@feelflow/ffid-sdk 11.0.0 → 12.1.0

package/dist/server/index.cjs

@@ -310,13 +310,13 @@ var HTTP_SERVER_ERROR_MIN = 500;
 var HTTP_SERVER_ERROR_LIMIT = 600;
 function createVerifyAccessToken(deps) {
   const { authMode, baseUrl, serviceCode, serviceApiKey, verifyStrategy, logger, createError, errorCodes, cache, timeout } = deps;
-  let jwtVerify2 = null;
+  let jwtVerify3 = null;
   let cacheReadFailureEscalated = false;
   let cacheWriteFailureEscalated = false;
   let missingSubtleCryptoLogged = false;
   function getJwtVerifier() {
-    if (!jwtVerify2) {
-      jwtVerify2 = createJwtVerifier({
+    if (!jwtVerify3) {
+      jwtVerify3 = createJwtVerifier({
         baseUrl,
         serviceCode,
         logger,
@@ -326,7 +326,7 @@ function createVerifyAccessToken(deps) {
         errorCodes
       });
     }
-    return jwtVerify2;
+    return jwtVerify3;
   }
   async function verifyAccessToken(accessToken, options) {
     if (authMode !== "service-key") {
@@ -574,7 +574,8 @@ function createBillingMethods(deps) {
           subscriptionId: params.subscriptionId,
           successUrl: params.successUrl,
           cancelUrl: params.cancelUrl,
-          ...params.planId ? { planId: params.planId } : {}
+          ...params.planId ? { planId: params.planId } : {},
+          ...params.quantity !== void 0 ? { quantity: params.quantity } : {}
         })
       }
     );
@@ -1387,7 +1388,7 @@ var FFID_ORGANIZATION_PROFILE_ERROR_CODES = {
 };
 
 // src/client/version-check.ts
-var SDK_VERSION = "11.0.0";
+var SDK_VERSION = "12.1.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -4595,6 +4596,19 @@ function generateServerState() {
   globalThis.crypto.getRandomValues(bytes);
   return Array.from(bytes, (b) => b.toString(HEX_RADIX2).padStart(2, "0")).join("");
 }
+var STORED_STATE_SEPARATOR = ".";
+function packStoredLoginHandle(handle) {
+  return `${handle.state}${STORED_STATE_SEPARATOR}${handle.codeVerifier}`;
+}
+function unpackStoredLoginHandle(stored) {
+  if (!stored) return null;
+  const sep = stored.indexOf(STORED_STATE_SEPARATOR);
+  if (sep <= 0) return null;
+  const state = stored.slice(0, sep);
+  const codeVerifier = stored.slice(sep + STORED_STATE_SEPARATOR.length);
+  if (!codeVerifier) return null;
+  return { state, codeVerifier };
+}
 
 // src/server/auth/server-oauth-token.ts
 var OAUTH_TOKEN_ENDPOINT2 = "/api/v1/oauth/token";
@@ -4656,7 +4670,7 @@ async function postToken(deps, body, fallbackErrorCode) {
   }
   return { tokens: toTokens(validation.tokens) };
 }
-function exchangeAuthorizationCodeServer(deps, code) {
+function exchangeAuthorizationCodeServer(deps, code, codeVerifier) {
   return postToken(
     deps,
     {
@@ -4664,7 +4678,8 @@ function exchangeAuthorizationCodeServer(deps, code) {
       code,
       client_id: deps.clientId,
       client_secret: deps.clientSecret,
-      redirect_uri: deps.redirectUri
+      redirect_uri: deps.redirectUri,
+      code_verifier: codeVerifier
     },
     FFID_ERROR_CODES.TOKEN_EXCHANGE_ERROR
   );
@@ -4685,6 +4700,7 @@ function refreshTokensServer(deps, refreshToken) {
 // src/server/auth/server-auth-client.ts
 var OAUTH_AUTHORIZE_ENDPOINT2 = "/api/v1/oauth/authorize";
 var SCREEN_HINT_SIGNUP2 = "signup";
+var CODE_CHALLENGE_METHOD_S256 = "S256";
 function createServerAuthClient(config) {
   if (!config.serviceCode?.trim()) {
     throw new Error("FFID Server Auth: serviceCode \u304C\u672A\u8A2D\u5B9A\u3067\u3059");
@@ -4709,20 +4725,29 @@ function createServerAuthClient(config) {
     redirectUri: config.redirectUri,
     timeout: config.timeout
   };
-  function buildAuthorizeUrl(opts) {
+  async function buildAuthorizeUrl(opts) {
     const state = generateServerState();
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = await generateCodeChallenge(codeVerifier);
     const params = new URLSearchParams({
       response_type: "code",
       client_id: clientId,
       scope: config.scope,
       redirect_uri: config.redirectUri,
-      state
+      state,
+      code_challenge: codeChallenge,
+      code_challenge_method: CODE_CHALLENGE_METHOD_S256
     });
     const organizationId = opts?.organizationId?.trim();
     if (organizationId) params.set("organization_id", organizationId);
     if (opts?.screenHint === SCREEN_HINT_SIGNUP2) params.set("screen_hint", SCREEN_HINT_SIGNUP2);
     if (opts?.prompt) params.set("prompt", opts.prompt);
-    return { url: `${apiBaseUrl}${OAUTH_AUTHORIZE_ENDPOINT2}?${params.toString()}`, state };
+    return {
+      url: `${apiBaseUrl}${OAUTH_AUTHORIZE_ENDPOINT2}?${params.toString()}`,
+      // Opaque cookie value: state + verifier. Only `state` and the challenge
+      // reach the URL; the verifier stays in the caller's httpOnly cookie.
+      state: packStoredLoginHandle({ state, codeVerifier })
+    };
   }
   async function handleCallback(input) {
     let url;
@@ -4736,12 +4761,15 @@ function createServerAuthClient(config) {
         }
       };
     }
+    const stored = unpackStoredLoginHandle(input.storedState);
     const returnedState = url.searchParams.get("state") ?? void 0;
-    if (!input.storedState || !returnedState || input.storedState !== returnedState) {
+    if (!stored || !returnedState || stored.state !== returnedState) {
       return {
         error: {
           code: FFID_ERROR_CODES.STATE_MISMATCH_ERROR,
-          message: "OAuth state \u304C\u4E00\u81F4\u3057\u307E\u305B\u3093\u3002CSRF \u306E\u53EF\u80FD\u6027\u304C\u3042\u308B\u305F\u3081\u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+          // Not "CSRF suspected": a state-only cookie written before 12.0.0 also
+          // lands here, once per in-flight login across the upgrade (#6611).
+          message: "OAuth state \u304C\u4E00\u81F4\u3057\u306A\u3044\u304B\u3001\u30ED\u30B0\u30A4\u30F3\u306E\u958B\u59CB\u304B\u3089\u6642\u9593\u304C\u7D4C\u3063\u3066\u3044\u307E\u3059\u3002\u3082\u3046\u4E00\u5EA6\u30ED\u30B0\u30A4\u30F3\u3057\u3066\u304F\u3060\u3055\u3044"
         }
       };
     }
@@ -4758,7 +4786,7 @@ function createServerAuthClient(config) {
         }
       };
     }
-    return exchangeAuthorizationCodeServer(deps, code);
+    return exchangeAuthorizationCodeServer(deps, code, stored.codeVerifier);
   }
   function refresh(refreshToken) {
     return refreshTokensServer(deps, refreshToken);
@@ -4838,6 +4866,186 @@ function clear(opts = {}) {
 }
 var sessionCookies = { serialize, read, clear };
 
+// src/server/db-token/constants.ts
+var FFID_DB_TOKEN_ALGORITHM = "ES256";
+var FFID_DB_TOKEN_ROLE = "authenticated";
+var FFID_DB_TOKEN_AUDIENCE = "authenticated";
+var DEFAULT_DB_TOKEN_TTL_SECONDS = 300;
+var MAX_DB_TOKEN_TTL_SECONDS = 900;
+var FFID_DB_TOKEN_ORGANIZATION_CLAIM = "organization_id";
+var FFID_DB_TOKEN_RESERVED_CLAIMS = [
+  "sub",
+  "role",
+  "aud",
+  "iss",
+  "iat",
+  "exp",
+  "nbf",
+  "jti",
+  FFID_DB_TOKEN_ORGANIZATION_CLAIM
+];
+var MILLISECONDS_PER_SECOND = 1e3;
+
+// src/server/db-token/errors.ts
+var FFID_DB_TOKEN_ERROR_CODES = {
+  /** Signing key is not a private P-256 JWK with a `kid`, or cannot be imported. */
+  INVALID_SIGNING_KEY: "INVALID_SIGNING_KEY",
+  /** `ttlSeconds` is not a positive integer within `MAX_DB_TOKEN_TTL_SECONDS`. */
+  INVALID_TTL: "INVALID_TTL",
+  /** `userId` is not a UUID. */
+  INVALID_USER_ID: "INVALID_USER_ID",
+  /** `organizationId` is not a UUID. */
+  INVALID_ORGANIZATION_ID: "INVALID_ORGANIZATION_ID",
+  /** A product claim uses a name the minter reserves (`sub`, `role`, `exp`, ...). */
+  RESERVED_CLAIM: "RESERVED_CLAIM",
+  /** `now` is not a valid `Date` (an Invalid Date would sign `iat` / `exp` as null). */
+  INVALID_CLOCK: "INVALID_CLOCK"
+};
+var FFIDDbTokenError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "FFIDDbTokenError";
+    this.code = code;
+  }
+};
+
+// src/server/db-token/mint.ts
+var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var RESERVED_CLAIM_SET = new Set(FFID_DB_TOKEN_RESERVED_CLAIMS);
+var isNonEmptyString = (value) => typeof value === "string" && value.length > 0;
+var invalidKey = (reason, cause) => new FFIDDbTokenError(
+  FFID_DB_TOKEN_ERROR_CODES.INVALID_SIGNING_KEY,
+  `Invalid DB token signing key: ${reason}`,
+  cause === void 0 ? void 0 : { cause }
+);
+var describeCause = (cause) => cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause);
+function parseSigningKey(signingKey, kidOverride) {
+  let candidate = signingKey;
+  if (typeof signingKey === "string") {
+    if (signingKey.trim().length === 0) {
+      throw invalidKey("signingKey is empty (is the environment variable set?)");
+    }
+    try {
+      candidate = JSON.parse(signingKey);
+    } catch {
+      throw invalidKey("not valid JSON");
+    }
+  }
+  if (typeof candidate !== "object" || candidate === null || Array.isArray(candidate)) {
+    throw invalidKey("expected a JWK object");
+  }
+  const jwk = candidate;
+  if (jwk.kty !== "EC" || jwk.crv !== "P-256") {
+    throw invalidKey(`expected kty=EC crv=P-256 for ${FFID_DB_TOKEN_ALGORITHM}`);
+  }
+  if (!isNonEmptyString(jwk.d) || !isNonEmptyString(jwk.x) || !isNonEmptyString(jwk.y)) {
+    throw invalidKey("expected a private key (d, x, y)");
+  }
+  const kid = kidOverride ?? jwk.kid;
+  if (!isNonEmptyString(kid)) {
+    throw invalidKey("kid is required (Supabase matches the header kid against the imported key)");
+  }
+  return { jwk, kid };
+}
+function resolveTtlSeconds(ttlSeconds) {
+  const ttl = ttlSeconds ?? DEFAULT_DB_TOKEN_TTL_SECONDS;
+  if (!Number.isInteger(ttl) || ttl < 1 || ttl > MAX_DB_TOKEN_TTL_SECONDS) {
+    throw new FFIDDbTokenError(
+      FFID_DB_TOKEN_ERROR_CODES.INVALID_TTL,
+      `ttlSeconds must be an integer between 1 and ${MAX_DB_TOKEN_TTL_SECONDS}`
+    );
+  }
+  return ttl;
+}
+function requireUuid(value, code, label) {
+  if (typeof value !== "string" || !UUID_PATTERN2.test(value)) {
+    throw new FFIDDbTokenError(FFID_DB_TOKEN_ERROR_CODES[code], `${label} must be a UUID`);
+  }
+  return value.toLowerCase();
+}
+function resolveNow(now) {
+  if (now === void 0) return /* @__PURE__ */ new Date();
+  if (!(now instanceof Date) || Number.isNaN(now.getTime())) {
+    throw new FFIDDbTokenError(FFID_DB_TOKEN_ERROR_CODES.INVALID_CLOCK, "now must be a valid Date");
+  }
+  return now;
+}
+function assertNoReservedClaims(claims) {
+  if (!claims) return;
+  for (const name of Object.keys(claims)) {
+    if (RESERVED_CLAIM_SET.has(name)) {
+      throw new FFIDDbTokenError(
+        FFID_DB_TOKEN_ERROR_CODES.RESERVED_CLAIM,
+        `Claim "${name}" is reserved by the DB token minter`
+      );
+    }
+  }
+}
+async function importSigningKey(jwk, kid) {
+  const ecParameters = { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y };
+  let privateKey;
+  let publicKey;
+  try {
+    const imported = await Promise.all([
+      jose.importJWK({ ...ecParameters, d: jwk.d, kid, alg: FFID_DB_TOKEN_ALGORITHM }, FFID_DB_TOKEN_ALGORITHM),
+      jose.importJWK({ ...ecParameters, kid, alg: FFID_DB_TOKEN_ALGORITHM }, FFID_DB_TOKEN_ALGORITHM)
+    ]);
+    if (imported[0] instanceof Uint8Array || imported[1] instanceof Uint8Array) {
+      throw new Error("expected an asymmetric key");
+    }
+    ;
+    [privateKey, publicKey] = imported;
+  } catch (cause) {
+    throw invalidKey(`key material could not be imported (${describeCause(cause)})`, cause);
+  }
+  try {
+    const probe = await new jose.SignJWT({}).setProtectedHeader({ alg: FFID_DB_TOKEN_ALGORITHM, kid }).sign(privateKey);
+    await jose.jwtVerify(probe, publicKey);
+  } catch (cause) {
+    throw invalidKey("private part (d) does not match the public part (x, y)", cause);
+  }
+  return privateKey;
+}
+function createDbTokenMinter(config) {
+  const { jwk, kid } = parseSigningKey(config.signingKey, config.kid);
+  const ttlSeconds = resolveTtlSeconds(config.ttlSeconds);
+  const issuer = config.issuer;
+  let keyPromise;
+  const loadKey = () => {
+    keyPromise ??= importSigningKey(jwk, kid).catch((error) => {
+      keyPromise = void 0;
+      throw error;
+    });
+    return keyPromise;
+  };
+  return {
+    kid,
+    ttlSeconds,
+    async mint(input) {
+      const sub = requireUuid(input.userId, "INVALID_USER_ID", "userId");
+      const organizationId = input.organizationId === void 0 || input.organizationId === null ? void 0 : requireUuid(input.organizationId, "INVALID_ORGANIZATION_ID", "organizationId");
+      assertNoReservedClaims(input.claims);
+      const now = resolveNow(input.now);
+      const iat = Math.floor(now.getTime() / MILLISECONDS_PER_SECOND);
+      const exp = iat + ttlSeconds;
+      const claims = {
+        ...input.claims,
+        sub,
+        role: FFID_DB_TOKEN_ROLE,
+        aud: FFID_DB_TOKEN_AUDIENCE,
+        iat,
+        exp,
+        ...issuer === void 0 ? {} : { iss: issuer },
+        ...organizationId === void 0 ? {} : { [FFID_DB_TOKEN_ORGANIZATION_CLAIM]: organizationId }
+      };
+      const key = await loadKey();
+      const token = await new jose.SignJWT(claims).setProtectedHeader({ alg: FFID_DB_TOKEN_ALGORITHM, kid, typ: "JWT" }).sign(key);
+      return { token, expiresAt: new Date(exp * MILLISECONDS_PER_SECOND), claims };
+    }
+  };
+}
+
 Object.defineProperty(exports, "DEFAULT_API_BASE_URL", {
   enumerable: true,
   get: function () { return chunkMDHKSVLP_cjs.DEFAULT_API_BASE_URL; }
@@ -4850,11 +5058,19 @@ exports.ALL_DENIED_EXCEPT_NECESSARY = ALL_DENIED_EXCEPT_NECESSARY;
 exports.CATALOG_HASH_PATTERN = CATALOG_HASH_PATTERN;
 exports.CONSENT_COOKIE_NAME = CONSENT_COOKIE_NAME;
 exports.COOKIE_VERSION = COOKIE_VERSION;
+exports.DEFAULT_DB_TOKEN_TTL_SECONDS = DEFAULT_DB_TOKEN_TTL_SECONDS;
 exports.FFIDCatalogHashError = FFIDCatalogHashError;
+exports.FFIDDbTokenError = FFIDDbTokenError;
 exports.FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES = FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES;
 exports.FFID_CATALOG_ENVIRONMENTS = FFID_CATALOG_ENVIRONMENTS;
 exports.FFID_CATALOG_PUBLICATION_STATUSES = FFID_CATALOG_PUBLICATION_STATUSES;
 exports.FFID_COMPANY_SIZE_CODES = FFID_COMPANY_SIZE_CODES;
+exports.FFID_DB_TOKEN_ALGORITHM = FFID_DB_TOKEN_ALGORITHM;
+exports.FFID_DB_TOKEN_AUDIENCE = FFID_DB_TOKEN_AUDIENCE;
+exports.FFID_DB_TOKEN_ERROR_CODES = FFID_DB_TOKEN_ERROR_CODES;
+exports.FFID_DB_TOKEN_ORGANIZATION_CLAIM = FFID_DB_TOKEN_ORGANIZATION_CLAIM;
+exports.FFID_DB_TOKEN_RESERVED_CLAIMS = FFID_DB_TOKEN_RESERVED_CLAIMS;
+exports.FFID_DB_TOKEN_ROLE = FFID_DB_TOKEN_ROLE;
 exports.FFID_ERROR_CODES = FFID_ERROR_CODES;
 exports.FFID_INDUSTRY_CODES = FFID_INDUSTRY_CODES;
 exports.FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES = FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES;
@@ -4862,6 +5078,7 @@ exports.FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB = FFID_MAX_ORGANIZATION_LOGO_FIL
 exports.FFID_OAUTH_DENIAL_REASONS = FFID_OAUTH_DENIAL_REASONS;
 exports.FFID_ORGANIZATION_PROFILE_ERROR_CODES = FFID_ORGANIZATION_PROFILE_ERROR_CODES;
 exports.FFID_SESSION_COOKIE_NAME = FFID_SESSION_COOKIE_NAME;
+exports.MAX_DB_TOKEN_TTL_SECONDS = MAX_DB_TOKEN_TTL_SECONDS;
 exports.canonicalizeCatalogValue = canonicalizeCatalogValue;
 exports.computeFFIDCheckoutCopyHash = computeFFIDCheckoutCopyHash;
 exports.computeLegalDisclosureHash = computeLegalDisclosureHash;
@@ -4869,6 +5086,7 @@ exports.computePaymentConfigurationHash = computePaymentConfigurationHash;
 exports.computePraxisCopyHash = computePraxisCopyHash;
 exports.computeScopeHash = computeScopeHash;
 exports.computeTaxConfigurationHash = computeTaxConfigurationHash;
+exports.createDbTokenMinter = createDbTokenMinter;
 exports.createFFIDClient = createFFIDClient;
 exports.createKVCacheAdapter = createKVCacheAdapter;
 exports.createMemoryCacheAdapter = createMemoryCacheAdapter;

package/dist/server/index.d.cts

@@ -1,5 +1,5 @@
-import { F as FFIDError, a as FFIDLogger, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo, f as FFIDCatalogEnvironment, g as FFIDBillingInterval, h as FFIDTaxBehavior, i as FFIDPublishedCatalog } from '../ffid-client-C3A8L9uW.cjs';
-export { j as FFIDAddMemberParams, k as FFIDAddMemberRequest, l as FFIDAddMemberResponse, m as FFIDAllowedLogoMimeType, n as FFIDAssignableMemberRole, o as FFIDCacheConfig, p as FFIDCatalogPublication, q as FFIDCatalogPublicationStatus, r as FFIDClient, s as FFIDCompanySizeCode, t as FFIDConfig, u as FFIDIndustryCode, v as FFIDListMembersResponse, w as FFIDListingConsentInput, x as FFIDLogoWallEntry, y as FFIDLogoWallResponse, z as FFIDMemberRole, A as FFIDMemberSeatAssignmentResult, B as FFIDOrganization, C as FFIDOrganizationLogoUploadResponse, D as FFIDOrganizationMember, E as FFIDOrganizationProfile, G as FFIDOrganizationProfileErrorCode, H as FFIDOrganizationProfileResponse, I as FFIDOtpSendResponse, J as FFIDOtpVerifyResponse, K as FFIDPasswordResetConfirmResponse, L as FFIDPasswordResetResponse, M as FFIDPasswordResetVerifyResponse, N as FFIDProfileCallOptions, O as FFIDProvisionMemberPlan, P as FFIDProvisionMemberPlanStatus, Q as FFIDProvisionMemberResult, R as FFIDProvisionMemberStatus, S as FFIDProvisionOrganizationDryRun, T as FFIDProvisionOrganizationMemberInput, U as FFIDProvisionOrganizationOutcome, V as FFIDProvisionOrganizationParams, W as FFIDProvisionOrganizationResponse, X as FFIDProvisionUserDryRun, Y as FFIDProvisionUserOutcome, Z as FFIDProvisionUserParams, _ as FFIDProvisionUserProfileInput, $ as FFIDProvisionUserResponse, a0 as FFIDProvisionedOrganization, a1 as FFIDProvisionedUser, a2 as FFIDPublishedPlan, a3 as FFIDRemoveMemberResponse, a4 as FFIDResetSessionResponse, a5 as FFIDSubscription, a6 as FFIDUpdateMemberRoleResponse, a7 as FFIDUpdateUserProfileRequest, a8 as FFIDUploadOrganizationLogoParams, a9 as FFIDUpsertOrganizationProfileParams, aa as FFIDUpsertOrganizationProfileRequest, ab as FFIDUser, ac as FFIDUserProfile, ad as FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, ae as FFID_CATALOG_ENVIRONMENTS, af as FFID_CATALOG_PUBLICATION_STATUSES, ag as FFID_COMPANY_SIZE_CODES, ah as FFID_INDUSTRY_CODES, ai as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, aj as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, ak as FFID_ORGANIZATION_PROFILE_ERROR_CODES, al as TokenData, am as TokenStore, an as createFFIDClient, ao as createTokenStore } from '../ffid-client-C3A8L9uW.cjs';
+import { F as FFIDError, a as FFIDLogger, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo, f as FFIDCatalogEnvironment, g as FFIDBillingInterval, h as FFIDTaxBehavior, i as FFIDPublishedCatalog } from '../ffid-client-aUNBn5SW.cjs';
+export { j as FFIDAddMemberParams, k as FFIDAddMemberRequest, l as FFIDAddMemberResponse, m as FFIDAllowedLogoMimeType, n as FFIDAssignableMemberRole, o as FFIDCacheConfig, p as FFIDCatalogPublication, q as FFIDCatalogPublicationStatus, r as FFIDClient, s as FFIDCompanySizeCode, t as FFIDConfig, u as FFIDIndustryCode, v as FFIDListMembersResponse, w as FFIDListingConsentInput, x as FFIDLogoWallEntry, y as FFIDLogoWallResponse, z as FFIDMemberRole, A as FFIDMemberSeatAssignmentResult, B as FFIDOrganization, C as FFIDOrganizationLogoUploadResponse, D as FFIDOrganizationMember, E as FFIDOrganizationProfile, G as FFIDOrganizationProfileErrorCode, H as FFIDOrganizationProfileResponse, I as FFIDOtpSendResponse, J as FFIDOtpVerifyResponse, K as FFIDPasswordResetConfirmResponse, L as FFIDPasswordResetResponse, M as FFIDPasswordResetVerifyResponse, N as FFIDProfileCallOptions, O as FFIDProvisionMemberPlan, P as FFIDProvisionMemberPlanStatus, Q as FFIDProvisionMemberResult, R as FFIDProvisionMemberStatus, S as FFIDProvisionOrganizationDryRun, T as FFIDProvisionOrganizationMemberInput, U as FFIDProvisionOrganizationOutcome, V as FFIDProvisionOrganizationParams, W as FFIDProvisionOrganizationResponse, X as FFIDProvisionUserDryRun, Y as FFIDProvisionUserOutcome, Z as FFIDProvisionUserParams, _ as FFIDProvisionUserProfileInput, $ as FFIDProvisionUserResponse, a0 as FFIDProvisionedOrganization, a1 as FFIDProvisionedUser, a2 as FFIDPublishedPlan, a3 as FFIDRemoveMemberResponse, a4 as FFIDResetSessionResponse, a5 as FFIDSubscription, a6 as FFIDUpdateMemberRoleResponse, a7 as FFIDUpdateUserProfileRequest, a8 as FFIDUploadOrganizationLogoParams, a9 as FFIDUpsertOrganizationProfileParams, aa as FFIDUpsertOrganizationProfileRequest, ab as FFIDUser, ac as FFIDUserProfile, ad as FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, ae as FFID_CATALOG_ENVIRONMENTS, af as FFID_CATALOG_PUBLICATION_STATUSES, ag as FFID_COMPANY_SIZE_CODES, ah as FFID_INDUSTRY_CODES, ai as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, aj as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, ak as FFID_ORGANIZATION_PROFILE_ERROR_CODES, al as TokenData, am as TokenStore, an as createFFIDClient, ao as createTokenStore } from '../ffid-client-aUNBn5SW.cjs';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-Ce2eXQtB.cjs';
 import { z } from 'zod';
 import '../types-Cjb9J0rL.cjs';
@@ -356,14 +356,22 @@ interface BuildAuthorizeUrlOptions {
 interface BuildAuthorizeUrlResult {
     /** Authorize URL to 302 the browser to. */
     url: string;
-    /** Random `state` — persist in an httpOnly cookie and pass back as `storedState`. */
+    /**
+     * Opaque value to persist in an httpOnly cookie and pass back as
+     * `storedState`. Since 12.0.0 (#6611) it is `<state>.<code_verifier>`, not the
+     * raw OAuth `state` — do not compare it with the callback's `state` query
+     * yourself, and do not parse it; {@link ServerAuthClient.handleCallback} does.
+     */
     state: string;
 }
 /** Input to {@link ServerAuthClient.handleCallback}. */
 interface HandleCallbackInput {
     /** The callback request URL (absolute). `code` / `state` are read from its query. */
     url: string | URL;
-    /** The `state` previously stored in the httpOnly cookie (undefined if absent). */
+    /**
+     * The value previously stored in the httpOnly cookie — `result.state` from
+     * {@link ServerAuthClient.buildAuthorizeUrl}, verbatim (undefined if absent).
+     */
     storedState: string | undefined;
 }
 /**
@@ -380,14 +388,18 @@ type ServerTokenResult = {
 /** Framework-agnostic confidential / BFF auth client. */
 interface ServerAuthClient {
     /**
-     * Build the authorize URL and a fresh `state`. The caller stores `state` in an
-     * httpOnly cookie, then 302s to `url`. No `code_challenge` is sent (v1 uses
-     * `client_secret`, not PKCE).
+     * Build the authorize URL with a fresh `state` and a PKCE S256
+     * `code_challenge` (#6611). The caller stores the returned `state` (which also
+     * carries the `code_verifier`) in an httpOnly cookie, then 302s to `url`.
+     * Async since 12.0.0 — the S256 challenge uses Web Crypto `subtle.digest`.
      */
-    buildAuthorizeUrl(opts?: BuildAuthorizeUrlOptions): BuildAuthorizeUrlResult;
+    buildAuthorizeUrl(opts?: BuildAuthorizeUrlOptions): Promise<BuildAuthorizeUrlResult>;
     /**
-     * Validate `state` (CSRF, fail-closed) then exchange `code` for tokens using
-     * the `client_secret` (server→server, browser never sees the secret or tokens).
+     * Validate `state` (CSRF, fail-closed; a stored value without the PKCE
+     * verifier is also a mismatch) then exchange `code` for tokens using the
+     * `client_secret` and `code_verifier` (server→server; browser JS never reads
+     * the secret, the verifier, or the tokens — the verifier and tokens travel only
+     * in httpOnly cookies, never in a URL).
      */
     handleCallback(input: HandleCallbackInput): Promise<ServerTokenResult>;
     /** Refresh tokens (`refresh_token` grant, `client_secret`-authenticated). */
@@ -637,4 +649,147 @@ declare function computeScopeHash(input: FFIDScopeHashInput): Promise<string>;
  */
 declare function validatePublishedCatalog(catalog: unknown): asserts catalog is FFIDPublishedCatalog;
 
-export { ALL_DENIED_EXCEPT_NECESSARY, type BuildAuthorizeUrlOptions, type BuildAuthorizeUrlResult, CATALOG_HASH_PATTERN, CONSENT_COOKIE_NAME, COOKIE_VERSION, type CookieOptions, type FFIDAuthorizationError, type FFIDAuthorizationErrorDetails, FFIDCacheAdapter, type FFIDCanonicalJsonValue, FFIDCatalogEnvironment, FFIDCatalogHashError, type FFIDConsentCategories, type FFIDConsentCategoryCode, type FFIDCookieStoreLike, type FFIDErrorCode, type FFIDOAuthDenialReason, FFIDOAuthUserInfo, type FFIDPaymentConfiguration, FFIDPublishedCatalog, type FFIDScopeHashInput, type FFIDScopeHashPlan, FFIDTaxBehavior, type FFIDTaxConfiguration, FFIDVerifyAccessTokenOptions, FFID_ERROR_CODES, FFID_OAUTH_DENIAL_REASONS, FFID_SESSION_COOKIE_NAME, type HandleCallbackInput, type KVNamespaceLike, type ServerAuthClient, type ServerAuthConfig, type ServerSessionTokens, type ServerTokenResult, canonicalizeCatalogValue, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createKVCacheAdapter, createMemoryCacheAdapter, createServerAuthClient, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, generateServerState, getFFIDAuthorizationError, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies, hashCanonicalJson, isFFIDOAuthDenialReason, sessionCookies, sha256Hex, validatePublishedCatalog };
+/**
+ * Constants for the product-side DB token minter (#6318).
+ *
+ * A product that reaches its own Supabase through supabase-js (PostgREST)
+ * mints a short-lived token for the FFID user on its server and sends it as
+ * the `Authorization: Bearer` header. Supabase validates it against the
+ * product's JWT Signing Keys and RLS reads the user from `auth.jwt()`.
+ */
+/** Only asymmetric signing is allowed; a shared secret (HS256) is rejected by policy. */
+declare const FFID_DB_TOKEN_ALGORITHM: "ES256";
+/** Supabase maps this claim to the Postgres role the request runs as. */
+declare const FFID_DB_TOKEN_ROLE: "authenticated";
+/** Same shape as the user tokens Supabase Auth issues (`aud` = `authenticated`). */
+declare const FFID_DB_TOKEN_AUDIENCE: "authenticated";
+/** Default lifetime: 5 minutes. The token is minted per request and never sent to the browser. */
+declare const DEFAULT_DB_TOKEN_TTL_SECONDS = 300;
+/** Hard ceiling: 15 minutes. Longer tokens defeat the "mint per request" model. */
+declare const MAX_DB_TOKEN_TTL_SECONDS = 900;
+/** Claim that carries the FFID organization id when the product scopes rows by organization. */
+declare const FFID_DB_TOKEN_ORGANIZATION_CLAIM: "organization_id";
+/**
+ * Claims the minter owns. Product-specific `claims` must not use these names,
+ * so a caller cannot forge a different user, role, or lifetime.
+ */
+declare const FFID_DB_TOKEN_RESERVED_CLAIMS: readonly ["sub", "role", "aud", "iss", "iat", "exp", "nbf", "jti", "organization_id"];
+
+/**
+ * Types for the product-side DB token minter (#6318).
+ */
+
+/**
+ * Private P-256 JWK used to sign DB tokens. Generate it with
+ * `supabase gen signing-key --algorithm ES256`, import that private JWK into the
+ * product's Supabase JWT Signing Keys (Supabase keeps it non-extractable and
+ * publishes only the public half via JWKS), and keep the same JWK in a server
+ * environment variable. Nothing else may hold it.
+ *
+ * The CLI output also carries `use`, `key_ops` and `ext`; the minter strips
+ * those before import (WebCrypto rejects an ECDSA private key whose `key_ops`
+ * includes `verify`).
+ */
+interface FFIDDbTokenSigningJwk {
+    kty: 'EC';
+    crv: 'P-256';
+    /** Private scalar. Its presence is what makes this a signing key. */
+    d: string;
+    x: string;
+    y: string;
+    /** Key id. Supabase matches the token header `kid` against the imported key. */
+    kid?: string;
+    alg?: string;
+    use?: string;
+    [parameter: string]: unknown;
+}
+interface FFIDDbTokenMinterConfig {
+    /**
+     * The private JWK, either as an object or as the JSON string stored in an
+     * environment variable (for example `SUPABASE_JWT_SIGNING_KEY`).
+     */
+    signingKey: string | FFIDDbTokenSigningJwk;
+    /** Overrides the JWK's `kid`. Required when the JWK has none. */
+    kid?: string;
+    /** Token lifetime. Default `DEFAULT_DB_TOKEN_TTL_SECONDS`, max `MAX_DB_TOKEN_TTL_SECONDS`. */
+    ttlSeconds?: number;
+    /** Optional `iss` claim. Supabase does not require it; set it when the product's policies read it. */
+    issuer?: string;
+}
+interface FFIDMintDbTokenInput {
+    /** FFID user id (UUID). Becomes `sub`, the value `private.current_ffid_user_id()` returns. */
+    userId: string;
+    /** FFID organization id (UUID). Becomes the `organization_id` claim. `null` means "none", like `FFIDUser.organizationId`. */
+    organizationId?: string | null;
+    /** Product-specific claims. Reserved names (`FFID_DB_TOKEN_RESERVED_CLAIMS`) are rejected. */
+    claims?: Record<string, unknown>;
+    /** Clock override for tests. Defaults to `new Date()`. An Invalid Date is rejected (`INVALID_CLOCK`). */
+    now?: Date;
+}
+interface FFIDDbTokenClaims {
+    sub: string;
+    role: typeof FFID_DB_TOKEN_ROLE;
+    aud: typeof FFID_DB_TOKEN_AUDIENCE;
+    iat: number;
+    exp: number;
+    iss?: string;
+    organization_id?: string;
+    [claim: string]: unknown;
+}
+interface FFIDDbToken {
+    /** Compact JWS to send as `Authorization: Bearer <token>` to the product's Supabase. */
+    token: string;
+    /** `exp` as a `Date`. For logging / diagnostics; the client is still created per request. */
+    expiresAt: Date;
+    /** The signed payload, for logging claim names (never log the token itself). */
+    claims: FFIDDbTokenClaims;
+}
+interface FFIDDbTokenMinter {
+    /** Key id written to every token header. */
+    readonly kid: string;
+    /** Effective lifetime in seconds. */
+    readonly ttlSeconds: number;
+    mint(input: FFIDMintDbTokenInput): Promise<FFIDDbToken>;
+}
+
+/**
+ * Creates a minter bound to one signing key. Create it once per process and
+ * call `mint()` per request.
+ *
+ * The key shape is checked synchronously here. The key material is imported on
+ * the first `mint()`; a successful import is kept for the minter's lifetime,
+ * a failed one is retried on the next `mint()`.
+ *
+ * @throws FFIDDbTokenError when the key shape or TTL is invalid.
+ */
+declare function createDbTokenMinter(config: FFIDDbTokenMinterConfig): FFIDDbTokenMinter;
+
+/**
+ * Errors thrown by the product-side DB token minter (#6318).
+ *
+ * These are programming / configuration errors on the product's server, never
+ * end-user input errors. Messages never include key material.
+ */
+declare const FFID_DB_TOKEN_ERROR_CODES: {
+    /** Signing key is not a private P-256 JWK with a `kid`, or cannot be imported. */
+    readonly INVALID_SIGNING_KEY: "INVALID_SIGNING_KEY";
+    /** `ttlSeconds` is not a positive integer within `MAX_DB_TOKEN_TTL_SECONDS`. */
+    readonly INVALID_TTL: "INVALID_TTL";
+    /** `userId` is not a UUID. */
+    readonly INVALID_USER_ID: "INVALID_USER_ID";
+    /** `organizationId` is not a UUID. */
+    readonly INVALID_ORGANIZATION_ID: "INVALID_ORGANIZATION_ID";
+    /** A product claim uses a name the minter reserves (`sub`, `role`, `exp`, ...). */
+    readonly RESERVED_CLAIM: "RESERVED_CLAIM";
+    /** `now` is not a valid `Date` (an Invalid Date would sign `iat` / `exp` as null). */
+    readonly INVALID_CLOCK: "INVALID_CLOCK";
+};
+type FFIDDbTokenErrorCode = (typeof FFID_DB_TOKEN_ERROR_CODES)[keyof typeof FFID_DB_TOKEN_ERROR_CODES];
+declare class FFIDDbTokenError extends Error {
+    readonly code: FFIDDbTokenErrorCode;
+    constructor(code: FFIDDbTokenErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
+}
+
+export { ALL_DENIED_EXCEPT_NECESSARY, type BuildAuthorizeUrlOptions, type BuildAuthorizeUrlResult, CATALOG_HASH_PATTERN, CONSENT_COOKIE_NAME, COOKIE_VERSION, type CookieOptions, DEFAULT_DB_TOKEN_TTL_SECONDS, type FFIDAuthorizationError, type FFIDAuthorizationErrorDetails, FFIDCacheAdapter, type FFIDCanonicalJsonValue, FFIDCatalogEnvironment, FFIDCatalogHashError, type FFIDConsentCategories, type FFIDConsentCategoryCode, type FFIDCookieStoreLike, type FFIDDbToken, type FFIDDbTokenClaims, FFIDDbTokenError, type FFIDDbTokenErrorCode, type FFIDDbTokenMinter, type FFIDDbTokenMinterConfig, type FFIDDbTokenSigningJwk, type FFIDErrorCode, type FFIDMintDbTokenInput, type FFIDOAuthDenialReason, FFIDOAuthUserInfo, type FFIDPaymentConfiguration, FFIDPublishedCatalog, type FFIDScopeHashInput, type FFIDScopeHashPlan, FFIDTaxBehavior, type FFIDTaxConfiguration, FFIDVerifyAccessTokenOptions, FFID_DB_TOKEN_ALGORITHM, FFID_DB_TOKEN_AUDIENCE, FFID_DB_TOKEN_ERROR_CODES, FFID_DB_TOKEN_ORGANIZATION_CLAIM, FFID_DB_TOKEN_RESERVED_CLAIMS, FFID_DB_TOKEN_ROLE, FFID_ERROR_CODES, FFID_OAUTH_DENIAL_REASONS, FFID_SESSION_COOKIE_NAME, type HandleCallbackInput, type KVNamespaceLike, MAX_DB_TOKEN_TTL_SECONDS, type ServerAuthClient, type ServerAuthConfig, type ServerSessionTokens, type ServerTokenResult, canonicalizeCatalogValue, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createDbTokenMinter, createKVCacheAdapter, createMemoryCacheAdapter, createServerAuthClient, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, generateServerState, getFFIDAuthorizationError, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies, hashCanonicalJson, isFFIDOAuthDenialReason, sessionCookies, sha256Hex, validatePublishedCatalog };