@feelflow/ffid-sdk 5.22.1 → 5.24.1

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-DM0ZhIDV.js';
-export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDProvisionMemberPlan, x as FFIDProvisionMemberPlanStatus, y as FFIDProvisionMemberResult, z as FFIDProvisionMemberStatus, A as FFIDProvisionOrganizationDryRun, B as FFIDProvisionOrganizationMemberInput, C as FFIDProvisionOrganizationOutcome, D as FFIDProvisionOrganizationParams, E as FFIDProvisionOrganizationResponse, G as FFIDProvisionUserDryRun, H as FFIDProvisionUserOutcome, I as FFIDProvisionUserParams, J as FFIDProvisionUserProfileInput, K as FFIDProvisionUserResponse, L as FFIDProvisionedOrganization, M as FFIDProvisionedUser, N as FFIDRemoveMemberResponse, O as FFIDResetSessionResponse, P as FFIDSubscription, Q as FFIDUpdateMemberRoleResponse, R as FFIDUpdateUserProfileRequest, S as FFIDUser, T as FFIDUserProfile, U as TokenData, V as TokenStore, W as createFFIDClient, X as createTokenStore } from '../ffid-client-DM0ZhIDV.js';
+import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-DX2PTTFr.js';
+export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDProvisionMemberPlan, x as FFIDProvisionMemberPlanStatus, y as FFIDProvisionMemberResult, z as FFIDProvisionMemberStatus, A as FFIDProvisionOrganizationDryRun, B as FFIDProvisionOrganizationMemberInput, C as FFIDProvisionOrganizationOutcome, D as FFIDProvisionOrganizationParams, E as FFIDProvisionOrganizationResponse, G as FFIDProvisionUserDryRun, H as FFIDProvisionUserOutcome, I as FFIDProvisionUserParams, J as FFIDProvisionUserProfileInput, K as FFIDProvisionUserResponse, L as FFIDProvisionedOrganization, M as FFIDProvisionedUser, N as FFIDRemoveMemberResponse, O as FFIDResetSessionResponse, P as FFIDSubscription, Q as FFIDUpdateMemberRoleResponse, R as FFIDUpdateUserProfileRequest, S as FFIDUser, T as FFIDUserProfile, U as TokenData, V as TokenStore, W as createFFIDClient, X as createTokenStore } from '../ffid-client-DX2PTTFr.js';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-D61jqRIO.js';
 import { z } from 'zod';
 import '../types-Cjb9J0rL.js';
@@ -233,4 +233,160 @@ declare function decodeConsentCookie(raw: string | null | undefined): FFIDConsen
 
 declare const CONSENT_COOKIE_NAME = "ffid_consent";
 
-export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, COOKIE_VERSION, FFIDCacheAdapter, type FFIDConsentCategories, type FFIDConsentCategoryCode, type FFIDCookieStoreLike, type FFIDErrorCode, FFIDOAuthUserInfo, FFIDVerifyAccessTokenOptions, FFID_ERROR_CODES, type KVNamespaceLike, createKVCacheAdapter, createMemoryCacheAdapter, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies };
+/**
+ * Public types for the confidential / BFF server auth helpers (#4261 / #4269).
+ * React/DOM-free — see `src/server/auth/server-auth-client.ts`.
+ */
+
+/** Configuration for {@link createServerAuthClient}. */
+interface ServerAuthConfig {
+    /** FFID service code (== OAuth `client_id` unless `clientId` is overridden). */
+    serviceCode: string;
+    /** OAuth `client_id`. Defaults to `serviceCode`. */
+    clientId?: string;
+    /**
+     * confidential-client secret — a `service_api_key` (`ffid_sk_live_…`) carrying
+     * the `oauth:client_auth` scope (PR-A1 #4267). Read from a server-only env var;
+     * never sent to the browser.
+     */
+    clientSecret: string;
+    /** FFID API base URL. Defaults to `DEFAULT_API_BASE_URL` (`https://id.feelflow.net`). */
+    apiBaseUrl?: string;
+    /** Server callback URL, registered in the service's `allowed_redirect_uris`. */
+    redirectUri: string;
+    /** OAuth scope (space-separated), forwarded to `/oauth/authorize?scope=…`. */
+    scope: string;
+    /**
+     * Optional request timeout (ms) applied to token fetches via
+     * `AbortSignal.timeout` (#4260). Unset → no timeout (fetch default).
+     */
+    timeout?: number | undefined;
+}
+/** Session tokens established by the BFF flow. Persist via {@link sessionCookies}. */
+interface ServerSessionTokens {
+    accessToken: string;
+    refreshToken: string;
+    /** Access-token expiry as epoch milliseconds. */
+    expiresAt: number;
+}
+/** Options for {@link ServerAuthClient.buildAuthorizeUrl}. */
+interface BuildAuthorizeUrlOptions {
+    /**
+     * `'signup'` は `?screen_hint=signup` を転送する（OIDC `prompt=create`
+     * 相当の意図の FFID 独自パラメータ）。
+     */
+    screenHint?: 'signup';
+    /** Forwards `?organization_id=…` (trimmed; empty is ignored). */
+    organizationId?: string;
+    /** Forwards OIDC `prompt` (`select_account` / `login`) to the upstream chooser (#4027). */
+    prompt?: 'login' | 'select_account';
+}
+/** Result of {@link ServerAuthClient.buildAuthorizeUrl}. */
+interface BuildAuthorizeUrlResult {
+    /** Authorize URL to 302 the browser to. */
+    url: string;
+    /** Random `state` — persist in an httpOnly cookie and pass back as `storedState`. */
+    state: string;
+}
+/** Input to {@link ServerAuthClient.handleCallback}. */
+interface HandleCallbackInput {
+    /** The callback request URL (absolute). `code` / `state` are read from its query. */
+    url: string | URL;
+    /** The `state` previously stored in the httpOnly cookie (undefined if absent). */
+    storedState: string | undefined;
+}
+/**
+ * Discriminated result of a server token operation. Mirrors {@link FFIDApiResponse}:
+ * exactly one of `tokens` / `error` is present.
+ */
+type ServerTokenResult = {
+    tokens: ServerSessionTokens;
+    error?: undefined;
+} | {
+    tokens?: undefined;
+    error: FFIDError;
+};
+/** Framework-agnostic confidential / BFF auth client. */
+interface ServerAuthClient {
+    /**
+     * Build the authorize URL and a fresh `state`. The caller stores `state` in an
+     * httpOnly cookie, then 302s to `url`. No `code_challenge` is sent (v1 uses
+     * `client_secret`, not PKCE).
+     */
+    buildAuthorizeUrl(opts?: BuildAuthorizeUrlOptions): BuildAuthorizeUrlResult;
+    /**
+     * Validate `state` (CSRF, fail-closed) then exchange `code` for tokens using
+     * the `client_secret` (server→server, browser never sees the secret or tokens).
+     */
+    handleCallback(input: HandleCallbackInput): Promise<ServerTokenResult>;
+    /** Refresh tokens (`refresh_token` grant, `client_secret`-authenticated). */
+    refresh(refreshToken: string): Promise<ServerTokenResult>;
+}
+/** Attributes for the session `Set-Cookie` (name is fixed — see {@link FFID_SESSION_COOKIE_NAME}). */
+interface CookieOptions {
+    /** `Path` attribute. Default `/`. */
+    path?: string;
+    /** `Domain` attribute. Omitted by default (host-only cookie). */
+    domain?: string;
+    /** `SameSite` attribute. Default `lax` (required for the cross-site callback redirect). */
+    sameSite?: 'lax' | 'strict' | 'none';
+    /**
+     * `Secure` attribute. Default `true`. ⚠️ `false` にすると cookie が平文 HTTP
+     * でも送信されるようになり、本番環境では非推奨（通常は変更しないこと）。
+     */
+    secure?: boolean;
+    /**
+     * `HttpOnly` attribute. Default `true`. ⚠️ `false` にするとトークンが
+     * ページ JS（`document.cookie`）から読めるようになり、本モジュールの
+     * 機密性モデルが破れる — 通常は変更しないこと。
+     */
+    httpOnly?: boolean;
+    /** `Max-Age` in seconds. Default 30 days. */
+    maxAge?: number;
+}
+
+/** Create a confidential / BFF auth client bound to one service's credentials. */
+declare function createServerAuthClient(config: ServerAuthConfig): ServerAuthClient;
+
+/**
+ * httpOnly session cookie codec for the confidential / BFF flow (#4261 / #4269).
+ *
+ * v1 stores the whole {@link ServerSessionTokens} in a single base64url-JSON
+ * cookie (`ffid_session`). httpOnly + Secure + SameSite=Lax by default so the
+ * browser can never read the tokens and the cookie survives the top-level
+ * callback redirect. The 4 KB per-cookie limit applies; access-token encryption
+ * and access/refresh split are documented future extensions (設計 spec
+ * (docs/02-design/2026-07-08-sdk-confidential-bff-design.md) §11).
+ *
+ * React/DOM-free: pure string I/O. The caller applies the returned `Set-Cookie`
+ * strings (e.g. `res.headers.append('Set-Cookie', c)`).
+ */
+
+/** Fixed session cookie name (read/serialize must agree — not configurable). */
+declare const FFID_SESSION_COOKIE_NAME = "ffid_session";
+declare function serialize(tokens: ServerSessionTokens, opts?: CookieOptions): string[];
+declare function read(cookieHeader: string | undefined): ServerSessionTokens | null;
+declare function clear(opts?: Omit<CookieOptions, 'maxAge'>): string[];
+/** httpOnly session cookie serialize / read / clear (returns `Set-Cookie` values). */
+declare const sessionCookies: {
+    serialize: typeof serialize;
+    read: typeof read;
+    clear: typeof clear;
+};
+
+/**
+ * Server-side OAuth `state` generation for the confidential / BFF flow (#4261).
+ *
+ * React/DOM-free: uses Web Crypto (`globalThis.crypto.getRandomValues`), which
+ * is available in Node 18+ and Edge runtimes. Unlike `src/auth/state.ts` (the
+ * browser flow), this never touches `window` / web storage — the caller persists
+ * the returned `state` in an httpOnly cookie instead.
+ */
+/**
+ * Generate a cryptographically-random, URL-safe OAuth `state` (32 hex chars).
+ * The caller stores this in an httpOnly `Secure` `SameSite=Lax` cookie and
+ * validates it on the callback (CSRF defense, RFC 6749 §10.12).
+ */
+declare function generateServerState(): string;
+
+export { ALL_DENIED_EXCEPT_NECESSARY, type BuildAuthorizeUrlOptions, type BuildAuthorizeUrlResult, CONSENT_COOKIE_NAME, COOKIE_VERSION, type CookieOptions, FFIDCacheAdapter, type FFIDConsentCategories, type FFIDConsentCategoryCode, type FFIDCookieStoreLike, type FFIDErrorCode, FFIDOAuthUserInfo, FFIDVerifyAccessTokenOptions, FFID_ERROR_CODES, FFID_SESSION_COOKIE_NAME, type HandleCallbackInput, type KVNamespaceLike, type ServerAuthClient, type ServerAuthConfig, type ServerSessionTokens, type ServerTokenResult, createKVCacheAdapter, createMemoryCacheAdapter, createServerAuthClient, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, generateServerState, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies, sessionCookies };

package/dist/server/index.js

@@ -85,7 +85,9 @@ function createMemoryStore() {
 function isTokenData(value) {
   if (typeof value !== "object" || value === null) return false;
   const obj = value;
-  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && typeof obj.expiresAt === "number";
+  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && // Number.isFinite also rejects NaN/Infinity (e.g. a crafted `1e999` JSON
+  // literal parses to Infinity and would never trip the expiry check — #4271)
+  typeof obj.expiresAt === "number" && Number.isFinite(obj.expiresAt);
 }
 function createTokenStore(storageType) {
   if (storageType === "memory") {
@@ -1221,7 +1223,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.22.1";
+var SDK_VERSION = "5.24.1";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1276,7 +1278,7 @@ function validateTokenResponse(tokenResponse) {
   if (!tokenResponse.refresh_token) {
     invalid.push("refresh_token");
   }
-  if (typeof tokenResponse.expires_in !== "number" || tokenResponse.expires_in <= 0) {
+  if (typeof tokenResponse.expires_in !== "number" || !Number.isFinite(tokenResponse.expires_in) || tokenResponse.expires_in <= 0) {
     invalid.push("expires_in");
   }
   if (invalid.length > 0) {
@@ -1291,8 +1293,15 @@ function createOAuthTokenMethods(deps) {
     resolvedRedirectUri,
     tokenStore,
     logger,
+    timeout,
     errorCodes
   } = deps;
+  function withTimeout2(init) {
+    if (timeout !== void 0) {
+      return { ...init, signal: AbortSignal.timeout(timeout) };
+    }
+    return init;
+  }
   async function exchangeCodeForTokens(code, codeVerifier, opts) {
     const url = `${baseUrl}${OAUTH_TOKEN_ENDPOINT}`;
     logger.debug("Exchanging code for tokens:", url);
@@ -1328,12 +1337,12 @@ function createOAuthTokenMethods(deps) {
     }
     let response;
     try {
-      response = await fetch(url, {
+      response = await fetch(url, withTimeout2({
         method: "POST",
         credentials: "omit",
         headers: { "Content-Type": "application/x-www-form-urlencoded", ...sdkHeaders() },
         body: new URLSearchParams(body).toString()
-      });
+      }));
     } catch (error) {
       logger.error("Network error during token exchange:", error);
       return {
@@ -1396,7 +1405,7 @@ function createOAuthTokenMethods(deps) {
     logger.debug("Refreshing access token:", url);
     let response;
     try {
-      response = await fetch(url, {
+      response = await fetch(url, withTimeout2({
         method: "POST",
         credentials: "omit",
         headers: { "Content-Type": "application/x-www-form-urlencoded", ...sdkHeaders() },
@@ -1405,7 +1414,7 @@ function createOAuthTokenMethods(deps) {
           refresh_token: tokens.refreshToken,
           client_id: clientId
         }).toString()
-      });
+      }));
     } catch (error) {
       logger.error("Network error during token refresh:", error);
       return {
@@ -1475,7 +1484,7 @@ function createOAuthTokenMethods(deps) {
     async function revokeOAuthToken(token, tokenTypeHint) {
       const url = `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`;
       try {
-        const response = await fetch(url, {
+        const response = await fetch(url, withTimeout2({
           method: "POST",
           credentials: "omit",
           headers: { "Content-Type": "application/x-www-form-urlencoded", ...sdkHeaders() },
@@ -1484,9 +1493,10 @@ function createOAuthTokenMethods(deps) {
             client_id: clientId,
             token_type_hint: tokenTypeHint
           }).toString()
-        });
+        }));
         return response.ok;
-      } catch {
+      } catch (err) {
+        logger.debug("Token revoke request failed (client-side; e.g. timeout/network):", err);
         return false;
       }
     }
@@ -2887,6 +2897,7 @@ function createFFIDClient(config) {
     resolvedRedirectUri,
     tokenStore,
     logger,
+    timeout,
     errorCodes: FFID_ERROR_CODES
   });
   async function fetchWithAuth(endpoint, options = {}, authOverride) {
@@ -3381,4 +3392,269 @@ function getFFIDConsentFromCookieHeader(cookieHeader) {
   return decodeConsentCookie(decodeURIComponent(value));
 }
 
-export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, COOKIE_VERSION, FFID_ERROR_CODES, createFFIDClient, createKVCacheAdapter, createMemoryCacheAdapter, createTokenStore, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies };
+// src/server/auth/server-state.ts
+var STATE_RANDOM_BYTES2 = 16;
+var HEX_RADIX = 16;
+function generateServerState() {
+  const bytes = new Uint8Array(STATE_RANDOM_BYTES2);
+  globalThis.crypto.getRandomValues(bytes);
+  return Array.from(bytes, (b) => b.toString(HEX_RADIX).padStart(2, "0")).join("");
+}
+
+// src/server/auth/server-oauth-token.ts
+var OAUTH_TOKEN_ENDPOINT2 = "/api/v1/oauth/token";
+var MS_PER_SECOND3 = 1e3;
+function withTimeout(init, timeout) {
+  if (timeout !== void 0) {
+    return { ...init, signal: AbortSignal.timeout(timeout) };
+  }
+  return init;
+}
+function validateTokenResponse2(r) {
+  const invalid = [];
+  if (!r.access_token) invalid.push("access_token");
+  if (!r.refresh_token) invalid.push("refresh_token");
+  if (typeof r.expires_in !== "number" || !Number.isFinite(r.expires_in) || r.expires_in <= 0) {
+    invalid.push("expires_in");
+  }
+  return invalid.length > 0 ? `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalid.join(", ")}` : null;
+}
+function toTokens(r) {
+  return {
+    accessToken: r.access_token,
+    refreshToken: r.refresh_token,
+    expiresAt: Date.now() + r.expires_in * MS_PER_SECOND3
+  };
+}
+function fail(code, message) {
+  return { error: { code, message } };
+}
+async function postToken(deps, body, fallbackErrorCode) {
+  const url = `${deps.apiBaseUrl}${OAUTH_TOKEN_ENDPOINT2}`;
+  let response;
+  try {
+    response = await fetch(
+      url,
+      withTimeout(
+        {
+          method: "POST",
+          credentials: "omit",
+          headers: { "Content-Type": "application/x-www-form-urlencoded", ...sdkHeaders() },
+          body: new URLSearchParams(body).toString()
+        },
+        deps.timeout
+      )
+    );
+  } catch (error) {
+    return fail(
+      FFID_ERROR_CODES.NETWORK_ERROR,
+      error instanceof Error ? error.message : "\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F"
+    );
+  }
+  let json;
+  try {
+    json = await response.json();
+  } catch {
+    return fail(
+      FFID_ERROR_CODES.PARSE_ERROR,
+      `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F (status: ${response.status})`
+    );
+  }
+  if (!response.ok) {
+    const errorBody = json;
+    return fail(errorBody.error ?? fallbackErrorCode, errorBody.error_description ?? "\u30C8\u30FC\u30AF\u30F3\u51E6\u7406\u306B\u5931\u6557\u3057\u307E\u3057\u305F");
+  }
+  const validationError = validateTokenResponse2(json);
+  if (validationError) {
+    return fail(fallbackErrorCode, validationError);
+  }
+  return { tokens: toTokens(json) };
+}
+function exchangeAuthorizationCodeServer(deps, code) {
+  return postToken(
+    deps,
+    {
+      grant_type: "authorization_code",
+      code,
+      client_id: deps.clientId,
+      client_secret: deps.clientSecret,
+      redirect_uri: deps.redirectUri
+    },
+    FFID_ERROR_CODES.TOKEN_EXCHANGE_ERROR
+  );
+}
+function refreshTokensServer(deps, refreshToken) {
+  return postToken(
+    deps,
+    {
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: deps.clientId,
+      client_secret: deps.clientSecret
+    },
+    FFID_ERROR_CODES.TOKEN_REFRESH_ERROR
+  );
+}
+
+// src/server/auth/server-auth-client.ts
+var OAUTH_AUTHORIZE_ENDPOINT2 = "/api/v1/oauth/authorize";
+var SCREEN_HINT_SIGNUP2 = "signup";
+function createServerAuthClient(config) {
+  if (!config.serviceCode?.trim()) {
+    throw new Error("FFID Server Auth: serviceCode \u304C\u672A\u8A2D\u5B9A\u3067\u3059");
+  }
+  if (!config.clientSecret?.trim()) {
+    throw new Error("FFID Server Auth: clientSecret \u304C\u672A\u8A2D\u5B9A\u3067\u3059");
+  }
+  if (!config.redirectUri?.trim()) {
+    throw new Error("FFID Server Auth: redirectUri \u304C\u672A\u8A2D\u5B9A\u3067\u3059");
+  }
+  if (!config.scope?.trim()) {
+    throw new Error(
+      "FFID Server Auth: scope \u304C\u672A\u8A2D\u5B9A\u3067\u3059\u3002`DEFAULT_OAUTH_SCOPES` \u3092 import \u3059\u308B\u304B\u660E\u793A\u7684\u306B\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044"
+    );
+  }
+  const apiBaseUrl = config.apiBaseUrl ?? DEFAULT_API_BASE_URL;
+  const clientId = config.clientId ?? config.serviceCode;
+  const deps = {
+    apiBaseUrl,
+    clientId,
+    clientSecret: config.clientSecret,
+    redirectUri: config.redirectUri,
+    timeout: config.timeout
+  };
+  function buildAuthorizeUrl(opts) {
+    const state = generateServerState();
+    const params = new URLSearchParams({
+      response_type: "code",
+      client_id: clientId,
+      scope: config.scope,
+      redirect_uri: config.redirectUri,
+      state
+    });
+    const organizationId = opts?.organizationId?.trim();
+    if (organizationId) params.set("organization_id", organizationId);
+    if (opts?.screenHint === SCREEN_HINT_SIGNUP2) params.set("screen_hint", SCREEN_HINT_SIGNUP2);
+    if (opts?.prompt) params.set("prompt", opts.prompt);
+    return { url: `${apiBaseUrl}${OAUTH_AUTHORIZE_ENDPOINT2}?${params.toString()}`, state };
+  }
+  async function handleCallback(input) {
+    let url;
+    try {
+      url = typeof input.url === "string" ? new URL(input.url) : input.url;
+    } catch {
+      return {
+        error: {
+          code: FFID_ERROR_CODES.TOKEN_EXCHANGE_ERROR,
+          message: "\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF URL \u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F"
+        }
+      };
+    }
+    const returnedState = url.searchParams.get("state") ?? void 0;
+    if (!input.storedState || !returnedState || input.storedState !== returnedState) {
+      return {
+        error: {
+          code: FFID_ERROR_CODES.STATE_MISMATCH_ERROR,
+          message: "OAuth state \u304C\u4E00\u81F4\u3057\u307E\u305B\u3093\u3002CSRF \u306E\u53EF\u80FD\u6027\u304C\u3042\u308B\u305F\u3081\u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+        }
+      };
+    }
+    const errorParam = url.searchParams.get("error");
+    if (errorParam) {
+      return {
+        error: {
+          code: errorParam,
+          message: url.searchParams.get("error_description") ?? "\u8A8D\u53EF\u30B5\u30FC\u30D0\u30FC\u304C\u30A8\u30E9\u30FC\u3092\u8FD4\u3057\u307E\u3057\u305F"
+        }
+      };
+    }
+    const code = url.searchParams.get("code");
+    if (!code) {
+      return {
+        error: {
+          code: FFID_ERROR_CODES.TOKEN_EXCHANGE_ERROR,
+          message: "authorization code \u304C\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF\u306B\u542B\u307E\u308C\u3066\u3044\u307E\u305B\u3093"
+        }
+      };
+    }
+    return exchangeAuthorizationCodeServer(deps, code);
+  }
+  function refresh(refreshToken) {
+    return refreshTokensServer(deps, refreshToken);
+  }
+  return { buildAuthorizeUrl, handleCallback, refresh };
+}
+
+// src/server/auth/session-cookies.ts
+var FFID_SESSION_COOKIE_NAME = "ffid_session";
+var DEFAULT_PATH = "/";
+var DEFAULT_SAME_SITE = "lax";
+var HOURS_PER_DAY2 = 24;
+var DEFAULT_MAX_AGE_DAYS = 30;
+var DEFAULT_MAX_AGE_SECONDS = 60 * 60 * HOURS_PER_DAY2 * DEFAULT_MAX_AGE_DAYS;
+var BASE64_GROUP = 4;
+function base64UrlEncode2(input) {
+  const bytes = new TextEncoder().encode(input);
+  const binary = Array.from(bytes, (byte) => String.fromCharCode(byte)).join("");
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlDecode(input) {
+  const b64 = input.replace(/-/g, "+").replace(/_/g, "/");
+  const remainder = b64.length % BASE64_GROUP;
+  const padded = remainder === 0 ? b64 : b64 + "=".repeat(BASE64_GROUP - remainder);
+  const bytes = Uint8Array.from(atob(padded), (char) => char.charCodeAt(0));
+  return new TextDecoder().decode(bytes);
+}
+function sameSiteLabel(value) {
+  return value.charAt(0).toUpperCase() + value.slice(1);
+}
+function buildSetCookie(nameValue, opts, maxAge) {
+  const path = opts.path ?? DEFAULT_PATH;
+  const sameSite = opts.sameSite ?? DEFAULT_SAME_SITE;
+  const secure = opts.secure ?? true;
+  const httpOnly = opts.httpOnly ?? true;
+  const attrs = [nameValue, `Path=${path}`, `Max-Age=${maxAge}`, `SameSite=${sameSiteLabel(sameSite)}`];
+  if (httpOnly) attrs.push("HttpOnly");
+  if (secure) attrs.push("Secure");
+  if (opts.domain) attrs.push(`Domain=${opts.domain}`);
+  return attrs.join("; ");
+}
+function parseCookieHeader(header) {
+  const out = {};
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    const key = part.slice(0, eq).trim();
+    if (key) out[key] = part.slice(eq + 1).trim();
+  }
+  return out;
+}
+function serialize(tokens, opts = {}) {
+  const value = base64UrlEncode2(JSON.stringify(tokens));
+  const maxAge = opts.maxAge ?? DEFAULT_MAX_AGE_SECONDS;
+  return [buildSetCookie(`${FFID_SESSION_COOKIE_NAME}=${value}`, opts, maxAge)];
+}
+function read(cookieHeader) {
+  if (!cookieHeader) return null;
+  const raw = parseCookieHeader(cookieHeader)[FFID_SESSION_COOKIE_NAME];
+  if (!raw) return null;
+  try {
+    const parsed = JSON.parse(base64UrlDecode(raw));
+    if (typeof parsed.accessToken !== "string" || typeof parsed.refreshToken !== "string" || typeof parsed.expiresAt !== "number") {
+      return null;
+    }
+    return {
+      accessToken: parsed.accessToken,
+      refreshToken: parsed.refreshToken,
+      expiresAt: parsed.expiresAt
+    };
+  } catch {
+    return null;
+  }
+}
+function clear(opts = {}) {
+  return [buildSetCookie(`${FFID_SESSION_COOKIE_NAME}=`, opts, 0)];
+}
+var sessionCookies = { serialize, read, clear };
+
+export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, COOKIE_VERSION, FFID_ERROR_CODES, FFID_SESSION_COOKIE_NAME, createFFIDClient, createKVCacheAdapter, createMemoryCacheAdapter, createServerAuthClient, createTokenStore, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, generateServerState, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies, sessionCookies };

package/dist/server/test/index.d.cts

@@ -1,4 +1,4 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-CEJMpqRZ.cjs';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-D0Jh4bO7.cjs';
 import '../../types-Cjb9J0rL.cjs';
 
 /**

package/dist/server/test/index.d.ts

@@ -1,4 +1,4 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-DM0ZhIDV.js';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-DX2PTTFr.js';
 import '../../types-Cjb9J0rL.js';
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feelflow/ffid-sdk",
-  "version": "5.22.1",
+  "version": "5.24.1",
   "description": "FeelFlow ID Platform SDK for React/Next.js applications",
   "keywords": [
     "feelflow",