@feelflow/ffid-sdk 5.17.1 → 5.19.0

package/dist/server/index.js

@@ -1,6 +1,6 @@
 import { DEFAULT_API_BASE_URL } from '../chunk-JEVK2XUM.js';
 export { DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES } from '../chunk-JEVK2XUM.js';
-import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { createRemoteJWKSet, jwtVerify, errors } from 'jose';
 
 // src/auth/token-store.ts
 var STORAGE_KEY = "ffid_tokens";
@@ -224,10 +224,29 @@ function createJwtVerifier(deps) {
       return { data: userInfo };
     } catch (error) {
       const message = error instanceof Error ? error.message : "JWT\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F";
-      logger.error("JWT verification failed:", message);
+      if (error instanceof errors.JWTExpired) {
+        logger.debug("JWT verification failed (token expired):", message);
+        return {
+          error: createError(
+            errorCodes.TOKEN_EXPIRED,
+            "\u30A2\u30AF\u30BB\u30B9\u30C8\u30FC\u30AF\u30F3\u306E\u6709\u52B9\u671F\u9650\u304C\u5207\u308C\u3066\u3044\u307E\u3059"
+          )
+        };
+      }
+      const isTokenLevelError = error instanceof errors.JWTClaimValidationFailed || error instanceof errors.JWTInvalid || error instanceof errors.JWSInvalid || error instanceof errors.JWSSignatureVerificationFailed || error instanceof errors.JOSEAlgNotAllowed || error instanceof errors.JOSENotSupported || error instanceof errors.JWKSNoMatchingKey || error instanceof errors.JWKSMultipleMatchingKeys;
+      if (isTokenLevelError) {
+        logger.warn("JWT verification failed:", message);
+        return {
+          error: createError(
+            errorCodes.TOKEN_VERIFICATION_ERROR,
+            `JWT\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${message}`
+          )
+        };
+      }
+      logger.error("JWT verification failed (JWKS fetch):", message);
       return {
         error: createError(
-          errorCodes.TOKEN_VERIFICATION_ERROR,
+          errorCodes.NETWORK_ERROR,
           `JWT\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${message}`
         )
       };
@@ -252,7 +271,9 @@ function createVerifyAccessToken(deps) {
         serviceCode,
         logger,
         createError,
-        errorCodes: { TOKEN_VERIFICATION_ERROR: errorCodes.TOKEN_VERIFICATION_ERROR }
+        // structural superset of JwtVerifierDeps.errorCodes — passing it
+        // wholesale removes the hand-transcription drift point
+        errorCodes
       });
     }
     return jwtVerify2;
@@ -848,6 +869,93 @@ function createMembersMethods(deps) {
   return { listMembers, addMember, updateMemberRole, removeMember };
 }
 
+// src/client/provisioning-methods.ts
+var USER_PROVISION_ENDPOINT = "/api/v1/ext/users/provision";
+var ORGANIZATION_PROVISION_ENDPOINT = "/api/v1/ext/organizations/provision";
+var MAX_PROVISION_MEMBERS = 100;
+var ASSIGNABLE_MEMBER_ROLES = {
+  admin: true,
+  member: true,
+  viewer: true
+};
+function isAssignableMemberRole(role) {
+  return Object.hasOwn(ASSIGNABLE_MEMBER_ROLES, role);
+}
+function createProvisioningMethods(deps) {
+  const { fetchWithAuth, createError, authMode } = deps;
+  function serviceKeyModeError() {
+    if (authMode === "service-key") return null;
+    return createError(
+      "VALIDATION_ERROR",
+      "provisionUser / provisionOrganization \u306F service-key \u8A8D\u8A3C\uFF08X-Service-Api-Key\uFF09\u3067\u306E\u307F\u5229\u7528\u3067\u304D\u307E\u3059\u3002Bearer / cookie \u30E2\u30FC\u30C9\u3067\u306F\u547C\u3073\u51FA\u305B\u307E\u305B\u3093"
+    );
+  }
+  async function provisionUser(params) {
+    const modeError = serviceKeyModeError();
+    if (modeError) return { error: modeError };
+    if (!params.email || !params.email.trim()) {
+      return { error: createError("VALIDATION_ERROR", "email \u306F\u5FC5\u9808\u3067\u3059") };
+    }
+    const body = { email: params.email.trim() };
+    if (params.profile !== void 0) body.profile = params.profile;
+    if (params.dryRun !== void 0) body.dryRun = params.dryRun;
+    return fetchWithAuth(USER_PROVISION_ENDPOINT, {
+      method: "POST",
+      body: JSON.stringify(body)
+    });
+  }
+  async function provisionOrganization(params) {
+    const modeError = serviceKeyModeError();
+    if (modeError) return { error: modeError };
+    if (!params.name || !params.name.trim()) {
+      return { error: createError("VALIDATION_ERROR", "name \u306F\u5FC5\u9808\u3067\u3059") };
+    }
+    if (!params.ownerEmail || !params.ownerEmail.trim()) {
+      return { error: createError("VALIDATION_ERROR", "ownerEmail \u306F\u5FC5\u9808\u3067\u3059") };
+    }
+    if (params.members) {
+      if (params.members.length > MAX_PROVISION_MEMBERS) {
+        return {
+          error: createError(
+            "VALIDATION_ERROR",
+            `members \u306F1\u30EA\u30AF\u30A8\u30B9\u30C8\u3042\u305F\u308A\u6700\u5927 ${MAX_PROVISION_MEMBERS} \u4EF6\u307E\u3067\u3067\u3059`
+          )
+        };
+      }
+      for (const member of params.members) {
+        if (!member.email || !member.email.trim()) {
+          return { error: createError("VALIDATION_ERROR", "members[].email \u306F\u5FC5\u9808\u3067\u3059") };
+        }
+        if (!isAssignableMemberRole(member.role)) {
+          return {
+            error: createError(
+              "VALIDATION_ERROR",
+              "members[].role \u306F admin\u3001member\u3001viewer \u306E\u3044\u305A\u308C\u304B\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044"
+            )
+          };
+        }
+      }
+    }
+    const body = {
+      name: params.name.trim(),
+      ownerEmail: params.ownerEmail.trim()
+    };
+    if (params.billingEmail !== void 0) body.billingEmail = params.billingEmail.trim();
+    if (params.members !== void 0) {
+      body.members = params.members.map((member) => ({
+        email: member.email.trim(),
+        role: member.role
+      }));
+    }
+    if (params.dryRun !== void 0) body.dryRun = params.dryRun;
+    return fetchWithAuth(ORGANIZATION_PROVISION_ENDPOINT, {
+      method: "POST",
+      body: JSON.stringify(body)
+    });
+  }
+  return { provisionUser, provisionOrganization };
+}
+
 // src/client/seat-methods.ts
 function seatsEndpoint(subscriptionId) {
   return `/api/v1/subscriptions/ext/${encodeURIComponent(subscriptionId)}/seats/assignments`;
@@ -1092,7 +1200,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.17.1";
+var SDK_VERSION = "5.19.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -2519,6 +2627,19 @@ var BLOCKING_EFFECTIVE_STATUSES = [
   "trial_expired"
 ];
 
+// src/client/error-codes.ts
+var FFID_ERROR_CODES = {
+  NETWORK_ERROR: "NETWORK_ERROR",
+  PARSE_ERROR: "PARSE_ERROR",
+  UNKNOWN_ERROR: "UNKNOWN_ERROR",
+  TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR",
+  TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR",
+  NO_TOKENS: "NO_TOKENS",
+  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR",
+  TOKEN_EXPIRED: "TOKEN_EXPIRED",
+  STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR"
+};
+
 // src/client/ffid-client.ts
 var UNAUTHORIZED_STATUS2 = 401;
 var SDK_LOG_PREFIX = "[FFID SDK]";
@@ -2527,8 +2648,10 @@ var noopLogger = {
   },
   info: () => {
   },
-  warn: (...args) => console.warn(SDK_LOG_PREFIX, ...args),
-  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
+  warn: () => {
+  },
+  error: () => {
+  }
 };
 var consoleLogger = {
   debug: (...args) => console.debug(SDK_LOG_PREFIX, ...args),
@@ -2536,16 +2659,6 @@ var consoleLogger = {
   warn: (...args) => console.warn(SDK_LOG_PREFIX, ...args),
   error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
 };
-var FFID_ERROR_CODES = {
-  NETWORK_ERROR: "NETWORK_ERROR",
-  PARSE_ERROR: "PARSE_ERROR",
-  UNKNOWN_ERROR: "UNKNOWN_ERROR",
-  TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR",
-  TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR",
-  NO_TOKENS: "NO_TOKENS",
-  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR",
-  STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR"
-};
 var EXT_CHECK_ENDPOINT = "/api/v1/subscriptions/ext/check";
 var DEFAULT_ALLOW_GRACE = true;
 var DEFAULT_SERVICE_ACCESS_FAIL_POLICY = "failClosed";
@@ -2928,6 +3041,11 @@ function createFFIDClient(config) {
     createError,
     serviceCode: config.serviceCode
   });
+  const { provisionUser, provisionOrganization } = createProvisioningMethods({
+    fetchWithAuth,
+    createError,
+    authMode
+  });
   const { getProfile, updateProfile } = createProfileMethods({
     fetchWithAuth,
     createError
@@ -3023,6 +3141,8 @@ function createFFIDClient(config) {
     addMember,
     updateMemberRole,
     removeMember,
+    provisionUser,
+    provisionOrganization,
     getProfile,
     updateProfile,
     // Non-contract ext API coverage (#3783)
@@ -3215,4 +3335,4 @@ function getFFIDConsentFromCookieHeader(cookieHeader) {
   return decodeConsentCookie(decodeURIComponent(value));
 }
 
-export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, COOKIE_VERSION, createFFIDClient, createKVCacheAdapter, createMemoryCacheAdapter, createTokenStore, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies };
+export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, COOKIE_VERSION, FFID_ERROR_CODES, createFFIDClient, createKVCacheAdapter, createMemoryCacheAdapter, createTokenStore, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies };

package/dist/server/test/index.d.cts

@@ -1,4 +1,4 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-Cwk6cG3b.cjs';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-BuDM5tmq.cjs';
 import '../../types-BeVl-z12.cjs';
 
 /**

package/dist/server/test/index.d.ts

@@ -1,4 +1,4 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-w8Twi5lD.js';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-D0x8TBS5.js';
 import '../../types-BeVl-z12.js';
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feelflow/ffid-sdk",
-  "version": "5.17.1",
+  "version": "5.19.0",
   "description": "FeelFlow ID Platform SDK for React/Next.js applications",
   "keywords": [
     "feelflow",