@feelflow/ffid-sdk 5.18.0 → 5.21.0

package/README.md

@@ -396,6 +396,83 @@ await ffid.updateMemberRole({
 - `role` は `admin` / `member` / `viewer` のみ指定可能です。`owner` は追加・昇格 API では扱いません。
 - agency client と同じ呼び味が必要な場合は `ffid.addMember(organizationId, { email, role })` も使えます。
 
+### Provisioning（users / organizations）
+
+外部サービスからの一括移行向けに、**service-key 認証**でユーザー・組織を冪等にプロビジョニングするメソッド。REST を直叩きせず `createFFIDClient` 経由で呼べる（SDK-first、#3790 / #4127）。
+
+- **`authMode: 'service-key'`（`X-Service-Api-Key`）専用**。`token`（Bearer）/ `cookie` モードで呼ぶとサーバーへ往復せず即座に `VALIDATION_ERROR` を返す（サーバー側エンドポイントが service-key 認証のみを受け付けるため）。
+- 必要 scope: `provisionUser` → `user:provision`、`provisionOrganization` → `organization:write`。
+
+```ts
+import { createFFIDClient } from '@feelflow/ffid-sdk/server'
+
+const ffid = createFFIDClient({
+  serviceCode: 'praxis',
+  scope: '',
+  authMode: 'service-key',
+  serviceApiKey: process.env.FFID_SERVICE_API_KEY!,
+})
+
+// 1. ユーザーを冪等に作成（新規なら created:true / 既存なら created:false）
+const userRes = await ffid.provisionUser({
+  email: 'owner@example.com',
+  profile: { displayName: '山田 太郎', companyName: 'Example Inc.' },
+})
+if (userRes.error) throw new Error(userRes.error.message)
+if (!userRes.data.dryRun) {
+  console.log(userRes.data.created ? '新規作成' : '既存ユーザー', userRes.data.user.id)
+}
+
+// 2. その owner の組織を作成し、メンバーを冪等に追加
+const orgRes = await ffid.provisionOrganization({
+  name: 'Example 組織',
+  ownerEmail: 'owner@example.com',
+  members: [
+    { email: 'member1@example.com', role: 'member' },
+    { email: 'member2@example.com', role: 'viewer' },
+  ],
+})
+if (orgRes.error) {
+  // owner が未登録なら error.code === 'OWNER_NOT_FOUND'（先に provisionUser が必要）
+  throw new Error(orgRes.error.message)
+}
+if (!orgRes.data.dryRun) {
+  for (const m of orgRes.data.members) {
+    console.log(m.email, m.status) // 'added' | 'already_member' | 'user_not_found'
+  }
+}
+```
+
+#### 冪等セマンティクス
+
+- `provisionUser`: **既存メールは `created: false`**（HTTP 200、no-op）、新規メールは `created: true`（HTTP 201、パスワードレス・メール確認済み）。メールはサーバー側で normalize（trim + lowercase）されるため、大文字小文字違いの再送でも同一ユーザーに解決する。新規作成で `profile` を渡した場合のみ `profileWritten` が付き、`false` は「ユーザーは作成されたがプロフィール書き込みに失敗」→ 再送を推奨。
+- `provisionOrganization`: owner が同名の組織を既に持つ場合は `created: false`（HTTP 200）。`members` は冪等に追加され、各要素の `status` が `added` / `already_member` / `user_not_found` を返す。
+
+#### dryRun
+
+`dryRun: true` を渡すと **一切書き込まず**、実行時に何が起きるかだけを返す。レスポンスは `dryRun` 判別のタグ付きユニオン。
+
+```ts
+const preview = await ffid.provisionUser({ email: 'owner@example.com', dryRun: true })
+if (!preview.error && preview.data.dryRun) {
+  console.log(preview.data.wouldCreate) // true = 実行すれば新規作成される
+}
+
+const orgPreview = await ffid.provisionOrganization({
+  name: 'Example 組織',
+  ownerEmail: 'owner@example.com',
+  members: [{ email: 'member1@example.com', role: 'member' }],
+  dryRun: true,
+})
+if (!orgPreview.error && orgPreview.data.dryRun) {
+  console.log(orgPreview.data.wouldCreate) // 組織を新規作成するか
+  // per-member plan status: 'would_add' | 'already_member' | 'user_not_found'
+  orgPreview.data.members.forEach((m) => console.log(m.email, m.status))
+}
+```
+
+`if (res.data.dryRun)` で TypeScript が型を絞り込むため、dry-run 分岐では `wouldCreate`、実行分岐では `created` がそれぞれ型安全に参照できる。
+
 ### getProfile() / updateProfile()
 
 ログイン中ユーザー自身のプロフィールを取得・更新するメソッド（`createFFIDClient` から呼び出し）。

package/dist/agency/index.cjs

@@ -16,8 +16,10 @@ var noopLogger = {
   },
   info: () => {
   },
-  warn: (...args) => console.warn(SDK_LOG_PREFIX, ...args),
-  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
+  warn: () => {
+  },
+  error: () => {
+  }
 };
 var consoleLogger = {
   debug: (...args) => console.debug(SDK_LOG_PREFIX, ...args),

package/dist/agency/index.js

@@ -15,8 +15,10 @@ var noopLogger = {
   },
   info: () => {
   },
-  warn: (...args) => console.warn(SDK_LOG_PREFIX, ...args),
-  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
+  warn: () => {
+  },
+  error: () => {
+  }
 };
 var consoleLogger = {
   debug: (...args) => console.debug(SDK_LOG_PREFIX, ...args),

package/dist/announcements/index.cjs

@@ -20,7 +20,8 @@ var quietLogger = {
   },
   warn: () => {
   },
-  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
+  error: () => {
+  }
 };
 var consoleLogger = {
   debug: (...args) => console.debug(SDK_LOG_PREFIX, ...args),

package/dist/announcements/index.js

@@ -18,7 +18,8 @@ var quietLogger = {
   },
   warn: () => {
   },
-  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
+  error: () => {
+  }
 };
 var consoleLogger = {
   debug: (...args) => console.debug(SDK_LOG_PREFIX, ...args),

package/dist/{chunk-55S5VUWR.cjs → chunk-RDQ4R3XC.cjs}

@@ -266,10 +266,12 @@ var OAUTH_INTROSPECT_ENDPOINT = "/api/v1/oauth/introspect";
 var CACHE_KEY_PREFIX = "ffid:introspect:";
 var HEX_BASE = 16;
 var HEX_BYTE_WIDTH = 2;
-var TOKEN_LOG_PREFIX_LENGTH = 8;
 function createVerifyAccessToken(deps) {
   const { authMode, baseUrl, serviceCode, serviceApiKey, verifyStrategy, logger, createError, errorCodes, cache, timeout } = deps;
   let jwtVerify2 = null;
+  let cacheReadFailureEscalated = false;
+  let cacheWriteFailureEscalated = false;
+  let missingSubtleCryptoLogged = false;
   function getJwtVerifier() {
     if (!jwtVerify2) {
       jwtVerify2 = createJwtVerifier({
@@ -329,8 +331,9 @@ function createVerifyAccessToken(deps) {
     }
     const url = `${baseUrl}${OAUTH_INTROSPECT_ENDPOINT}`;
     logger.debug("Verifying access token:", url);
-    const cacheKey = cache ? await buildCacheKey(accessToken, cacheKeySuffix) : "";
-    if (cache) {
+    const cacheKey = cache ? await buildCacheKey(accessToken, cacheKeySuffix) : null;
+    let verificationCacheDegraded = cache !== void 0 && cacheKey === null;
+    if (cache && cacheKey !== null) {
       try {
         const cached = await cache.adapter.get(cacheKey);
         if (cached && typeof cached === "object" && "sub" in cached) {
@@ -338,7 +341,16 @@ function createVerifyAccessToken(deps) {
           return { data: cached };
         }
       } catch (cacheError) {
-        logger.warn("Cache read failed, falling back to API call:", cacheError);
+        verificationCacheDegraded = true;
+        if (!cacheReadFailureEscalated) {
+          cacheReadFailureEscalated = true;
+          logger.error(
+            "Cache read failed \u2014 falling back to API call. Redis \u7B49\u306E cache adapter \u969C\u5BB3\u6642\u306F\u5168 verification \u304C introspect \u306B degrade \u3057\u307E\u3059\uFF08\u3053\u306E error \u306F instance \u3054\u3068\u306B\u521D\u56DE\u306E\u307F\u3001\u4EE5\u964D\u306F warn\uFF09:",
+            cacheError
+          );
+        } else {
+          logger.warn("Cache read failed, falling back to API call:", cacheError);
+        }
       }
     }
     const fetchOptions = {
@@ -433,31 +445,40 @@ function createVerifyAccessToken(deps) {
       }
     } : base;
     const userinfo = normalizeUserinfo(raw);
-    if (cache) {
+    if (cache && cacheKey !== null) {
       try {
         await cache.adapter.set(cacheKey, userinfo, cache.ttl);
       } catch (cacheError) {
-        logger.warn("Cache write failed (result still returned):", cacheError);
+        verificationCacheDegraded = true;
+        if (!cacheWriteFailureEscalated) {
+          cacheWriteFailureEscalated = true;
+          logger.error(
+            "Cache write failed \u2014 result still returned. cache adapter \u969C\u5BB3\u6642\u306F introspect \u7D50\u679C\u304C\u30AD\u30E3\u30C3\u30B7\u30E5\u3055\u308C\u305A\u5168 verification \u304C API \u547C\u3073\u51FA\u3057\u306B degrade \u3057\u307E\u3059\uFF08\u3053\u306E error \u306F instance \u3054\u3068\u306B\u521D\u56DE\u306E\u307F\u3001\u4EE5\u964D\u306F warn\uFF09:",
+            cacheError
+          );
+        } else {
+          logger.warn("Cache write failed (result still returned):", cacheError);
+        }
       }
     }
-    return { data: userinfo };
+    return verificationCacheDegraded ? { data: userinfo, meta: { verificationCacheDegraded: true } } : { data: userinfo };
   }
   async function buildCacheKey(token, suffix) {
-    let key;
-    if (typeof globalThis.crypto?.subtle?.digest === "function") {
-      const encoder = new TextEncoder();
-      const data = encoder.encode(token);
-      const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-      const hashArray = Array.from(new Uint8Array(hashBuffer));
-      const hashHex = hashArray.map((b) => b.toString(HEX_BASE).padStart(HEX_BYTE_WIDTH, "0")).join("");
-      key = CACHE_KEY_PREFIX + hashHex;
-    } else {
-      const tokenPrefix = token.length > TOKEN_LOG_PREFIX_LENGTH ? token.substring(0, TOKEN_LOG_PREFIX_LENGTH) + "..." : "***";
-      logger.warn(
-        `crypto.subtle \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081\u3001\u30AD\u30E3\u30C3\u30B7\u30E5\u30AD\u30FC\u306B\u30CF\u30C3\u30B7\u30E5\u5316\u3055\u308C\u3066\u3044\u306A\u3044\u30C8\u30FC\u30AF\u30F3\u3092\u4F7F\u7528\u3057\u307E\u3059 (token prefix: ${tokenPrefix})`
-      );
-      key = CACHE_KEY_PREFIX + token;
-    }
+    if (typeof globalThis.crypto?.subtle?.digest !== "function") {
+      if (!missingSubtleCryptoLogged) {
+        missingSubtleCryptoLogged = true;
+        logger.error(
+          "crypto.subtle \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081 introspect \u7D50\u679C\u306E\u30AD\u30E3\u30C3\u30B7\u30E5\u3092\u7121\u52B9\u5316\u3057\u307E\u3057\u305F\uFF08\u30CF\u30C3\u30B7\u30E5\u5316\u3055\u308C\u3066\u3044\u306A\u3044\u30C8\u30FC\u30AF\u30F3\u3092 cache key \u306B\u4F7F\u308F\u306A\u3044\u305F\u3081\u306E\u63AA\u7F6E #4119\uFF09\u3002\u5168 verification \u304C API \u547C\u3073\u51FA\u3057\u306B\u306A\u308A\u307E\u3059"
+        );
+      }
+      return null;
+    }
+    const encoder = new TextEncoder();
+    const data = encoder.encode(token);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    const hashHex = hashArray.map((b) => b.toString(HEX_BASE).padStart(HEX_BYTE_WIDTH, "0")).join("");
+    const key = CACHE_KEY_PREFIX + hashHex;
     return suffix ? `${key}:${suffix}` : key;
   }
   return verifyAccessToken;
@@ -875,6 +896,93 @@ function createMembersMethods(deps) {
   return { listMembers, addMember, updateMemberRole, removeMember };
 }
 
+// src/client/provisioning-methods.ts
+var USER_PROVISION_ENDPOINT = "/api/v1/ext/users/provision";
+var ORGANIZATION_PROVISION_ENDPOINT = "/api/v1/ext/organizations/provision";
+var MAX_PROVISION_MEMBERS = 100;
+var ASSIGNABLE_MEMBER_ROLES = {
+  admin: true,
+  member: true,
+  viewer: true
+};
+function isAssignableMemberRole(role) {
+  return Object.hasOwn(ASSIGNABLE_MEMBER_ROLES, role);
+}
+function createProvisioningMethods(deps) {
+  const { fetchWithAuth, createError, authMode } = deps;
+  function serviceKeyModeError() {
+    if (authMode === "service-key") return null;
+    return createError(
+      "VALIDATION_ERROR",
+      "provisionUser / provisionOrganization \u306F service-key \u8A8D\u8A3C\uFF08X-Service-Api-Key\uFF09\u3067\u306E\u307F\u5229\u7528\u3067\u304D\u307E\u3059\u3002Bearer / cookie \u30E2\u30FC\u30C9\u3067\u306F\u547C\u3073\u51FA\u305B\u307E\u305B\u3093"
+    );
+  }
+  async function provisionUser(params) {
+    const modeError = serviceKeyModeError();
+    if (modeError) return { error: modeError };
+    if (!params.email || !params.email.trim()) {
+      return { error: createError("VALIDATION_ERROR", "email \u306F\u5FC5\u9808\u3067\u3059") };
+    }
+    const body = { email: params.email.trim() };
+    if (params.profile !== void 0) body.profile = params.profile;
+    if (params.dryRun !== void 0) body.dryRun = params.dryRun;
+    return fetchWithAuth(USER_PROVISION_ENDPOINT, {
+      method: "POST",
+      body: JSON.stringify(body)
+    });
+  }
+  async function provisionOrganization(params) {
+    const modeError = serviceKeyModeError();
+    if (modeError) return { error: modeError };
+    if (!params.name || !params.name.trim()) {
+      return { error: createError("VALIDATION_ERROR", "name \u306F\u5FC5\u9808\u3067\u3059") };
+    }
+    if (!params.ownerEmail || !params.ownerEmail.trim()) {
+      return { error: createError("VALIDATION_ERROR", "ownerEmail \u306F\u5FC5\u9808\u3067\u3059") };
+    }
+    if (params.members) {
+      if (params.members.length > MAX_PROVISION_MEMBERS) {
+        return {
+          error: createError(
+            "VALIDATION_ERROR",
+            `members \u306F1\u30EA\u30AF\u30A8\u30B9\u30C8\u3042\u305F\u308A\u6700\u5927 ${MAX_PROVISION_MEMBERS} \u4EF6\u307E\u3067\u3067\u3059`
+          )
+        };
+      }
+      for (const member of params.members) {
+        if (!member.email || !member.email.trim()) {
+          return { error: createError("VALIDATION_ERROR", "members[].email \u306F\u5FC5\u9808\u3067\u3059") };
+        }
+        if (!isAssignableMemberRole(member.role)) {
+          return {
+            error: createError(
+              "VALIDATION_ERROR",
+              "members[].role \u306F admin\u3001member\u3001viewer \u306E\u3044\u305A\u308C\u304B\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044"
+            )
+          };
+        }
+      }
+    }
+    const body = {
+      name: params.name.trim(),
+      ownerEmail: params.ownerEmail.trim()
+    };
+    if (params.billingEmail !== void 0) body.billingEmail = params.billingEmail.trim();
+    if (params.members !== void 0) {
+      body.members = params.members.map((member) => ({
+        email: member.email.trim(),
+        role: member.role
+      }));
+    }
+    if (params.dryRun !== void 0) body.dryRun = params.dryRun;
+    return fetchWithAuth(ORGANIZATION_PROVISION_ENDPOINT, {
+      method: "POST",
+      body: JSON.stringify(body)
+    });
+  }
+  return { provisionUser, provisionOrganization };
+}
+
 // src/client/seat-methods.ts
 function seatsEndpoint(subscriptionId) {
   return `/api/v1/subscriptions/ext/${encodeURIComponent(subscriptionId)}/seats/assignments`;
@@ -1119,7 +1227,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.18.0";
+var SDK_VERSION = "5.21.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1361,33 +1469,48 @@ function createOAuthTokenMethods(deps) {
   async function signOutToken() {
     const tokens = tokenStore.getTokens();
     tokenStore.clearTokens();
+    const allRevoked = {
+      revoked: true,
+      accessTokenRevoked: true,
+      refreshTokenRevoked: true
+    };
     if (!tokens) {
       logger.debug("No tokens to revoke");
-      return { data: void 0 };
+      return { data: allRevoked };
     }
-    const url = `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`;
-    logger.debug("Revoking token:", url);
-    try {
-      const response = await fetch(url, {
-        method: "POST",
-        credentials: "omit",
-        headers: { "Content-Type": "application/x-www-form-urlencoded", ...sdkHeaders() },
-        body: new URLSearchParams({
-          token: tokens.accessToken,
-          client_id: clientId
-        }).toString()
-      });
-      if (!response.ok) {
-        logger.warn(
-          "\u30C8\u30FC\u30AF\u30F3\u7121\u52B9\u5316\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30B5\u30FC\u30D0\u30FC\u3067\u5931\u6557\u3057\u307E\u3057\u305F:",
-          `status=${response.status}`
-        );
+    async function revokeOAuthToken(token, tokenTypeHint) {
+      const url = `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`;
+      try {
+        const response = await fetch(url, {
+          method: "POST",
+          credentials: "omit",
+          headers: { "Content-Type": "application/x-www-form-urlencoded", ...sdkHeaders() },
+          body: new URLSearchParams({
+            token,
+            client_id: clientId,
+            token_type_hint: tokenTypeHint
+          }).toString()
+        });
+        return response.ok;
+      } catch {
+        return false;
       }
-    } catch (error) {
-      logger.warn("\u30C8\u30FC\u30AF\u30F3\u7121\u52B9\u5316\u306E\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30EA\u30AF\u30A8\u30B9\u30C8\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+    }
+    logger.debug("Revoking tokens:", `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`);
+    const accessTokenRevoked = await revokeOAuthToken(tokens.accessToken, "access_token");
+    if (!accessTokenRevoked) {
+      logger.warn("\u30A2\u30AF\u30BB\u30B9\u30C8\u30FC\u30AF\u30F3\u306E\u7121\u52B9\u5316\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30B5\u30FC\u30D0\u30FC\u3067\u5931\u6557\u3057\u307E\u3057\u305F");
+    }
+    const refreshTokenRevoked = tokens.refreshToken ? await revokeOAuthToken(tokens.refreshToken, "refresh_token") : true;
+    if (tokens.refreshToken && !refreshTokenRevoked) {
+      logger.warn("\u30EA\u30D5\u30EC\u30C3\u30B7\u30E5\u30C8\u30FC\u30AF\u30F3\u306E\u7121\u52B9\u5316\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30B5\u30FC\u30D0\u30FC\u3067\u5931\u6557\u3057\u307E\u3057\u305F");
+    }
+    const revoked = accessTokenRevoked && refreshTokenRevoked;
+    if (!revoked) {
+      logger.warn("\u30C8\u30FC\u30AF\u30F3\u7121\u52B9\u5316\u304C\u4E00\u90E8\u307E\u305F\u306F\u5168\u90E8\u5931\u6557\u3057\u307E\u3057\u305F\uFF08\u30ED\u30FC\u30AB\u30EB\u30C8\u30FC\u30AF\u30F3\u306F\u30AF\u30EA\u30A2\u6E08\u307F\uFF09");
     }
     logger.debug("Token sign-out completed");
-    return { data: void 0 };
+    return { data: { revoked, accessTokenRevoked, refreshTokenRevoked } };
   }
   return { exchangeCodeForTokens, refreshAccessToken, signOutToken };
 }
@@ -1551,7 +1674,7 @@ function createSessionMethods(deps) {
     }
     if (response.status === NO_CONTENT_STATUS) {
       logger.debug("Response: 204 No Content");
-      return { data: void 0 };
+      return { data: { revoked: true } };
     }
     if (!response.ok) {
       try {
@@ -1578,7 +1701,7 @@ function createSessionMethods(deps) {
       }
     }
     logger.debug("Response:", response.status);
-    return { data: void 0 };
+    return { data: { revoked: true } };
   }
   return { getSession, signOutCookie };
 }
@@ -1796,6 +1919,9 @@ var REDIRECT_LOOP_WINDOW_MS = 6e4;
 var REDIRECT_LOOP_THRESHOLD = 3;
 var storageReadFailureLogged = false;
 var storageWriteFailureLogged = false;
+function isLoopDetectionDegraded() {
+  return storageReadFailureLogged || storageWriteFailureLogged;
+}
 function logStorageReadFailure(logger, err) {
   if (storageReadFailureLogged) return;
   storageReadFailureLogged = true;
@@ -1940,9 +2066,16 @@ function createRedirectMethods(deps) {
     }
     const state = generateRandomState();
     if (!storeState(state, logger)) {
+      cleanupVerifierStorage(logger);
+      cleanupStateStorage(logger);
       logger.error(
-        "redirectToAuthorize: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF\u3067\u306E CSRF \u691C\u8A3C\u304C\u5931\u6557\u3057\u307E\u3059"
+        "redirectToAuthorize: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u8A8D\u53EF\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
       );
+      return {
+        success: false,
+        code: "state_persistence_failed",
+        error: "OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u8A8D\u53EF\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+      };
     }
     const redirectUri = resolvedRedirectUri ?? window.location.origin + window.location.pathname;
     const params = new URLSearchParams({
@@ -1977,7 +2110,7 @@ function createRedirectMethods(deps) {
       rollbackLastRedirectAttempt(authorizeKey, logger);
       throw err;
     }
-    return { success: true };
+    return isLoopDetectionDegraded() ? { success: true, loopDetectionDisabled: true } : { success: true };
   }
   async function redirectToLogin(options) {
     if (typeof window === "undefined") {
@@ -3130,6 +3263,11 @@ function createFFIDClient(config) {
     createError,
     serviceCode: config.serviceCode
   });
+  const { provisionUser, provisionOrganization } = createProvisioningMethods({
+    fetchWithAuth,
+    createError,
+    authMode
+  });
   const { getProfile, updateProfile } = createProfileMethods({
     fetchWithAuth,
     createError
@@ -3225,6 +3363,8 @@ function createFFIDClient(config) {
     addMember,
     updateMemberRole,
     removeMember,
+    provisionUser,
+    provisionOrganization,
     getProfile,
     updateProfile,
     // Non-contract ext API coverage (#3783)
@@ -4237,7 +4377,8 @@ var quietLogger = {
   },
   warn: () => {
   },
-  error: (...args) => console.error(SDK_LOG_PREFIX2, ...args)
+  error: () => {
+  }
 };
 var consoleLogger2 = {
   debug: (...args) => console.debug(SDK_LOG_PREFIX2, ...args),