@feelflow/ffid-sdk 9.0.0 → 10.1.0

package/dist/index.js

@@ -1,5 +1,5 @@
-import { useFFIDContext, useSubscription } from './chunk-TUXIJEEZ.js';
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, AGENCY_INVITE_COOKIE_MAX_AGE_SEC, AGENCY_INVITE_COOKIE_NAME, AGENCY_INVITE_TOKEN_PARAM, AGENCY_INVITE_TOKEN_REDACTION, BLOCKING_EFFECTIVE_STATUSES, CATALOG_HASH_PATTERN, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDCatalogHashError, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_CATALOG_ENVIRONMENTS, FFID_CATALOG_PUBLICATION_STATUSES, FFID_COMPANY_SIZE_CODES, FFID_ERROR_CODES, FFID_INDUSTRY_CODES, FFID_INQUIRY_ACQUISITION_SOURCES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, FFID_ORGANIZATION_PROFILE_ERROR_CODES, FFID_SUBSCRIPTION_ERROR_CODES, canonicalizeCatalogValue, captureAgencyInviteToken, clearAgencyInviteToken, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, hashCanonicalJson, isBlockedFromUserinfo, isFFIDInquiryAcquisitionSource, isFFIDInquiryCategorySite2026, normalizeRedirectUri, readAgencyInviteCookie, readAgencyInviteToken, redactAgencyInviteToken, retrieveCodeVerifier, retrieveState, sha256Hex, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useSubscription, validatePublishedCatalog, withSubscription } from './chunk-TUXIJEEZ.js';
+import { useFFIDContext, useSubscription } from './chunk-ITSQIAO5.js';
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, AGENCY_INVITE_COOKIE_MAX_AGE_SEC, AGENCY_INVITE_COOKIE_NAME, AGENCY_INVITE_TOKEN_PARAM, AGENCY_INVITE_TOKEN_REDACTION, BLOCKING_EFFECTIVE_STATUSES, CATALOG_HASH_PATTERN, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDCatalogHashError, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_CATALOG_ENVIRONMENTS, FFID_CATALOG_PUBLICATION_STATUSES, FFID_COMPANY_SIZE_CODES, FFID_CREDITS_CONSUME_MAX_AMOUNT, FFID_CREDITS_CONSUME_MIN_AMOUNT, FFID_CREDITS_ERROR_CODES, FFID_CREDITS_FEATURE_PATTERN, FFID_CREDITS_HISTORY_DEFAULT_LIMIT, FFID_CREDITS_HISTORY_MAX_LIMIT, FFID_CREDITS_HISTORY_MIN_LIMIT, FFID_CREDITS_IDEMPOTENCY_KEY_PATTERN, FFID_CREDITS_LOW_THRESHOLD_PERCENT, FFID_CREDITS_METADATA_MAX_BYTES, FFID_CREDIT_GRANT_KINDS, FFID_CREDIT_HISTORY_TYPES, FFID_CREDIT_PACK_MAX_QUANTITY, FFID_CREDIT_PACK_MIN_QUANTITY, FFID_ERROR_CODES, FFID_INDUSTRY_CODES, FFID_INQUIRY_ACQUISITION_SOURCES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, FFID_OAUTH_DENIAL_REASONS, FFID_ORGANIZATION_PROFILE_ERROR_CODES, FFID_SUBSCRIPTION_ERROR_CODES, canonicalizeCatalogValue, captureAgencyInviteToken, clearAgencyInviteToken, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, getFFIDAuthorizationError, handleRedirectCallback, hasAccessFromUserinfo, hashCanonicalJson, isBlockedFromUserinfo, isFFIDInquiryAcquisitionSource, isFFIDInquiryCategorySite2026, isFFIDOAuthDenialReason, normalizeRedirectUri, readAgencyInviteCookie, readAgencyInviteToken, redactAgencyInviteToken, retrieveCodeVerifier, retrieveState, sha256Hex, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useSubscription, validatePublishedCatalog, withSubscription } from './chunk-ITSQIAO5.js';
 export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, CONSENT_DISMISSAL_TIMESTAMP_KEY, COOKIE_VERSION, DEFAULT_CONSENT_ERROR_MESSAGES, FFIDAnalyticsProvider, FFIDConsentError, FFIDCookieBanner, FFIDCookieLink, FFIDCookieSettings, FFID_CONSENT_ERROR_CODES, clearConsentDismissalTimestamp, decodeConsentCookie, encodeConsentCookie, readConsentCookie, readConsentDismissalTimestamp, useFFIDConsent, useFFIDConsentPreferences, writeConsentCookie, writeConsentDismissalTimestamp } from './chunk-S2AEBJRX.js';
 import { useEffect, useRef } from 'react';
 import { jsx, Fragment } from 'react/jsx-runtime';

package/dist/server/index.cjs

@@ -1371,7 +1371,7 @@ var FFID_ORGANIZATION_PROFILE_ERROR_CODES = {
 };
 
 // src/client/version-check.ts
-var SDK_VERSION = "9.0.0";
+var SDK_VERSION = "10.1.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1727,8 +1727,11 @@ function createProvisioningMethods(deps) {
 }
 
 // src/client/seat-methods.ts
+function seatSummaryEndpoint(subscriptionId) {
+  return `/api/v1/subscriptions/ext/${encodeURIComponent(subscriptionId)}/seats`;
+}
 function seatsEndpoint(subscriptionId) {
-  return `/api/v1/subscriptions/ext/${encodeURIComponent(subscriptionId)}/seats/assignments`;
+  return `${seatSummaryEndpoint(subscriptionId)}/assignments`;
 }
 function createSeatMethods(deps) {
   const { fetchWithAuth, createError } = deps;
@@ -1738,6 +1741,12 @@ function createSeatMethods(deps) {
     }
     return fetchWithAuth(seatsEndpoint(params.subscriptionId));
   }
+  async function getSeats(subscriptionId) {
+    if (!subscriptionId || !subscriptionId.trim()) {
+      return { error: createError("VALIDATION_ERROR", "subscriptionId \u306F\u5FC5\u9808\u3067\u3059") };
+    }
+    return fetchWithAuth(seatSummaryEndpoint(subscriptionId));
+  }
   async function assignSeats(params) {
     if (!params.subscriptionId) {
       return { error: createError("VALIDATION_ERROR", "subscriptionId \u306F\u5FC5\u9808\u3067\u3059") };
@@ -1762,7 +1771,7 @@ function createSeatMethods(deps) {
       { method: "DELETE" }
     );
   }
-  return { listSeatAssignments, assignSeats, unassignSeat };
+  return { listSeatAssignments, getSeats, assignSeats, unassignSeat };
 }
 
 // src/client/profile-methods.ts
@@ -3489,6 +3498,222 @@ function createInquiryMethods(deps) {
   return { create };
 }
 
+// src/types/credits.ts
+var FFID_CREDITS_CONSUME_MIN_AMOUNT = 1;
+var FFID_CREDITS_CONSUME_MAX_AMOUNT = 1e6;
+var FFID_CREDITS_METADATA_MAX_BYTES = 4096;
+var FFID_CREDITS_HISTORY_MIN_LIMIT = 1;
+var FFID_CREDITS_HISTORY_MAX_LIMIT = 100;
+var FFID_CREDIT_PACK_MIN_QUANTITY = 1;
+var FFID_CREDIT_PACK_MAX_QUANTITY = 10;
+var FFID_CREDITS_IDEMPOTENCY_KEY_PATTERN = /^[A-Za-z0-9._:-]{8,128}$/;
+var FFID_CREDITS_FEATURE_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+var FFID_CREDIT_HISTORY_TYPES = ["grant", "consumption", "revocation"];
+
+// src/client/credits-methods.ts
+var EXT_SUBSCRIPTIONS_PATH = "/api/v1/subscriptions/ext";
+var CREDIT_PACKS_ENDPOINT = `${EXT_SUBSCRIPTIONS_PATH}/credits/packs`;
+var CREDIT_PACK_CHECKOUT_ENDPOINT = `${CREDIT_PACKS_ENDPOINT}/checkout`;
+var PORTAL_SUBSCRIPTION_PATH = "/subscriptions";
+var BUY_CREDITS_QUERY = { key: "purchase", value: "credits" };
+var ORG_QUERY_KEY = "org";
+var FFID_CONTRACT_ID_PREFIX = "ffid:";
+var STRIPE_SUBSCRIPTION_ID_PREFIX = "sub_";
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var VALIDATION_ERROR = "VALIDATION_ERROR";
+var FORBIDDEN = "FORBIDDEN";
+var utf8Encoder = new TextEncoder();
+function creditsEndpoint(subscriptionId, action) {
+  return `${EXT_SUBSCRIPTIONS_PATH}/${encodeURIComponent(subscriptionId)}/credits/${action}`;
+}
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isIntegerInRange(value, min, max) {
+  return typeof value === "number" && Number.isInteger(value) && value >= min && value <= max;
+}
+function createCreditsMethods(deps) {
+  const { fetchWithAuth, createError, authMode, baseUrl, serviceCode, logger } = deps;
+  function validationError(field, message) {
+    return { error: { ...createError(VALIDATION_ERROR, message), details: { field } } };
+  }
+  function forbidden(reason, message) {
+    return { error: { ...createError(FORBIDDEN, message), details: { reason } } };
+  }
+  function missingSubscriptionId(subscriptionId) {
+    return subscriptionId && subscriptionId.trim() ? null : validationError("subscriptionId", "subscriptionId \u306F\u5FC5\u9808\u3067\u3059");
+  }
+  async function getBalance(subscriptionId) {
+    const invalid = missingSubscriptionId(subscriptionId);
+    if (invalid) return invalid;
+    return fetchWithAuth(creditsEndpoint(subscriptionId, "balance"));
+  }
+  async function listHistory(subscriptionId, options = {}) {
+    const invalid = missingSubscriptionId(subscriptionId);
+    if (invalid) return invalid;
+    const query = new URLSearchParams();
+    if (options.cursor !== void 0) query.set("cursor", options.cursor);
+    if (options.limit !== void 0) {
+      if (!isIntegerInRange(options.limit, FFID_CREDITS_HISTORY_MIN_LIMIT, FFID_CREDITS_HISTORY_MAX_LIMIT)) {
+        return validationError(
+          "limit",
+          `limit \u306F ${FFID_CREDITS_HISTORY_MIN_LIMIT}\u301C${FFID_CREDITS_HISTORY_MAX_LIMIT} \u306E\u6574\u6570\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044`
+        );
+      }
+      query.set("limit", String(options.limit));
+    }
+    if (options.type !== void 0) {
+      if (!FFID_CREDIT_HISTORY_TYPES.includes(options.type)) {
+        return validationError("type", `type \u306F ${FFID_CREDIT_HISTORY_TYPES.join(" / ")} \u306E\u3044\u305A\u308C\u304B\u3067\u3059`);
+      }
+      query.set("type", options.type);
+    }
+    const qs = query.toString();
+    return fetchWithAuth(
+      `${creditsEndpoint(subscriptionId, "history")}${qs ? `?${qs}` : ""}`
+    );
+  }
+  async function listPacks(packServiceCode) {
+    const resolved = packServiceCode ?? (authMode === "service-key" ? void 0 : serviceCode);
+    if (resolved !== void 0 && !resolved.trim()) {
+      return validationError("serviceCode", "serviceCode \u3092\u6307\u5B9A\u3059\u308B\u5834\u5408\u3001\u7A7A\u6587\u5B57\u306F\u4F7F\u7528\u3067\u304D\u307E\u305B\u3093");
+    }
+    const qs = resolved === void 0 ? "" : `?${new URLSearchParams({ serviceCode: resolved }).toString()}`;
+    return fetchWithAuth(`${CREDIT_PACKS_ENDPOINT}${qs}`);
+  }
+  async function createPackCheckout(params) {
+    if (authMode !== "token") {
+      return forbidden(
+        "bearer_required",
+        "createPackCheckout \u306F token \u30E2\u30FC\u30C9\uFF08Bearer\uFF09\u3067\u306E\u307F\u5229\u7528\u3067\u304D\u307E\u3059\u3002\u8CFC\u5165\u8005\u306E\u8A18\u9332\u306B\u5B9F\u30E6\u30FC\u30B6\u30FC\u304C\u5FC5\u8981\u306A\u305F\u3081\u3067\u3059"
+      );
+    }
+    const invalid = missingSubscriptionId(params.subscriptionId);
+    if (invalid) return invalid;
+    for (const field of ["packCode", "successUrl", "cancelUrl"]) {
+      if (!params[field] || !params[field].trim()) {
+        return validationError(field, `${field} \u306F\u5FC5\u9808\u3067\u3059`);
+      }
+    }
+    if (params.quantity !== void 0 && !isIntegerInRange(params.quantity, FFID_CREDIT_PACK_MIN_QUANTITY, FFID_CREDIT_PACK_MAX_QUANTITY)) {
+      return validationError(
+        "quantity",
+        `quantity \u306F ${FFID_CREDIT_PACK_MIN_QUANTITY}\u301C${FFID_CREDIT_PACK_MAX_QUANTITY} \u306E\u6574\u6570\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044`
+      );
+    }
+    const body = {
+      subscriptionId: params.subscriptionId,
+      packCode: params.packCode,
+      successUrl: params.successUrl,
+      cancelUrl: params.cancelUrl
+    };
+    if (params.quantity !== void 0) body.quantity = params.quantity;
+    return fetchWithAuth(CREDIT_PACK_CHECKOUT_ENDPOINT, {
+      method: "POST",
+      body: JSON.stringify(body)
+    });
+  }
+  function validateConsume(params) {
+    const invalid = missingSubscriptionId(params.subscriptionId);
+    if (invalid) return invalid;
+    if (!isIntegerInRange(params.amount, FFID_CREDITS_CONSUME_MIN_AMOUNT, FFID_CREDITS_CONSUME_MAX_AMOUNT)) {
+      return validationError(
+        "amount",
+        `amount \u306F ${FFID_CREDITS_CONSUME_MIN_AMOUNT}\u301C${FFID_CREDITS_CONSUME_MAX_AMOUNT} \u306E\u6574\u6570\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044`
+      );
+    }
+    if (typeof params.idempotencyKey !== "string" || !FFID_CREDITS_IDEMPOTENCY_KEY_PATTERN.test(params.idempotencyKey)) {
+      return validationError(
+        "idempotencyKey",
+        "idempotencyKey \u306E\u5F62\u5F0F\u304C\u4E0D\u6B63\u3067\u3059\uFF08\u82F1\u6570\u5B57\u3068 . _ : - \u306E 8\u301C128 \u6587\u5B57\u3002\u63A8\u5968\u306F feature:requestId\uFF09"
+      );
+    }
+    if (typeof params.feature !== "string" || !FFID_CREDITS_FEATURE_PATTERN.test(params.feature)) {
+      return validationError("feature", "feature \u306E\u5F62\u5F0F\u304C\u4E0D\u6B63\u3067\u3059\uFF08\u5C0F\u6587\u5B57\u82F1\u6570\u5B57\u3067\u59CB\u307E\u308B\u3001\u5C0F\u6587\u5B57\u82F1\u6570\u5B57\u3068 . _ - \u306E 1\u301C64 \u6587\u5B57\uFF09");
+    }
+    if (params.metadata !== void 0) {
+      if (!isPlainObject2(params.metadata)) {
+        return validationError("metadata", "metadata \u306F JSON \u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059");
+      }
+      let serialized;
+      try {
+        serialized = JSON.stringify(params.metadata);
+      } catch {
+        return validationError("metadata", "metadata \u306F JSON \u306B\u5909\u63DB\u3067\u304D\u308B\u5024\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\uFF08BigInt\u30FB\u5FAA\u74B0\u53C2\u7167\u306F\u4E0D\u53EF\uFF09");
+      }
+      if (utf8Encoder.encode(serialized).byteLength > FFID_CREDITS_METADATA_MAX_BYTES) {
+        return validationError("metadata", `metadata \u306F ${FFID_CREDITS_METADATA_MAX_BYTES} \u30D0\u30A4\u30C8\u4EE5\u4E0B\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059`);
+      }
+    }
+    if (params.userId !== void 0 && !UUID_PATTERN.test(params.userId)) {
+      return validationError("userId", "userId \u306F\u6709\u52B9\u306AUUID\u5F62\u5F0F\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059");
+    }
+    return null;
+  }
+  async function consume(params) {
+    if (authMode !== "service-key") {
+      return forbidden(
+        "api_key_required",
+        "credits.consume \u306F service-key \u8A8D\u8A3C\uFF08X-Service-Api-Key\uFF09\u3067\u306E\u307F\u5229\u7528\u3067\u304D\u307E\u3059\u3002\u6D88\u8CBB\u306E\u5831\u544A\u306F\u30B5\u30FC\u30D3\u30B9\u306E\u30D0\u30C3\u30AF\u30A8\u30F3\u30C9\u304B\u3089\u884C\u3063\u3066\u304F\u3060\u3055\u3044"
+      );
+    }
+    const invalid = validateConsume(params);
+    if (invalid) return invalid;
+    const body = {
+      amount: params.amount,
+      idempotencyKey: params.idempotencyKey,
+      feature: params.feature
+    };
+    if (params.metadata !== void 0) body.metadata = params.metadata;
+    if (params.userId !== void 0) body.userId = params.userId;
+    return fetchWithAuth(creditsEndpoint(params.subscriptionId, "consume"), {
+      method: "POST",
+      body: JSON.stringify(body)
+    });
+  }
+  function getBuyCreditsUrl(params) {
+    const raw = params.subscriptionId?.trim() ?? "";
+    if (raw.startsWith(STRIPE_SUBSCRIPTION_ID_PREFIX)) {
+      return validationError(
+        "subscriptionId",
+        "getBuyCreditsUrl \u306B\u306F\u5951\u7D04\u306E UUID\uFF08\u307E\u305F\u306F ffid:<uuid>\uFF09\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002Stripe \u306E sub_... \u306F\u4F7F\u3048\u307E\u305B\u3093"
+      );
+    }
+    const uuid = raw.startsWith(FFID_CONTRACT_ID_PREFIX) ? raw.slice(FFID_CONTRACT_ID_PREFIX.length) : raw;
+    if (!UUID_PATTERN.test(uuid)) {
+      return validationError("subscriptionId", "subscriptionId \u306F\u5951\u7D04\u306E UUID\uFF08\u307E\u305F\u306F ffid:<uuid>\uFF09\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059");
+    }
+    const query = new URLSearchParams({ [BUY_CREDITS_QUERY.key]: BUY_CREDITS_QUERY.value });
+    if (params.orgId !== void 0 && params.orgId.trim()) {
+      query.set(ORG_QUERY_KEY, params.orgId);
+    }
+    return { data: `${baseUrl}${PORTAL_SUBSCRIPTION_PATH}/${encodeURIComponent(uuid)}?${query.toString()}` };
+  }
+  function redirectToBuyCredits(params) {
+    const result = getBuyCreditsUrl(params);
+    if (result.error) {
+      logger.warn("redirectToBuyCredits:", result.error.message);
+      return { success: false, error: result.error.message };
+    }
+    if (typeof window === "undefined") {
+      logger.warn("SSR \u74B0\u5883\u3067\u306F\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3067\u304D\u307E\u305B\u3093");
+      return { success: false, error: "SSR \u74B0\u5883\u3067\u306F\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3067\u304D\u307E\u305B\u3093" };
+    }
+    logger.debug("Redirecting to buy credits:", result.data);
+    window.location.href = result.data;
+    return { success: true };
+  }
+  return {
+    getBalance,
+    listHistory,
+    listPacks,
+    createPackCheckout,
+    consume,
+    getBuyCreditsUrl,
+    redirectToBuyCredits
+  };
+}
+
 // src/subscriptions/userinfo-helpers.ts
 var ACCESS_GRANTING_EFFECTIVE_STATUSES = [
   "active",
@@ -3547,7 +3772,12 @@ function toServiceAccessDecision(response, allowGrace) {
     planCode: response.planCode,
     currentPeriodEnd: response.currentPeriodEnd,
     gracePeriodEndsAt: response.gracePeriodEndsAt ?? null,
-    reactivatable: response.reactivatable ?? false
+    reactivatable: response.reactivatable ?? false,
+    // Informational pass-through (10.0.0). Deliberately not part of hasAccess /
+    // denialReason: credits and the member limit never gate access (CREDITS_API §1-5).
+    ...response.pricingModel !== void 0 ? { pricingModel: response.pricingModel } : {},
+    ...response.credits !== void 0 ? { credits: response.credits } : {},
+    ...response.memberLimitReached !== void 0 ? { memberLimitReached: response.memberLimitReached } : {}
   };
 }
 function failClosedServiceAccessDecision(params, error) {
@@ -3909,7 +4139,7 @@ function createFFIDClient(config) {
     fetchWithAuth,
     createError
   });
-  const { listSeatAssignments, assignSeats, unassignSeat } = createSeatMethods({
+  const { listSeatAssignments, getSeats, assignSeats, unassignSeat } = createSeatMethods({
     fetchWithAuth,
     createError
   });
@@ -4016,6 +4246,14 @@ function createFFIDClient(config) {
     fetchWithAuth,
     createError
   });
+  const credits = createCreditsMethods({
+    fetchWithAuth,
+    createError,
+    authMode,
+    baseUrl,
+    serviceCode: config.serviceCode,
+    logger
+  });
   const verifyAccessToken = createVerifyAccessToken({
     authMode,
     baseUrl,
@@ -4071,6 +4309,7 @@ function createFFIDClient(config) {
     getInvoice,
     retryPayment,
     listSeatAssignments,
+    getSeats,
     assignSeats,
     unassignSeat,
     listPlans,
@@ -4081,13 +4320,16 @@ function createFFIDClient(config) {
     cancelSubscription,
     cancelPendingDowngrade,
     previewPlanChange,
+    /** @deprecated 10.0.0: per_seat (praxis) only; removed in 11.0.0 */
     previewSeatChange,
     verifyAccessToken,
     getSubscribeUrl,
     redirectToSubscribe,
     getChangePlanUrl,
     redirectToChangePlan,
+    /** @deprecated 10.0.0: per_seat (praxis) only; removed in 11.0.0 */
     getChangeSeatsUrl,
+    /** @deprecated 10.0.0: per_seat (praxis) only; removed in 11.0.0 */
     redirectToChangeSeats,
     getRecoverPaymentUrl,
     redirectToRecoverPayment,
@@ -4103,6 +4345,8 @@ function createFFIDClient(config) {
     newsletter,
     /** Inquiry methods (create) */
     inquiry,
+    /** Credits methods for flat plans (consume / balance / history / packs) */
+    credits,
     /** Token store (token mode only) */
     tokenStore,
     /**
@@ -4121,6 +4365,50 @@ function createFFIDClient(config) {
   };
 }
 
+// src/client/authorization-error.ts
+var FFID_OAUTH_DENIAL_REASONS = [
+  /** The user is not a member of the organization */
+  "no_membership",
+  /** The organization has no usable subscription for the service */
+  "no_active_subscription",
+  /** The organization has a subscription, but the user has no seat in it */
+  "no_seat_assignment",
+  /** The subscription has expired (canceled / past due beyond grace) */
+  "subscription_expired",
+  /** The flat plan's member limit is full, so no seat could be given */
+  "member_limit_reached"
+];
+function isFFIDOAuthDenialReason(value) {
+  return typeof value === "string" && FFID_OAUTH_DENIAL_REASONS.includes(value);
+}
+var DEFAULT_AUTHORIZATION_ERROR_MESSAGE = "\u8A8D\u53EF\u30B5\u30FC\u30D0\u30FC\u304C\u30A8\u30E9\u30FC\u3092\u8FD4\u3057\u307E\u3057\u305F";
+function buildAuthorizationError(params) {
+  const oauthError = params.get("error");
+  if (!oauthError) return null;
+  const rawReason = params.get("denial_reason");
+  const errorDescription = params.get("error_description");
+  const details = {
+    source: "authorization",
+    denialReason: isFFIDOAuthDenialReason(rawReason) ? rawReason : null,
+    errorDescription
+  };
+  return {
+    code: oauthError,
+    message: errorDescription ?? DEFAULT_AUTHORIZATION_ERROR_MESSAGE,
+    details: { ...details }
+  };
+}
+function getFFIDAuthorizationError(error) {
+  const details = error?.details;
+  if (!error || !details || details.source !== "authorization") return null;
+  const description = details.errorDescription;
+  return {
+    oauthError: error.code,
+    denialReason: isFFIDOAuthDenialReason(details.denialReason) ? details.denialReason : null,
+    errorDescription: typeof description === "string" ? description : null
+  };
+}
+
 // src/client/cache/memory-cache-adapter.ts
 var MS_PER_SECOND2 = 1e3;
 function createMemoryCacheAdapter() {
@@ -4411,14 +4699,9 @@ function createServerAuthClient(config) {
         }
       };
     }
-    const errorParam = url.searchParams.get("error");
-    if (errorParam) {
-      return {
-        error: {
-          code: errorParam,
-          message: url.searchParams.get("error_description") ?? "\u8A8D\u53EF\u30B5\u30FC\u30D0\u30FC\u304C\u30A8\u30E9\u30FC\u3092\u8FD4\u3057\u307E\u3057\u305F"
-        }
-      };
+    const authorizationError = buildAuthorizationError(url.searchParams);
+    if (authorizationError) {
+      return { error: authorizationError };
     }
     const code = url.searchParams.get("code");
     if (!code) {
@@ -4530,6 +4813,7 @@ exports.FFID_ERROR_CODES = FFID_ERROR_CODES;
 exports.FFID_INDUSTRY_CODES = FFID_INDUSTRY_CODES;
 exports.FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES = FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES;
 exports.FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB = FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB;
+exports.FFID_OAUTH_DENIAL_REASONS = FFID_OAUTH_DENIAL_REASONS;
 exports.FFID_ORGANIZATION_PROFILE_ERROR_CODES = FFID_ORGANIZATION_PROFILE_ERROR_CODES;
 exports.FFID_SESSION_COOKIE_NAME = FFID_SESSION_COOKIE_NAME;
 exports.canonicalizeCatalogValue = canonicalizeCatalogValue;
@@ -4548,9 +4832,11 @@ exports.createVerifyAccessToken = createVerifyAccessToken;
 exports.decodeConsentCookie = decodeConsentCookie;
 exports.encodeConsentCookie = encodeConsentCookie;
 exports.generateServerState = generateServerState;
+exports.getFFIDAuthorizationError = getFFIDAuthorizationError;
 exports.getFFIDConsentFromCookieHeader = getFFIDConsentFromCookieHeader;
 exports.getFFIDConsentFromCookies = getFFIDConsentFromCookies;
 exports.hashCanonicalJson = hashCanonicalJson;
+exports.isFFIDOAuthDenialReason = isFFIDOAuthDenialReason;
 exports.sessionCookies = sessionCookies;
 exports.sha256Hex = sha256Hex;
 exports.validatePublishedCatalog = validatePublishedCatalog;

package/dist/server/index.d.cts

@@ -1,5 +1,5 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo, f as FFIDCatalogEnvironment, g as FFIDBillingInterval, h as FFIDTaxBehavior, i as FFIDPublishedCatalog } from '../ffid-client-6aLs9Fqc.cjs';
-export { j as FFIDAddMemberParams, k as FFIDAddMemberRequest, l as FFIDAddMemberResponse, m as FFIDAllowedLogoMimeType, n as FFIDAssignableMemberRole, o as FFIDCacheConfig, p as FFIDCatalogPublication, q as FFIDCatalogPublicationStatus, r as FFIDClient, s as FFIDCompanySizeCode, t as FFIDConfig, u as FFIDIndustryCode, v as FFIDListMembersResponse, w as FFIDListingConsentInput, x as FFIDLogoWallEntry, y as FFIDLogoWallResponse, z as FFIDMemberRole, A as FFIDOrganization, B as FFIDOrganizationLogoUploadResponse, C as FFIDOrganizationMember, D as FFIDOrganizationProfile, E as FFIDOrganizationProfileErrorCode, G as FFIDOrganizationProfileResponse, H as FFIDOtpSendResponse, I as FFIDOtpVerifyResponse, J as FFIDPasswordResetConfirmResponse, K as FFIDPasswordResetResponse, L as FFIDPasswordResetVerifyResponse, M as FFIDProfileCallOptions, N as FFIDProvisionMemberPlan, O as FFIDProvisionMemberPlanStatus, P as FFIDProvisionMemberResult, Q as FFIDProvisionMemberStatus, R as FFIDProvisionOrganizationDryRun, S as FFIDProvisionOrganizationMemberInput, T as FFIDProvisionOrganizationOutcome, U as FFIDProvisionOrganizationParams, V as FFIDProvisionOrganizationResponse, W as FFIDProvisionUserDryRun, X as FFIDProvisionUserOutcome, Y as FFIDProvisionUserParams, Z as FFIDProvisionUserProfileInput, _ as FFIDProvisionUserResponse, $ as FFIDProvisionedOrganization, a0 as FFIDProvisionedUser, a1 as FFIDPublishedPlan, a2 as FFIDRemoveMemberResponse, a3 as FFIDResetSessionResponse, a4 as FFIDSubscription, a5 as FFIDUpdateMemberRoleResponse, a6 as FFIDUpdateUserProfileRequest, a7 as FFIDUploadOrganizationLogoParams, a8 as FFIDUpsertOrganizationProfileParams, a9 as FFIDUpsertOrganizationProfileRequest, aa as FFIDUser, ab as FFIDUserProfile, ac as FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, ad as FFID_CATALOG_ENVIRONMENTS, ae as FFID_CATALOG_PUBLICATION_STATUSES, af as FFID_COMPANY_SIZE_CODES, ag as FFID_INDUSTRY_CODES, ah as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, ai as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, aj as FFID_ORGANIZATION_PROFILE_ERROR_CODES, ak as TokenData, al as TokenStore, am as createFFIDClient, an as createTokenStore } from '../ffid-client-6aLs9Fqc.cjs';
+import { F as FFIDError, a as FFIDLogger, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo, f as FFIDCatalogEnvironment, g as FFIDBillingInterval, h as FFIDTaxBehavior, i as FFIDPublishedCatalog } from '../ffid-client-qcfCWLfs.cjs';
+export { j as FFIDAddMemberParams, k as FFIDAddMemberRequest, l as FFIDAddMemberResponse, m as FFIDAllowedLogoMimeType, n as FFIDAssignableMemberRole, o as FFIDCacheConfig, p as FFIDCatalogPublication, q as FFIDCatalogPublicationStatus, r as FFIDClient, s as FFIDCompanySizeCode, t as FFIDConfig, u as FFIDIndustryCode, v as FFIDListMembersResponse, w as FFIDListingConsentInput, x as FFIDLogoWallEntry, y as FFIDLogoWallResponse, z as FFIDMemberRole, A as FFIDOrganization, B as FFIDOrganizationLogoUploadResponse, C as FFIDOrganizationMember, D as FFIDOrganizationProfile, E as FFIDOrganizationProfileErrorCode, G as FFIDOrganizationProfileResponse, H as FFIDOtpSendResponse, I as FFIDOtpVerifyResponse, J as FFIDPasswordResetConfirmResponse, K as FFIDPasswordResetResponse, L as FFIDPasswordResetVerifyResponse, M as FFIDProfileCallOptions, N as FFIDProvisionMemberPlan, O as FFIDProvisionMemberPlanStatus, P as FFIDProvisionMemberResult, Q as FFIDProvisionMemberStatus, R as FFIDProvisionOrganizationDryRun, S as FFIDProvisionOrganizationMemberInput, T as FFIDProvisionOrganizationOutcome, U as FFIDProvisionOrganizationParams, V as FFIDProvisionOrganizationResponse, W as FFIDProvisionUserDryRun, X as FFIDProvisionUserOutcome, Y as FFIDProvisionUserParams, Z as FFIDProvisionUserProfileInput, _ as FFIDProvisionUserResponse, $ as FFIDProvisionedOrganization, a0 as FFIDProvisionedUser, a1 as FFIDPublishedPlan, a2 as FFIDRemoveMemberResponse, a3 as FFIDResetSessionResponse, a4 as FFIDSubscription, a5 as FFIDUpdateMemberRoleResponse, a6 as FFIDUpdateUserProfileRequest, a7 as FFIDUploadOrganizationLogoParams, a8 as FFIDUpsertOrganizationProfileParams, a9 as FFIDUpsertOrganizationProfileRequest, aa as FFIDUser, ab as FFIDUserProfile, ac as FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, ad as FFID_CATALOG_ENVIRONMENTS, ae as FFID_CATALOG_PUBLICATION_STATUSES, af as FFID_COMPANY_SIZE_CODES, ag as FFID_INDUSTRY_CODES, ah as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, ai as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, aj as FFID_ORGANIZATION_PROFILE_ERROR_CODES, ak as TokenData, al as TokenStore, am as createFFIDClient, an as createTokenStore } from '../ffid-client-qcfCWLfs.cjs';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-Ce2eXQtB.cjs';
 import { z } from 'zod';
 import '../types-Cjb9J0rL.cjs';
@@ -31,6 +31,77 @@ declare const FFID_ERROR_CODES: {
  */
 type FFIDErrorCode = (typeof FFID_ERROR_CODES)[keyof typeof FFID_ERROR_CODES];
 
+/**
+ * OAuth authorization errors returned to the service's `redirect_uri` (#6523)
+ *
+ * When FFID's `/oauth/authorize` refuses a user, it redirects back with
+ * `error=<OAuth error>&error_description=...&state=...` (RFC 6749 §4.1.2.1). For
+ * subscription / seat denials it also adds the FFID extension `denial_reason`
+ * (#6498), so a service can tell "no seat in this organization" from "no
+ * subscription" without parsing `error_description`.
+ *
+ * Both callback paths build the same {@link FFIDError} from those params:
+ * - `handleRedirectCallback` / token-mode `FFIDProvider` (browser, PKCE)
+ * - `createServerAuthClient().handleCallback` (confidential / BFF)
+ *
+ * `error.code` is the OAuth `error` value verbatim (e.g. `access_denied`), and
+ * `error.details` is {@link FFIDAuthorizationErrorDetails}. Read it with
+ * {@link getFFIDAuthorizationError}.
+ *
+ * This module has no browser dependency so the server entry can share it.
+ */
+
+/**
+ * Values of FFID's `denial_reason` (the authorize error redirect and the
+ * `/oauth/userinfo` 403; `/oauth/introspect` only answers `active: false`). Kept
+ * identical to the FFID server's `DENIAL_REASONS` by a test in the FFID repository.
+ *
+ * This is a different vocabulary from `FFIDServiceAccessDenialReason`
+ * (`checkServiceAccess()`), which is derived from the subscription status.
+ */
+declare const FFID_OAUTH_DENIAL_REASONS: readonly ["no_membership", "no_active_subscription", "no_seat_assignment", "subscription_expired", "member_limit_reached"];
+type FFIDOAuthDenialReason = (typeof FFID_OAUTH_DENIAL_REASONS)[number];
+/** Runtime guard for {@link FFIDOAuthDenialReason}. Unknown values are `false`. */
+declare function isFFIDOAuthDenialReason(value: unknown): value is FFIDOAuthDenialReason;
+/** `FFIDError.details` of an authorization error */
+interface FFIDAuthorizationErrorDetails {
+    /** Marks the error as an authorize redirect error (vs. token / network errors) */
+    source: 'authorization';
+    /**
+     * FFID's `denial_reason`. `null` when FFID did not send one (any OAuth error other
+     * than a subscription / seat denial) **or** sent a value this SDK version does not
+     * know — the error itself is still returned, only the reason is unknown.
+     */
+    denialReason: FFIDOAuthDenialReason | null;
+    /**
+     * `error_description` as sent — short ASCII English meant for logs. The same text
+     * is `error.message` (when FFID sent one), so show end users guidance chosen by
+     * `denialReason` rather than the message itself.
+     */
+    errorDescription: string | null;
+}
+/** An authorization error read back by {@link getFFIDAuthorizationError} */
+interface FFIDAuthorizationError {
+    /** The OAuth `error` value, e.g. `access_denied`, `login_required` */
+    oauthError: string;
+    denialReason: FFIDOAuthDenialReason | null;
+    errorDescription: string | null;
+}
+/**
+ * Read an authorization error (and FFID's `denial_reason`) from an {@link FFIDError},
+ * e.g. `useFFID().error` or the result of `handleRedirectCallback` /
+ * `createServerAuthClient().handleCallback`. Returns `null` for any other error.
+ *
+ * ```ts
+ * const denial = getFFIDAuthorizationError(error)
+ * if (denial?.denialReason === 'no_seat_assignment') {
+ *   // Ask an organization owner / admin to add the user. Do not call login() again:
+ *   // FFID would refuse the same way.
+ * }
+ * ```
+ */
+declare function getFFIDAuthorizationError(error: FFIDError | null | undefined): FFIDAuthorizationError | null;
+
 /** Token verification - verifyAccessToken() implementation */
 
 /** Dependencies required by verifyAccessToken */
@@ -566,4 +637,4 @@ declare function computeScopeHash(input: FFIDScopeHashInput): Promise<string>;
  */
 declare function validatePublishedCatalog(catalog: unknown): asserts catalog is FFIDPublishedCatalog;
 
-export { ALL_DENIED_EXCEPT_NECESSARY, type BuildAuthorizeUrlOptions, type BuildAuthorizeUrlResult, CATALOG_HASH_PATTERN, CONSENT_COOKIE_NAME, COOKIE_VERSION, type CookieOptions, FFIDCacheAdapter, type FFIDCanonicalJsonValue, FFIDCatalogEnvironment, FFIDCatalogHashError, type FFIDConsentCategories, type FFIDConsentCategoryCode, type FFIDCookieStoreLike, type FFIDErrorCode, FFIDOAuthUserInfo, type FFIDPaymentConfiguration, FFIDPublishedCatalog, type FFIDScopeHashInput, type FFIDScopeHashPlan, FFIDTaxBehavior, type FFIDTaxConfiguration, FFIDVerifyAccessTokenOptions, FFID_ERROR_CODES, FFID_SESSION_COOKIE_NAME, type HandleCallbackInput, type KVNamespaceLike, type ServerAuthClient, type ServerAuthConfig, type ServerSessionTokens, type ServerTokenResult, canonicalizeCatalogValue, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createKVCacheAdapter, createMemoryCacheAdapter, createServerAuthClient, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, generateServerState, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies, hashCanonicalJson, sessionCookies, sha256Hex, validatePublishedCatalog };
+export { ALL_DENIED_EXCEPT_NECESSARY, type BuildAuthorizeUrlOptions, type BuildAuthorizeUrlResult, CATALOG_HASH_PATTERN, CONSENT_COOKIE_NAME, COOKIE_VERSION, type CookieOptions, type FFIDAuthorizationError, type FFIDAuthorizationErrorDetails, FFIDCacheAdapter, type FFIDCanonicalJsonValue, FFIDCatalogEnvironment, FFIDCatalogHashError, type FFIDConsentCategories, type FFIDConsentCategoryCode, type FFIDCookieStoreLike, type FFIDErrorCode, type FFIDOAuthDenialReason, FFIDOAuthUserInfo, type FFIDPaymentConfiguration, FFIDPublishedCatalog, type FFIDScopeHashInput, type FFIDScopeHashPlan, FFIDTaxBehavior, type FFIDTaxConfiguration, FFIDVerifyAccessTokenOptions, FFID_ERROR_CODES, FFID_OAUTH_DENIAL_REASONS, FFID_SESSION_COOKIE_NAME, type HandleCallbackInput, type KVNamespaceLike, type ServerAuthClient, type ServerAuthConfig, type ServerSessionTokens, type ServerTokenResult, canonicalizeCatalogValue, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createKVCacheAdapter, createMemoryCacheAdapter, createServerAuthClient, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, generateServerState, getFFIDAuthorizationError, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies, hashCanonicalJson, isFFIDOAuthDenialReason, sessionCookies, sha256Hex, validatePublishedCatalog };

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo, f as FFIDCatalogEnvironment, g as FFIDBillingInterval, h as FFIDTaxBehavior, i as FFIDPublishedCatalog } from '../ffid-client-B0cORHac.js';
-export { j as FFIDAddMemberParams, k as FFIDAddMemberRequest, l as FFIDAddMemberResponse, m as FFIDAllowedLogoMimeType, n as FFIDAssignableMemberRole, o as FFIDCacheConfig, p as FFIDCatalogPublication, q as FFIDCatalogPublicationStatus, r as FFIDClient, s as FFIDCompanySizeCode, t as FFIDConfig, u as FFIDIndustryCode, v as FFIDListMembersResponse, w as FFIDListingConsentInput, x as FFIDLogoWallEntry, y as FFIDLogoWallResponse, z as FFIDMemberRole, A as FFIDOrganization, B as FFIDOrganizationLogoUploadResponse, C as FFIDOrganizationMember, D as FFIDOrganizationProfile, E as FFIDOrganizationProfileErrorCode, G as FFIDOrganizationProfileResponse, H as FFIDOtpSendResponse, I as FFIDOtpVerifyResponse, J as FFIDPasswordResetConfirmResponse, K as FFIDPasswordResetResponse, L as FFIDPasswordResetVerifyResponse, M as FFIDProfileCallOptions, N as FFIDProvisionMemberPlan, O as FFIDProvisionMemberPlanStatus, P as FFIDProvisionMemberResult, Q as FFIDProvisionMemberStatus, R as FFIDProvisionOrganizationDryRun, S as FFIDProvisionOrganizationMemberInput, T as FFIDProvisionOrganizationOutcome, U as FFIDProvisionOrganizationParams, V as FFIDProvisionOrganizationResponse, W as FFIDProvisionUserDryRun, X as FFIDProvisionUserOutcome, Y as FFIDProvisionUserParams, Z as FFIDProvisionUserProfileInput, _ as FFIDProvisionUserResponse, $ as FFIDProvisionedOrganization, a0 as FFIDProvisionedUser, a1 as FFIDPublishedPlan, a2 as FFIDRemoveMemberResponse, a3 as FFIDResetSessionResponse, a4 as FFIDSubscription, a5 as FFIDUpdateMemberRoleResponse, a6 as FFIDUpdateUserProfileRequest, a7 as FFIDUploadOrganizationLogoParams, a8 as FFIDUpsertOrganizationProfileParams, a9 as FFIDUpsertOrganizationProfileRequest, aa as FFIDUser, ab as FFIDUserProfile, ac as FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, ad as FFID_CATALOG_ENVIRONMENTS, ae as FFID_CATALOG_PUBLICATION_STATUSES, af as FFID_COMPANY_SIZE_CODES, ag as FFID_INDUSTRY_CODES, ah as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, ai as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, aj as FFID_ORGANIZATION_PROFILE_ERROR_CODES, ak as TokenData, al as TokenStore, am as createFFIDClient, an as createTokenStore } from '../ffid-client-B0cORHac.js';
+import { F as FFIDError, a as FFIDLogger, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo, f as FFIDCatalogEnvironment, g as FFIDBillingInterval, h as FFIDTaxBehavior, i as FFIDPublishedCatalog } from '../ffid-client-DUbQLYTN.js';
+export { j as FFIDAddMemberParams, k as FFIDAddMemberRequest, l as FFIDAddMemberResponse, m as FFIDAllowedLogoMimeType, n as FFIDAssignableMemberRole, o as FFIDCacheConfig, p as FFIDCatalogPublication, q as FFIDCatalogPublicationStatus, r as FFIDClient, s as FFIDCompanySizeCode, t as FFIDConfig, u as FFIDIndustryCode, v as FFIDListMembersResponse, w as FFIDListingConsentInput, x as FFIDLogoWallEntry, y as FFIDLogoWallResponse, z as FFIDMemberRole, A as FFIDOrganization, B as FFIDOrganizationLogoUploadResponse, C as FFIDOrganizationMember, D as FFIDOrganizationProfile, E as FFIDOrganizationProfileErrorCode, G as FFIDOrganizationProfileResponse, H as FFIDOtpSendResponse, I as FFIDOtpVerifyResponse, J as FFIDPasswordResetConfirmResponse, K as FFIDPasswordResetResponse, L as FFIDPasswordResetVerifyResponse, M as FFIDProfileCallOptions, N as FFIDProvisionMemberPlan, O as FFIDProvisionMemberPlanStatus, P as FFIDProvisionMemberResult, Q as FFIDProvisionMemberStatus, R as FFIDProvisionOrganizationDryRun, S as FFIDProvisionOrganizationMemberInput, T as FFIDProvisionOrganizationOutcome, U as FFIDProvisionOrganizationParams, V as FFIDProvisionOrganizationResponse, W as FFIDProvisionUserDryRun, X as FFIDProvisionUserOutcome, Y as FFIDProvisionUserParams, Z as FFIDProvisionUserProfileInput, _ as FFIDProvisionUserResponse, $ as FFIDProvisionedOrganization, a0 as FFIDProvisionedUser, a1 as FFIDPublishedPlan, a2 as FFIDRemoveMemberResponse, a3 as FFIDResetSessionResponse, a4 as FFIDSubscription, a5 as FFIDUpdateMemberRoleResponse, a6 as FFIDUpdateUserProfileRequest, a7 as FFIDUploadOrganizationLogoParams, a8 as FFIDUpsertOrganizationProfileParams, a9 as FFIDUpsertOrganizationProfileRequest, aa as FFIDUser, ab as FFIDUserProfile, ac as FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, ad as FFID_CATALOG_ENVIRONMENTS, ae as FFID_CATALOG_PUBLICATION_STATUSES, af as FFID_COMPANY_SIZE_CODES, ag as FFID_INDUSTRY_CODES, ah as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, ai as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, aj as FFID_ORGANIZATION_PROFILE_ERROR_CODES, ak as TokenData, al as TokenStore, am as createFFIDClient, an as createTokenStore } from '../ffid-client-DUbQLYTN.js';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-Ce2eXQtB.js';
 import { z } from 'zod';
 import '../types-Cjb9J0rL.js';
@@ -31,6 +31,77 @@ declare const FFID_ERROR_CODES: {
  */
 type FFIDErrorCode = (typeof FFID_ERROR_CODES)[keyof typeof FFID_ERROR_CODES];
 
+/**
+ * OAuth authorization errors returned to the service's `redirect_uri` (#6523)
+ *
+ * When FFID's `/oauth/authorize` refuses a user, it redirects back with
+ * `error=<OAuth error>&error_description=...&state=...` (RFC 6749 §4.1.2.1). For
+ * subscription / seat denials it also adds the FFID extension `denial_reason`
+ * (#6498), so a service can tell "no seat in this organization" from "no
+ * subscription" without parsing `error_description`.
+ *
+ * Both callback paths build the same {@link FFIDError} from those params:
+ * - `handleRedirectCallback` / token-mode `FFIDProvider` (browser, PKCE)
+ * - `createServerAuthClient().handleCallback` (confidential / BFF)
+ *
+ * `error.code` is the OAuth `error` value verbatim (e.g. `access_denied`), and
+ * `error.details` is {@link FFIDAuthorizationErrorDetails}. Read it with
+ * {@link getFFIDAuthorizationError}.
+ *
+ * This module has no browser dependency so the server entry can share it.
+ */
+
+/**
+ * Values of FFID's `denial_reason` (the authorize error redirect and the
+ * `/oauth/userinfo` 403; `/oauth/introspect` only answers `active: false`). Kept
+ * identical to the FFID server's `DENIAL_REASONS` by a test in the FFID repository.
+ *
+ * This is a different vocabulary from `FFIDServiceAccessDenialReason`
+ * (`checkServiceAccess()`), which is derived from the subscription status.
+ */
+declare const FFID_OAUTH_DENIAL_REASONS: readonly ["no_membership", "no_active_subscription", "no_seat_assignment", "subscription_expired", "member_limit_reached"];
+type FFIDOAuthDenialReason = (typeof FFID_OAUTH_DENIAL_REASONS)[number];
+/** Runtime guard for {@link FFIDOAuthDenialReason}. Unknown values are `false`. */
+declare function isFFIDOAuthDenialReason(value: unknown): value is FFIDOAuthDenialReason;
+/** `FFIDError.details` of an authorization error */
+interface FFIDAuthorizationErrorDetails {
+    /** Marks the error as an authorize redirect error (vs. token / network errors) */
+    source: 'authorization';
+    /**
+     * FFID's `denial_reason`. `null` when FFID did not send one (any OAuth error other
+     * than a subscription / seat denial) **or** sent a value this SDK version does not
+     * know — the error itself is still returned, only the reason is unknown.
+     */
+    denialReason: FFIDOAuthDenialReason | null;
+    /**
+     * `error_description` as sent — short ASCII English meant for logs. The same text
+     * is `error.message` (when FFID sent one), so show end users guidance chosen by
+     * `denialReason` rather than the message itself.
+     */
+    errorDescription: string | null;
+}
+/** An authorization error read back by {@link getFFIDAuthorizationError} */
+interface FFIDAuthorizationError {
+    /** The OAuth `error` value, e.g. `access_denied`, `login_required` */
+    oauthError: string;
+    denialReason: FFIDOAuthDenialReason | null;
+    errorDescription: string | null;
+}
+/**
+ * Read an authorization error (and FFID's `denial_reason`) from an {@link FFIDError},
+ * e.g. `useFFID().error` or the result of `handleRedirectCallback` /
+ * `createServerAuthClient().handleCallback`. Returns `null` for any other error.
+ *
+ * ```ts
+ * const denial = getFFIDAuthorizationError(error)
+ * if (denial?.denialReason === 'no_seat_assignment') {
+ *   // Ask an organization owner / admin to add the user. Do not call login() again:
+ *   // FFID would refuse the same way.
+ * }
+ * ```
+ */
+declare function getFFIDAuthorizationError(error: FFIDError | null | undefined): FFIDAuthorizationError | null;
+
 /** Token verification - verifyAccessToken() implementation */
 
 /** Dependencies required by verifyAccessToken */
@@ -566,4 +637,4 @@ declare function computeScopeHash(input: FFIDScopeHashInput): Promise<string>;
  */
 declare function validatePublishedCatalog(catalog: unknown): asserts catalog is FFIDPublishedCatalog;
 
-export { ALL_DENIED_EXCEPT_NECESSARY, type BuildAuthorizeUrlOptions, type BuildAuthorizeUrlResult, CATALOG_HASH_PATTERN, CONSENT_COOKIE_NAME, COOKIE_VERSION, type CookieOptions, FFIDCacheAdapter, type FFIDCanonicalJsonValue, FFIDCatalogEnvironment, FFIDCatalogHashError, type FFIDConsentCategories, type FFIDConsentCategoryCode, type FFIDCookieStoreLike, type FFIDErrorCode, FFIDOAuthUserInfo, type FFIDPaymentConfiguration, FFIDPublishedCatalog, type FFIDScopeHashInput, type FFIDScopeHashPlan, FFIDTaxBehavior, type FFIDTaxConfiguration, FFIDVerifyAccessTokenOptions, FFID_ERROR_CODES, FFID_SESSION_COOKIE_NAME, type HandleCallbackInput, type KVNamespaceLike, type ServerAuthClient, type ServerAuthConfig, type ServerSessionTokens, type ServerTokenResult, canonicalizeCatalogValue, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createKVCacheAdapter, createMemoryCacheAdapter, createServerAuthClient, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, generateServerState, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies, hashCanonicalJson, sessionCookies, sha256Hex, validatePublishedCatalog };
+export { ALL_DENIED_EXCEPT_NECESSARY, type BuildAuthorizeUrlOptions, type BuildAuthorizeUrlResult, CATALOG_HASH_PATTERN, CONSENT_COOKIE_NAME, COOKIE_VERSION, type CookieOptions, type FFIDAuthorizationError, type FFIDAuthorizationErrorDetails, FFIDCacheAdapter, type FFIDCanonicalJsonValue, FFIDCatalogEnvironment, FFIDCatalogHashError, type FFIDConsentCategories, type FFIDConsentCategoryCode, type FFIDCookieStoreLike, type FFIDErrorCode, type FFIDOAuthDenialReason, FFIDOAuthUserInfo, type FFIDPaymentConfiguration, FFIDPublishedCatalog, type FFIDScopeHashInput, type FFIDScopeHashPlan, FFIDTaxBehavior, type FFIDTaxConfiguration, FFIDVerifyAccessTokenOptions, FFID_ERROR_CODES, FFID_OAUTH_DENIAL_REASONS, FFID_SESSION_COOKIE_NAME, type HandleCallbackInput, type KVNamespaceLike, type ServerAuthClient, type ServerAuthConfig, type ServerSessionTokens, type ServerTokenResult, canonicalizeCatalogValue, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createKVCacheAdapter, createMemoryCacheAdapter, createServerAuthClient, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, generateServerState, getFFIDAuthorizationError, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies, hashCanonicalJson, isFFIDOAuthDenialReason, sessionCookies, sha256Hex, validatePublishedCatalog };