@feelflow/ffid-sdk 5.17.0 → 5.18.0

package/dist/{chunk-HBPYSPBY.cjs → chunk-55S5VUWR.cjs}

@@ -117,10 +117,13 @@ function hasOwnKey(value, key) {
 function normalizeUserinfo(raw) {
   const hasOrganizationId = hasOwnKey(raw, "organization_id");
   const hasOrganizationName = hasOwnKey(raw, "organization_name");
-  const organizationFields = hasOrganizationId ? {
-    organizationId: raw.organization_id ?? null,
-    organizationName: hasOrganizationName ? raw.organization_name ?? null : null
-  } : hasOrganizationName ? { organizationName: raw.organization_name ?? null } : {};
+  const hasOrganizationMemberRole = hasOwnKey(raw, "organization_member_role");
+  const organizationMemberRole = hasOrganizationMemberRole ? raw.organization_member_role ?? null : raw.subscription ? raw.subscription.member_role ?? null : void 0;
+  const organizationFields = {
+    ...hasOrganizationId ? { organizationId: raw.organization_id ?? null } : {},
+    ...hasOrganizationId || hasOrganizationName ? { organizationName: raw.organization_name ?? null } : {},
+    ...organizationMemberRole !== void 0 ? { organizationMemberRole } : {}
+  };
   return {
     sub: raw.sub,
     email: raw.email,
@@ -227,10 +230,29 @@ function createJwtVerifier(deps) {
       return { data: userInfo };
     } catch (error) {
       const message = error instanceof Error ? error.message : "JWT\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F";
-      logger.error("JWT verification failed:", message);
+      if (error instanceof jose.errors.JWTExpired) {
+        logger.debug("JWT verification failed (token expired):", message);
+        return {
+          error: createError(
+            errorCodes.TOKEN_EXPIRED,
+            "\u30A2\u30AF\u30BB\u30B9\u30C8\u30FC\u30AF\u30F3\u306E\u6709\u52B9\u671F\u9650\u304C\u5207\u308C\u3066\u3044\u307E\u3059"
+          )
+        };
+      }
+      const isTokenLevelError = error instanceof jose.errors.JWTClaimValidationFailed || error instanceof jose.errors.JWTInvalid || error instanceof jose.errors.JWSInvalid || error instanceof jose.errors.JWSSignatureVerificationFailed || error instanceof jose.errors.JOSEAlgNotAllowed || error instanceof jose.errors.JOSENotSupported || error instanceof jose.errors.JWKSNoMatchingKey || error instanceof jose.errors.JWKSMultipleMatchingKeys;
+      if (isTokenLevelError) {
+        logger.warn("JWT verification failed:", message);
+        return {
+          error: createError(
+            errorCodes.TOKEN_VERIFICATION_ERROR,
+            `JWT\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${message}`
+          )
+        };
+      }
+      logger.error("JWT verification failed (JWKS fetch):", message);
       return {
         error: createError(
-          errorCodes.TOKEN_VERIFICATION_ERROR,
+          errorCodes.NETWORK_ERROR,
           `JWT\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${message}`
         )
       };
@@ -255,7 +277,9 @@ function createVerifyAccessToken(deps) {
         serviceCode,
         logger,
         createError,
-        errorCodes: { TOKEN_VERIFICATION_ERROR: errorCodes.TOKEN_VERIFICATION_ERROR }
+        // structural superset of JwtVerifierDeps.errorCodes — passing it
+        // wholesale removes the hand-transcription drift point
+        errorCodes
       });
     }
     return jwtVerify2;
@@ -1095,7 +1119,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.17.0";
+var SDK_VERSION = "5.18.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -2692,6 +2716,19 @@ function isBlockedFromUserinfo(sub) {
   return BLOCKING_EFFECTIVE_STATUSES.includes(effectiveStatus);
 }
 
+// src/client/error-codes.ts
+var FFID_ERROR_CODES = {
+  NETWORK_ERROR: "NETWORK_ERROR",
+  PARSE_ERROR: "PARSE_ERROR",
+  UNKNOWN_ERROR: "UNKNOWN_ERROR",
+  TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR",
+  TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR",
+  NO_TOKENS: "NO_TOKENS",
+  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR",
+  TOKEN_EXPIRED: "TOKEN_EXPIRED",
+  STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR"
+};
+
 // src/client/ffid-client.ts
 var UNAUTHORIZED_STATUS2 = 401;
 var SDK_LOG_PREFIX = "[FFID SDK]";
@@ -2700,8 +2737,10 @@ var noopLogger = {
   },
   info: () => {
   },
-  warn: (...args) => console.warn(SDK_LOG_PREFIX, ...args),
-  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
+  warn: () => {
+  },
+  error: () => {
+  }
 };
 var consoleLogger = {
   debug: (...args) => console.debug(SDK_LOG_PREFIX, ...args),
@@ -2709,16 +2748,6 @@ var consoleLogger = {
   warn: (...args) => console.warn(SDK_LOG_PREFIX, ...args),
   error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
 };
-var FFID_ERROR_CODES = {
-  NETWORK_ERROR: "NETWORK_ERROR",
-  PARSE_ERROR: "PARSE_ERROR",
-  UNKNOWN_ERROR: "UNKNOWN_ERROR",
-  TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR",
-  TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR",
-  NO_TOKENS: "NO_TOKENS",
-  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR",
-  STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR"
-};
 var EXT_CHECK_ENDPOINT = "/api/v1/subscriptions/ext/check";
 var DEFAULT_ALLOW_GRACE = true;
 var DEFAULT_SERVICE_ACCESS_FAIL_POLICY = "failClosed";
@@ -5348,6 +5377,7 @@ exports.FFIDSDKError = FFIDSDKError;
 exports.FFIDSubscriptionBadge = FFIDSubscriptionBadge;
 exports.FFIDUserMenu = FFIDUserMenu;
 exports.FFID_ANNOUNCEMENTS_ERROR_CODES = FFID_ANNOUNCEMENTS_ERROR_CODES;
+exports.FFID_ERROR_CODES = FFID_ERROR_CODES;
 exports.FFID_INQUIRY_CATEGORIES = FFID_INQUIRY_CATEGORIES;
 exports.FFID_INQUIRY_CATEGORIES_SITE_2026 = FFID_INQUIRY_CATEGORIES_SITE_2026;
 exports.cleanupStateStorage = cleanupStateStorage;

package/dist/{chunk-HLCHSKAF.js → chunk-L2H56C4W.js}

@@ -1,5 +1,5 @@
 import { createContext, useState, useRef, useEffect, useMemo, useCallback, useContext } from 'react';
-import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { createRemoteJWKSet, jwtVerify, errors } from 'jose';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
 
 // src/constants.ts
@@ -115,10 +115,13 @@ function hasOwnKey(value, key) {
 function normalizeUserinfo(raw) {
   const hasOrganizationId = hasOwnKey(raw, "organization_id");
   const hasOrganizationName = hasOwnKey(raw, "organization_name");
-  const organizationFields = hasOrganizationId ? {
-    organizationId: raw.organization_id ?? null,
-    organizationName: hasOrganizationName ? raw.organization_name ?? null : null
-  } : hasOrganizationName ? { organizationName: raw.organization_name ?? null } : {};
+  const hasOrganizationMemberRole = hasOwnKey(raw, "organization_member_role");
+  const organizationMemberRole = hasOrganizationMemberRole ? raw.organization_member_role ?? null : raw.subscription ? raw.subscription.member_role ?? null : void 0;
+  const organizationFields = {
+    ...hasOrganizationId ? { organizationId: raw.organization_id ?? null } : {},
+    ...hasOrganizationId || hasOrganizationName ? { organizationName: raw.organization_name ?? null } : {},
+    ...organizationMemberRole !== void 0 ? { organizationMemberRole } : {}
+  };
   return {
     sub: raw.sub,
     email: raw.email,
@@ -225,10 +228,29 @@ function createJwtVerifier(deps) {
       return { data: userInfo };
     } catch (error) {
       const message = error instanceof Error ? error.message : "JWT\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F";
-      logger.error("JWT verification failed:", message);
+      if (error instanceof errors.JWTExpired) {
+        logger.debug("JWT verification failed (token expired):", message);
+        return {
+          error: createError(
+            errorCodes.TOKEN_EXPIRED,
+            "\u30A2\u30AF\u30BB\u30B9\u30C8\u30FC\u30AF\u30F3\u306E\u6709\u52B9\u671F\u9650\u304C\u5207\u308C\u3066\u3044\u307E\u3059"
+          )
+        };
+      }
+      const isTokenLevelError = error instanceof errors.JWTClaimValidationFailed || error instanceof errors.JWTInvalid || error instanceof errors.JWSInvalid || error instanceof errors.JWSSignatureVerificationFailed || error instanceof errors.JOSEAlgNotAllowed || error instanceof errors.JOSENotSupported || error instanceof errors.JWKSNoMatchingKey || error instanceof errors.JWKSMultipleMatchingKeys;
+      if (isTokenLevelError) {
+        logger.warn("JWT verification failed:", message);
+        return {
+          error: createError(
+            errorCodes.TOKEN_VERIFICATION_ERROR,
+            `JWT\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${message}`
+          )
+        };
+      }
+      logger.error("JWT verification failed (JWKS fetch):", message);
       return {
         error: createError(
-          errorCodes.TOKEN_VERIFICATION_ERROR,
+          errorCodes.NETWORK_ERROR,
           `JWT\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${message}`
         )
       };
@@ -253,7 +275,9 @@ function createVerifyAccessToken(deps) {
         serviceCode,
         logger,
         createError,
-        errorCodes: { TOKEN_VERIFICATION_ERROR: errorCodes.TOKEN_VERIFICATION_ERROR }
+        // structural superset of JwtVerifierDeps.errorCodes — passing it
+        // wholesale removes the hand-transcription drift point
+        errorCodes
       });
     }
     return jwtVerify2;
@@ -1093,7 +1117,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.17.0";
+var SDK_VERSION = "5.18.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -2690,6 +2714,19 @@ function isBlockedFromUserinfo(sub) {
   return BLOCKING_EFFECTIVE_STATUSES.includes(effectiveStatus);
 }
 
+// src/client/error-codes.ts
+var FFID_ERROR_CODES = {
+  NETWORK_ERROR: "NETWORK_ERROR",
+  PARSE_ERROR: "PARSE_ERROR",
+  UNKNOWN_ERROR: "UNKNOWN_ERROR",
+  TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR",
+  TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR",
+  NO_TOKENS: "NO_TOKENS",
+  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR",
+  TOKEN_EXPIRED: "TOKEN_EXPIRED",
+  STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR"
+};
+
 // src/client/ffid-client.ts
 var UNAUTHORIZED_STATUS2 = 401;
 var SDK_LOG_PREFIX = "[FFID SDK]";
@@ -2698,8 +2735,10 @@ var noopLogger = {
   },
   info: () => {
   },
-  warn: (...args) => console.warn(SDK_LOG_PREFIX, ...args),
-  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
+  warn: () => {
+  },
+  error: () => {
+  }
 };
 var consoleLogger = {
   debug: (...args) => console.debug(SDK_LOG_PREFIX, ...args),
@@ -2707,16 +2746,6 @@ var consoleLogger = {
   warn: (...args) => console.warn(SDK_LOG_PREFIX, ...args),
   error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
 };
-var FFID_ERROR_CODES = {
-  NETWORK_ERROR: "NETWORK_ERROR",
-  PARSE_ERROR: "PARSE_ERROR",
-  UNKNOWN_ERROR: "UNKNOWN_ERROR",
-  TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR",
-  TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR",
-  NO_TOKENS: "NO_TOKENS",
-  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR",
-  STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR"
-};
 var EXT_CHECK_ENDPOINT = "/api/v1/subscriptions/ext/check";
 var DEFAULT_ALLOW_GRACE = true;
 var DEFAULT_SERVICE_ACCESS_FAIL_POLICY = "failClosed";
@@ -5331,4 +5360,4 @@ function FFIDInquiryForm({
   );
 }
 
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, cleanupStateStorage, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useFFIDContext, useSubscription, withSubscription };
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, cleanupStateStorage, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useFFIDContext, useSubscription, withSubscription };

package/dist/components/index.cjs

@@ -1,34 +1,34 @@
 'use strict';
 
-var chunkHBPYSPBY_cjs = require('../chunk-HBPYSPBY.cjs');
+var chunk55S5VUWR_cjs = require('../chunk-55S5VUWR.cjs');
 
 
 
 Object.defineProperty(exports, "FFIDAnnouncementBadge", {
   enumerable: true,
-  get: function () { return chunkHBPYSPBY_cjs.FFIDAnnouncementBadge; }
+  get: function () { return chunk55S5VUWR_cjs.FFIDAnnouncementBadge; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementList", {
   enumerable: true,
-  get: function () { return chunkHBPYSPBY_cjs.FFIDAnnouncementList; }
+  get: function () { return chunk55S5VUWR_cjs.FFIDAnnouncementList; }
 });
 Object.defineProperty(exports, "FFIDInquiryForm", {
   enumerable: true,
-  get: function () { return chunkHBPYSPBY_cjs.FFIDInquiryForm; }
+  get: function () { return chunk55S5VUWR_cjs.FFIDInquiryForm; }
 });
 Object.defineProperty(exports, "FFIDLoginButton", {
   enumerable: true,
-  get: function () { return chunkHBPYSPBY_cjs.FFIDLoginButton; }
+  get: function () { return chunk55S5VUWR_cjs.FFIDLoginButton; }
 });
 Object.defineProperty(exports, "FFIDOrganizationSwitcher", {
   enumerable: true,
-  get: function () { return chunkHBPYSPBY_cjs.FFIDOrganizationSwitcher; }
+  get: function () { return chunk55S5VUWR_cjs.FFIDOrganizationSwitcher; }
 });
 Object.defineProperty(exports, "FFIDSubscriptionBadge", {
   enumerable: true,
-  get: function () { return chunkHBPYSPBY_cjs.FFIDSubscriptionBadge; }
+  get: function () { return chunk55S5VUWR_cjs.FFIDSubscriptionBadge; }
 });
 Object.defineProperty(exports, "FFIDUserMenu", {
   enumerable: true,
-  get: function () { return chunkHBPYSPBY_cjs.FFIDUserMenu; }
+  get: function () { return chunk55S5VUWR_cjs.FFIDUserMenu; }
 });

package/dist/components/index.d.cts

@@ -1,3 +1,3 @@
-export { G as FFIDAnnouncementBadge, ag as FFIDAnnouncementBadgeClassNames, ah as FFIDAnnouncementBadgeProps, H as FFIDAnnouncementList, ai as FFIDAnnouncementListClassNames, aj as FFIDAnnouncementListProps, Q as FFIDInquiryForm, R as FFIDInquiryFormCategoryItem, S as FFIDInquiryFormClassNames, T as FFIDInquiryFormLegalLayout, U as FFIDInquiryFormOrganization, V as FFIDInquiryFormPlaceholderContext, W as FFIDInquiryFormPrefill, X as FFIDInquiryFormProps, Y as FFIDInquiryFormSubmitData, Z as FFIDInquiryFormSubmitResult, $ as FFIDLoginButton, ak as FFIDLoginButtonProps, a2 as FFIDOrganizationSwitcher, al as FFIDOrganizationSwitcherClassNames, am as FFIDOrganizationSwitcherProps, a7 as FFIDSubscriptionBadge, an as FFIDSubscriptionBadgeClassNames, ao as FFIDSubscriptionBadgeProps, a9 as FFIDUserMenu, ap as FFIDUserMenuClassNames, aq as FFIDUserMenuProps } from '../index-CG0vObax.cjs';
+export { G as FFIDAnnouncementBadge, ag as FFIDAnnouncementBadgeClassNames, ah as FFIDAnnouncementBadgeProps, H as FFIDAnnouncementList, ai as FFIDAnnouncementListClassNames, aj as FFIDAnnouncementListProps, Q as FFIDInquiryForm, R as FFIDInquiryFormCategoryItem, S as FFIDInquiryFormClassNames, T as FFIDInquiryFormLegalLayout, U as FFIDInquiryFormOrganization, V as FFIDInquiryFormPlaceholderContext, W as FFIDInquiryFormPrefill, X as FFIDInquiryFormProps, Y as FFIDInquiryFormSubmitData, Z as FFIDInquiryFormSubmitResult, $ as FFIDLoginButton, ak as FFIDLoginButtonProps, a2 as FFIDOrganizationSwitcher, al as FFIDOrganizationSwitcherClassNames, am as FFIDOrganizationSwitcherProps, a7 as FFIDSubscriptionBadge, an as FFIDSubscriptionBadgeClassNames, ao as FFIDSubscriptionBadgeProps, a9 as FFIDUserMenu, ap as FFIDUserMenuClassNames, aq as FFIDUserMenuProps } from '../index-Bkul-fRw.cjs';
 import 'react/jsx-runtime';
 import 'react';

package/dist/components/index.d.ts

@@ -1,3 +1,3 @@
-export { G as FFIDAnnouncementBadge, ag as FFIDAnnouncementBadgeClassNames, ah as FFIDAnnouncementBadgeProps, H as FFIDAnnouncementList, ai as FFIDAnnouncementListClassNames, aj as FFIDAnnouncementListProps, Q as FFIDInquiryForm, R as FFIDInquiryFormCategoryItem, S as FFIDInquiryFormClassNames, T as FFIDInquiryFormLegalLayout, U as FFIDInquiryFormOrganization, V as FFIDInquiryFormPlaceholderContext, W as FFIDInquiryFormPrefill, X as FFIDInquiryFormProps, Y as FFIDInquiryFormSubmitData, Z as FFIDInquiryFormSubmitResult, $ as FFIDLoginButton, ak as FFIDLoginButtonProps, a2 as FFIDOrganizationSwitcher, al as FFIDOrganizationSwitcherClassNames, am as FFIDOrganizationSwitcherProps, a7 as FFIDSubscriptionBadge, an as FFIDSubscriptionBadgeClassNames, ao as FFIDSubscriptionBadgeProps, a9 as FFIDUserMenu, ap as FFIDUserMenuClassNames, aq as FFIDUserMenuProps } from '../index-CG0vObax.js';
+export { G as FFIDAnnouncementBadge, ag as FFIDAnnouncementBadgeClassNames, ah as FFIDAnnouncementBadgeProps, H as FFIDAnnouncementList, ai as FFIDAnnouncementListClassNames, aj as FFIDAnnouncementListProps, Q as FFIDInquiryForm, R as FFIDInquiryFormCategoryItem, S as FFIDInquiryFormClassNames, T as FFIDInquiryFormLegalLayout, U as FFIDInquiryFormOrganization, V as FFIDInquiryFormPlaceholderContext, W as FFIDInquiryFormPrefill, X as FFIDInquiryFormProps, Y as FFIDInquiryFormSubmitData, Z as FFIDInquiryFormSubmitResult, $ as FFIDLoginButton, ak as FFIDLoginButtonProps, a2 as FFIDOrganizationSwitcher, al as FFIDOrganizationSwitcherClassNames, am as FFIDOrganizationSwitcherProps, a7 as FFIDSubscriptionBadge, an as FFIDSubscriptionBadgeClassNames, ao as FFIDSubscriptionBadgeProps, a9 as FFIDUserMenu, ap as FFIDUserMenuClassNames, aq as FFIDUserMenuProps } from '../index-Bkul-fRw.js';
 import 'react/jsx-runtime';
 import 'react';

package/dist/components/index.js

@@ -1 +1 @@
-export { FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDSubscriptionBadge, FFIDUserMenu } from '../chunk-HLCHSKAF.js';
+export { FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDSubscriptionBadge, FFIDUserMenu } from '../chunk-L2H56C4W.js';

package/dist/{ffid-client-DZEK3tkP.d.cts → ffid-client-Cwk6cG3b.d.cts}

@@ -1240,10 +1240,12 @@ interface FFIDOAuthUserInfoSubscription {
 /**
  * Unified user-identity shape returned by `getSession()` (→ `/oauth/userinfo`)
  * and `verifyAccessToken()` (JWT or introspect path). `subscription`,
- * `organizationId`, and `organizationName` are scope-gated on `/oauth/userinfo`
- * (FFID #3380, requires `subscription:read`); JWT-only verify additionally
- * omits `subscription` and `organizationName` when `includeProfile` is false
- * because the JWT has `org_id` but no `org_name` claim.
+ * `organizationId`, `organizationName`, and `organizationMemberRole` are
+ * scope-gated on `/oauth/userinfo` (FFID #3380 / #4060, requires
+ * `subscription:read`); JWT verification without `includeProfile`
+ * additionally omits `subscription`, `organizationName`, and
+ * `organizationMemberRole` because the JWT has `org_id` but no `org_name`
+ * or membership-role claim.
  * See per-field JSDoc — misreading `undefined` is a security regression.
  */
 interface FFIDOAuthUserInfo {
@@ -1280,6 +1282,19 @@ interface FFIDOAuthUserInfo {
      * claim.
      */
     organizationName?: string | null | undefined;
+    /**
+     * Organization membership role, `null` if FFID cannot resolve a role for the
+     * selected organization, or `undefined` if the granted scope omits
+     * `subscription:read` on `/oauth/userinfo` (FFID #4060), or if the caller
+     * used JWT verification without `includeProfile`. JWT payloads carry
+     * `org_id` but no membership-role claim.
+     *
+     * This duplicates `subscription.memberRole` at the top level so consumers can
+     * sync `(organizationId, organizationMemberRole)` without unpacking the full
+     * subscription blob. Older FFID responses that omit the top-level wire field
+     * are normalized from `subscription.member_role` when available.
+     */
+    organizationMemberRole?: FFIDOAuthUserInfoMemberRole | null | undefined;
     /**
      * Subscription summary for `(user, service, organization)`. Branch on
      * `effectiveStatus` (5.3.0+) for access decisions.

package/dist/{ffid-client-BtS84epg.d.ts → ffid-client-w8Twi5lD.d.ts}

@@ -1240,10 +1240,12 @@ interface FFIDOAuthUserInfoSubscription {
 /**
  * Unified user-identity shape returned by `getSession()` (→ `/oauth/userinfo`)
  * and `verifyAccessToken()` (JWT or introspect path). `subscription`,
- * `organizationId`, and `organizationName` are scope-gated on `/oauth/userinfo`
- * (FFID #3380, requires `subscription:read`); JWT-only verify additionally
- * omits `subscription` and `organizationName` when `includeProfile` is false
- * because the JWT has `org_id` but no `org_name` claim.
+ * `organizationId`, `organizationName`, and `organizationMemberRole` are
+ * scope-gated on `/oauth/userinfo` (FFID #3380 / #4060, requires
+ * `subscription:read`); JWT verification without `includeProfile`
+ * additionally omits `subscription`, `organizationName`, and
+ * `organizationMemberRole` because the JWT has `org_id` but no `org_name`
+ * or membership-role claim.
  * See per-field JSDoc — misreading `undefined` is a security regression.
  */
 interface FFIDOAuthUserInfo {
@@ -1280,6 +1282,19 @@ interface FFIDOAuthUserInfo {
      * claim.
      */
     organizationName?: string | null | undefined;
+    /**
+     * Organization membership role, `null` if FFID cannot resolve a role for the
+     * selected organization, or `undefined` if the granted scope omits
+     * `subscription:read` on `/oauth/userinfo` (FFID #4060), or if the caller
+     * used JWT verification without `includeProfile`. JWT payloads carry
+     * `org_id` but no membership-role claim.
+     *
+     * This duplicates `subscription.memberRole` at the top level so consumers can
+     * sync `(organizationId, organizationMemberRole)` without unpacking the full
+     * subscription blob. Older FFID responses that omit the top-level wire field
+     * are normalized from `subscription.member_role` when available.
+     */
+    organizationMemberRole?: FFIDOAuthUserInfoMemberRole | null | undefined;
     /**
      * Subscription summary for `(user, service, organization)`. Branch on
      * `effectiveStatus` (5.3.0+) for access decisions.

package/dist/{index-CG0vObax.d.cts → index-Bkul-fRw.d.cts}

@@ -316,10 +316,12 @@ interface FFIDOAuthUserInfoSubscription {
 /**
  * Unified user-identity shape returned by `getSession()` (→ `/oauth/userinfo`)
  * and `verifyAccessToken()` (JWT or introspect path). `subscription`,
- * `organizationId`, and `organizationName` are scope-gated on `/oauth/userinfo`
- * (FFID #3380, requires `subscription:read`); JWT-only verify additionally
- * omits `subscription` and `organizationName` when `includeProfile` is false
- * because the JWT has `org_id` but no `org_name` claim.
+ * `organizationId`, `organizationName`, and `organizationMemberRole` are
+ * scope-gated on `/oauth/userinfo` (FFID #3380 / #4060, requires
+ * `subscription:read`); JWT verification without `includeProfile`
+ * additionally omits `subscription`, `organizationName`, and
+ * `organizationMemberRole` because the JWT has `org_id` but no `org_name`
+ * or membership-role claim.
  * See per-field JSDoc — misreading `undefined` is a security regression.
  */
 interface FFIDOAuthUserInfo {
@@ -356,6 +358,19 @@ interface FFIDOAuthUserInfo {
      * claim.
      */
     organizationName?: string | null | undefined;
+    /**
+     * Organization membership role, `null` if FFID cannot resolve a role for the
+     * selected organization, or `undefined` if the granted scope omits
+     * `subscription:read` on `/oauth/userinfo` (FFID #4060), or if the caller
+     * used JWT verification without `includeProfile`. JWT payloads carry
+     * `org_id` but no membership-role claim.
+     *
+     * This duplicates `subscription.memberRole` at the top level so consumers can
+     * sync `(organizationId, organizationMemberRole)` without unpacking the full
+     * subscription blob. Older FFID responses that omit the top-level wire field
+     * are normalized from `subscription.member_role` when available.
+     */
+    organizationMemberRole?: FFIDOAuthUserInfoMemberRole | null | undefined;
     /**
      * Subscription summary for `(user, service, organization)`. Branch on
      * `effectiveStatus` (5.3.0+) for access decisions.

package/dist/{index-CG0vObax.d.ts → index-Bkul-fRw.d.ts}

@@ -316,10 +316,12 @@ interface FFIDOAuthUserInfoSubscription {
 /**
  * Unified user-identity shape returned by `getSession()` (→ `/oauth/userinfo`)
  * and `verifyAccessToken()` (JWT or introspect path). `subscription`,
- * `organizationId`, and `organizationName` are scope-gated on `/oauth/userinfo`
- * (FFID #3380, requires `subscription:read`); JWT-only verify additionally
- * omits `subscription` and `organizationName` when `includeProfile` is false
- * because the JWT has `org_id` but no `org_name` claim.
+ * `organizationId`, `organizationName`, and `organizationMemberRole` are
+ * scope-gated on `/oauth/userinfo` (FFID #3380 / #4060, requires
+ * `subscription:read`); JWT verification without `includeProfile`
+ * additionally omits `subscription`, `organizationName`, and
+ * `organizationMemberRole` because the JWT has `org_id` but no `org_name`
+ * or membership-role claim.
  * See per-field JSDoc — misreading `undefined` is a security regression.
  */
 interface FFIDOAuthUserInfo {
@@ -356,6 +358,19 @@ interface FFIDOAuthUserInfo {
      * claim.
      */
     organizationName?: string | null | undefined;
+    /**
+     * Organization membership role, `null` if FFID cannot resolve a role for the
+     * selected organization, or `undefined` if the granted scope omits
+     * `subscription:read` on `/oauth/userinfo` (FFID #4060), or if the caller
+     * used JWT verification without `includeProfile`. JWT payloads carry
+     * `org_id` but no membership-role claim.
+     *
+     * This duplicates `subscription.memberRole` at the top level so consumers can
+     * sync `(organizationId, organizationMemberRole)` without unpacking the full
+     * subscription blob. Older FFID responses that omit the top-level wire field
+     * are normalized from `subscription.member_role` when available.
+     */
+    organizationMemberRole?: FFIDOAuthUserInfoMemberRole | null | undefined;
     /**
      * Subscription summary for `(user, service, organization)`. Branch on
      * `effectiveStatus` (5.3.0+) for access decisions.