@feelflow/ffid-sdk 5.17.1 → 5.19.0

package/dist/index.d.ts

@@ -564,6 +564,217 @@ interface FFIDRemoveMemberResponse {
     message: string;
 }
 
+/**
+ * Provisioning types (ext API) — service-key-authenticated, idempotent user /
+ * organization provisioning for external batch migration (#3790 / #4127).
+ *
+ * Mirrors the server contract of `POST /api/v1/ext/users/provision` and
+ * `POST /api/v1/ext/organizations/provision`. Responses are modelled as
+ * discriminated unions on `dryRun` so consumers narrow with `if (res.dryRun)`
+ * and the compiler enforces which fields are present on each branch
+ * (`wouldCreate` on dry-run, `created` on a real call).
+ */
+
+/** Optional business-profile fields applied to a freshly provisioned user. */
+interface FFIDProvisionUserProfileInput {
+    /** Display name (1–255 chars). */
+    displayName?: string;
+    /** Company name (≤255 chars). */
+    companyName?: string;
+    /** Department (≤255 chars). */
+    department?: string;
+    /** Job title (≤255 chars). */
+    jobTitle?: string;
+    /** Phone number (≤30 chars). */
+    phone?: string;
+}
+/** Parameters for `provisionUser`. */
+interface FFIDProvisionUserParams {
+    /**
+     * Email of the user to provision. Normalized (trim + lowercase) server-side
+     * before the idempotency lookup, so re-runs with different casing resolve to
+     * the same user.
+     */
+    email: string;
+    /** Optional business profile applied only when a new user is created. */
+    profile?: FFIDProvisionUserProfileInput;
+    /**
+     * When `true`, the server performs no writes and returns a
+     * {@link FFIDProvisionUserDryRun} describing what a real call would do.
+     * @default false
+     */
+    dryRun?: boolean;
+}
+/** Minimal identity returned for a provisioned / resolved user. */
+interface FFIDProvisionedUser {
+    /** User ID (UUID). */
+    id: string;
+    /** Email address (normalized). */
+    email: string;
+}
+/**
+ * Real (non-dry-run) user provisioning outcome.
+ *
+ * Idempotent: an existing email resolves to `created: false` (HTTP 200) instead
+ * of creating a duplicate; a new email yields `created: true` (HTTP 201) for a
+ * passwordless, email-confirmed user.
+ */
+interface FFIDProvisionUserOutcome {
+    /** Discriminant — absent/`false` for a real call. */
+    dryRun?: false;
+    /**
+     * `true`  → a new passwordless, email-confirmed user was created (HTTP 201).
+     * `false` → a user with this email already existed; idempotent no-op (HTTP 200).
+     */
+    created: boolean;
+    user: FFIDProvisionedUser;
+    /**
+     * Present only when a new user was created **and** a `profile` was supplied.
+     * `false` means the user row was created but the authoritative profile write
+     * did not complete — some profile fields may not be fully applied, so
+     * re-issue the profile to be sure. Absent on the idempotent-existing branch
+     * and when no profile was requested.
+     */
+    profileWritten?: boolean;
+}
+/** Dry-run user provisioning outcome — no writes performed. */
+interface FFIDProvisionUserDryRun {
+    /** Discriminant — always `true` for a dry-run. */
+    dryRun: true;
+    /** Whether a real call would create a new user. */
+    wouldCreate: boolean;
+    /** `id` is present only when the user already exists. */
+    user: {
+        id?: string;
+        email: string;
+    };
+}
+/**
+ * Response from `provisionUser`. Narrow with the truthiness of `dryRun`:
+ *
+ * ```ts
+ * if (res.dryRun) {
+ *   // FFIDProvisionUserDryRun — inspect res.wouldCreate
+ * } else {
+ *   // FFIDProvisionUserOutcome — inspect res.created
+ * }
+ * ```
+ *
+ * A real (non-dry-run) response omits `dryRun` on the wire (it is `undefined`,
+ * not `false`), so narrow with `if (res.dryRun)` — do **not** use
+ * `res.dryRun === false` or `switch (res.dryRun)`, which would miss every real
+ * response. This mirrors how `FFIDApiResponse` is narrowed on `data` / `error`.
+ */
+type FFIDProvisionUserResponse = FFIDProvisionUserOutcome | FFIDProvisionUserDryRun;
+/** A member to add to the provisioned organization. */
+interface FFIDProvisionOrganizationMemberInput {
+    email: string;
+    /** `owner` is intentionally excluded — the owner is set via `ownerEmail`. */
+    role: FFIDAssignableMemberRole;
+}
+/** Parameters for `provisionOrganization`. */
+interface FFIDProvisionOrganizationParams {
+    /** Organization display name (1–255 chars). */
+    name: string;
+    /**
+     * Email of the organization owner. The owner **must** already be an FFID user
+     * — provision them via `provisionUser` first, otherwise the call returns an
+     * `OWNER_NOT_FOUND` error (HTTP 422).
+     */
+    ownerEmail: string;
+    /** Optional billing contact email. */
+    billingEmail?: string;
+    /** Members to add idempotently (≤100 per request; validated client-side). */
+    members?: FFIDProvisionOrganizationMemberInput[];
+    /**
+     * When `true`, the server performs no writes and returns a
+     * {@link FFIDProvisionOrganizationDryRun} describing what a real call would do.
+     * @default false
+     */
+    dryRun?: boolean;
+}
+/** Minimal organization shape returned by the org provisioning helper. */
+interface FFIDProvisionedOrganization {
+    /** Organization ID (UUID). */
+    id: string;
+    /** Organization display name. */
+    name: string;
+    /** URL-safe slug. */
+    slug: string;
+}
+/** Per-member outcome status of a real (non-dry-run) organization provision. */
+type FFIDProvisionMemberStatus = 'added' | 'already_member' | 'user_not_found';
+/** Per-member outcome status of a dry-run organization provision. */
+type FFIDProvisionMemberPlanStatus = 'would_add' | 'already_member' | 'user_not_found';
+/** Per-member outcome of a real (non-dry-run) organization provision. */
+interface FFIDProvisionMemberResult {
+    email: string;
+    role: FFIDAssignableMemberRole;
+    /**
+     * - `added`          — membership was inserted.
+     * - `already_member` — user was already a member (idempotent no-op).
+     * - `user_not_found` — no FFID user exists for this email (skipped).
+     */
+    status: FFIDProvisionMemberStatus;
+}
+/** Per-member plan of a dry-run organization provision. */
+interface FFIDProvisionMemberPlan {
+    email: string;
+    role: FFIDAssignableMemberRole;
+    /**
+     * - `would_add`      — user exists and is not yet a member.
+     * - `already_member` — user is already a member of the existing org.
+     * - `user_not_found` — no FFID user exists for this email.
+     */
+    status: FFIDProvisionMemberPlanStatus;
+}
+/** Real (non-dry-run) organization provisioning outcome. */
+interface FFIDProvisionOrganizationOutcome {
+    /** Discriminant — absent/`false` for a real call. */
+    dryRun?: false;
+    /**
+     * `true`  → a brand-new organization was created (HTTP 201).
+     * `false` → the owner already owned an org with this name; idempotent (HTTP 200).
+     */
+    created: boolean;
+    organization: FFIDProvisionedOrganization;
+    /** Per-member results (added / already_member / user_not_found). */
+    members: FFIDProvisionMemberResult[];
+}
+/** Dry-run organization provisioning outcome — no writes performed. */
+interface FFIDProvisionOrganizationDryRun {
+    /** Discriminant — always `true` for a dry-run. */
+    dryRun: true;
+    /**
+     * Whether a real call would create a new organization. Coupled to
+     * `organization`: `wouldCreate === (organization === null)` — the server
+     * returns `organization: null` exactly when it would create a new org.
+     */
+    wouldCreate: boolean;
+    /** `null` when the org does not exist yet (would be created) — see `wouldCreate`. */
+    organization: FFIDProvisionedOrganization | null;
+    /** Per-member plans (would_add / already_member / user_not_found). */
+    members: FFIDProvisionMemberPlan[];
+}
+/**
+ * Response from `provisionOrganization`. Narrow on `dryRun`:
+ *
+ * ```ts
+ * if (res.dryRun) {
+ *   // FFIDProvisionOrganizationDryRun — inspect res.wouldCreate / res.organization (nullable)
+ * } else {
+ *   // FFIDProvisionOrganizationOutcome — inspect res.created / res.members
+ * }
+ * ```
+ *
+ * As with `FFIDProvisionUserResponse`, a real response omits `dryRun` on the
+ * wire, so narrow with `if (res.dryRun)` — not `res.dryRun === false`.
+ *
+ * When `ownerEmail` has no FFID user, the call resolves to
+ * `{ error: { code: 'OWNER_NOT_FOUND' } }` (HTTP 422) rather than a data branch.
+ */
+type FFIDProvisionOrganizationResponse = FFIDProvisionOrganizationOutcome | FFIDProvisionOrganizationDryRun;
+
 /**
  * Contract resource types (#3787 Phase A)
  *
@@ -1127,6 +1338,33 @@ interface RedirectToAuthorizeOptions {
     prompt?: FFIDPrompt;
 }
 
+/**
+ * FFID SDK error codes
+ *
+ * Codes the SDK itself attaches to `FFIDError.code`. Exported from the
+ * package entry points so consumers can branch on codes (e.g.
+ * `TOKEN_EXPIRED` vs `TOKEN_VERIFICATION_ERROR`) without hardcoding strings.
+ */
+/** Error codes used by the SDK */
+declare const FFID_ERROR_CODES: {
+    readonly NETWORK_ERROR: "NETWORK_ERROR";
+    readonly PARSE_ERROR: "PARSE_ERROR";
+    readonly UNKNOWN_ERROR: "UNKNOWN_ERROR";
+    readonly TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR";
+    readonly TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR";
+    readonly NO_TOKENS: "NO_TOKENS";
+    readonly TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR";
+    readonly TOKEN_EXPIRED: "TOKEN_EXPIRED";
+    readonly STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR";
+};
+/**
+ * Union of the error code literals the SDK itself produces.
+ *
+ * Note: `FFIDError.code` intentionally stays `string` — server-provided
+ * error codes pass through verbatim and must not be narrowed away.
+ */
+type FFIDErrorCode = (typeof FFID_ERROR_CODES)[keyof typeof FFID_ERROR_CODES];
+
 /** Creates an FFID API client instance */
 declare function createFFIDClient(config: FFIDConfig): {
     getSession: () => Promise<FFIDApiResponse<FFIDSessionResponse>>;
@@ -1167,6 +1405,8 @@ declare function createFFIDClient(config: FFIDConfig): {
         organizationId: string;
         userId: string;
     }) => Promise<FFIDApiResponse<FFIDRemoveMemberResponse>>;
+    provisionUser: (params: FFIDProvisionUserParams) => Promise<FFIDApiResponse<FFIDProvisionUserResponse>>;
+    provisionOrganization: (params: FFIDProvisionOrganizationParams) => Promise<FFIDApiResponse<FFIDProvisionOrganizationResponse>>;
     getProfile: (options?: FFIDProfileCallOptions) => Promise<FFIDApiResponse<FFIDUserProfile>>;
     updateProfile: (data: FFIDUpdateUserProfileRequest, options?: FFIDProfileCallOptions) => Promise<FFIDApiResponse<FFIDUserProfile>>;
     getLoginHistory: (params?: FFIDGetLoginHistoryParams) => Promise<FFIDApiResponse<FFIDLoginHistoryResponse>>;
@@ -2040,4 +2280,4 @@ declare function createInquiryMethods(deps: InquiryMethodsDeps): {
 };
 type FFIDInquiryClient = ReturnType<typeof createInquiryMethods>;
 
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, AnnouncementListResponse, BLOCKING_EFFECTIVE_STATUSES, type ComputeEffectiveStatusInput, type ContractWizardFlowType, type ContractWizardResubscribeOptions, type ContractWizardSubscribeOptions, type ContractWizardSubscriptionOptions, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EffectiveSubscriptionStatus, type ExchangeCodeForTokensOptions, type FFIDAddMemberParams, type FFIDAddMemberRequest, type FFIDAddMemberResponse, FFIDAnnouncementsApiResponse, type FFIDAnnouncementsClient, FFIDAnnouncementsClientConfig, FFIDAnnouncementsLogger, FFIDApiResponse, type FFIDAssignableMemberRole, type FFIDBillingInterval, FFIDCacheAdapter, type FFIDCancelPendingDowngradeResponse, type FFIDCancelSubscriptionParams, type FFIDCancelSubscriptionResponse, type FFIDChangePlanParams, type FFIDChangePlanResponse, FFIDCheckServiceAccessParams, type FFIDCheckoutSessionResponse, type FFIDClient, FFIDConfig, type FFIDCreateCheckoutParams, type FFIDCreatePortalParams, FFIDError, type FFIDInquiryClient, FFIDInquiryCreateParams, FFIDInquiryCreateResponse, type FFIDInvitationStatus, type FFIDInviteMemberRequest, type FFIDInviteMemberResponse, type FFIDLeaveOrganizationParams, type FFIDLeaveOrganizationResponse, type FFIDListMembersResponse, type FFIDListPlansResponse, FFIDLogger, type FFIDLoginHistoryEntry, type FFIDLoginHistoryResponse, type FFIDMemberRole, type FFIDMemberStatus, type FFIDNewsletterBodySource, type FFIDNewsletterCampaignStatus, type FFIDNewsletterClient, type FFIDNewsletterConfirmParams, type FFIDNewsletterConfirmResponse, type FFIDNewsletterDispatchParams, type FFIDNewsletterDispatchResponse, type FFIDNewsletterSegment, type FFIDNewsletterSubscribeParams, type FFIDNewsletterSubscribeResponse, type FFIDNewsletterType, type FFIDNewsletterUnsubscribeParams, type FFIDNewsletterUnsubscribeResponse, FFIDOAuthUserInfo, FFIDOAuthUserInfoSubscription, FFIDOrganization, type FFIDOrganizationDomain, type FFIDOrganizationDomainsResponse, type FFIDOrganizationMember, type FFIDOrganizationNotificationPreferences, type FFIDOrganizationNotificationPreferencesResponse, type FFIDOtpSendResponse, type FFIDOtpVerifyResponse, type FFIDPasswordResetConfirmResponse, type FFIDPasswordResetResponse, type FFIDPasswordResetVerifyResponse, type FFIDPlanChangeLineItem, type FFIDPlanChangePreview, type FFIDPlanChangePreviewResponse, type FFIDPlanInfo, type FFIDPortalSessionResponse, type FFIDPreviewPlanChangeParams, type FFIDPreviewSeatChangeParams, type FFIDProfileCallOptions, FFIDProvider, type FFIDProviderProps, FFIDRedirectResult, type FFIDRemoveMemberResponse, type FFIDResetSessionResponse, FFIDSDKError, type FFIDSeatChangeLineItem, type FFIDSeatChangePreview, type FFIDSeatChangePreviewResponse, FFIDServiceAccessDecision, type FFIDServiceInfo, FFIDSessionResponse, type FFIDSubscribeParams, type FFIDSubscribeResponse, FFIDSubscription, FFIDSubscriptionCheckResponse, FFIDSubscriptionContextValue, type FFIDSubscriptionDetail, FFIDSubscriptionStatus, type FFIDSubscriptionSummary, type FFIDSupportedCurrency, type FFIDUpdateMemberRoleResponse, type FFIDUpdateNotificationPreferencesRequest, type FFIDUpdateUserProfileRequest, FFIDUser, type FFIDUserProfile, FFIDVerifyAccessTokenOptions, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_NEWSLETTER_DISPATCH_MAX_RECIPIENTS, FFID_NEWSLETTER_TYPES, type HandleRedirectCallbackClient, type HandleRedirectCallbackOptions, type KVNamespaceLike, ListAnnouncementsOptions, type NormalizeRedirectUriResult, type RedirectToAuthorizeOptions, type TokenData, type TokenStore, type UseFFIDReturn, type UseRequireActiveSubscriptionOptions, type UseRequireActiveSubscriptionReturn, type WithFFIDAuthOptions, type WithSubscriptionOptions, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createKVCacheAdapter, createMemoryCacheAdapter, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useRequireActiveSubscription, useSubscription, withFFIDAuth, withSubscription };
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, AnnouncementListResponse, BLOCKING_EFFECTIVE_STATUSES, type ComputeEffectiveStatusInput, type ContractWizardFlowType, type ContractWizardResubscribeOptions, type ContractWizardSubscribeOptions, type ContractWizardSubscriptionOptions, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EffectiveSubscriptionStatus, type ExchangeCodeForTokensOptions, type FFIDAddMemberParams, type FFIDAddMemberRequest, type FFIDAddMemberResponse, FFIDAnnouncementsApiResponse, type FFIDAnnouncementsClient, FFIDAnnouncementsClientConfig, FFIDAnnouncementsLogger, FFIDApiResponse, type FFIDAssignableMemberRole, type FFIDBillingInterval, FFIDCacheAdapter, type FFIDCancelPendingDowngradeResponse, type FFIDCancelSubscriptionParams, type FFIDCancelSubscriptionResponse, type FFIDChangePlanParams, type FFIDChangePlanResponse, FFIDCheckServiceAccessParams, type FFIDCheckoutSessionResponse, type FFIDClient, FFIDConfig, type FFIDCreateCheckoutParams, type FFIDCreatePortalParams, FFIDError, type FFIDErrorCode, type FFIDInquiryClient, FFIDInquiryCreateParams, FFIDInquiryCreateResponse, type FFIDInvitationStatus, type FFIDInviteMemberRequest, type FFIDInviteMemberResponse, type FFIDLeaveOrganizationParams, type FFIDLeaveOrganizationResponse, type FFIDListMembersResponse, type FFIDListPlansResponse, FFIDLogger, type FFIDLoginHistoryEntry, type FFIDLoginHistoryResponse, type FFIDMemberRole, type FFIDMemberStatus, type FFIDNewsletterBodySource, type FFIDNewsletterCampaignStatus, type FFIDNewsletterClient, type FFIDNewsletterConfirmParams, type FFIDNewsletterConfirmResponse, type FFIDNewsletterDispatchParams, type FFIDNewsletterDispatchResponse, type FFIDNewsletterSegment, type FFIDNewsletterSubscribeParams, type FFIDNewsletterSubscribeResponse, type FFIDNewsletterType, type FFIDNewsletterUnsubscribeParams, type FFIDNewsletterUnsubscribeResponse, FFIDOAuthUserInfo, FFIDOAuthUserInfoSubscription, FFIDOrganization, type FFIDOrganizationDomain, type FFIDOrganizationDomainsResponse, type FFIDOrganizationMember, type FFIDOrganizationNotificationPreferences, type FFIDOrganizationNotificationPreferencesResponse, type FFIDOtpSendResponse, type FFIDOtpVerifyResponse, type FFIDPasswordResetConfirmResponse, type FFIDPasswordResetResponse, type FFIDPasswordResetVerifyResponse, type FFIDPlanChangeLineItem, type FFIDPlanChangePreview, type FFIDPlanChangePreviewResponse, type FFIDPlanInfo, type FFIDPortalSessionResponse, type FFIDPreviewPlanChangeParams, type FFIDPreviewSeatChangeParams, type FFIDProfileCallOptions, FFIDProvider, type FFIDProviderProps, type FFIDProvisionMemberPlan, type FFIDProvisionMemberPlanStatus, type FFIDProvisionMemberResult, type FFIDProvisionMemberStatus, type FFIDProvisionOrganizationDryRun, type FFIDProvisionOrganizationMemberInput, type FFIDProvisionOrganizationOutcome, type FFIDProvisionOrganizationParams, type FFIDProvisionOrganizationResponse, type FFIDProvisionUserDryRun, type FFIDProvisionUserOutcome, type FFIDProvisionUserParams, type FFIDProvisionUserProfileInput, type FFIDProvisionUserResponse, type FFIDProvisionedOrganization, type FFIDProvisionedUser, FFIDRedirectResult, type FFIDRemoveMemberResponse, type FFIDResetSessionResponse, FFIDSDKError, type FFIDSeatChangeLineItem, type FFIDSeatChangePreview, type FFIDSeatChangePreviewResponse, FFIDServiceAccessDecision, type FFIDServiceInfo, FFIDSessionResponse, type FFIDSubscribeParams, type FFIDSubscribeResponse, FFIDSubscription, FFIDSubscriptionCheckResponse, FFIDSubscriptionContextValue, type FFIDSubscriptionDetail, FFIDSubscriptionStatus, type FFIDSubscriptionSummary, type FFIDSupportedCurrency, type FFIDUpdateMemberRoleResponse, type FFIDUpdateNotificationPreferencesRequest, type FFIDUpdateUserProfileRequest, FFIDUser, type FFIDUserProfile, FFIDVerifyAccessTokenOptions, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_ERROR_CODES, FFID_NEWSLETTER_DISPATCH_MAX_RECIPIENTS, FFID_NEWSLETTER_TYPES, type HandleRedirectCallbackClient, type HandleRedirectCallbackOptions, type KVNamespaceLike, ListAnnouncementsOptions, type NormalizeRedirectUriResult, type RedirectToAuthorizeOptions, type TokenData, type TokenStore, type UseFFIDReturn, type UseRequireActiveSubscriptionOptions, type UseRequireActiveSubscriptionReturn, type WithFFIDAuthOptions, type WithSubscriptionOptions, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createKVCacheAdapter, createMemoryCacheAdapter, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useRequireActiveSubscription, useSubscription, withFFIDAuth, withSubscription };

package/dist/index.js

@@ -1,5 +1,5 @@
-import { useFFIDContext, useSubscription } from './chunk-26X62P76.js';
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useSubscription, withSubscription } from './chunk-26X62P76.js';
+import { useFFIDContext, useSubscription } from './chunk-D3PZ6SZB.js';
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useSubscription, withSubscription } from './chunk-D3PZ6SZB.js';
 export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, CONSENT_DISMISSAL_TIMESTAMP_KEY, COOKIE_VERSION, DEFAULT_CONSENT_ERROR_MESSAGES, FFIDAnalyticsProvider, FFIDConsentError, FFIDCookieBanner, FFIDCookieLink, FFIDCookieSettings, FFID_CONSENT_ERROR_CODES, clearConsentDismissalTimestamp, decodeConsentCookie, encodeConsentCookie, readConsentCookie, readConsentDismissalTimestamp, useFFIDConsent, useFFIDConsentPreferences, writeConsentCookie, writeConsentDismissalTimestamp } from './chunk-G7VOX64X.js';
 import { useEffect, useRef } from 'react';
 import { jsx, Fragment } from 'react/jsx-runtime';

package/dist/server/index.cjs

@@ -225,10 +225,29 @@ function createJwtVerifier(deps) {
       return { data: userInfo };
     } catch (error) {
       const message = error instanceof Error ? error.message : "JWT\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F";
-      logger.error("JWT verification failed:", message);
+      if (error instanceof jose.errors.JWTExpired) {
+        logger.debug("JWT verification failed (token expired):", message);
+        return {
+          error: createError(
+            errorCodes.TOKEN_EXPIRED,
+            "\u30A2\u30AF\u30BB\u30B9\u30C8\u30FC\u30AF\u30F3\u306E\u6709\u52B9\u671F\u9650\u304C\u5207\u308C\u3066\u3044\u307E\u3059"
+          )
+        };
+      }
+      const isTokenLevelError = error instanceof jose.errors.JWTClaimValidationFailed || error instanceof jose.errors.JWTInvalid || error instanceof jose.errors.JWSInvalid || error instanceof jose.errors.JWSSignatureVerificationFailed || error instanceof jose.errors.JOSEAlgNotAllowed || error instanceof jose.errors.JOSENotSupported || error instanceof jose.errors.JWKSNoMatchingKey || error instanceof jose.errors.JWKSMultipleMatchingKeys;
+      if (isTokenLevelError) {
+        logger.warn("JWT verification failed:", message);
+        return {
+          error: createError(
+            errorCodes.TOKEN_VERIFICATION_ERROR,
+            `JWT\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${message}`
+          )
+        };
+      }
+      logger.error("JWT verification failed (JWKS fetch):", message);
       return {
         error: createError(
-          errorCodes.TOKEN_VERIFICATION_ERROR,
+          errorCodes.NETWORK_ERROR,
           `JWT\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${message}`
         )
       };
@@ -253,7 +272,9 @@ function createVerifyAccessToken(deps) {
         serviceCode,
         logger,
         createError,
-        errorCodes: { TOKEN_VERIFICATION_ERROR: errorCodes.TOKEN_VERIFICATION_ERROR }
+        // structural superset of JwtVerifierDeps.errorCodes — passing it
+        // wholesale removes the hand-transcription drift point
+        errorCodes
       });
     }
     return jwtVerify2;
@@ -849,6 +870,93 @@ function createMembersMethods(deps) {
   return { listMembers, addMember, updateMemberRole, removeMember };
 }
 
+// src/client/provisioning-methods.ts
+var USER_PROVISION_ENDPOINT = "/api/v1/ext/users/provision";
+var ORGANIZATION_PROVISION_ENDPOINT = "/api/v1/ext/organizations/provision";
+var MAX_PROVISION_MEMBERS = 100;
+var ASSIGNABLE_MEMBER_ROLES = {
+  admin: true,
+  member: true,
+  viewer: true
+};
+function isAssignableMemberRole(role) {
+  return Object.hasOwn(ASSIGNABLE_MEMBER_ROLES, role);
+}
+function createProvisioningMethods(deps) {
+  const { fetchWithAuth, createError, authMode } = deps;
+  function serviceKeyModeError() {
+    if (authMode === "service-key") return null;
+    return createError(
+      "VALIDATION_ERROR",
+      "provisionUser / provisionOrganization \u306F service-key \u8A8D\u8A3C\uFF08X-Service-Api-Key\uFF09\u3067\u306E\u307F\u5229\u7528\u3067\u304D\u307E\u3059\u3002Bearer / cookie \u30E2\u30FC\u30C9\u3067\u306F\u547C\u3073\u51FA\u305B\u307E\u305B\u3093"
+    );
+  }
+  async function provisionUser(params) {
+    const modeError = serviceKeyModeError();
+    if (modeError) return { error: modeError };
+    if (!params.email || !params.email.trim()) {
+      return { error: createError("VALIDATION_ERROR", "email \u306F\u5FC5\u9808\u3067\u3059") };
+    }
+    const body = { email: params.email.trim() };
+    if (params.profile !== void 0) body.profile = params.profile;
+    if (params.dryRun !== void 0) body.dryRun = params.dryRun;
+    return fetchWithAuth(USER_PROVISION_ENDPOINT, {
+      method: "POST",
+      body: JSON.stringify(body)
+    });
+  }
+  async function provisionOrganization(params) {
+    const modeError = serviceKeyModeError();
+    if (modeError) return { error: modeError };
+    if (!params.name || !params.name.trim()) {
+      return { error: createError("VALIDATION_ERROR", "name \u306F\u5FC5\u9808\u3067\u3059") };
+    }
+    if (!params.ownerEmail || !params.ownerEmail.trim()) {
+      return { error: createError("VALIDATION_ERROR", "ownerEmail \u306F\u5FC5\u9808\u3067\u3059") };
+    }
+    if (params.members) {
+      if (params.members.length > MAX_PROVISION_MEMBERS) {
+        return {
+          error: createError(
+            "VALIDATION_ERROR",
+            `members \u306F1\u30EA\u30AF\u30A8\u30B9\u30C8\u3042\u305F\u308A\u6700\u5927 ${MAX_PROVISION_MEMBERS} \u4EF6\u307E\u3067\u3067\u3059`
+          )
+        };
+      }
+      for (const member of params.members) {
+        if (!member.email || !member.email.trim()) {
+          return { error: createError("VALIDATION_ERROR", "members[].email \u306F\u5FC5\u9808\u3067\u3059") };
+        }
+        if (!isAssignableMemberRole(member.role)) {
+          return {
+            error: createError(
+              "VALIDATION_ERROR",
+              "members[].role \u306F admin\u3001member\u3001viewer \u306E\u3044\u305A\u308C\u304B\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044"
+            )
+          };
+        }
+      }
+    }
+    const body = {
+      name: params.name.trim(),
+      ownerEmail: params.ownerEmail.trim()
+    };
+    if (params.billingEmail !== void 0) body.billingEmail = params.billingEmail.trim();
+    if (params.members !== void 0) {
+      body.members = params.members.map((member) => ({
+        email: member.email.trim(),
+        role: member.role
+      }));
+    }
+    if (params.dryRun !== void 0) body.dryRun = params.dryRun;
+    return fetchWithAuth(ORGANIZATION_PROVISION_ENDPOINT, {
+      method: "POST",
+      body: JSON.stringify(body)
+    });
+  }
+  return { provisionUser, provisionOrganization };
+}
+
 // src/client/seat-methods.ts
 function seatsEndpoint(subscriptionId) {
   return `/api/v1/subscriptions/ext/${encodeURIComponent(subscriptionId)}/seats/assignments`;
@@ -1093,7 +1201,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.17.1";
+var SDK_VERSION = "5.19.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -2520,6 +2628,19 @@ var BLOCKING_EFFECTIVE_STATUSES = [
   "trial_expired"
 ];
 
+// src/client/error-codes.ts
+var FFID_ERROR_CODES = {
+  NETWORK_ERROR: "NETWORK_ERROR",
+  PARSE_ERROR: "PARSE_ERROR",
+  UNKNOWN_ERROR: "UNKNOWN_ERROR",
+  TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR",
+  TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR",
+  NO_TOKENS: "NO_TOKENS",
+  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR",
+  TOKEN_EXPIRED: "TOKEN_EXPIRED",
+  STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR"
+};
+
 // src/client/ffid-client.ts
 var UNAUTHORIZED_STATUS2 = 401;
 var SDK_LOG_PREFIX = "[FFID SDK]";
@@ -2528,8 +2649,10 @@ var noopLogger = {
   },
   info: () => {
   },
-  warn: (...args) => console.warn(SDK_LOG_PREFIX, ...args),
-  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
+  warn: () => {
+  },
+  error: () => {
+  }
 };
 var consoleLogger = {
   debug: (...args) => console.debug(SDK_LOG_PREFIX, ...args),
@@ -2537,16 +2660,6 @@ var consoleLogger = {
   warn: (...args) => console.warn(SDK_LOG_PREFIX, ...args),
   error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
 };
-var FFID_ERROR_CODES = {
-  NETWORK_ERROR: "NETWORK_ERROR",
-  PARSE_ERROR: "PARSE_ERROR",
-  UNKNOWN_ERROR: "UNKNOWN_ERROR",
-  TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR",
-  TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR",
-  NO_TOKENS: "NO_TOKENS",
-  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR",
-  STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR"
-};
 var EXT_CHECK_ENDPOINT = "/api/v1/subscriptions/ext/check";
 var DEFAULT_ALLOW_GRACE = true;
 var DEFAULT_SERVICE_ACCESS_FAIL_POLICY = "failClosed";
@@ -2929,6 +3042,11 @@ function createFFIDClient(config) {
     createError,
     serviceCode: config.serviceCode
   });
+  const { provisionUser, provisionOrganization } = createProvisioningMethods({
+    fetchWithAuth,
+    createError,
+    authMode
+  });
   const { getProfile, updateProfile } = createProfileMethods({
     fetchWithAuth,
     createError
@@ -3024,6 +3142,8 @@ function createFFIDClient(config) {
     addMember,
     updateMemberRole,
     removeMember,
+    provisionUser,
+    provisionOrganization,
     getProfile,
     updateProfile,
     // Non-contract ext API coverage (#3783)
@@ -3227,6 +3347,7 @@ Object.defineProperty(exports, "DEFAULT_OAUTH_SCOPES", {
 exports.ALL_DENIED_EXCEPT_NECESSARY = ALL_DENIED_EXCEPT_NECESSARY;
 exports.CONSENT_COOKIE_NAME = CONSENT_COOKIE_NAME;
 exports.COOKIE_VERSION = COOKIE_VERSION;
+exports.FFID_ERROR_CODES = FFID_ERROR_CODES;
 exports.createFFIDClient = createFFIDClient;
 exports.createKVCacheAdapter = createKVCacheAdapter;
 exports.createMemoryCacheAdapter = createMemoryCacheAdapter;

package/dist/server/index.d.cts

@@ -1,9 +1,36 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-Cwk6cG3b.cjs';
-export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDRemoveMemberResponse, x as FFIDResetSessionResponse, y as FFIDSubscription, z as FFIDUpdateMemberRoleResponse, A as FFIDUpdateUserProfileRequest, B as FFIDUser, C as FFIDUserProfile, T as TokenData, D as TokenStore, E as createFFIDClient, G as createTokenStore } from '../ffid-client-Cwk6cG3b.cjs';
+import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-BuDM5tmq.cjs';
+export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDProvisionMemberPlan, x as FFIDProvisionMemberPlanStatus, y as FFIDProvisionMemberResult, z as FFIDProvisionMemberStatus, A as FFIDProvisionOrganizationDryRun, B as FFIDProvisionOrganizationMemberInput, C as FFIDProvisionOrganizationOutcome, D as FFIDProvisionOrganizationParams, E as FFIDProvisionOrganizationResponse, G as FFIDProvisionUserDryRun, H as FFIDProvisionUserOutcome, I as FFIDProvisionUserParams, J as FFIDProvisionUserProfileInput, K as FFIDProvisionUserResponse, L as FFIDProvisionedOrganization, M as FFIDProvisionedUser, N as FFIDRemoveMemberResponse, O as FFIDResetSessionResponse, P as FFIDSubscription, Q as FFIDUpdateMemberRoleResponse, R as FFIDUpdateUserProfileRequest, S as FFIDUser, T as FFIDUserProfile, U as TokenData, V as TokenStore, W as createFFIDClient, X as createTokenStore } from '../ffid-client-BuDM5tmq.cjs';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-D61jqRIO.cjs';
 import { z } from 'zod';
 import '../types-BeVl-z12.cjs';
 
+/**
+ * FFID SDK error codes
+ *
+ * Codes the SDK itself attaches to `FFIDError.code`. Exported from the
+ * package entry points so consumers can branch on codes (e.g.
+ * `TOKEN_EXPIRED` vs `TOKEN_VERIFICATION_ERROR`) without hardcoding strings.
+ */
+/** Error codes used by the SDK */
+declare const FFID_ERROR_CODES: {
+    readonly NETWORK_ERROR: "NETWORK_ERROR";
+    readonly PARSE_ERROR: "PARSE_ERROR";
+    readonly UNKNOWN_ERROR: "UNKNOWN_ERROR";
+    readonly TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR";
+    readonly TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR";
+    readonly NO_TOKENS: "NO_TOKENS";
+    readonly TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR";
+    readonly TOKEN_EXPIRED: "TOKEN_EXPIRED";
+    readonly STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR";
+};
+/**
+ * Union of the error code literals the SDK itself produces.
+ *
+ * Note: `FFIDError.code` intentionally stays `string` — server-provided
+ * error codes pass through verbatim and must not be narrowed away.
+ */
+type FFIDErrorCode = (typeof FFID_ERROR_CODES)[keyof typeof FFID_ERROR_CODES];
+
 /** Token verification - verifyAccessToken() implementation */
 
 /** Dependencies required by verifyAccessToken */
@@ -16,9 +43,10 @@ interface VerifyAccessTokenDeps {
     logger: FFIDLogger;
     createError: (code: string, message: string) => FFIDError;
     errorCodes: {
-        NETWORK_ERROR: string;
-        PARSE_ERROR: string;
-        TOKEN_VERIFICATION_ERROR: string;
+        NETWORK_ERROR: 'NETWORK_ERROR';
+        PARSE_ERROR: 'PARSE_ERROR';
+        TOKEN_VERIFICATION_ERROR: 'TOKEN_VERIFICATION_ERROR';
+        TOKEN_EXPIRED: 'TOKEN_EXPIRED';
     };
     cache?: {
         adapter: FFIDCacheAdapter;
@@ -205,4 +233,4 @@ declare function decodeConsentCookie(raw: string | null | undefined): FFIDConsen
 
 declare const CONSENT_COOKIE_NAME = "ffid_consent";
 
-export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, COOKIE_VERSION, FFIDCacheAdapter, type FFIDConsentCategories, type FFIDConsentCategoryCode, type FFIDCookieStoreLike, FFIDOAuthUserInfo, FFIDVerifyAccessTokenOptions, type KVNamespaceLike, createKVCacheAdapter, createMemoryCacheAdapter, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies };
+export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, COOKIE_VERSION, FFIDCacheAdapter, type FFIDConsentCategories, type FFIDConsentCategoryCode, type FFIDCookieStoreLike, type FFIDErrorCode, FFIDOAuthUserInfo, FFIDVerifyAccessTokenOptions, FFID_ERROR_CODES, type KVNamespaceLike, createKVCacheAdapter, createMemoryCacheAdapter, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies };

package/dist/server/index.d.ts

@@ -1,9 +1,36 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-w8Twi5lD.js';
-export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDRemoveMemberResponse, x as FFIDResetSessionResponse, y as FFIDSubscription, z as FFIDUpdateMemberRoleResponse, A as FFIDUpdateUserProfileRequest, B as FFIDUser, C as FFIDUserProfile, T as TokenData, D as TokenStore, E as createFFIDClient, G as createTokenStore } from '../ffid-client-w8Twi5lD.js';
+import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-D0x8TBS5.js';
+export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDProvisionMemberPlan, x as FFIDProvisionMemberPlanStatus, y as FFIDProvisionMemberResult, z as FFIDProvisionMemberStatus, A as FFIDProvisionOrganizationDryRun, B as FFIDProvisionOrganizationMemberInput, C as FFIDProvisionOrganizationOutcome, D as FFIDProvisionOrganizationParams, E as FFIDProvisionOrganizationResponse, G as FFIDProvisionUserDryRun, H as FFIDProvisionUserOutcome, I as FFIDProvisionUserParams, J as FFIDProvisionUserProfileInput, K as FFIDProvisionUserResponse, L as FFIDProvisionedOrganization, M as FFIDProvisionedUser, N as FFIDRemoveMemberResponse, O as FFIDResetSessionResponse, P as FFIDSubscription, Q as FFIDUpdateMemberRoleResponse, R as FFIDUpdateUserProfileRequest, S as FFIDUser, T as FFIDUserProfile, U as TokenData, V as TokenStore, W as createFFIDClient, X as createTokenStore } from '../ffid-client-D0x8TBS5.js';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-D61jqRIO.js';
 import { z } from 'zod';
 import '../types-BeVl-z12.js';
 
+/**
+ * FFID SDK error codes
+ *
+ * Codes the SDK itself attaches to `FFIDError.code`. Exported from the
+ * package entry points so consumers can branch on codes (e.g.
+ * `TOKEN_EXPIRED` vs `TOKEN_VERIFICATION_ERROR`) without hardcoding strings.
+ */
+/** Error codes used by the SDK */
+declare const FFID_ERROR_CODES: {
+    readonly NETWORK_ERROR: "NETWORK_ERROR";
+    readonly PARSE_ERROR: "PARSE_ERROR";
+    readonly UNKNOWN_ERROR: "UNKNOWN_ERROR";
+    readonly TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR";
+    readonly TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR";
+    readonly NO_TOKENS: "NO_TOKENS";
+    readonly TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR";
+    readonly TOKEN_EXPIRED: "TOKEN_EXPIRED";
+    readonly STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR";
+};
+/**
+ * Union of the error code literals the SDK itself produces.
+ *
+ * Note: `FFIDError.code` intentionally stays `string` — server-provided
+ * error codes pass through verbatim and must not be narrowed away.
+ */
+type FFIDErrorCode = (typeof FFID_ERROR_CODES)[keyof typeof FFID_ERROR_CODES];
+
 /** Token verification - verifyAccessToken() implementation */
 
 /** Dependencies required by verifyAccessToken */
@@ -16,9 +43,10 @@ interface VerifyAccessTokenDeps {
     logger: FFIDLogger;
     createError: (code: string, message: string) => FFIDError;
     errorCodes: {
-        NETWORK_ERROR: string;
-        PARSE_ERROR: string;
-        TOKEN_VERIFICATION_ERROR: string;
+        NETWORK_ERROR: 'NETWORK_ERROR';
+        PARSE_ERROR: 'PARSE_ERROR';
+        TOKEN_VERIFICATION_ERROR: 'TOKEN_VERIFICATION_ERROR';
+        TOKEN_EXPIRED: 'TOKEN_EXPIRED';
     };
     cache?: {
         adapter: FFIDCacheAdapter;
@@ -205,4 +233,4 @@ declare function decodeConsentCookie(raw: string | null | undefined): FFIDConsen
 
 declare const CONSENT_COOKIE_NAME = "ffid_consent";
 
-export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, COOKIE_VERSION, FFIDCacheAdapter, type FFIDConsentCategories, type FFIDConsentCategoryCode, type FFIDCookieStoreLike, FFIDOAuthUserInfo, FFIDVerifyAccessTokenOptions, type KVNamespaceLike, createKVCacheAdapter, createMemoryCacheAdapter, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies };
+export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, COOKIE_VERSION, FFIDCacheAdapter, type FFIDConsentCategories, type FFIDConsentCategoryCode, type FFIDCookieStoreLike, type FFIDErrorCode, FFIDOAuthUserInfo, FFIDVerifyAccessTokenOptions, FFID_ERROR_CODES, type KVNamespaceLike, createKVCacheAdapter, createMemoryCacheAdapter, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies };