuthConfig, type ServerSessionTokens, type ServerTokenResult, canonicalizeCatalogValue, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createKVCacheAdapter, createMemoryCacheAdapter, createServerAuthClient, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, generateServerState, getFFIDAuthorizationError, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies, hashCanonicalJson, isFFIDOAuthDenialReason, sessionCookies, sha256Hex, validatePublishedCatalog };

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo, f as FFIDCatalogEnvironment, g as FFIDBillingInterval, h as FFIDTaxBehavior, i as FFIDPublishedCatalog } from '../ffid-client-5uxXRgIO.js';
-export { j as FFIDAddMemberParams, k as FFIDAddMemberRequest, l as FFIDAddMemberResponse, m as FFIDAllowedLogoMimeType, n as FFIDAssignableMemberRole, o as FFIDCacheConfig, p as FFIDCatalogPublication, q as FFIDCatalogPublicationStatus, r as FFIDClient, s as FFIDCompanySizeCode, t as FFIDConfig, u as FFIDIndustryCode, v as FFIDListMembersResponse, w as FFIDListingConsentInput, x as FFIDLogoWallEntry, y as FFIDLogoWallResponse, z as FFIDMemberRole, A as FFIDOrganization, B as FFIDOrganizationLogoUploadResponse, C as FFIDOrganizationMember, D as FFIDOrganizationProfile, E as FFIDOrganizationProfileErrorCode, G as FFIDOrganizationProfileResponse, H as FFIDOtpSendResponse, I as FFIDOtpVerifyResponse, J as FFIDPasswordResetConfirmResponse, K as FFIDPasswordResetResponse, L as FFIDPasswordResetVerifyResponse, M as FFIDProfileCallOptions, N as FFIDProvisionMemberPlan, O as FFIDProvisionMemberPlanStatus, P as FFIDProvisionMemberResult, Q as FFIDProvisionMemberStatus, R as FFIDProvisionOrganizationDryRun, S as FFIDProvisionOrganizationMemberInput, T as FFIDProvisionOrganizationOutcome, U as FFIDProvisionOrganizationParams, V as FFIDProvisionOrganizationResponse, W as FFIDProvisionUserDryRun, X as FFIDProvisionUserOutcome, Y as FFIDProvisionUserParams, Z as FFIDProvisionUserProfileInput, _ as FFIDProvisionUserResponse, $ as FFIDProvisionedOrganization, a0 as FFIDProvisionedUser, a1 as FFIDPublishedPlan, a2 as FFIDRemoveMemberResponse, a3 as FFIDResetSessionResponse, a4 as FFIDSubscription, a5 as FFIDUpdateMemberRoleResponse, a6 as FFIDUpdateUserProfileRequest, a7 as FFIDUploadOrganizationLogoParams, a8 as FFIDUpsertOrganizationProfileParams, a9 as FFIDUpsertOrganizationProfileRequest, aa as FFIDUser, ab as FFIDUserProfile, ac as FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, ad as FFID_CATALOG_ENVIRONMENTS, ae as FFID_CATALOG_PUBLICATION_STATUSES, af as FFID_COMPANY_SIZE_CODES, ag as FFID_INDUSTRY_CODES, ah as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, ai as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, aj as FFID_ORGANIZATION_PROFILE_ERROR_CODES, ak as TokenData, al as TokenStore, am as createFFIDClient, an as createTokenStore } from '../ffid-client-5uxXRgIO.js';
+import { F as FFIDError, a as FFIDLogger, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo, f as FFIDCatalogEnvironment, g as FFIDBillingInterval, h as FFIDTaxBehavior, i as FFIDPublishedCatalog } from '../ffid-client-By_vcKYu.js';
+export { j as FFIDAddMemberParams, k as FFIDAddMemberRequest, l as FFIDAddMemberResponse, m as FFIDAllowedLogoMimeType, n as FFIDAssignableMemberRole, o as FFIDCacheConfig, p as FFIDCatalogPublication, q as FFIDCatalogPublicationStatus, r as FFIDClient, s as FFIDCompanySizeCode, t as FFIDConfig, u as FFIDIndustryCode, v as FFIDListMembersResponse, w as FFIDListingConsentInput, x as FFIDLogoWallEntry, y as FFIDLogoWallResponse, z as FFIDMemberRole, A as FFIDMemberSeatAssignmentResult, B as FFIDOrganization, C as FFIDOrganizationLogoUploadResponse, D as FFIDOrganizationMember, E as FFIDOrganizationProfile, G as FFIDOrganizationProfileErrorCode, H as FFIDOrganizationProfileResponse, I as FFIDOtpSendResponse, J as FFIDOtpVerifyResponse, K as FFIDPasswordResetConfirmResponse, L as FFIDPasswordResetResponse, M as FFIDPasswordResetVerifyResponse, N as FFIDProfileCallOptions, O as FFIDProvisionMemberPlan, P as FFIDProvisionMemberPlanStatus, Q as FFIDProvisionMemberResult, R as FFIDProvisionMemberStatus, S as FFIDProvisionOrganizationDryRun, T as FFIDProvisionOrganizationMemberInput, U as FFIDProvisionOrganizationOutcome, V as FFIDProvisionOrganizationParams, W as FFIDProvisionOrganizationResponse, X as FFIDProvisionUserDryRun, Y as FFIDProvisionUserOutcome, Z as FFIDProvisionUserParams, _ as FFIDProvisionUserProfileInput, $ as FFIDProvisionUserResponse, a0 as FFIDProvisionedOrganization, a1 as FFIDProvisionedUser, a2 as FFIDPublishedPlan, a3 as FFIDRemoveMemberResponse, a4 as FFIDResetSessionResponse, a5 as FFIDSubscription, a6 as FFIDUpdateMemberRoleResponse, a7 as FFIDUpdateUserProfileRequest, a8 as FFIDUploadOrganizationLogoParams, a9 as FFIDUpsertOrganizationProfileParams, aa as FFIDUpsertOrganizationProfileRequest, ab as FFIDUser, ac as FFIDUserProfile, ad as FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, ae as FFID_CATALOG_ENVIRONMENTS, af as FFID_CATALOG_PUBLICATION_STATUSES, ag as FFID_COMPANY_SIZE_CODES, ah as FFID_INDUSTRY_CODES, ai as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, aj as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, ak as FFID_ORGANIZATION_PROFILE_ERROR_CODES, al as TokenData, am as TokenStore, an as createFFIDClient, ao as createTokenStore } from '../ffid-client-By_vcKYu.js';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-Ce2eXQtB.js';
 import { z } from 'zod';
 import '../types-Cjb9J0rL.js';
@@ -31,6 +31,77 @@ declare const FFID_ERROR_CODES: {
  */
 type FFIDErrorCode = (typeof FFID_ERROR_CODES)[keyof typeof FFID_ERROR_CODES];
 
+/**
+ * OAuth authorization errors returned to the service's `redirect_uri` (#6523)
+ *
+ * When FFID's `/oauth/authorize` refuses a user, it redirects back with
+ * `error=<OAuth error>&error_description=...&state=...` (RFC 6749 §4.1.2.1). For
+ * subscription / seat denials it also adds the FFID extension `denial_reason`
+ * (#6498), so a service can tell "no seat in this organization" from "no
+ * subscription" without parsing `error_description`.
+ *
+ * Both callback paths build the same {@link FFIDError} from those params:
+ * - `handleRedirectCallback` / token-mode `FFIDProvider` (browser, PKCE)
+ * - `createServerAuthClient().handleCallback` (confidential / BFF)
+ *
+ * `error.code` is the OAuth `error` value verbatim (e.g. `access_denied`), and
+ * `error.details` is {@link FFIDAuthorizationErrorDetails}. Read it with
+ * {@link getFFIDAuthorizationError}.
+ *
+ * This module has no browser dependency so the server entry can share it.
+ */
+
+/**
+ * Values of FFID's `denial_reason` (the authorize error redirect and the
+ * `/oauth/userinfo` 403; `/oauth/introspect` only answers `active: false`). Kept
+ * identical to the FFID server's `DENIAL_REASONS` by a test in the FFID repository.
+ *
+ * This is a different vocabulary from `FFIDServiceAccessDenialReason`
+ * (`checkServiceAccess()`), which is derived from the subscription status.
+ */
+declare const FFID_OAUTH_DENIAL_REASONS: readonly ["no_membership", "no_active_subscription", "no_seat_assignment", "subscription_expired", "member_limit_reached"];
+type FFIDOAuthDenialReason = (typeof FFID_OAUTH_DENIAL_REASONS)[number];
+/** Runtime guard for {@link FFIDOAuthDenialReason}. Unknown values are `false`. */
+declare function isFFIDOAuthDenialReason(value: unknown): value is FFIDOAuthDenialReason;
+/** `FFIDError.details` of an authorization error */
+interface FFIDAuthorizationErrorDetails {
+    /** Marks the error as an authorize redirect error (vs. token / network errors) */
+    source: 'authorization';
+    /**
+     * FFID's `denial_reason`. `null` when FFID did not send one (any OAuth error other
+     * than a subscription / seat denial) **or** sent a value this SDK version does not
+     * know — the error itself is still returned, only the reason is unknown.
+     */
+    denialReason: FFIDOAuthDenialReason | null;
+    /**
+     * `error_description` as sent — short ASCII English meant for logs. The same text
+     * is `error.message` (when FFID sent one), so show end users guidance chosen by
+     * `denialReason` rather than the message itself.
+     */
+    errorDescription: string | null;
+}
+/** An authorization error read back by {@link getFFIDAuthorizationError} */
+interface FFIDAuthorizationError {
+    /** The OAuth `error` value, e.g. `access_denied`, `login_required` */
+    oauthError: string;
+    denialReason: FFIDOAuthDenialReason | null;
+    errorDescription: string | null;
+}
+/**
+ * Read an authorization error (and FFID's `denial_reason`) from an {@link FFIDError},
+ * e.g. `useFFID().error` or the result of `handleRedirectCallback` /
+ * `createServerAuthClient().handleCallback`. Returns `null` for any other error.
+ *
+ * ```ts
+ * const denial = getFFIDAuthorizationError(error)
+ * if (denial?.denialReason === 'no_seat_assignment') {
+ *   // Ask an organization owner / admin to add the user. Do not call login() again:
+ *   // FFID would refuse the same way.
+ * }
+ * ```
+ */
+declare function getFFIDAuthorizationError(error: FFIDError | null | undefined): FFIDAuthorizationError | null;
+
 /** Token verification - verifyAccessToken() implementation */
 
 /** Dependencies required by verifyAccessToken */
@@ -566,4 +637,4 @@ declare function computeScopeHash(input: FFIDScopeHashInput): Promise<string>;
  */
 declare function validatePublishedCatalog(catalog: unknown): asserts catalog is FFIDPublishedCatalog;
 
-export { ALL_DENIED_EXCEPT_NECESSARY, type BuildAuthorizeUrlOptions, type BuildAuthorizeUrlResult, CATALOG_HASH_PATTERN, CONSENT_COOKIE_NAME, COOKIE_VERSION, type CookieOptions, FFIDCacheAdapter, type FFIDCanonicalJsonValue, FFIDCatalogEnvironment, FFIDCatalogHashError, type FFIDConsentCategories, type FFIDConsentCategoryCode, type FFIDCookieStoreLike, type FFIDErrorCode, FFIDOAuthUserInfo, type FFIDPaymentConfiguration, FFIDPublishedCatalog, type FFIDScopeHashInput, type FFIDScopeHashPlan, FFIDTaxBehavior, type FFIDTaxConfiguration, FFIDVerifyAccessTokenOptions, FFID_ERROR_CODES, FFID_SESSION_COOKIE_NAME, type HandleCallbackInput, type KVNamespaceLike, type ServerAuthClient, type ServerAuthConfig, type ServerSessionTokens, type ServerTokenResult, canonicalizeCatalogValue, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createKVCacheAdapter, createMemoryCacheAdapter, createServerAuthClient, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, generateServerState, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies, hashCanonicalJson, sessionCookies, sha256Hex, validatePublishedCatalog };
+export { ALL_DENIED_EXCEPT_NECESSARY, type BuildAuthorizeUrlOptions, type BuildAuthorizeUrlResult, CATALOG_HASH_PATTERN, CONSENT_COOKIE_NAME, COOKIE_VERSION, type CookieOptions, type FFIDAuthorizationError, type FFIDAuthorizationErrorDetails, FFIDCacheAdapter, type FFIDCanonicalJsonValue, FFIDCatalogEnvironment, FFIDCatalogHashError, type FFIDConsentCategories, type FFIDConsentCategoryCode, type FFIDCookieStoreLike, type FFIDErrorCode, type FFIDOAuthDenialReason, FFIDOAuthUserInfo, type FFIDPaymentConfiguration, FFIDPublishedCatalog, type FFIDScopeHashInput, type FFIDScopeHashPlan, FFIDTaxBehavior, type FFIDTaxConfiguration, FFIDVerifyAccessTokenOptions, FFID_ERROR_CODES, FFID_OAUTH_DENIAL_REASONS, FFID_SESSION_COOKIE_NAME, type HandleCallbackInput, type KVNamespaceLike, type ServerAuthClient, type ServerAuthConfig, type ServerSessionTokens, type ServerTokenResult, canonicalizeCatalogValue, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createKVCacheAdapter, createMemoryCacheAdapter, createServerAuthClient, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, generateServerState, getFFIDAuthorizationError, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies, hashCanonicalJson, isFFIDOAuthDenialReason, sessionCookies, sha256Hex, validatePublishedCatalog };

package/dist/server/index.js

@@ -304,6 +304,9 @@ var OAUTH_INTROSPECT_ENDPOINT = "/api/v1/oauth/introspect";
 var CACHE_KEY_PREFIX = "ffid:introspect:";
 var HEX_BASE = 16;
 var HEX_BYTE_WIDTH = 2;
+var HTTP_TOO_MANY_REQUESTS = 429;
+var HTTP_SERVER_ERROR_MIN = 500;
+var HTTP_SERVER_ERROR_LIMIT = 600;
 function createVerifyAccessToken(deps) {
   const { authMode, baseUrl, serviceCode, serviceApiKey, verifyStrategy, logger, createError, errorCodes, cache, timeout } = deps;
   let jwtVerify2 = null;
@@ -358,6 +361,16 @@ function createVerifyAccessToken(deps) {
     }
     return verifyViaIntrospect(accessToken);
   }
+  function introspectionUnavailable(status) {
+    logger.error("Token introspection unavailable", { status });
+    return {
+      error: {
+        code: errorCodes.NETWORK_ERROR,
+        message: `\u30C8\u30FC\u30AF\u30F3\u691C\u8A3C\u30B5\u30FC\u30D3\u30B9\u304C\u4E00\u6642\u7684\u306B\u5229\u7528\u3067\u304D\u307E\u305B\u3093 (status: ${status})`,
+        details: { status }
+      }
+    };
+  }
   async function verifyViaIntrospect(accessToken, cacheKeySuffix) {
     if (!serviceApiKey) {
       return {
@@ -415,10 +428,12 @@ function createVerifyAccessToken(deps) {
         }
       };
     }
+    const upstreamUnavailable = response.status === HTTP_TOO_MANY_REQUESTS || response.status >= HTTP_SERVER_ERROR_MIN && response.status < HTTP_SERVER_ERROR_LIMIT;
     let introspectResponse;
     try {
       introspectResponse = await response.json();
     } catch (parseError) {
+      if (upstreamUnavailable) return introspectionUnavailable(response.status);
       logger.error("Parse error during token verification:", parseError);
       return {
         error: {
@@ -427,6 +442,7 @@ function createVerifyAccessToken(deps) {
         }
       };
     }
+    if (upstreamUnavailable) return introspectionUnavailable(response.status);
     if (!response.ok) {
       const errorBody = introspectResponse;
       return {
@@ -1370,7 +1386,7 @@ var FFID_ORGANIZATION_PROFILE_ERROR_CODES = {
 };
 
 // src/client/version-check.ts
-var SDK_VERSION = "10.0.0";
+var SDK_VERSION = "11.0.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1938,7 +1954,7 @@ function createInviteMethods(deps) {
     }).toString();
     return fetchWithAuth(`${EXT_INVITE_ENDPOINT}?${query}`, {
       method: "POST",
-      body: JSON.stringify({ email: params.email, role: params.role })
+      body: JSON.stringify({ email: params.email, role: params.role, inviterUserId: params.inviterUserId })
     });
   }
   return { inviteMember };
@@ -2241,6 +2257,25 @@ function createOAuthTokenMethods(deps) {
   return { exchangeCodeForTokens, refreshAccessToken, signOutToken };
 }
 
+// src/client/request-timeout.ts
+function withRequestTimeout(options, timeout) {
+  if (timeout === void 0 || options.signal?.aborted) return options;
+  const deadline = AbortSignal.timeout(timeout);
+  if (!options.signal) return { ...options, signal: deadline };
+  const callerSignal = options.signal;
+  const controller = new AbortController();
+  const abortFromCaller = () => abort(callerSignal.reason);
+  const abortFromDeadline = () => abort(deadline.reason);
+  function abort(reason) {
+    callerSignal.removeEventListener("abort", abortFromCaller);
+    deadline.removeEventListener("abort", abortFromDeadline);
+    controller.abort(reason);
+  }
+  callerSignal.addEventListener("abort", abortFromCaller, { once: true });
+  deadline.addEventListener("abort", abortFromDeadline, { once: true });
+  return { ...options, signal: controller.signal };
+}
+
 // src/client/session.ts
 var SESSION_ENDPOINT = "/api/v1/auth/session";
 var LOGOUT_ENDPOINT = "/api/v1/auth/signout";
@@ -3759,6 +3794,7 @@ function toServiceAccessDecision(response, allowGrace) {
   const isBlocked = response.isBlocked ?? (effectiveStatus === null || effectiveStatus !== null && BLOCKING_EFFECTIVE_STATUSES.includes(effectiveStatus));
   return {
     hasAccess,
+    ...response.seatAssigned !== void 0 ? { seatAssigned: response.seatAssigned } : {},
     effectiveStatus,
     isGrace,
     isBlocked: isBlocked || !hasAccess,
@@ -3965,9 +4001,10 @@ function createFFIDClient(config) {
   async function fetchWithAuth(endpoint, options = {}, authOverride) {
     const url = `${baseUrl}${endpoint}`;
     logger.debug("Fetching:", url);
-    const fetchOptions = buildFetchOptions(options, authOverride);
+    let fetchOptions = buildFetchOptions(options, authOverride);
     let response;
     try {
+      fetchOptions = withRequestTimeout(fetchOptions, timeout);
       response = await fetch(url, fetchOptions);
     } catch (error) {
       logger.error("Network error:", error);
@@ -3982,9 +4019,9 @@ function createFFIDClient(config) {
       const refreshResult = await refreshAccessToken();
       if (!refreshResult.error) {
         logger.debug("Token refreshed, retrying request");
-        const retryOptions = buildFetchOptions(options);
         try {
-          response = await fetch(url, retryOptions);
+          fetchOptions = withRequestTimeout(buildFetchOptions(options), timeout);
+          response = await fetch(url, fetchOptions);
         } catch (retryError) {
           logger.error("Network error on retry:", retryError);
           return {
@@ -4003,6 +4040,15 @@ function createFFIDClient(config) {
     try {
       raw = await response.json();
     } catch (parseError) {
+      if (fetchOptions.signal?.aborted) {
+        logger.error("Response body aborted:", parseError);
+        return {
+          error: {
+            code: FFID_ERROR_CODES.NETWORK_ERROR,
+            message: "\u30EC\u30B9\u30DD\u30F3\u30B9\u306E\u53D7\u4FE1\u304C\u4E2D\u65AD\u3055\u308C\u307E\u3057\u305F"
+          }
+        };
+      }
       logger.error("Parse error:", parseError, "Status:", response.status);
       return {
         error: {
@@ -4364,6 +4410,50 @@ function createFFIDClient(config) {
   };
 }
 
+// src/client/authorization-error.ts
+var FFID_OAUTH_DENIAL_REASONS = [
+  /** The user is not a member of the organization */
+  "no_membership",
+  /** The organization has no usable subscription for the service */
+  "no_active_subscription",
+  /** The organization has a subscription, but the user has no seat in it */
+  "no_seat_assignment",
+  /** The subscription has expired (canceled / past due beyond grace) */
+  "subscription_expired",
+  /** The flat plan's member limit is full, so no seat could be given */
+  "member_limit_reached"
+];
+function isFFIDOAuthDenialReason(value) {
+  return typeof value === "string" && FFID_OAUTH_DENIAL_REASONS.includes(value);
+}
+var DEFAULT_AUTHORIZATION_ERROR_MESSAGE = "\u8A8D\u53EF\u30B5\u30FC\u30D0\u30FC\u304C\u30A8\u30E9\u30FC\u3092\u8FD4\u3057\u307E\u3057\u305F";
+function buildAuthorizationError(params) {
+  const oauthError = params.get("error");
+  if (!oauthError) return null;
+  const rawReason = params.get("denial_reason");
+  const errorDescription = params.get("error_description");
+  const details = {
+    source: "authorization",
+    denialReason: isFFIDOAuthDenialReason(rawReason) ? rawReason : null,
+    errorDescription
+  };
+  return {
+    code: oauthError,
+    message: errorDescription ?? DEFAULT_AUTHORIZATION_ERROR_MESSAGE,
+    details: { ...details }
+  };
+}
+function getFFIDAuthorizationError(error) {
+  const details = error?.details;
+  if (!error || !details || details.source !== "authorization") return null;
+  const description = details.errorDescription;
+  return {
+    oauthError: error.code,
+    denialReason: isFFIDOAuthDenialReason(details.denialReason) ? details.denialReason : null,
+    errorDescription: typeof description === "string" ? description : null
+  };
+}
+
 // src/client/cache/memory-cache-adapter.ts
 var MS_PER_SECOND2 = 1e3;
 function createMemoryCacheAdapter() {
@@ -4654,14 +4744,9 @@ function createServerAuthClient(config) {
         }
       };
     }
-    const errorParam = url.searchParams.get("error");
-    if (errorParam) {
-      return {
-        error: {
-          code: errorParam,
-          message: url.searchParams.get("error_description") ?? "\u8A8D\u53EF\u30B5\u30FC\u30D0\u30FC\u304C\u30A8\u30E9\u30FC\u3092\u8FD4\u3057\u307E\u3057\u305F"
-        }
-      };
+    const authorizationError = buildAuthorizationError(url.searchParams);
+    if (authorizationError) {
+      return { error: authorizationError };
     }
     const code = url.searchParams.get("code");
     if (!code) {
@@ -4752,4 +4837,4 @@ function clear(opts = {}) {
 }
 var sessionCookies = { serialize, read, clear };
 
-export { ALL_DENIED_EXCEPT_NECESSARY, CATALOG_HASH_PATTERN, CONSENT_COOKIE_NAME, COOKIE_VERSION, FFIDCatalogHashError, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, FFID_CATALOG_ENVIRONMENTS, FFID_CATALOG_PUBLICATION_STATUSES, FFID_COMPANY_SIZE_CODES, FFID_ERROR_CODES, FFID_INDUSTRY_CODES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, FFID_ORGANIZATION_PROFILE_ERROR_CODES, FFID_SESSION_COOKIE_NAME, canonicalizeCatalogValue, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createFFIDClient, createKVCacheAdapter, createMemoryCacheAdapter, createServerAuthClient, createTokenStore, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, generateServerState, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies, hashCanonicalJson, sessionCookies, sha256Hex, validatePublishedCatalog };
+export { ALL_DENIED_EXCEPT_NECESSARY, CATALOG_HASH_PATTERN, CONSENT_COOKIE_NAME, COOKIE_VERSION, FFIDCatalogHashError, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, FFID_CATALOG_ENVIRONMENTS, FFID_CATALOG_PUBLICATION_STATUSES, FFID_COMPANY_SIZE_CODES, FFID_ERROR_CODES, FFID_INDUSTRY_CODES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, FFID_OAUTH_DENIAL_REASONS, FFID_ORGANIZATION_PROFILE_ERROR_CODES, FFID_SESSION_COOKIE_NAME, canonicalizeCatalogValue, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createFFIDClient, createKVCacheAdapter, createMemoryCacheAdapter, createServerAuthClient, createTokenStore, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, generateServerState, getFFIDAuthorizationError, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies, hashCanonicalJson, isFFIDOAuthDenialReason, sessionCookies, sha256Hex, validatePublishedCatalog };

package/dist/server/test/index.d.cts

@@ -1,4 +1,4 @@
-import { r as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-CumygXXz.cjs';
+import { r as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-C3A8L9uW.cjs';
 import '../../types-Cjb9J0rL.cjs';
 
 /**

package/dist/server/test/index.d.ts

@@ -1,4 +1,4 @@
-import { r as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-5uxXRgIO.js';
+import { r as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-By_vcKYu.js';
 import '../../types-Cjb9J0rL.js';
 
 /**