@feelflow/ffid-sdk 5.12.0 → 5.14.0

package/dist/server/index.cjs

@@ -119,6 +119,9 @@ function normalizeUserinfo(raw) {
   return {
     sub: raw.sub,
     email: raw.email,
+    // #3791: undefined → undefined を保つ（false に丸めない）。古い FFID は wire に
+    // 含めないため、consumer は undefined を「未確認」ではなく「不明」として扱える。
+    emailVerified: raw.email_verified,
     name: raw.name,
     picture: raw.picture,
     companyName: raw.company_name ?? null,
@@ -374,6 +377,9 @@ function createVerifyAccessToken(deps) {
     const base = {
       sub: introspectResponse.sub,
       email: introspectResponse.email ?? null,
+      // #3791: preserve undefined (do NOT coerce to false) so introspect-strategy
+      // callers can distinguish "verified" / "not verified" / "older server".
+      email_verified: introspectResponse.email_verified,
       name: introspectResponse.name ?? null,
       picture: introspectResponse.picture ?? null,
       company_name: introspectResponse.company_name ?? null,
@@ -928,8 +934,163 @@ function createProfileMethods(deps) {
   return { getProfile, updateProfile };
 }
 
+// src/client/login-history-methods.ts
+var EXT_LOGIN_HISTORY_ENDPOINT = "/api/v1/users/ext/me/login-history";
+function createLoginHistoryMethods(deps) {
+  const { fetchWithAuth, createError } = deps;
+  async function getLoginHistory(params) {
+    if (params?.limit !== void 0 && (!Number.isInteger(params.limit) || params.limit <= 0)) {
+      return {
+        error: createError(
+          "VALIDATION_ERROR",
+          "limit \u306F1\u4EE5\u4E0A\u306E\u6574\u6570\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044"
+        )
+      };
+    }
+    const query = new URLSearchParams();
+    if (params?.userId !== void 0) {
+      query.set("userId", params.userId);
+    }
+    if (params?.limit !== void 0) {
+      query.set("limit", String(params.limit));
+    }
+    const queryString = query.toString();
+    const endpoint = queryString ? `${EXT_LOGIN_HISTORY_ENDPOINT}?${queryString}` : EXT_LOGIN_HISTORY_ENDPOINT;
+    return fetchWithAuth(endpoint);
+  }
+  return { getLoginHistory };
+}
+
+// src/client/organization-domains-methods.ts
+var EXT_DOMAINS_ENDPOINT = "/api/v1/organizations/ext/domains";
+function createOrganizationDomainsMethods(deps) {
+  const { fetchWithAuth, createError, serviceCode } = deps;
+  function buildQuery(organizationId) {
+    return new URLSearchParams({ organizationId, serviceCode }).toString();
+  }
+  async function getOrganizationDomains(params) {
+    if (!params.organizationId) {
+      return {
+        error: createError("VALIDATION_ERROR", "organizationId \u306F\u5FC5\u9808\u3067\u3059")
+      };
+    }
+    return fetchWithAuth(
+      `${EXT_DOMAINS_ENDPOINT}?${buildQuery(params.organizationId)}`
+    );
+  }
+  return { getOrganizationDomains };
+}
+
+// src/client/notification-preferences-methods.ts
+var EXT_NOTIFICATION_PREFERENCES_ENDPOINT = "/api/v1/organizations/ext/notification-preferences";
+function createNotificationPreferencesMethods(deps) {
+  const { fetchWithAuth, createError, serviceCode } = deps;
+  function buildQuery(organizationId) {
+    return new URLSearchParams({ organizationId, serviceCode }).toString();
+  }
+  async function getNotificationPreferences(params) {
+    if (!params.organizationId) {
+      return {
+        error: createError("VALIDATION_ERROR", "organizationId \u306F\u5FC5\u9808\u3067\u3059")
+      };
+    }
+    return fetchWithAuth(
+      `${EXT_NOTIFICATION_PREFERENCES_ENDPOINT}?${buildQuery(params.organizationId)}`
+    );
+  }
+  async function updateNotificationPreferences(params) {
+    if (!params.organizationId) {
+      return {
+        error: createError("VALIDATION_ERROR", "organizationId \u306F\u5FC5\u9808\u3067\u3059")
+      };
+    }
+    if (params.preferences === null || typeof params.preferences !== "object" || Array.isArray(params.preferences)) {
+      return {
+        error: createError("VALIDATION_ERROR", "preferences \u306F\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059")
+      };
+    }
+    if (Object.keys(params.preferences).length === 0) {
+      return {
+        error: createError("VALIDATION_ERROR", "\u66F4\u65B0\u3059\u308B\u30D5\u30A3\u30FC\u30EB\u30C9\u30921\u3064\u4EE5\u4E0A\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044")
+      };
+    }
+    return fetchWithAuth(
+      `${EXT_NOTIFICATION_PREFERENCES_ENDPOINT}?${buildQuery(params.organizationId)}`,
+      {
+        method: "PATCH",
+        body: JSON.stringify({ preferences: params.preferences })
+      }
+    );
+  }
+  return { getNotificationPreferences, updateNotificationPreferences };
+}
+
+// src/client/invite-methods.ts
+var EXT_INVITE_ENDPOINT = "/api/v1/organizations/ext/invite";
+function createInviteMethods(deps) {
+  const { fetchWithAuth, createError, serviceCode } = deps;
+  const assignableRoles = /* @__PURE__ */ new Set(["admin", "member", "viewer"]);
+  async function inviteMember(params) {
+    if (!params.organizationId || !params.email) {
+      return {
+        error: createError("VALIDATION_ERROR", "organizationId \u3068 email \u306F\u5FC5\u9808\u3067\u3059")
+      };
+    }
+    if (params.role !== void 0 && !assignableRoles.has(params.role)) {
+      return {
+        error: createError(
+          "VALIDATION_ERROR",
+          "role \u306F admin\u3001member\u3001viewer \u306E\u3044\u305A\u308C\u304B\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044"
+        )
+      };
+    }
+    const query = new URLSearchParams({
+      organizationId: params.organizationId,
+      serviceCode
+    }).toString();
+    return fetchWithAuth(`${EXT_INVITE_ENDPOINT}?${query}`, {
+      method: "POST",
+      body: JSON.stringify({ email: params.email, role: params.role })
+    });
+  }
+  return { inviteMember };
+}
+
+// src/client/org-membership-methods.ts
+var EXT_USER_ORGANIZATIONS_ENDPOINT = "/api/v1/users/ext/me/organizations";
+function createOrgMembershipMethods(deps) {
+  const { fetchWithAuth, createError } = deps;
+  async function leaveOrganization(params) {
+    if (!params || !params.organizationId) {
+      return {
+        error: createError("VALIDATION_ERROR", "organizationId \u306F\u5FC5\u9808\u3067\u3059")
+      };
+    }
+    let endpoint = `${EXT_USER_ORGANIZATIONS_ENDPOINT}/${encodeURIComponent(params.organizationId)}`;
+    if (params.userId) {
+      endpoint += `?${new URLSearchParams({ userId: params.userId }).toString()}`;
+    }
+    return fetchWithAuth(endpoint, {
+      method: "DELETE"
+    });
+  }
+  return { leaveOrganization };
+}
+
+// src/client/noncontract-methods.ts
+function createNonContractMethods(deps) {
+  const { fetchWithAuth, createError, serviceCode } = deps;
+  return {
+    ...createLoginHistoryMethods({ fetchWithAuth, createError }),
+    ...createOrganizationDomainsMethods({ fetchWithAuth, createError, serviceCode }),
+    ...createNotificationPreferencesMethods({ fetchWithAuth, createError, serviceCode }),
+    ...createInviteMethods({ fetchWithAuth, createError, serviceCode }),
+    ...createOrgMembershipMethods({ fetchWithAuth, createError })
+  };
+}
+
 // src/client/version-check.ts
-var SDK_VERSION = "5.12.0";
+var SDK_VERSION = "5.14.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1001,9 +1162,20 @@ function createOAuthTokenMethods(deps) {
     logger,
     errorCodes
   } = deps;
-  async function exchangeCodeForTokens(code, codeVerifier) {
+  async function exchangeCodeForTokens(code, codeVerifier, opts) {
     const url = `${baseUrl}${OAUTH_TOKEN_ENDPOINT}`;
     logger.debug("Exchanging code for tokens:", url);
+    if (opts?.expectedState !== void 0 || opts?.actualState !== void 0) {
+      if (opts?.expectedState !== opts?.actualState) {
+        logger.error("Token exchange aborted: OAuth state mismatch or omitted (possible CSRF)");
+        return {
+          error: {
+            code: errorCodes.STATE_MISMATCH_ERROR,
+            message: "OAuth state \u304C\u4E00\u81F4\u3057\u307E\u305B\u3093\u3002CSRF \u306E\u53EF\u80FD\u6027\u304C\u3042\u308B\u305F\u3081\u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+          }
+        };
+      }
+    }
     const effectiveRedirectUri = resolvedRedirectUri ?? (typeof window !== "undefined" ? window.location.origin + window.location.pathname : null);
     if (!effectiveRedirectUri) {
       logger.error("redirectUri is required for token exchange in SSR environments. Set config.redirectUri explicitly.");
@@ -1448,6 +1620,46 @@ function base64UrlEncode(buffer) {
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 
+// src/auth/state.ts
+var STATE_STORAGE_KEY = "ffid_oauth_state";
+var STATE_FALLBACK_STORAGE_KEY = "ffid_oauth_state_fb";
+var STATE_FALLBACK_TIMESTAMP_KEY = "ffid_oauth_state_fb_ts";
+function storeState(state, logger) {
+  if (typeof window === "undefined") {
+    logger?.warn("storeState: storage is not available in SSR context");
+    return false;
+  }
+  let sessionStored = false;
+  try {
+    window.sessionStorage.setItem(STATE_STORAGE_KEY, state);
+    sessionStored = true;
+  } catch (error) {
+    logger?.warn("storeState: sessionStorage \u3078\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  let localStored = false;
+  try {
+    window.localStorage.setItem(STATE_FALLBACK_STORAGE_KEY, state);
+    window.localStorage.setItem(STATE_FALLBACK_TIMESTAMP_KEY, String(Date.now()));
+    localStored = true;
+  } catch (error) {
+    logger?.warn("storeState: localStorage fallback \u3078\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  return sessionStored || localStored;
+}
+function cleanupStateStorage(logger) {
+  try {
+    window.sessionStorage.removeItem(STATE_STORAGE_KEY);
+  } catch (error) {
+    logger?.warn("retrieveState: sessionStorage \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  try {
+    window.localStorage.removeItem(STATE_FALLBACK_STORAGE_KEY);
+    window.localStorage.removeItem(STATE_FALLBACK_TIMESTAMP_KEY);
+  } catch (error) {
+    logger?.warn("retrieveState: localStorage \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+}
+
 // src/client/redirect.ts
 var OAUTH_AUTHORIZE_ENDPOINT = "/api/v1/oauth/authorize";
 var AUTH_LOGOUT_ENDPOINT = "/api/v1/auth/logout";
@@ -1579,6 +1791,7 @@ function createRedirectMethods(deps) {
     const recentCount = getRecentRedirectCount(authorizeKey, now, logger);
     if (recentCount >= REDIRECT_LOOP_THRESHOLD) {
       cleanupVerifierStorage(logger);
+      cleanupStateStorage(logger);
       logger.warn("[FFID SDK] redirect loop detected \u2014 \u81EA\u52D5\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3092\u505C\u6B62\u3057\u307E\u3057\u305F", {
         authorizeKey,
         recentCount,
@@ -1602,6 +1815,11 @@ function createRedirectMethods(deps) {
       return { success: false, error: errorMessage };
     }
     const state = generateRandomState();
+    if (!storeState(state, logger)) {
+      logger.error(
+        "redirectToAuthorize: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF\u3067\u306E CSRF \u691C\u8A3C\u304C\u5931\u6557\u3057\u307E\u3059"
+      );
+    }
     const redirectUri = resolvedRedirectUri ?? window.location.origin + window.location.pathname;
     const params = new URLSearchParams({
       response_type: "code",
@@ -2316,7 +2534,8 @@ var FFID_ERROR_CODES = {
   TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR",
   TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR",
   NO_TOKENS: "NO_TOKENS",
-  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR"
+  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR",
+  STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR"
 };
 var EXT_CHECK_ENDPOINT = "/api/v1/subscriptions/ext/check";
 var DEFAULT_ALLOW_GRACE = true;
@@ -2704,6 +2923,18 @@ function createFFIDClient(config) {
     fetchWithAuth,
     createError
   });
+  const {
+    getLoginHistory,
+    getOrganizationDomains,
+    getNotificationPreferences,
+    updateNotificationPreferences,
+    inviteMember,
+    leaveOrganization
+  } = createNonContractMethods({
+    fetchWithAuth,
+    createError,
+    serviceCode: config.serviceCode
+  });
   const { getAnalyticsConfig } = createAnalyticsMethods({
     fetchWithAuth,
     createError
@@ -2784,6 +3015,13 @@ function createFFIDClient(config) {
     removeMember,
     getProfile,
     updateProfile,
+    // Non-contract ext API coverage (#3783)
+    getLoginHistory,
+    getOrganizationDomains,
+    getNotificationPreferences,
+    updateNotificationPreferences,
+    inviteMember,
+    leaveOrganization,
     getAnalyticsConfig,
     createCheckoutSession,
     createPortalSession,

package/dist/server/index.d.cts

@@ -1,5 +1,5 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-Dx4oc4Cw.cjs';
-export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDRemoveMemberResponse, x as FFIDResetSessionResponse, y as FFIDSubscription, z as FFIDUpdateMemberRoleResponse, A as FFIDUpdateUserProfileRequest, B as FFIDUser, C as FFIDUserProfile, T as TokenData, D as TokenStore, E as createFFIDClient, G as createTokenStore } from '../ffid-client-Dx4oc4Cw.cjs';
+import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-CKFxY60u.cjs';
+export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDRemoveMemberResponse, x as FFIDResetSessionResponse, y as FFIDSubscription, z as FFIDUpdateMemberRoleResponse, A as FFIDUpdateUserProfileRequest, B as FFIDUser, C as FFIDUserProfile, T as TokenData, D as TokenStore, E as createFFIDClient, G as createTokenStore } from '../ffid-client-CKFxY60u.cjs';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-D61jqRIO.cjs';
 import { z } from 'zod';
 import '../types-BeVl-z12.cjs';

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-5IprSUVR.js';
-export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDRemoveMemberResponse, x as FFIDResetSessionResponse, y as FFIDSubscription, z as FFIDUpdateMemberRoleResponse, A as FFIDUpdateUserProfileRequest, B as FFIDUser, C as FFIDUserProfile, T as TokenData, D as TokenStore, E as createFFIDClient, G as createTokenStore } from '../ffid-client-5IprSUVR.js';
+import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-9-lh0G_h.js';
+export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDRemoveMemberResponse, x as FFIDResetSessionResponse, y as FFIDSubscription, z as FFIDUpdateMemberRoleResponse, A as FFIDUpdateUserProfileRequest, B as FFIDUser, C as FFIDUserProfile, T as TokenData, D as TokenStore, E as createFFIDClient, G as createTokenStore } from '../ffid-client-9-lh0G_h.js';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-D61jqRIO.js';
 import { z } from 'zod';
 import '../types-BeVl-z12.js';

package/dist/server/index.js

@@ -118,6 +118,9 @@ function normalizeUserinfo(raw) {
   return {
     sub: raw.sub,
     email: raw.email,
+    // #3791: undefined → undefined を保つ（false に丸めない）。古い FFID は wire に
+    // 含めないため、consumer は undefined を「未確認」ではなく「不明」として扱える。
+    emailVerified: raw.email_verified,
     name: raw.name,
     picture: raw.picture,
     companyName: raw.company_name ?? null,
@@ -373,6 +376,9 @@ function createVerifyAccessToken(deps) {
     const base = {
       sub: introspectResponse.sub,
       email: introspectResponse.email ?? null,
+      // #3791: preserve undefined (do NOT coerce to false) so introspect-strategy
+      // callers can distinguish "verified" / "not verified" / "older server".
+      email_verified: introspectResponse.email_verified,
       name: introspectResponse.name ?? null,
       picture: introspectResponse.picture ?? null,
       company_name: introspectResponse.company_name ?? null,
@@ -927,8 +933,163 @@ function createProfileMethods(deps) {
   return { getProfile, updateProfile };
 }
 
+// src/client/login-history-methods.ts
+var EXT_LOGIN_HISTORY_ENDPOINT = "/api/v1/users/ext/me/login-history";
+function createLoginHistoryMethods(deps) {
+  const { fetchWithAuth, createError } = deps;
+  async function getLoginHistory(params) {
+    if (params?.limit !== void 0 && (!Number.isInteger(params.limit) || params.limit <= 0)) {
+      return {
+        error: createError(
+          "VALIDATION_ERROR",
+          "limit \u306F1\u4EE5\u4E0A\u306E\u6574\u6570\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044"
+        )
+      };
+    }
+    const query = new URLSearchParams();
+    if (params?.userId !== void 0) {
+      query.set("userId", params.userId);
+    }
+    if (params?.limit !== void 0) {
+      query.set("limit", String(params.limit));
+    }
+    const queryString = query.toString();
+    const endpoint = queryString ? `${EXT_LOGIN_HISTORY_ENDPOINT}?${queryString}` : EXT_LOGIN_HISTORY_ENDPOINT;
+    return fetchWithAuth(endpoint);
+  }
+  return { getLoginHistory };
+}
+
+// src/client/organization-domains-methods.ts
+var EXT_DOMAINS_ENDPOINT = "/api/v1/organizations/ext/domains";
+function createOrganizationDomainsMethods(deps) {
+  const { fetchWithAuth, createError, serviceCode } = deps;
+  function buildQuery(organizationId) {
+    return new URLSearchParams({ organizationId, serviceCode }).toString();
+  }
+  async function getOrganizationDomains(params) {
+    if (!params.organizationId) {
+      return {
+        error: createError("VALIDATION_ERROR", "organizationId \u306F\u5FC5\u9808\u3067\u3059")
+      };
+    }
+    return fetchWithAuth(
+      `${EXT_DOMAINS_ENDPOINT}?${buildQuery(params.organizationId)}`
+    );
+  }
+  return { getOrganizationDomains };
+}
+
+// src/client/notification-preferences-methods.ts
+var EXT_NOTIFICATION_PREFERENCES_ENDPOINT = "/api/v1/organizations/ext/notification-preferences";
+function createNotificationPreferencesMethods(deps) {
+  const { fetchWithAuth, createError, serviceCode } = deps;
+  function buildQuery(organizationId) {
+    return new URLSearchParams({ organizationId, serviceCode }).toString();
+  }
+  async function getNotificationPreferences(params) {
+    if (!params.organizationId) {
+      return {
+        error: createError("VALIDATION_ERROR", "organizationId \u306F\u5FC5\u9808\u3067\u3059")
+      };
+    }
+    return fetchWithAuth(
+      `${EXT_NOTIFICATION_PREFERENCES_ENDPOINT}?${buildQuery(params.organizationId)}`
+    );
+  }
+  async function updateNotificationPreferences(params) {
+    if (!params.organizationId) {
+      return {
+        error: createError("VALIDATION_ERROR", "organizationId \u306F\u5FC5\u9808\u3067\u3059")
+      };
+    }
+    if (params.preferences === null || typeof params.preferences !== "object" || Array.isArray(params.preferences)) {
+      return {
+        error: createError("VALIDATION_ERROR", "preferences \u306F\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059")
+      };
+    }
+    if (Object.keys(params.preferences).length === 0) {
+      return {
+        error: createError("VALIDATION_ERROR", "\u66F4\u65B0\u3059\u308B\u30D5\u30A3\u30FC\u30EB\u30C9\u30921\u3064\u4EE5\u4E0A\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044")
+      };
+    }
+    return fetchWithAuth(
+      `${EXT_NOTIFICATION_PREFERENCES_ENDPOINT}?${buildQuery(params.organizationId)}`,
+      {
+        method: "PATCH",
+        body: JSON.stringify({ preferences: params.preferences })
+      }
+    );
+  }
+  return { getNotificationPreferences, updateNotificationPreferences };
+}
+
+// src/client/invite-methods.ts
+var EXT_INVITE_ENDPOINT = "/api/v1/organizations/ext/invite";
+function createInviteMethods(deps) {
+  const { fetchWithAuth, createError, serviceCode } = deps;
+  const assignableRoles = /* @__PURE__ */ new Set(["admin", "member", "viewer"]);
+  async function inviteMember(params) {
+    if (!params.organizationId || !params.email) {
+      return {
+        error: createError("VALIDATION_ERROR", "organizationId \u3068 email \u306F\u5FC5\u9808\u3067\u3059")
+      };
+    }
+    if (params.role !== void 0 && !assignableRoles.has(params.role)) {
+      return {
+        error: createError(
+          "VALIDATION_ERROR",
+          "role \u306F admin\u3001member\u3001viewer \u306E\u3044\u305A\u308C\u304B\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044"
+        )
+      };
+    }
+    const query = new URLSearchParams({
+      organizationId: params.organizationId,
+      serviceCode
+    }).toString();
+    return fetchWithAuth(`${EXT_INVITE_ENDPOINT}?${query}`, {
+      method: "POST",
+      body: JSON.stringify({ email: params.email, role: params.role })
+    });
+  }
+  return { inviteMember };
+}
+
+// src/client/org-membership-methods.ts
+var EXT_USER_ORGANIZATIONS_ENDPOINT = "/api/v1/users/ext/me/organizations";
+function createOrgMembershipMethods(deps) {
+  const { fetchWithAuth, createError } = deps;
+  async function leaveOrganization(params) {
+    if (!params || !params.organizationId) {
+      return {
+        error: createError("VALIDATION_ERROR", "organizationId \u306F\u5FC5\u9808\u3067\u3059")
+      };
+    }
+    let endpoint = `${EXT_USER_ORGANIZATIONS_ENDPOINT}/${encodeURIComponent(params.organizationId)}`;
+    if (params.userId) {
+      endpoint += `?${new URLSearchParams({ userId: params.userId }).toString()}`;
+    }
+    return fetchWithAuth(endpoint, {
+      method: "DELETE"
+    });
+  }
+  return { leaveOrganization };
+}
+
+// src/client/noncontract-methods.ts
+function createNonContractMethods(deps) {
+  const { fetchWithAuth, createError, serviceCode } = deps;
+  return {
+    ...createLoginHistoryMethods({ fetchWithAuth, createError }),
+    ...createOrganizationDomainsMethods({ fetchWithAuth, createError, serviceCode }),
+    ...createNotificationPreferencesMethods({ fetchWithAuth, createError, serviceCode }),
+    ...createInviteMethods({ fetchWithAuth, createError, serviceCode }),
+    ...createOrgMembershipMethods({ fetchWithAuth, createError })
+  };
+}
+
 // src/client/version-check.ts
-var SDK_VERSION = "5.12.0";
+var SDK_VERSION = "5.14.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1000,9 +1161,20 @@ function createOAuthTokenMethods(deps) {
     logger,
     errorCodes
   } = deps;
-  async function exchangeCodeForTokens(code, codeVerifier) {
+  async function exchangeCodeForTokens(code, codeVerifier, opts) {
     const url = `${baseUrl}${OAUTH_TOKEN_ENDPOINT}`;
     logger.debug("Exchanging code for tokens:", url);
+    if (opts?.expectedState !== void 0 || opts?.actualState !== void 0) {
+      if (opts?.expectedState !== opts?.actualState) {
+        logger.error("Token exchange aborted: OAuth state mismatch or omitted (possible CSRF)");
+        return {
+          error: {
+            code: errorCodes.STATE_MISMATCH_ERROR,
+            message: "OAuth state \u304C\u4E00\u81F4\u3057\u307E\u305B\u3093\u3002CSRF \u306E\u53EF\u80FD\u6027\u304C\u3042\u308B\u305F\u3081\u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+          }
+        };
+      }
+    }
     const effectiveRedirectUri = resolvedRedirectUri ?? (typeof window !== "undefined" ? window.location.origin + window.location.pathname : null);
     if (!effectiveRedirectUri) {
       logger.error("redirectUri is required for token exchange in SSR environments. Set config.redirectUri explicitly.");
@@ -1447,6 +1619,46 @@ function base64UrlEncode(buffer) {
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 
+// src/auth/state.ts
+var STATE_STORAGE_KEY = "ffid_oauth_state";
+var STATE_FALLBACK_STORAGE_KEY = "ffid_oauth_state_fb";
+var STATE_FALLBACK_TIMESTAMP_KEY = "ffid_oauth_state_fb_ts";
+function storeState(state, logger) {
+  if (typeof window === "undefined") {
+    logger?.warn("storeState: storage is not available in SSR context");
+    return false;
+  }
+  let sessionStored = false;
+  try {
+    window.sessionStorage.setItem(STATE_STORAGE_KEY, state);
+    sessionStored = true;
+  } catch (error) {
+    logger?.warn("storeState: sessionStorage \u3078\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  let localStored = false;
+  try {
+    window.localStorage.setItem(STATE_FALLBACK_STORAGE_KEY, state);
+    window.localStorage.setItem(STATE_FALLBACK_TIMESTAMP_KEY, String(Date.now()));
+    localStored = true;
+  } catch (error) {
+    logger?.warn("storeState: localStorage fallback \u3078\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  return sessionStored || localStored;
+}
+function cleanupStateStorage(logger) {
+  try {
+    window.sessionStorage.removeItem(STATE_STORAGE_KEY);
+  } catch (error) {
+    logger?.warn("retrieveState: sessionStorage \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  try {
+    window.localStorage.removeItem(STATE_FALLBACK_STORAGE_KEY);
+    window.localStorage.removeItem(STATE_FALLBACK_TIMESTAMP_KEY);
+  } catch (error) {
+    logger?.warn("retrieveState: localStorage \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+}
+
 // src/client/redirect.ts
 var OAUTH_AUTHORIZE_ENDPOINT = "/api/v1/oauth/authorize";
 var AUTH_LOGOUT_ENDPOINT = "/api/v1/auth/logout";
@@ -1578,6 +1790,7 @@ function createRedirectMethods(deps) {
     const recentCount = getRecentRedirectCount(authorizeKey, now, logger);
     if (recentCount >= REDIRECT_LOOP_THRESHOLD) {
       cleanupVerifierStorage(logger);
+      cleanupStateStorage(logger);
       logger.warn("[FFID SDK] redirect loop detected \u2014 \u81EA\u52D5\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3092\u505C\u6B62\u3057\u307E\u3057\u305F", {
         authorizeKey,
         recentCount,
@@ -1601,6 +1814,11 @@ function createRedirectMethods(deps) {
       return { success: false, error: errorMessage };
     }
     const state = generateRandomState();
+    if (!storeState(state, logger)) {
+      logger.error(
+        "redirectToAuthorize: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF\u3067\u306E CSRF \u691C\u8A3C\u304C\u5931\u6557\u3057\u307E\u3059"
+      );
+    }
     const redirectUri = resolvedRedirectUri ?? window.location.origin + window.location.pathname;
     const params = new URLSearchParams({
       response_type: "code",
@@ -2315,7 +2533,8 @@ var FFID_ERROR_CODES = {
   TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR",
   TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR",
   NO_TOKENS: "NO_TOKENS",
-  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR"
+  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR",
+  STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR"
 };
 var EXT_CHECK_ENDPOINT = "/api/v1/subscriptions/ext/check";
 var DEFAULT_ALLOW_GRACE = true;
@@ -2703,6 +2922,18 @@ function createFFIDClient(config) {
     fetchWithAuth,
     createError
   });
+  const {
+    getLoginHistory,
+    getOrganizationDomains,
+    getNotificationPreferences,
+    updateNotificationPreferences,
+    inviteMember,
+    leaveOrganization
+  } = createNonContractMethods({
+    fetchWithAuth,
+    createError,
+    serviceCode: config.serviceCode
+  });
   const { getAnalyticsConfig } = createAnalyticsMethods({
     fetchWithAuth,
     createError
@@ -2783,6 +3014,13 @@ function createFFIDClient(config) {
     removeMember,
     getProfile,
     updateProfile,
+    // Non-contract ext API coverage (#3783)
+    getLoginHistory,
+    getOrganizationDomains,
+    getNotificationPreferences,
+    updateNotificationPreferences,
+    inviteMember,
+    leaveOrganization,
     getAnalyticsConfig,
     createCheckoutSession,
     createPortalSession,

package/dist/server/test/index.d.cts

@@ -1,4 +1,4 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-Dx4oc4Cw.cjs';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-CKFxY60u.cjs';
 import '../../types-BeVl-z12.cjs';
 
 /**

package/dist/server/test/index.d.ts

@@ -1,4 +1,4 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-5IprSUVR.js';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-9-lh0G_h.js';
 import '../../types-BeVl-z12.js';
 
 /**