@feelflow/ffid-sdk 5.12.0 → 5.14.0

package/dist/{chunk-KB2JG64Z.js → chunk-4II4R7NR.js}

@@ -122,6 +122,9 @@ function normalizeUserinfo(raw) {
   return {
     sub: raw.sub,
     email: raw.email,
+    // #3791: undefined → undefined を保つ（false に丸めない）。古い FFID は wire に
+    // 含めないため、consumer は undefined を「未確認」ではなく「不明」として扱える。
+    emailVerified: raw.email_verified,
     name: raw.name,
     picture: raw.picture,
     companyName: raw.company_name ?? null,
@@ -377,6 +380,9 @@ function createVerifyAccessToken(deps) {
     const base = {
       sub: introspectResponse.sub,
       email: introspectResponse.email ?? null,
+      // #3791: preserve undefined (do NOT coerce to false) so introspect-strategy
+      // callers can distinguish "verified" / "not verified" / "older server".
+      email_verified: introspectResponse.email_verified,
       name: introspectResponse.name ?? null,
       picture: introspectResponse.picture ?? null,
       company_name: introspectResponse.company_name ?? null,
@@ -931,8 +937,163 @@ function createProfileMethods(deps) {
   return { getProfile, updateProfile };
 }
 
+// src/client/login-history-methods.ts
+var EXT_LOGIN_HISTORY_ENDPOINT = "/api/v1/users/ext/me/login-history";
+function createLoginHistoryMethods(deps) {
+  const { fetchWithAuth, createError } = deps;
+  async function getLoginHistory(params) {
+    if (params?.limit !== void 0 && (!Number.isInteger(params.limit) || params.limit <= 0)) {
+      return {
+        error: createError(
+          "VALIDATION_ERROR",
+          "limit \u306F1\u4EE5\u4E0A\u306E\u6574\u6570\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044"
+        )
+      };
+    }
+    const query = new URLSearchParams();
+    if (params?.userId !== void 0) {
+      query.set("userId", params.userId);
+    }
+    if (params?.limit !== void 0) {
+      query.set("limit", String(params.limit));
+    }
+    const queryString = query.toString();
+    const endpoint = queryString ? `${EXT_LOGIN_HISTORY_ENDPOINT}?${queryString}` : EXT_LOGIN_HISTORY_ENDPOINT;
+    return fetchWithAuth(endpoint);
+  }
+  return { getLoginHistory };
+}
+
+// src/client/organization-domains-methods.ts
+var EXT_DOMAINS_ENDPOINT = "/api/v1/organizations/ext/domains";
+function createOrganizationDomainsMethods(deps) {
+  const { fetchWithAuth, createError, serviceCode } = deps;
+  function buildQuery(organizationId) {
+    return new URLSearchParams({ organizationId, serviceCode }).toString();
+  }
+  async function getOrganizationDomains(params) {
+    if (!params.organizationId) {
+      return {
+        error: createError("VALIDATION_ERROR", "organizationId \u306F\u5FC5\u9808\u3067\u3059")
+      };
+    }
+    return fetchWithAuth(
+      `${EXT_DOMAINS_ENDPOINT}?${buildQuery(params.organizationId)}`
+    );
+  }
+  return { getOrganizationDomains };
+}
+
+// src/client/notification-preferences-methods.ts
+var EXT_NOTIFICATION_PREFERENCES_ENDPOINT = "/api/v1/organizations/ext/notification-preferences";
+function createNotificationPreferencesMethods(deps) {
+  const { fetchWithAuth, createError, serviceCode } = deps;
+  function buildQuery(organizationId) {
+    return new URLSearchParams({ organizationId, serviceCode }).toString();
+  }
+  async function getNotificationPreferences(params) {
+    if (!params.organizationId) {
+      return {
+        error: createError("VALIDATION_ERROR", "organizationId \u306F\u5FC5\u9808\u3067\u3059")
+      };
+    }
+    return fetchWithAuth(
+      `${EXT_NOTIFICATION_PREFERENCES_ENDPOINT}?${buildQuery(params.organizationId)}`
+    );
+  }
+  async function updateNotificationPreferences(params) {
+    if (!params.organizationId) {
+      return {
+        error: createError("VALIDATION_ERROR", "organizationId \u306F\u5FC5\u9808\u3067\u3059")
+      };
+    }
+    if (params.preferences === null || typeof params.preferences !== "object" || Array.isArray(params.preferences)) {
+      return {
+        error: createError("VALIDATION_ERROR", "preferences \u306F\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059")
+      };
+    }
+    if (Object.keys(params.preferences).length === 0) {
+      return {
+        error: createError("VALIDATION_ERROR", "\u66F4\u65B0\u3059\u308B\u30D5\u30A3\u30FC\u30EB\u30C9\u30921\u3064\u4EE5\u4E0A\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044")
+      };
+    }
+    return fetchWithAuth(
+      `${EXT_NOTIFICATION_PREFERENCES_ENDPOINT}?${buildQuery(params.organizationId)}`,
+      {
+        method: "PATCH",
+        body: JSON.stringify({ preferences: params.preferences })
+      }
+    );
+  }
+  return { getNotificationPreferences, updateNotificationPreferences };
+}
+
+// src/client/invite-methods.ts
+var EXT_INVITE_ENDPOINT = "/api/v1/organizations/ext/invite";
+function createInviteMethods(deps) {
+  const { fetchWithAuth, createError, serviceCode } = deps;
+  const assignableRoles = /* @__PURE__ */ new Set(["admin", "member", "viewer"]);
+  async function inviteMember(params) {
+    if (!params.organizationId || !params.email) {
+      return {
+        error: createError("VALIDATION_ERROR", "organizationId \u3068 email \u306F\u5FC5\u9808\u3067\u3059")
+      };
+    }
+    if (params.role !== void 0 && !assignableRoles.has(params.role)) {
+      return {
+        error: createError(
+          "VALIDATION_ERROR",
+          "role \u306F admin\u3001member\u3001viewer \u306E\u3044\u305A\u308C\u304B\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044"
+        )
+      };
+    }
+    const query = new URLSearchParams({
+      organizationId: params.organizationId,
+      serviceCode
+    }).toString();
+    return fetchWithAuth(`${EXT_INVITE_ENDPOINT}?${query}`, {
+      method: "POST",
+      body: JSON.stringify({ email: params.email, role: params.role })
+    });
+  }
+  return { inviteMember };
+}
+
+// src/client/org-membership-methods.ts
+var EXT_USER_ORGANIZATIONS_ENDPOINT = "/api/v1/users/ext/me/organizations";
+function createOrgMembershipMethods(deps) {
+  const { fetchWithAuth, createError } = deps;
+  async function leaveOrganization(params) {
+    if (!params || !params.organizationId) {
+      return {
+        error: createError("VALIDATION_ERROR", "organizationId \u306F\u5FC5\u9808\u3067\u3059")
+      };
+    }
+    let endpoint = `${EXT_USER_ORGANIZATIONS_ENDPOINT}/${encodeURIComponent(params.organizationId)}`;
+    if (params.userId) {
+      endpoint += `?${new URLSearchParams({ userId: params.userId }).toString()}`;
+    }
+    return fetchWithAuth(endpoint, {
+      method: "DELETE"
+    });
+  }
+  return { leaveOrganization };
+}
+
+// src/client/noncontract-methods.ts
+function createNonContractMethods(deps) {
+  const { fetchWithAuth, createError, serviceCode } = deps;
+  return {
+    ...createLoginHistoryMethods({ fetchWithAuth, createError }),
+    ...createOrganizationDomainsMethods({ fetchWithAuth, createError, serviceCode }),
+    ...createNotificationPreferencesMethods({ fetchWithAuth, createError, serviceCode }),
+    ...createInviteMethods({ fetchWithAuth, createError, serviceCode }),
+    ...createOrgMembershipMethods({ fetchWithAuth, createError })
+  };
+}
+
 // src/client/version-check.ts
-var SDK_VERSION = "5.12.0";
+var SDK_VERSION = "5.14.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1004,9 +1165,20 @@ function createOAuthTokenMethods(deps) {
     logger,
     errorCodes
   } = deps;
-  async function exchangeCodeForTokens(code, codeVerifier) {
+  async function exchangeCodeForTokens(code, codeVerifier, opts) {
     const url = `${baseUrl}${OAUTH_TOKEN_ENDPOINT}`;
     logger.debug("Exchanging code for tokens:", url);
+    if (opts?.expectedState !== void 0 || opts?.actualState !== void 0) {
+      if (opts?.expectedState !== opts?.actualState) {
+        logger.error("Token exchange aborted: OAuth state mismatch or omitted (possible CSRF)");
+        return {
+          error: {
+            code: errorCodes.STATE_MISMATCH_ERROR,
+            message: "OAuth state \u304C\u4E00\u81F4\u3057\u307E\u305B\u3093\u3002CSRF \u306E\u53EF\u80FD\u6027\u304C\u3042\u308B\u305F\u3081\u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+          }
+        };
+      }
+    }
     const effectiveRedirectUri = resolvedRedirectUri ?? (typeof window !== "undefined" ? window.location.origin + window.location.pathname : null);
     if (!effectiveRedirectUri) {
       logger.error("redirectUri is required for token exchange in SSR environments. Set config.redirectUri explicitly.");
@@ -1490,6 +1662,102 @@ function base64UrlEncode(buffer) {
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 
+// src/auth/state.ts
+var STATE_STORAGE_KEY = "ffid_oauth_state";
+var STATE_FALLBACK_STORAGE_KEY = "ffid_oauth_state_fb";
+var STATE_FALLBACK_TIMESTAMP_KEY = "ffid_oauth_state_fb_ts";
+var OAUTH_STATE_MAX_AGE_MS = 5 * 60 * 1e3;
+function storeState(state, logger) {
+  if (typeof window === "undefined") {
+    logger?.warn("storeState: storage is not available in SSR context");
+    return false;
+  }
+  let sessionStored = false;
+  try {
+    window.sessionStorage.setItem(STATE_STORAGE_KEY, state);
+    sessionStored = true;
+  } catch (error) {
+    logger?.warn("storeState: sessionStorage \u3078\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  let localStored = false;
+  try {
+    window.localStorage.setItem(STATE_FALLBACK_STORAGE_KEY, state);
+    window.localStorage.setItem(STATE_FALLBACK_TIMESTAMP_KEY, String(Date.now()));
+    localStored = true;
+  } catch (error) {
+    logger?.warn("storeState: localStorage fallback \u3078\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  return sessionStored || localStored;
+}
+function retrieveState(logger) {
+  if (typeof window === "undefined") return null;
+  let sessionState = null;
+  try {
+    sessionState = window.sessionStorage.getItem(STATE_STORAGE_KEY);
+  } catch (error) {
+    logger?.warn("retrieveState: sessionStorage \u304B\u3089\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  if (sessionState) {
+    cleanupStateStorage(logger);
+    return sessionState;
+  }
+  let fallbackState = null;
+  let fallbackTimestamp = null;
+  try {
+    fallbackState = window.localStorage.getItem(STATE_FALLBACK_STORAGE_KEY);
+    fallbackTimestamp = window.localStorage.getItem(STATE_FALLBACK_TIMESTAMP_KEY);
+  } catch (error) {
+    logger?.warn("retrieveState: localStorage fallback \u304B\u3089\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+    cleanupStateStorage(logger);
+    return null;
+  }
+  if (!fallbackState || !fallbackTimestamp) {
+    cleanupStateStorage(logger);
+    return null;
+  }
+  const ts = Number(fallbackTimestamp);
+  const age = Date.now() - ts;
+  if (!Number.isFinite(ts) || age < 0 || age > OAUTH_STATE_MAX_AGE_MS) {
+    cleanupStateStorage(logger);
+    return null;
+  }
+  logger?.warn(
+    "retrieveState: sessionStorage was empty, recovered OAuth state from localStorage fallback"
+  );
+  cleanupStateStorage(logger);
+  return fallbackState;
+}
+function isStateStorageAvailable() {
+  if (typeof window === "undefined") return false;
+  const probeKey = "__ffid_oauth_state_probe__";
+  try {
+    window.sessionStorage.setItem(probeKey, "1");
+    window.sessionStorage.removeItem(probeKey);
+    return true;
+  } catch {
+  }
+  try {
+    window.localStorage.setItem(probeKey, "1");
+    window.localStorage.removeItem(probeKey);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function cleanupStateStorage(logger) {
+  try {
+    window.sessionStorage.removeItem(STATE_STORAGE_KEY);
+  } catch (error) {
+    logger?.warn("retrieveState: sessionStorage \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  try {
+    window.localStorage.removeItem(STATE_FALLBACK_STORAGE_KEY);
+    window.localStorage.removeItem(STATE_FALLBACK_TIMESTAMP_KEY);
+  } catch (error) {
+    logger?.warn("retrieveState: localStorage \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+}
+
 // src/client/redirect.ts
 var OAUTH_AUTHORIZE_ENDPOINT = "/api/v1/oauth/authorize";
 var AUTH_LOGOUT_ENDPOINT = "/api/v1/auth/logout";
@@ -1621,6 +1889,7 @@ function createRedirectMethods(deps) {
     const recentCount = getRecentRedirectCount(authorizeKey, now, logger);
     if (recentCount >= REDIRECT_LOOP_THRESHOLD) {
       cleanupVerifierStorage(logger);
+      cleanupStateStorage(logger);
       logger.warn("[FFID SDK] redirect loop detected \u2014 \u81EA\u52D5\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3092\u505C\u6B62\u3057\u307E\u3057\u305F", {
         authorizeKey,
         recentCount,
@@ -1644,6 +1913,11 @@ function createRedirectMethods(deps) {
       return { success: false, error: errorMessage };
     }
     const state = generateRandomState();
+    if (!storeState(state, logger)) {
+      logger.error(
+        "redirectToAuthorize: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF\u3067\u306E CSRF \u691C\u8A3C\u304C\u5931\u6557\u3057\u307E\u3059"
+      );
+    }
     const redirectUri = resolvedRedirectUri ?? window.location.origin + window.location.pathname;
     const params = new URLSearchParams({
       response_type: "code",
@@ -2433,7 +2707,8 @@ var FFID_ERROR_CODES = {
   TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR",
   TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR",
   NO_TOKENS: "NO_TOKENS",
-  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR"
+  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR",
+  STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR"
 };
 var EXT_CHECK_ENDPOINT = "/api/v1/subscriptions/ext/check";
 var DEFAULT_ALLOW_GRACE = true;
@@ -2821,6 +3096,18 @@ function createFFIDClient(config) {
     fetchWithAuth,
     createError
   });
+  const {
+    getLoginHistory,
+    getOrganizationDomains,
+    getNotificationPreferences,
+    updateNotificationPreferences,
+    inviteMember,
+    leaveOrganization
+  } = createNonContractMethods({
+    fetchWithAuth,
+    createError,
+    serviceCode: config.serviceCode
+  });
   const { getAnalyticsConfig } = createAnalyticsMethods({
     fetchWithAuth,
     createError
@@ -2901,6 +3188,13 @@ function createFFIDClient(config) {
     removeMember,
     getProfile,
     updateProfile,
+    // Non-contract ext API coverage (#3783)
+    getLoginHistory,
+    getOrganizationDomains,
+    getNotificationPreferences,
+    updateNotificationPreferences,
+    inviteMember,
+    leaveOrganization,
     getAnalyticsConfig,
     createCheckoutSession,
     createPortalSession,
@@ -2951,6 +3245,99 @@ function createFFIDClient(config) {
     redirectUri: resolvedRedirectUri
   };
 }
+
+// src/client/callback.ts
+var CALLBACK_ERROR_CODES = {
+  /** Stored state missing or did not match the callback `state` (CSRF guard) */
+  STATE_MISMATCH: "STATE_MISMATCH_ERROR",
+  /**
+   * Web storage is unavailable, so `state` could never be persisted across the
+   * OAuth bounce. An environment issue (e.g. iOS private mode), not an attack —
+   * surfaced distinctly so callers don't mistake it for a CSRF mismatch.
+   */
+  STATE_UNAVAILABLE: "STATE_STORAGE_UNAVAILABLE",
+  /** Callback URL had no `code` param */
+  MISSING_CODE: "MISSING_AUTHORIZATION_CODE",
+  /** SSR with no `options.url` — cannot resolve callback params */
+  CALLBACK_URL_UNAVAILABLE: "CALLBACK_URL_UNAVAILABLE"
+};
+function extractSearchParams(source) {
+  try {
+    return new URL(source).searchParams;
+  } catch {
+    const queryStart = source.indexOf("?");
+    const query = queryStart >= 0 ? source.slice(queryStart + 1) : source;
+    return new URLSearchParams(query);
+  }
+}
+function cleanCallbackUrlParams(logger) {
+  try {
+    const cleanUrl = new URL(window.location.href);
+    cleanUrl.searchParams.delete("code");
+    cleanUrl.searchParams.delete("state");
+    window.history.replaceState({}, "", cleanUrl.toString());
+  } catch (error) {
+    logger.warn("handleRedirectCallback: URL \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+}
+async function handleRedirectCallback(client, options) {
+  const { logger } = client;
+  const hasWindow = typeof window !== "undefined";
+  const source = options?.url ?? (hasWindow ? window.location.search : null);
+  if (source === null) {
+    logger.warn("handleRedirectCallback: SSR \u74B0\u5883\u3067\u306F options.url \u304C\u5FC5\u8981\u3067\u3059");
+    return {
+      error: client.createError(
+        CALLBACK_ERROR_CODES.CALLBACK_URL_UNAVAILABLE,
+        "\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF URL \u3092\u89E3\u6C7A\u3067\u304D\u307E\u305B\u3093\u3002SSR \u74B0\u5883\u3067\u306F options.url \u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044"
+      )
+    };
+  }
+  const params = extractSearchParams(source);
+  const code = params.get("code");
+  const urlState = params.get("state");
+  if (!code) {
+    logger.warn("handleRedirectCallback: \u8A8D\u53EF\u30B3\u30FC\u30C9\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093");
+    return {
+      error: client.createError(
+        CALLBACK_ERROR_CODES.MISSING_CODE,
+        "\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF URL \u306B\u8A8D\u53EF\u30B3\u30FC\u30C9\u304C\u542B\u307E\u308C\u3066\u3044\u307E\u305B\u3093"
+      )
+    };
+  }
+  const storedState = retrieveState(logger);
+  if (storedState !== null || urlState !== null) {
+    const stateMatches = storedState !== null && storedState === urlState;
+    if (!stateMatches) {
+      if (storedState === null && !isStateStorageAvailable()) {
+        logger.error(
+          "handleRedirectCallback: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u308B storage \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081 CSRF \u691C\u8A3C\u304C\u3067\u304D\u307E\u305B\u3093\uFF08iOS private mode \u7B49\uFF09"
+        );
+        return {
+          error: client.createError(
+            CALLBACK_ERROR_CODES.STATE_UNAVAILABLE,
+            "OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u308B storage \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081\u8A8D\u8A3C\u3092\u5B8C\u4E86\u3067\u304D\u307E\u305B\u3093\u3002\u30D6\u30E9\u30A6\u30B6\u306E\u30D7\u30E9\u30A4\u30D9\u30FC\u30C8\u30E2\u30FC\u30C9\u3084\u30B9\u30C8\u30EC\u30FC\u30B8\u8A2D\u5B9A\u3092\u3054\u78BA\u8A8D\u304F\u3060\u3055\u3044"
+          )
+        };
+      }
+      logger.error(
+        "handleRedirectCallback: OAuth state mismatch or omitted (possible CSRF) \u2014 \u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+      );
+      return {
+        error: client.createError(
+          CALLBACK_ERROR_CODES.STATE_MISMATCH,
+          "OAuth state \u304C\u4E00\u81F4\u3057\u307E\u305B\u3093\u3002CSRF \u306E\u53EF\u80FD\u6027\u304C\u3042\u308B\u305F\u3081\u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+        )
+      };
+    }
+  }
+  const verifier = retrieveCodeVerifier(logger);
+  const result = await client.exchangeCodeForTokens(code, verifier ?? void 0);
+  if (!result.error && hasWindow) {
+    cleanCallbackUrlParams(logger);
+  }
+  return result;
+}
 var DEFAULT_REFRESH_INTERVAL_MS = 5 * 60 * 1e3;
 var TOKEN_REFRESH_RATIO = 0.8;
 var FFIDContext = createContext(null);
@@ -3125,8 +3512,7 @@ function FFIDProvider({
     const code = urlParams.get("code");
     if (!code) return;
     client.logger.debug("Authorization code detected, exchanging for tokens");
-    const codeVerifier = retrieveCodeVerifier(client.logger);
-    client.exchangeCodeForTokens(code, codeVerifier ?? void 0).then((result) => {
+    handleRedirectCallback(client).then((result) => {
       if (result.error) {
         client.logger.error("Token exchange failed:", result.error);
         setError(result.error);
@@ -3134,10 +3520,6 @@ function FFIDProvider({
         setIsLoading(false);
         return;
       }
-      const cleanUrl = new URL(window.location.href);
-      cleanUrl.searchParams.delete("code");
-      cleanUrl.searchParams.delete("state");
-      window.history.replaceState({}, "", cleanUrl.toString());
       client.logger.debug("Token exchange successful, refreshing session");
       return refresh();
     }).catch((err) => {
@@ -4938,4 +5320,4 @@ function FFIDInquiryForm({
   );
 }
 
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, storeCodeVerifier, useFFID, useFFIDAnnouncements, useFFIDContext, useSubscription, withSubscription };
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, cleanupStateStorage, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useFFIDContext, useSubscription, withSubscription };