@feelflow/ffid-sdk 5.10.0 → 5.13.0

package/dist/{ffid-client-DRjzfAaS.d.cts → ffid-client-BG0Qr86U.d.ts}

@@ -1,4 +1,4 @@
-import { E as EffectiveSubscriptionStatus } from './types-BYdtyO_2.cjs';
+import { E as EffectiveSubscriptionStatus } from './types-BeVl-z12.js';
 
 /**
  * Inquiry types exposed by the FFID SDK.
@@ -270,6 +270,52 @@ interface FFIDServiceAccessDecision {
     error?: FFIDServiceAccessError;
 }
 
+/**
+ * Billing checkout / portal session types.
+ *
+ * types/index.ts のサイズ上限対応で切り出し（中身は逐語移設、#3787 Phase A）。
+ */
+/**
+ * Checkout session response from billing checkout endpoint
+ */
+interface FFIDCheckoutSessionResponse {
+    /** Stripe Checkout session ID */
+    sessionId: string;
+    /** Stripe Checkout session URL (null if session creation had issues) */
+    url: string | null;
+}
+/**
+ * Portal session response from billing portal endpoint
+ */
+interface FFIDPortalSessionResponse {
+    /** Stripe Billing Portal URL */
+    url: string;
+}
+/**
+ * Parameters for creating a checkout session
+ */
+interface FFIDCreateCheckoutParams {
+    /** Organization ID (UUID) */
+    organizationId: string;
+    /** Subscription ID (UUID) */
+    subscriptionId: string;
+    /** URL to redirect after successful checkout */
+    successUrl: string;
+    /** URL to redirect after cancelled checkout */
+    cancelUrl: string;
+    /** Optional plan ID for upgrade or resubscription */
+    planId?: string;
+}
+/**
+ * Parameters for creating a billing portal session
+ */
+interface FFIDCreatePortalParams {
+    /** Organization ID (UUID) */
+    organizationId: string;
+    /** URL to redirect when user exits the portal */
+    returnUrl: string;
+}
+
 /** Billing interval for subscriptions */
 type FFIDBillingInterval = 'monthly' | 'yearly';
 /**
@@ -637,6 +683,122 @@ interface FFIDRemoveMemberResponse {
     message: string;
 }
 
+/**
+ * Contract resource types (#3787 Phase A)
+ *
+ * シート割り当て・請求書・支払い再試行の ext API 型。
+ * サーバー側の sanitize 済みレスポンス（Stripe 内部 ID を含まない）と対になる。
+ */
+/** シート割り当て 1 件（ユーザー情報付き、一覧用） */
+interface FFIDSeatAssignmentWithUser {
+    userId: string;
+    email: string;
+    name: string | null;
+    role: string;
+    assignedAt: string;
+    assignedBy: string | null;
+}
+/** シート割り当てレコード（割り当て直後のレスポンス用） */
+interface FFIDSeatAssignmentRecord {
+    id: string;
+    subscriptionId: string;
+    userId: string;
+    assignedBy: string | null;
+    assignedAt: string;
+    createdAt: string;
+    updatedAt: string;
+}
+/** GET /api/v1/subscriptions/ext/{id}/seats/assignments のレスポンス */
+interface FFIDListSeatAssignmentsResponse {
+    assignments: FFIDSeatAssignmentWithUser[];
+    totalSeats: number;
+    assignedSeats: number;
+    availableSeats: number;
+}
+/** listSeatAssignments のパラメータ */
+interface FFIDListSeatAssignmentsParams {
+    subscriptionId: string;
+}
+/** assignSeats のパラメータ */
+interface FFIDAssignSeatsParams {
+    subscriptionId: string;
+    userIds: string[];
+}
+/** POST /api/v1/subscriptions/ext/{id}/seats/assignments のレスポンス */
+interface FFIDAssignSeatsResponse {
+    message: string;
+    assignments: FFIDSeatAssignmentRecord[];
+}
+/** unassignSeat のパラメータ */
+interface FFIDUnassignSeatParams {
+    subscriptionId: string;
+    userId: string;
+}
+/** DELETE /api/v1/subscriptions/ext/{id}/seats/assignments/{userId} のレスポンス */
+interface FFIDUnassignSeatResponse {
+    message: string;
+}
+/** 請求書サマリー（一覧用） */
+interface FFIDInvoiceSummary {
+    id: string;
+    organizationId: string;
+    subscriptionId: string | null;
+    invoiceNumber: string;
+    description: string | null;
+    subtotal: number;
+    taxRate: number;
+    taxAmount: number;
+    totalAmount: number;
+    currency: string;
+    status: string;
+    issuedAt: string | null;
+    dueDate: string | null;
+    paidAt: string | null;
+    pdfUrl: string | null;
+    createdAt: string;
+}
+/** 請求書詳細（請求先情報・備考を含む） */
+interface FFIDInvoiceDetail extends FFIDInvoiceSummary {
+    billingName: string | null;
+    billingEmail: string | null;
+    notes: string | null;
+}
+/** listInvoices のパラメータ */
+interface FFIDListInvoicesParams {
+    organizationId: string;
+}
+/** GET /api/v1/billing/ext/invoices のレスポンス */
+interface FFIDListInvoicesResponse {
+    invoices: FFIDInvoiceSummary[];
+    count: number;
+}
+/** getInvoice のパラメータ */
+interface FFIDGetInvoiceParams {
+    invoiceId: string;
+}
+/** GET /api/v1/billing/ext/invoices/{id} のレスポンス */
+interface FFIDGetInvoiceResponse {
+    invoice: FFIDInvoiceDetail;
+}
+/** retryPayment のパラメータ */
+interface FFIDRetryPaymentParams {
+    organizationId: string;
+}
+/** 再試行に失敗した契約の詳細 */
+interface FFIDRetryPaymentFailure {
+    subscriptionId: string;
+    reason: string;
+    stripeCode?: string;
+}
+/** POST /api/v1/billing/ext/retry-payment のレスポンス */
+interface FFIDRetryPaymentSummary {
+    totalAttempted: number;
+    succeeded: number;
+    failed: number;
+    noOpenInvoice: number;
+    failures: FFIDRetryPaymentFailure[];
+}
+
 /**
  * FFID SDK Type Definitions
  *
@@ -793,6 +955,17 @@ interface FFIDOAuthUserInfoSubscription {
 interface FFIDOAuthUserInfo {
     sub: string;
     email: string | null;
+    /**
+     * Whether the user's email is verified on the FFID side (#3791). Use this to
+     * safely gate email-based auto account-linking (account-takeover prevention):
+     * never auto-link on an unverified email.
+     *
+     * `undefined` means the FFID server predates the field (older deployment) or
+     * the verification path could not populate it — NOT "unverified". Treat
+     * `undefined` as "unknown" and fall back to a stricter linking policy rather
+     * than coercing it to `false`/`true`.
+     */
+    emailVerified?: boolean | undefined;
     name: string | null;
     picture: string | null;
     companyName?: string | null | undefined;
@@ -962,47 +1135,6 @@ type FFIDApiResponse<T> = {
     error: FFIDError;
 };
 
-/**
- * Checkout session response from billing checkout endpoint
- */
-interface FFIDCheckoutSessionResponse {
-    /** Stripe Checkout session ID */
-    sessionId: string;
-    /** Stripe Checkout session URL (null if session creation had issues) */
-    url: string | null;
-}
-/**
- * Portal session response from billing portal endpoint
- */
-interface FFIDPortalSessionResponse {
-    /** Stripe Billing Portal URL */
-    url: string;
-}
-/**
- * Parameters for creating a checkout session
- */
-interface FFIDCreateCheckoutParams {
-    /** Organization ID (UUID) */
-    organizationId: string;
-    /** Subscription ID (UUID) */
-    subscriptionId: string;
-    /** URL to redirect after successful checkout */
-    successUrl: string;
-    /** URL to redirect after cancelled checkout */
-    cancelUrl: string;
-    /** Optional plan ID for upgrade or resubscription */
-    planId?: string;
-}
-/**
- * Parameters for creating a billing portal session
- */
-interface FFIDCreatePortalParams {
-    /** Organization ID (UUID) */
-    organizationId: string;
-    /** URL to redirect when user exits the portal */
-    returnUrl: string;
-}
-
 /**
  * User profile for the authenticated user (returned by `getProfile` / `updateProfile`).
  *
@@ -1232,34 +1364,6 @@ interface ContractWizardSubscriptionOptions {
     organizationId?: string;
 }
 
-/** Redirect and URL generation - redirectToLogin / redirectToAuthorize / redirectToLogout / getLoginUrl / getSignupUrl / getLogoutUrl */
-
-/**
- * `screen_hint=signup` query value for `/oauth/authorize` (#2908 / #2911).
- * Forwards to Supabase Auth signup screen; only the `'signup'` value is
- * propagated (no-op when `'login'` or omitted).
- */
-declare const SCREEN_HINT_SIGNUP: "signup";
-/** Options for redirectToAuthorize */
-interface RedirectToAuthorizeOptions {
-    /** Target organization ID — triggers org-scoped OAuth re-authorization */
-    organizationId?: string;
-    /**
-     * Initial Supabase Auth screen hint (#2908 / #2911).
-     *
-     * - `'signup'`: forwards `?screen_hint=signup` so the FFID OAuth flow lands
-     *   on the signup screen (used by external services that want to deep-link
-     *   new users into the signup CTA).
-     * - `'login'` / `undefined`: no `screen_hint` param is added — the default
-     *   login screen is shown.
-     *
-     * In cookie mode, `'signup'` redirects to the FFID `/signup` page instead
-     * of `/login` so the SDK contract (signup-screen intent) stays consistent
-     * regardless of `authMode`.
-     */
-    screenHint?: typeof SCREEN_HINT_SIGNUP | 'login';
-}
-
 /**
  * Token Store
  *
@@ -1301,6 +1405,53 @@ interface TokenStore {
  */
 declare function createTokenStore(storageType?: 'localStorage' | 'memory'): TokenStore;
 
+/** OAuth token operations - exchangeCodeForTokens / refreshAccessToken / signOutToken */
+
+/**
+ * Optional OAuth `state` validation for {@link exchangeCodeForTokens}.
+ *
+ * If a `state` is supplied on EITHER side — `expectedState` (the value persisted
+ * at `redirectToAuthorize`) or `actualState` (the value returned on the callback
+ * URL) — both must be present and equal before any token exchange. A mismatch
+ * OR an omitted counterpart fails closed (no exchange) to defend against CSRF
+ * (RFC 6749 §10.12 / #3841). Validation is skipped only when BOTH are omitted
+ * (backward compatible — callers that don't opt in are unaffected).
+ */
+interface ExchangeCodeForTokensOptions {
+    /** Stored state from `redirectToAuthorize` (e.g. `retrieveState()`) */
+    expectedState?: string;
+    /** State returned on the OAuth callback URL */
+    actualState?: string;
+}
+
+/** Redirect and URL generation - redirectToLogin / redirectToAuthorize / redirectToLogout / getLoginUrl / getSignupUrl / getLogoutUrl */
+
+/**
+ * `screen_hint=signup` query value for `/oauth/authorize` (#2908 / #2911).
+ * Forwards to Supabase Auth signup screen; only the `'signup'` value is
+ * propagated (no-op when `'login'` or omitted).
+ */
+declare const SCREEN_HINT_SIGNUP: "signup";
+/** Options for redirectToAuthorize */
+interface RedirectToAuthorizeOptions {
+    /** Target organization ID — triggers org-scoped OAuth re-authorization */
+    organizationId?: string;
+    /**
+     * Initial Supabase Auth screen hint (#2908 / #2911).
+     *
+     * - `'signup'`: forwards `?screen_hint=signup` so the FFID OAuth flow lands
+     *   on the signup screen (used by external services that want to deep-link
+     *   new users into the signup CTA).
+     * - `'login'` / `undefined`: no `screen_hint` param is added — the default
+     *   login screen is shown.
+     *
+     * In cookie mode, `'signup'` redirects to the FFID `/signup` page instead
+     * of `/login` so the SDK contract (signup-screen intent) stays consistent
+     * regardless of `authMode`.
+     */
+    screenHint?: typeof SCREEN_HINT_SIGNUP | 'login';
+}
+
 /** Creates an FFID API client instance */
 declare function createFFIDClient(config: FFIDConfig): {
     getSession: () => Promise<FFIDApiResponse<FFIDSessionResponse>>;
@@ -1312,7 +1463,7 @@ declare function createFFIDClient(config: FFIDConfig): {
     getLogoutUrl: (postLogoutRedirectUri?: string) => string;
     getSignupUrl: (redirectUrl?: string) => string;
     createError: (code: string, message: string) => FFIDError;
-    exchangeCodeForTokens: (code: string, codeVerifier?: string) => Promise<FFIDApiResponse<void>>;
+    exchangeCodeForTokens: (code: string, codeVerifier?: string, opts?: ExchangeCodeForTokensOptions) => Promise<FFIDApiResponse<void>>;
     refreshAccessToken: () => Promise<FFIDApiResponse<void>>;
     checkSubscription: (params: {
         userId?: string;
@@ -1341,6 +1492,12 @@ declare function createFFIDClient(config: FFIDConfig): {
     getAnalyticsConfig: (serviceCode: string, options?: FFIDProfileCallOptions) => Promise<FFIDApiResponse<FFIDAnalyticsConfig>>;
     createCheckoutSession: (params: FFIDCreateCheckoutParams) => Promise<FFIDApiResponse<FFIDCheckoutSessionResponse>>;
     createPortalSession: (params: FFIDCreatePortalParams) => Promise<FFIDApiResponse<FFIDPortalSessionResponse>>;
+    listInvoices: (params: FFIDListInvoicesParams) => Promise<FFIDApiResponse<FFIDListInvoicesResponse>>;
+    getInvoice: (params: FFIDGetInvoiceParams) => Promise<FFIDApiResponse<FFIDGetInvoiceResponse>>;
+    retryPayment: (params: FFIDRetryPaymentParams) => Promise<FFIDApiResponse<FFIDRetryPaymentSummary>>;
+    listSeatAssignments: (params: FFIDListSeatAssignmentsParams) => Promise<FFIDApiResponse<FFIDListSeatAssignmentsResponse>>;
+    assignSeats: (params: FFIDAssignSeatsParams) => Promise<FFIDApiResponse<FFIDAssignSeatsResponse>>;
+    unassignSeat: (params: FFIDUnassignSeatParams) => Promise<FFIDApiResponse<FFIDUnassignSeatResponse>>;
     listPlans: () => Promise<FFIDApiResponse<FFIDListPlansResponse>>;
     getSubscription: (subscriptionId: string) => Promise<FFIDApiResponse<FFIDSubscriptionDetail>>;
     subscribe: (params: FFIDSubscribeParams) => Promise<FFIDApiResponse<FFIDSubscribeResponse>>;