@feelflow/ffid-sdk 12.0.0 → 12.2.0

package/README.md

@@ -22,6 +22,35 @@ pnpm add @feelflow/ffid-sdk
 
 ## 統合ガイド
 
+### ニュースレター登録・目的別停止（12.2.0）
+
+登録はサーバー上の `service-key` クライアントで行います。Service API Key を
+ブラウザへ渡さず、公開フォームのCAPTCHAと配信同意をBFFで検証してください。
+
+```ts
+// 一つの登録操作に一つのUUID。応答が失われた再操作では同じキーを保持する。
+const idempotencyKey = crypto.randomUUID()
+const result = await client.newsletter.subscribe({
+  email: 'reader@example.com',
+  types: ['general'],
+  source: 'website-newsletter',
+  locale: 'ja',
+}, { idempotencyKey })
+
+// tokenはメール内の不透明な値。ログへ出さない。
+await client.newsletter.unsubscribe({ token, type: 'general' })
+```
+
+`requiresConfirmation` は確認メール送信済み、`confirmationEmailPending` は未送信、
+`requiresSignIn` は既存会員の設定案内です。後二つを「登録完了」にしないでください。
+未送信フラグは自動再送の予約を意味しません。登録内容を変えるときと、確定した結果の
+後で新しい登録を依頼するときは新しいキーを使います。SDKが自動再送することはありません。
+独立ニュースレター側の処理中・結果不明なreceiptの回復は、運用上の確認が必要です。
+配信停止の `type` を省略すると既存の全目的停止を維持します。
+キー付き登録には、独立ownerへ転送する更新済みFFID互換APIが必要です。旧処理モードでは
+書込み・メール送信前に拒否し、SDKは返却された `requestId` の一致を確認します。
+互換APIの配備と独立化の切替を確認してから、BFFでキー付き登録を有効にしてください。
+
 サービスを FFID Platform に統合する詳細なガイドは **[Integration Guide](./docs/INTEGRATION_GUIDE.md)** を参照してください。OAuth フロー、フロントエンド/バックエンド実装パターン、セキュリティチェックリスト、アンチパターン集を網羅しています。
 
 ### Cookie 同意管理基盤 (v5.0.0+)
@@ -888,6 +917,9 @@ import { createFFIDAnnouncementsClient } from '@feelflow/ffid-sdk/announcements'
 
 // Webhook 署名検証・ハンドラー（※ Node.js crypto が必要）
 import { createFFIDWebhookHandler, verifyWebhookSignature } from '@feelflow/ffid-sdk/webhooks'
+
+// 製品側 DB 用の短命トークン（ES256）
+import { createDbTokenMinter } from '@feelflow/ffid-sdk/server'
 ```
 
 > **Note**: `webhooks` モジュールは Node.js の `crypto` モジュールと `Buffer` を使用します。Cloudflare Workers で利用する場合は [`nodejs_compat` 互換フラグ](https://developers.cloudflare.com/workers/runtime-apis/nodejs/)を有効にしてください。
@@ -940,6 +972,36 @@ module.exports = {
 
 > **Note**: サーバーサイドで bundler を使わずに実行する場合、**subpath exports（`@feelflow/ffid-sdk/legal` 等）を使用すれば** external 設定なしで React がインストールされていなくても動作します。メインエントリ（`@feelflow/ffid-sdk`）を ESM で import する場合は、モジュールグラフが静的に解決されるため React が必要です。
 
+### 製品側 DB 用トークン（createDbTokenMinter）
+
+FFID でログインする製品が、自分の Supabase に supabase-js でアクセスするときの短命トークン（ES256）を作ります（12.1.0 以降）。サーバー専用で、React には依存しません。製品のサーバーが FFID のセッションを確認した後に呼び、RLS は `private.current_ffid_user_id()` から利用者を読みます。
+
+```typescript
+import { createDbTokenMinter } from '@feelflow/ffid-sdk/server'
+
+// プロセスで 1 回
+const minter = createDbTokenMinter({
+  signingKey: process.env.SUPABASE_JWT_SIGNING_KEY?.trim() ?? '', // 私有 JWK（JSON 文字列）
+})
+
+// リクエストごと
+const { token, expiresAt } = await minter.mint({
+  userId: session.user.id,                  // sub（UUID）
+  organizationId: session.organization?.id, // 任意。organization_id claim
+})
+// createClient(url, key, { global: { headers: { Authorization: `Bearer ${token}` } } })
+```
+
+- 設定: `signingKey`（必須。私有 P-256 JWK で `kid` が必要）/ `kid`（任意の上書き）/ `ttlSeconds`（既定 300、上限 900）/ `issuer`（任意）
+- 入力: `userId`、`organizationId`、`claims`（製品固有。`sub` / `role` / `aud` / `iss` / `iat` / `exp` / `nbf` / `jti` / `organization_id` は予約済み）
+- エラー: `FFIDDbTokenError`。`code` は `INVALID_SIGNING_KEY` / `INVALID_TTL` / `INVALID_USER_ID` / `INVALID_ORGANIZATION_ID` / `RESERVED_CLAIM` / `INVALID_CLOCK`。取り込み失敗は message に原因、`cause` に元のエラー（鍵材料は含まれません）
+- `supabase gen signing-key --algorithm ES256` の出力（`use` / `key_ops` / `ext` 付き）をそのまま渡せます。SDK が EC パラメータだけを取り込みます
+- 環境変数は読みません。鍵は設定として渡します。追加の依存はありません
+
+> **Warning**: 私有鍵とトークンは **ブラウザに渡さず、ログにも出さないでください**。鍵が無いときは 503 で止め、service role に黙って切り替えないでください。
+
+鍵の登録手順、RLS の SQL、確認項目は [DB_USER_IDENTITY_STANDARD.md](../../docs/06-reference/DB_USER_IDENTITY_STANDARD.md) を参照してください。
+
 ### `peerDependencies` は optional です
 
 SDK の `package.json` で `react` / `react-dom` は `optional: true` に設定済みです（利用者側での設定は不要）。React をインストールしなくても `npm install` 時に warning は発生しません。

package/dist/agency/index.d.cts

@@ -28,6 +28,13 @@ interface FFIDAgencyLogger {
     error: (...args: unknown[]) => void;
 }
 type FFIDAgencyStatus = 'active' | 'suspended' | 'inactive';
+/**
+ * 代理店の課金方式。
+ *
+ * `'markup'` は非推奨（FFID #6507）。既存データの値として残している。`updateBilling()` は
+ * 互換のため今も `'markup'` を受け付けるが、新しく設定しないこと。受け取った値を網羅的に
+ * 扱う箇所では引き続き `'markup'` を扱うこと。
+ */
 type FFIDAgencyBillingType = 'direct' | 'consolidated' | 'markup';
 type FFIDAgencyMemberRole = 'owner' | 'admin' | 'sales' | 'support';
 type FFIDAgencyMemberStatus = 'active' | 'invited' | 'suspended';
@@ -99,7 +106,9 @@ interface FFIDAgencyOrganization {
     organizationSlug: string;
     billingOverride: FFIDAgencyBillingOverride;
     commissionRate: number | null;
+    /** @deprecated markup 課金方式は非推奨（FFID #6507）。帳票用の既存値を読むだけで、更新する API は無い。 */
     markupRate: number | null;
+    /** @deprecated markup 課金方式は非推奨（FFID #6507）。帳票用の既存値を読むだけで、更新する API は無い。 */
     markupFixed: number | null;
     /** 組織単位の卸割引率 override（%、0〜100）。null = 代理店デフォルトに従う。 */
     wholesaleDiscountRate: number | null;
@@ -192,7 +201,9 @@ interface FFIDAgencyBillingConfig {
     stripeCustomerId: string | null;
     invoiceEmail: string | null;
     paymentTerms: number | null;
+    /** @deprecated markup 課金方式は非推奨（FFID #6507）。帳票用の既存値を読むだけで、更新する API は無い。 */
     defaultMarkupRate: number | null;
+    /** @deprecated markup 課金方式は非推奨（FFID #6507）。帳票用の既存値を読むだけで、更新する API は無い。 */
     defaultMarkupFixed: number | null;
     /** 代理店デフォルト卸割引率（%、0〜100）。null = 未設定（定価請求）。 */
     wholesaleDiscountRate: number | null;
@@ -201,7 +212,15 @@ interface FFIDUpdateAgencyBillingRequest {
     billingType?: FFIDAgencyBillingType;
     invoiceEmail?: string;
     paymentTerms?: number;
+    /**
+     * @deprecated FFID はこの項目を受け付けず、送っても黙って捨てる（FFID #6507）。
+     * markup 課金方式は非推奨で、値を更新する手段は無い。
+     */
     defaultMarkupRate?: number;
+    /**
+     * @deprecated FFID はこの項目を受け付けず、送っても黙って捨てる（FFID #6507）。
+     * markup 課金方式は非推奨で、値を更新する手段は無い。
+     */
     defaultMarkupFixed?: number;
     /** 代理店デフォルト卸割引率（%、0〜100）。null で未設定に戻す。 */
     wholesaleDiscountRate?: number | null;

package/dist/agency/index.d.ts

@@ -28,6 +28,13 @@ interface FFIDAgencyLogger {
     error: (...args: unknown[]) => void;
 }
 type FFIDAgencyStatus = 'active' | 'suspended' | 'inactive';
+/**
+ * 代理店の課金方式。
+ *
+ * `'markup'` は非推奨（FFID #6507）。既存データの値として残している。`updateBilling()` は
+ * 互換のため今も `'markup'` を受け付けるが、新しく設定しないこと。受け取った値を網羅的に
+ * 扱う箇所では引き続き `'markup'` を扱うこと。
+ */
 type FFIDAgencyBillingType = 'direct' | 'consolidated' | 'markup';
 type FFIDAgencyMemberRole = 'owner' | 'admin' | 'sales' | 'support';
 type FFIDAgencyMemberStatus = 'active' | 'invited' | 'suspended';
@@ -99,7 +106,9 @@ interface FFIDAgencyOrganization {
     organizationSlug: string;
     billingOverride: FFIDAgencyBillingOverride;
     commissionRate: number | null;
+    /** @deprecated markup 課金方式は非推奨（FFID #6507）。帳票用の既存値を読むだけで、更新する API は無い。 */
     markupRate: number | null;
+    /** @deprecated markup 課金方式は非推奨（FFID #6507）。帳票用の既存値を読むだけで、更新する API は無い。 */
     markupFixed: number | null;
     /** 組織単位の卸割引率 override（%、0〜100）。null = 代理店デフォルトに従う。 */
     wholesaleDiscountRate: number | null;
@@ -192,7 +201,9 @@ interface FFIDAgencyBillingConfig {
     stripeCustomerId: string | null;
     invoiceEmail: string | null;
     paymentTerms: number | null;
+    /** @deprecated markup 課金方式は非推奨（FFID #6507）。帳票用の既存値を読むだけで、更新する API は無い。 */
     defaultMarkupRate: number | null;
+    /** @deprecated markup 課金方式は非推奨（FFID #6507）。帳票用の既存値を読むだけで、更新する API は無い。 */
     defaultMarkupFixed: number | null;
     /** 代理店デフォルト卸割引率（%、0〜100）。null = 未設定（定価請求）。 */
     wholesaleDiscountRate: number | null;
@@ -201,7 +212,15 @@ interface FFIDUpdateAgencyBillingRequest {
     billingType?: FFIDAgencyBillingType;
     invoiceEmail?: string;
     paymentTerms?: number;
+    /**
+     * @deprecated FFID はこの項目を受け付けず、送っても黙って捨てる（FFID #6507）。
+     * markup 課金方式は非推奨で、値を更新する手段は無い。
+     */
     defaultMarkupRate?: number;
+    /**
+     * @deprecated FFID はこの項目を受け付けず、送っても黙って捨てる（FFID #6507）。
+     * markup 課金方式は非推奨で、値を更新する手段は無い。
+     */
     defaultMarkupFixed?: number;
     /** 代理店デフォルト卸割引率（%、0〜100）。null で未設定に戻す。 */
     wholesaleDiscountRate?: number | null;

package/dist/{chunk-OL7KVPQ4.js → chunk-75ISD4I4.js}

@@ -1,5 +1,6 @@
 import { createContext, useState, useRef, useEffect, useMemo, useCallback, useContext } from 'react';
 import { createRemoteJWKSet, jwtVerify, errors } from 'jose';
+import { z } from 'zod';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
 
 // src/constants.ts
@@ -577,7 +578,8 @@ function createBillingMethods(deps) {
           subscriptionId: params.subscriptionId,
           successUrl: params.successUrl,
           cancelUrl: params.cancelUrl,
-          ...params.planId ? { planId: params.planId } : {}
+          ...params.planId ? { planId: params.planId } : {},
+          ...params.quantity !== void 0 ? { quantity: params.quantity } : {}
         })
       }
     );
@@ -1390,7 +1392,7 @@ var FFID_ORGANIZATION_PROFILE_ERROR_CODES = {
 };
 
 // src/client/version-check.ts
-var SDK_VERSION = "12.0.0";
+var SDK_VERSION = "12.2.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -3477,24 +3479,45 @@ function createContractWizardMethods(deps) {
   };
 }
 
+// src/newsletter/types.ts
+var FFID_NEWSLETTER_TYPES = ["inquiry_followup", "general"];
+var FFID_NEWSLETTER_DISPATCH_MAX_RECIPIENTS = 1e3;
+
 // src/newsletter/ffid-newsletter-client.ts
 var EXT_SUBSCRIBE_ENDPOINT2 = "/api/v1/ext/newsletter/subscribe";
 var CONFIRM_ENDPOINT = "/api/newsletter/confirm";
 var UNSUBSCRIBE_ENDPOINT = "/api/newsletter/unsubscribe";
 var DISPATCH_ENDPOINT = "/api/v1/newsletter/dispatch";
+var PUBLIC_TOKEN_TIMEOUT_MS = 3e4;
+var subscribeResponseSchema = z.object({
+  ok: z.literal(true),
+  requiresConfirmation: z.boolean(),
+  requiresSignIn: z.boolean(),
+  confirmationEmailPending: z.boolean(),
+  requestId: z.uuid().optional()
+}).refine(
+  (value) => [
+    value.requiresConfirmation,
+    value.requiresSignIn,
+    value.confirmationEmailPending
+  ].filter(Boolean).length <= 1
+);
 function trimOrEmpty(s) {
   return typeof s === "string" ? s.trim() : "";
 }
 async function postPublic(url, init, opts) {
   let response;
   try {
-    response = await fetch(url, init);
-  } catch (err) {
+    response = await fetch(url, {
+      ...init,
+      credentials: "omit",
+      redirect: "error",
+      cache: "no-store",
+      signal: AbortSignal.timeout(PUBLIC_TOKEN_TIMEOUT_MS)
+    });
+  } catch {
     return {
-      error: opts.createError(
-        "NETWORK_ERROR",
-        err instanceof Error ? err.message : "\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F"
-      )
+      error: opts.createError("NETWORK_ERROR", opts.fallbackMessage)
     };
   }
   if (!response.ok) {
@@ -3521,7 +3544,7 @@ async function postPublic(url, init, opts) {
 }
 function createNewsletterMethods(deps) {
   const { fetchWithAuth, baseUrl, createError } = deps;
-  async function subscribe(params) {
+  async function subscribe(params, options = {}) {
     const email = trimOrEmpty(params.email);
     const source = trimOrEmpty(params.source);
     if (!email) {
@@ -3538,10 +3561,19 @@ function createNewsletterMethods(deps) {
         )
       };
     }
-    return fetchWithAuth(
+    if (options.idempotencyKey !== void 0 && !z.uuid().safeParse(options.idempotencyKey).success) {
+      return {
+        error: createError(
+          "INVALID_IDEMPOTENCY_KEY",
+          "idempotencyKey \u306B\u306F UUID \u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044"
+        )
+      };
+    }
+    const response = await fetchWithAuth(
       EXT_SUBSCRIBE_ENDPOINT2,
       {
         method: "POST",
+        ...options.idempotencyKey ? { headers: { "Idempotency-Key": options.idempotencyKey } } : {},
         body: JSON.stringify({
           email,
           types: params.types,
@@ -3550,6 +3582,23 @@ function createNewsletterMethods(deps) {
         })
       }
     );
+    if (response.error) return response;
+    const parsed = subscribeResponseSchema.safeParse(response.data);
+    if (!parsed.success)
+      return {
+        error: createError(
+          "PARSE_ERROR",
+          "\u30CB\u30E5\u30FC\u30B9\u30EC\u30BF\u30FC\u767B\u9332\u306E\u5FDC\u7B54\u3092\u78BA\u8A8D\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F"
+        )
+      };
+    if (options.idempotencyKey && parsed.data.requestId !== options.idempotencyKey)
+      return {
+        error: createError(
+          "PARSE_ERROR",
+          "\u30CB\u30E5\u30FC\u30B9\u30EC\u30BF\u30FC\u767B\u9332\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u8B58\u5225\u5B50\u3092\u78BA\u8A8D\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F"
+        )
+      };
+    return { data: parsed.data };
   }
   async function confirm(params) {
     const token = trimOrEmpty(params.token);
@@ -3577,6 +3626,16 @@ function createNewsletterMethods(deps) {
     }
     const url = new URL(`${baseUrl}${UNSUBSCRIBE_ENDPOINT}`);
     url.searchParams.set("token", token);
+    if (params.type !== void 0) {
+      if (!FFID_NEWSLETTER_TYPES.includes(params.type))
+        return {
+          error: createError(
+            "VALIDATION_ERROR",
+            "\u30CB\u30E5\u30FC\u30B9\u30EC\u30BF\u30FC\u306E\u914D\u4FE1\u7A2E\u5225\u304C\u4E0D\u6B63\u3067\u3059"
+          )
+        };
+      url.searchParams.set("type", params.type);
+    }
     return postPublic(
       url.toString(),
       { method: "POST" },
@@ -4077,7 +4136,9 @@ var FFID_SUBSCRIPTION_ERROR_CODES = {
   SUBSCRIPTION_NOT_CANCELABLE: "SUBSCRIPTION_NOT_CANCELABLE",
   SUBSCRIPTION_ALREADY_CANCELED: "SUBSCRIPTION_ALREADY_CANCELED",
   FREE_DOWNGRADE_NOT_ALLOWED: "FREE_DOWNGRADE_NOT_ALLOWED",
-  PAYMENT_METHOD_REQUIRED: "PAYMENT_METHOD_REQUIRED"
+  PAYMENT_METHOD_REQUIRED: "PAYMENT_METHOD_REQUIRED",
+  SEAT_ABOVE_MAX: "SEAT_ABOVE_MAX",
+  SEAT_BELOW_MIN: "SEAT_BELOW_MIN"
 };
 var FFID_CREDITS_ERROR_CODES = {
   CREDITS_INSUFFICIENT: "CREDITS_INSUFFICIENT",
@@ -6865,4 +6926,4 @@ function FFIDInquiryForm({
   );
 }
 
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, AGENCY_INVITE_COOKIE_MAX_AGE_SEC, AGENCY_INVITE_COOKIE_NAME, AGENCY_INVITE_TOKEN_PARAM, AGENCY_INVITE_TOKEN_REDACTION, BLOCKING_EFFECTIVE_STATUSES, CATALOG_HASH_PATTERN, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDCatalogHashError, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_CATALOG_ENVIRONMENTS, FFID_CATALOG_PUBLICATION_STATUSES, FFID_COMPANY_SIZE_CODES, FFID_CREDITS_CONSUME_MAX_AMOUNT, FFID_CREDITS_CONSUME_MIN_AMOUNT, FFID_CREDITS_ERROR_CODES, FFID_CREDITS_FEATURE_PATTERN, FFID_CREDITS_HISTORY_DEFAULT_LIMIT, FFID_CREDITS_HISTORY_MAX_LIMIT, FFID_CREDITS_HISTORY_MIN_LIMIT, FFID_CREDITS_IDEMPOTENCY_KEY_PATTERN, FFID_CREDITS_LOW_THRESHOLD_PERCENT, FFID_CREDITS_METADATA_MAX_BYTES, FFID_CREDIT_GRANT_KINDS, FFID_CREDIT_HISTORY_TYPES, FFID_CREDIT_PACK_MAX_QUANTITY, FFID_CREDIT_PACK_MIN_QUANTITY, FFID_ERROR_CODES, FFID_INDUSTRY_CODES, FFID_INQUIRY_ACQUISITION_SOURCES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, FFID_OAUTH_DENIAL_REASONS, FFID_ORGANIZATION_PROFILE_ERROR_CODES, FFID_SUBSCRIPTION_ERROR_CODES, canonicalizeCatalogValue, captureAgencyInviteToken, cleanupStateStorage, clearAgencyInviteToken, computeEffectiveStatusFromSession, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, getFFIDAuthorizationError, handleRedirectCallback, hasAccessFromUserinfo, hashCanonicalJson, isBlockedFromUserinfo, isFFIDInquiryAcquisitionSource, isFFIDInquiryCategorySite2026, isFFIDOAuthDenialReason, normalizeRedirectUri, readAgencyInviteCookie, readAgencyInviteToken, redactAgencyInviteToken, retrieveCodeVerifier, retrieveState, sha256Hex, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useFFIDContext, useSubscription, validatePublishedCatalog, withSubscription };
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, AGENCY_INVITE_COOKIE_MAX_AGE_SEC, AGENCY_INVITE_COOKIE_NAME, AGENCY_INVITE_TOKEN_PARAM, AGENCY_INVITE_TOKEN_REDACTION, BLOCKING_EFFECTIVE_STATUSES, CATALOG_HASH_PATTERN, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDCatalogHashError, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_CATALOG_ENVIRONMENTS, FFID_CATALOG_PUBLICATION_STATUSES, FFID_COMPANY_SIZE_CODES, FFID_CREDITS_CONSUME_MAX_AMOUNT, FFID_CREDITS_CONSUME_MIN_AMOUNT, FFID_CREDITS_ERROR_CODES, FFID_CREDITS_FEATURE_PATTERN, FFID_CREDITS_HISTORY_DEFAULT_LIMIT, FFID_CREDITS_HISTORY_MAX_LIMIT, FFID_CREDITS_HISTORY_MIN_LIMIT, FFID_CREDITS_IDEMPOTENCY_KEY_PATTERN, FFID_CREDITS_LOW_THRESHOLD_PERCENT, FFID_CREDITS_METADATA_MAX_BYTES, FFID_CREDIT_GRANT_KINDS, FFID_CREDIT_HISTORY_TYPES, FFID_CREDIT_PACK_MAX_QUANTITY, FFID_CREDIT_PACK_MIN_QUANTITY, FFID_ERROR_CODES, FFID_INDUSTRY_CODES, FFID_INQUIRY_ACQUISITION_SOURCES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, FFID_NEWSLETTER_DISPATCH_MAX_RECIPIENTS, FFID_NEWSLETTER_TYPES, FFID_OAUTH_DENIAL_REASONS, FFID_ORGANIZATION_PROFILE_ERROR_CODES, FFID_SUBSCRIPTION_ERROR_CODES, canonicalizeCatalogValue, captureAgencyInviteToken, cleanupStateStorage, clearAgencyInviteToken, computeEffectiveStatusFromSession, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, getFFIDAuthorizationError, handleRedirectCallback, hasAccessFromUserinfo, hashCanonicalJson, isBlockedFromUserinfo, isFFIDInquiryAcquisitionSource, isFFIDInquiryCategorySite2026, isFFIDOAuthDenialReason, normalizeRedirectUri, readAgencyInviteCookie, readAgencyInviteToken, redactAgencyInviteToken, retrieveCodeVerifier, retrieveState, sha256Hex, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useFFIDContext, useSubscription, validatePublishedCatalog, withSubscription };

package/dist/{chunk-XRWDTYA7.cjs → chunk-LT7FQ7BT.cjs}

@@ -2,6 +2,7 @@
 
 var react = require('react');
 var jose = require('jose');
+var zod = require('zod');
 var jsxRuntime = require('react/jsx-runtime');
 
 // src/constants.ts
@@ -579,7 +580,8 @@ function createBillingMethods(deps) {
           subscriptionId: params.subscriptionId,
           successUrl: params.successUrl,
           cancelUrl: params.cancelUrl,
-          ...params.planId ? { planId: params.planId } : {}
+          ...params.planId ? { planId: params.planId } : {},
+          ...params.quantity !== void 0 ? { quantity: params.quantity } : {}
         })
       }
     );
@@ -1392,7 +1394,7 @@ var FFID_ORGANIZATION_PROFILE_ERROR_CODES = {
 };
 
 // src/client/version-check.ts
-var SDK_VERSION = "12.0.0";
+var SDK_VERSION = "12.2.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -3479,24 +3481,45 @@ function createContractWizardMethods(deps) {
   };
 }
 
+// src/newsletter/types.ts
+var FFID_NEWSLETTER_TYPES = ["inquiry_followup", "general"];
+var FFID_NEWSLETTER_DISPATCH_MAX_RECIPIENTS = 1e3;
+
 // src/newsletter/ffid-newsletter-client.ts
 var EXT_SUBSCRIBE_ENDPOINT2 = "/api/v1/ext/newsletter/subscribe";
 var CONFIRM_ENDPOINT = "/api/newsletter/confirm";
 var UNSUBSCRIBE_ENDPOINT = "/api/newsletter/unsubscribe";
 var DISPATCH_ENDPOINT = "/api/v1/newsletter/dispatch";
+var PUBLIC_TOKEN_TIMEOUT_MS = 3e4;
+var subscribeResponseSchema = zod.z.object({
+  ok: zod.z.literal(true),
+  requiresConfirmation: zod.z.boolean(),
+  requiresSignIn: zod.z.boolean(),
+  confirmationEmailPending: zod.z.boolean(),
+  requestId: zod.z.uuid().optional()
+}).refine(
+  (value) => [
+    value.requiresConfirmation,
+    value.requiresSignIn,
+    value.confirmationEmailPending
+  ].filter(Boolean).length <= 1
+);
 function trimOrEmpty(s) {
   return typeof s === "string" ? s.trim() : "";
 }
 async function postPublic(url, init, opts) {
   let response;
   try {
-    response = await fetch(url, init);
-  } catch (err) {
+    response = await fetch(url, {
+      ...init,
+      credentials: "omit",
+      redirect: "error",
+      cache: "no-store",
+      signal: AbortSignal.timeout(PUBLIC_TOKEN_TIMEOUT_MS)
+    });
+  } catch {
     return {
-      error: opts.createError(
-        "NETWORK_ERROR",
-        err instanceof Error ? err.message : "\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30A8\u30E9\u30FC\u304C\u767A\u751F\u3057\u307E\u3057\u305F"
-      )
+      error: opts.createError("NETWORK_ERROR", opts.fallbackMessage)
     };
   }
   if (!response.ok) {
@@ -3523,7 +3546,7 @@ async function postPublic(url, init, opts) {
 }
 function createNewsletterMethods(deps) {
   const { fetchWithAuth, baseUrl, createError } = deps;
-  async function subscribe(params) {
+  async function subscribe(params, options = {}) {
     const email = trimOrEmpty(params.email);
     const source = trimOrEmpty(params.source);
     if (!email) {
@@ -3540,10 +3563,19 @@ function createNewsletterMethods(deps) {
         )
       };
     }
-    return fetchWithAuth(
+    if (options.idempotencyKey !== void 0 && !zod.z.uuid().safeParse(options.idempotencyKey).success) {
+      return {
+        error: createError(
+          "INVALID_IDEMPOTENCY_KEY",
+          "idempotencyKey \u306B\u306F UUID \u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044"
+        )
+      };
+    }
+    const response = await fetchWithAuth(
       EXT_SUBSCRIBE_ENDPOINT2,
       {
         method: "POST",
+        ...options.idempotencyKey ? { headers: { "Idempotency-Key": options.idempotencyKey } } : {},
         body: JSON.stringify({
           email,
           types: params.types,
@@ -3552,6 +3584,23 @@ function createNewsletterMethods(deps) {
         })
       }
     );
+    if (response.error) return response;
+    const parsed = subscribeResponseSchema.safeParse(response.data);
+    if (!parsed.success)
+      return {
+        error: createError(
+          "PARSE_ERROR",
+          "\u30CB\u30E5\u30FC\u30B9\u30EC\u30BF\u30FC\u767B\u9332\u306E\u5FDC\u7B54\u3092\u78BA\u8A8D\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F"
+        )
+      };
+    if (options.idempotencyKey && parsed.data.requestId !== options.idempotencyKey)
+      return {
+        error: createError(
+          "PARSE_ERROR",
+          "\u30CB\u30E5\u30FC\u30B9\u30EC\u30BF\u30FC\u767B\u9332\u306E\u30EA\u30AF\u30A8\u30B9\u30C8\u8B58\u5225\u5B50\u3092\u78BA\u8A8D\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F"
+        )
+      };
+    return { data: parsed.data };
   }
   async function confirm(params) {
     const token = trimOrEmpty(params.token);
@@ -3579,6 +3628,16 @@ function createNewsletterMethods(deps) {
     }
     const url = new URL(`${baseUrl}${UNSUBSCRIBE_ENDPOINT}`);
     url.searchParams.set("token", token);
+    if (params.type !== void 0) {
+      if (!FFID_NEWSLETTER_TYPES.includes(params.type))
+        return {
+          error: createError(
+            "VALIDATION_ERROR",
+            "\u30CB\u30E5\u30FC\u30B9\u30EC\u30BF\u30FC\u306E\u914D\u4FE1\u7A2E\u5225\u304C\u4E0D\u6B63\u3067\u3059"
+          )
+        };
+      url.searchParams.set("type", params.type);
+    }
     return postPublic(
       url.toString(),
       { method: "POST" },
@@ -4079,7 +4138,9 @@ var FFID_SUBSCRIPTION_ERROR_CODES = {
   SUBSCRIPTION_NOT_CANCELABLE: "SUBSCRIPTION_NOT_CANCELABLE",
   SUBSCRIPTION_ALREADY_CANCELED: "SUBSCRIPTION_ALREADY_CANCELED",
   FREE_DOWNGRADE_NOT_ALLOWED: "FREE_DOWNGRADE_NOT_ALLOWED",
-  PAYMENT_METHOD_REQUIRED: "PAYMENT_METHOD_REQUIRED"
+  PAYMENT_METHOD_REQUIRED: "PAYMENT_METHOD_REQUIRED",
+  SEAT_ABOVE_MAX: "SEAT_ABOVE_MAX",
+  SEAT_BELOW_MIN: "SEAT_BELOW_MIN"
 };
 var FFID_CREDITS_ERROR_CODES = {
   CREDITS_INSUFFICIENT: "CREDITS_INSUFFICIENT",
@@ -6913,6 +6974,8 @@ exports.FFID_INQUIRY_CATEGORIES = FFID_INQUIRY_CATEGORIES;
 exports.FFID_INQUIRY_CATEGORIES_SITE_2026 = FFID_INQUIRY_CATEGORIES_SITE_2026;
 exports.FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES = FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES;
 exports.FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB = FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB;
+exports.FFID_NEWSLETTER_DISPATCH_MAX_RECIPIENTS = FFID_NEWSLETTER_DISPATCH_MAX_RECIPIENTS;
+exports.FFID_NEWSLETTER_TYPES = FFID_NEWSLETTER_TYPES;
 exports.FFID_OAUTH_DENIAL_REASONS = FFID_OAUTH_DENIAL_REASONS;
 exports.FFID_ORGANIZATION_PROFILE_ERROR_CODES = FFID_ORGANIZATION_PROFILE_ERROR_CODES;
 exports.FFID_SUBSCRIPTION_ERROR_CODES = FFID_SUBSCRIPTION_ERROR_CODES;

package/dist/components/index.cjs

@@ -1,34 +1,34 @@
 'use strict';
 
-var chunkXRWDTYA7_cjs = require('../chunk-XRWDTYA7.cjs');
+var chunkLT7FQ7BT_cjs = require('../chunk-LT7FQ7BT.cjs');
 
 
 
 Object.defineProperty(exports, "FFIDAnnouncementBadge", {
   enumerable: true,
-  get: function () { return chunkXRWDTYA7_cjs.FFIDAnnouncementBadge; }
+  get: function () { return chunkLT7FQ7BT_cjs.FFIDAnnouncementBadge; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementList", {
   enumerable: true,
-  get: function () { return chunkXRWDTYA7_cjs.FFIDAnnouncementList; }
+  get: function () { return chunkLT7FQ7BT_cjs.FFIDAnnouncementList; }
 });
 Object.defineProperty(exports, "FFIDInquiryForm", {
   enumerable: true,
-  get: function () { return chunkXRWDTYA7_cjs.FFIDInquiryForm; }
+  get: function () { return chunkLT7FQ7BT_cjs.FFIDInquiryForm; }
 });
 Object.defineProperty(exports, "FFIDLoginButton", {
   enumerable: true,
-  get: function () { return chunkXRWDTYA7_cjs.FFIDLoginButton; }
+  get: function () { return chunkLT7FQ7BT_cjs.FFIDLoginButton; }
 });
 Object.defineProperty(exports, "FFIDOrganizationSwitcher", {
   enumerable: true,
-  get: function () { return chunkXRWDTYA7_cjs.FFIDOrganizationSwitcher; }
+  get: function () { return chunkLT7FQ7BT_cjs.FFIDOrganizationSwitcher; }
 });
 Object.defineProperty(exports, "FFIDSubscriptionBadge", {
   enumerable: true,
-  get: function () { return chunkXRWDTYA7_cjs.FFIDSubscriptionBadge; }
+  get: function () { return chunkLT7FQ7BT_cjs.FFIDSubscriptionBadge; }
 });
 Object.defineProperty(exports, "FFIDUserMenu", {
   enumerable: true,
-  get: function () { return chunkXRWDTYA7_cjs.FFIDUserMenu; }
+  get: function () { return chunkLT7FQ7BT_cjs.FFIDUserMenu; }
 });

package/dist/components/index.js

@@ -1 +1 @@
-export { FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDSubscriptionBadge, FFIDUserMenu } from '../chunk-OL7KVPQ4.js';
+export { FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDSubscriptionBadge, FFIDUserMenu } from '../chunk-75ISD4I4.js';

package/dist/{ffid-client-DW8_m1_M.d.cts → ffid-client-DMwmK8mM.d.cts}

@@ -114,7 +114,7 @@ interface FFIDInquiryCreateResponse {
  * Newsletter types exposed by the FFID SDK.
  *
  * 2-layer newsletter model (#2078):
- *   - `inquiry_followup`: 問い合わせフォローアップ (Type A)
+ *   - `inquiry_followup`: 資料請求・お問い合わせ後のご案内 (Type A)
  *   - `general`:          定期ニュースレター (Type B)
  *
  * FFID account holders' preferences live in `user_marketing_preferences`;
@@ -133,6 +133,12 @@ interface FFIDNewsletterSubscribeParams {
     /** ISO 639-1 locale (e.g. 'ja', 'en') */
     locale?: string;
 }
+interface FFIDNewsletterSubscribeOptions {
+    /** UUID for one intentional registration. Reuse unchanged across retries;
+     *  create a new key when the registration changes or a new request is intended.
+     *  Transport-only: sent as Idempotency-Key, never added to the consent body. */
+    idempotencyKey?: string | undefined;
+}
 interface FFIDNewsletterSubscribeResponse {
     ok: true;
     /** True when a double opt-in confirmation email was sent */
@@ -140,6 +146,11 @@ interface FFIDNewsletterSubscribeResponse {
     /** True when the email matched an existing FFID account; the caller
      *  must sign in to update preferences. Preferences are NOT modified. */
     requiresSignIn: boolean;
+    /** True when confirmation could not be sent; subscription is still pending.
+     *  This flag does not promise an automatic resend. */
+    confirmationEmailPending: boolean;
+    /** Present only when the independent owner acknowledged a durable registration intent. */
+    requestId?: string | undefined;
 }
 interface FFIDNewsletterConfirmParams {
     /** Confirmation token received in the double opt-in email */
@@ -151,6 +162,8 @@ interface FFIDNewsletterConfirmResponse {
 interface FFIDNewsletterUnsubscribeParams {
     /** Unsubscribe token received in the newsletter footer / List-Unsubscribe header */
     token: string;
+    /** Stop only the selected purpose. Omission preserves legacy all-purpose links. */
+    type?: FFIDNewsletterType | undefined;
 }
 interface FFIDNewsletterUnsubscribeResponse {
     ok: true;
@@ -1164,6 +1177,15 @@ interface FFIDCreateCheckoutParams {
     cancelUrl: string;
     /** Optional plan ID for upgrade or resubscription */
     planId?: string;
+    /**
+     * Seat count after the plan change (#5755). Use together with `planId` (a
+     * different plan); seat-only changes go through the seats API. Omit to carry
+     * over the current seat count. Must fit the target plan's seat range
+     * (fixed-seat plans need their fixed count) and, when decreasing, the seats in
+     * use — otherwise 422 `SEAT_QUANTITY_OUT_OF_RANGE`. Raising the plan while
+     * lowering seats (or vice versa) is 400 `INVALID_UPGRADE_PLAN`.
+     */
+    quantity?: number;
 }
 /**
  * Parameters for creating a billing portal session
@@ -2871,7 +2893,7 @@ declare function createFFIDClient(config: FFIDConfig): {
     }) => Promise<FFIDApiResponse<FFIDOtpVerifyResponse>>;
     /** Newsletter methods (subscribe / confirm / unsubscribe) */
     newsletter: {
-        subscribe: (params: FFIDNewsletterSubscribeParams) => Promise<FFIDApiResponse<FFIDNewsletterSubscribeResponse>>;
+        subscribe: (params: FFIDNewsletterSubscribeParams, options?: FFIDNewsletterSubscribeOptions) => Promise<FFIDApiResponse<FFIDNewsletterSubscribeResponse>>;
         confirm: (params: FFIDNewsletterConfirmParams) => Promise<FFIDApiResponse<FFIDNewsletterConfirmResponse>>;
         unsubscribe: (params: FFIDNewsletterUnsubscribeParams) => Promise<FFIDApiResponse<FFIDNewsletterUnsubscribeResponse>>;
         dispatch: (params: FFIDNewsletterDispatchParams) => Promise<FFIDApiResponse<FFIDNewsletterDispatchResponse>>;