@feelflow/ffid-sdk 5.2.3 → 5.3.1

package/dist/consent/index.cjs

@@ -1,258 +1,258 @@
 'use strict';
 
-var chunk3NSKF6TB_cjs = require('../chunk-3NSKF6TB.cjs');
+var chunkQZN4WZCV_cjs = require('../chunk-QZN4WZCV.cjs');
 
 
 
 Object.defineProperty(exports, "ALL_DENIED_EXCEPT_NECESSARY", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.ALL_DENIED_EXCEPT_NECESSARY; }
+  get: function () { return chunkQZN4WZCV_cjs.ALL_DENIED_EXCEPT_NECESSARY; }
 });
 Object.defineProperty(exports, "CONSENT_COOKIE_MAX_AGE_SEC", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.CONSENT_COOKIE_MAX_AGE_SEC; }
+  get: function () { return chunkQZN4WZCV_cjs.CONSENT_COOKIE_MAX_AGE_SEC; }
 });
 Object.defineProperty(exports, "CONSENT_COOKIE_NAME", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.CONSENT_COOKIE_NAME; }
+  get: function () { return chunkQZN4WZCV_cjs.CONSENT_COOKIE_NAME; }
 });
 Object.defineProperty(exports, "CONSENT_DISMISSAL_TIMESTAMP_KEY", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.CONSENT_DISMISSAL_TIMESTAMP_KEY; }
+  get: function () { return chunkQZN4WZCV_cjs.CONSENT_DISMISSAL_TIMESTAMP_KEY; }
 });
 Object.defineProperty(exports, "CONSENT_SESSION_STORAGE_KEY", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.CONSENT_SESSION_STORAGE_KEY; }
+  get: function () { return chunkQZN4WZCV_cjs.CONSENT_SESSION_STORAGE_KEY; }
 });
 Object.defineProperty(exports, "COOKIE_VERSION", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.COOKIE_VERSION; }
+  get: function () { return chunkQZN4WZCV_cjs.COOKIE_VERSION; }
 });
 Object.defineProperty(exports, "DEFAULT_CONSENT_ERROR_MESSAGES", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.DEFAULT_CONSENT_ERROR_MESSAGES; }
+  get: function () { return chunkQZN4WZCV_cjs.DEFAULT_CONSENT_ERROR_MESSAGES; }
 });
 Object.defineProperty(exports, "DEFAULT_MERGE_WARNING_MESSAGES", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.DEFAULT_MERGE_WARNING_MESSAGES; }
+  get: function () { return chunkQZN4WZCV_cjs.DEFAULT_MERGE_WARNING_MESSAGES; }
 });
 Object.defineProperty(exports, "DEVICE_ID_LOCAL_STORAGE_KEY", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.DEVICE_ID_LOCAL_STORAGE_KEY; }
+  get: function () { return chunkQZN4WZCV_cjs.DEVICE_ID_LOCAL_STORAGE_KEY; }
 });
 Object.defineProperty(exports, "DEVICE_ID_SESSION_STORAGE_KEY", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.DEVICE_ID_SESSION_STORAGE_KEY; }
+  get: function () { return chunkQZN4WZCV_cjs.DEVICE_ID_SESSION_STORAGE_KEY; }
 });
 Object.defineProperty(exports, "DeviceIdSchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.DeviceIdSchema; }
+  get: function () { return chunkQZN4WZCV_cjs.DeviceIdSchema; }
 });
 Object.defineProperty(exports, "FFIDAnalyticsProvider", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFIDAnalyticsProvider; }
+  get: function () { return chunkQZN4WZCV_cjs.FFIDAnalyticsProvider; }
 });
 Object.defineProperty(exports, "FFIDConsentCategoriesSchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFIDConsentCategoriesSchema; }
+  get: function () { return chunkQZN4WZCV_cjs.FFIDConsentCategoriesSchema; }
 });
 Object.defineProperty(exports, "FFIDConsentCategoryCodeSchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFIDConsentCategoryCodeSchema; }
+  get: function () { return chunkQZN4WZCV_cjs.FFIDConsentCategoryCodeSchema; }
 });
 Object.defineProperty(exports, "FFIDConsentCategoryMetadataSchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFIDConsentCategoryMetadataSchema; }
+  get: function () { return chunkQZN4WZCV_cjs.FFIDConsentCategoryMetadataSchema; }
 });
 Object.defineProperty(exports, "FFIDConsentContext", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFIDConsentContext; }
+  get: function () { return chunkQZN4WZCV_cjs.FFIDConsentContext; }
 });
 Object.defineProperty(exports, "FFIDConsentError", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFIDConsentError; }
+  get: function () { return chunkQZN4WZCV_cjs.FFIDConsentError; }
 });
 Object.defineProperty(exports, "FFIDConsentMergeStrategySchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFIDConsentMergeStrategySchema; }
+  get: function () { return chunkQZN4WZCV_cjs.FFIDConsentMergeStrategySchema; }
 });
 Object.defineProperty(exports, "FFIDConsentMergeWarningSchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFIDConsentMergeWarningSchema; }
+  get: function () { return chunkQZN4WZCV_cjs.FFIDConsentMergeWarningSchema; }
 });
 Object.defineProperty(exports, "FFIDConsentSourceSchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFIDConsentSourceSchema; }
+  get: function () { return chunkQZN4WZCV_cjs.FFIDConsentSourceSchema; }
 });
 Object.defineProperty(exports, "FFIDConsentStateSchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFIDConsentStateSchema; }
+  get: function () { return chunkQZN4WZCV_cjs.FFIDConsentStateSchema; }
 });
 Object.defineProperty(exports, "FFIDConsentUpdateSchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFIDConsentUpdateSchema; }
+  get: function () { return chunkQZN4WZCV_cjs.FFIDConsentUpdateSchema; }
 });
 Object.defineProperty(exports, "FFIDCookieBanner", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFIDCookieBanner; }
+  get: function () { return chunkQZN4WZCV_cjs.FFIDCookieBanner; }
 });
 Object.defineProperty(exports, "FFIDCookieLink", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFIDCookieLink; }
+  get: function () { return chunkQZN4WZCV_cjs.FFIDCookieLink; }
 });
 Object.defineProperty(exports, "FFIDCookiePolicySchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFIDCookiePolicySchema; }
+  get: function () { return chunkQZN4WZCV_cjs.FFIDCookiePolicySchema; }
 });
 Object.defineProperty(exports, "FFIDCookieSettings", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFIDCookieSettings; }
+  get: function () { return chunkQZN4WZCV_cjs.FFIDCookieSettings; }
 });
 Object.defineProperty(exports, "FFIDInternalConsentSourceSchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFIDInternalConsentSourceSchema; }
+  get: function () { return chunkQZN4WZCV_cjs.FFIDInternalConsentSourceSchema; }
 });
 Object.defineProperty(exports, "FFIDPublicConsentSourceSchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFIDPublicConsentSourceSchema; }
+  get: function () { return chunkQZN4WZCV_cjs.FFIDPublicConsentSourceSchema; }
 });
 Object.defineProperty(exports, "FFID_CONSENT_ERROR_CODES", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFID_CONSENT_ERROR_CODES; }
+  get: function () { return chunkQZN4WZCV_cjs.FFID_CONSENT_ERROR_CODES; }
 });
 Object.defineProperty(exports, "FFID_CONSENT_NOT_DECIDED_STATE", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.FFID_CONSENT_NOT_DECIDED_STATE; }
+  get: function () { return chunkQZN4WZCV_cjs.FFID_CONSENT_NOT_DECIDED_STATE; }
 });
 Object.defineProperty(exports, "GetCategoriesWireSchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.GetCategoriesWireSchema; }
+  get: function () { return chunkQZN4WZCV_cjs.GetCategoriesWireSchema; }
 });
 Object.defineProperty(exports, "GetConsentMeWireSchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.GetConsentMeWireSchema; }
+  get: function () { return chunkQZN4WZCV_cjs.GetConsentMeWireSchema; }
 });
 Object.defineProperty(exports, "GetDocumentWireSchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.GetDocumentWireSchema; }
+  get: function () { return chunkQZN4WZCV_cjs.GetDocumentWireSchema; }
 });
 Object.defineProperty(exports, "PostConsentRequestSchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.PostConsentRequestSchema; }
+  get: function () { return chunkQZN4WZCV_cjs.PostConsentRequestSchema; }
 });
 Object.defineProperty(exports, "PostConsentWireSchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.PostConsentWireSchema; }
+  get: function () { return chunkQZN4WZCV_cjs.PostConsentWireSchema; }
 });
 Object.defineProperty(exports, "PostSyncRequestSchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.PostSyncRequestSchema; }
+  get: function () { return chunkQZN4WZCV_cjs.PostSyncRequestSchema; }
 });
 Object.defineProperty(exports, "PostSyncWireSchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.PostSyncWireSchema; }
+  get: function () { return chunkQZN4WZCV_cjs.PostSyncWireSchema; }
 });
 Object.defineProperty(exports, "PostWithdrawWireSchema", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.PostWithdrawWireSchema; }
+  get: function () { return chunkQZN4WZCV_cjs.PostWithdrawWireSchema; }
 });
 Object.defineProperty(exports, "clearConsentDismissalTimestamp", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.clearConsentDismissalTimestamp; }
+  get: function () { return chunkQZN4WZCV_cjs.clearConsentDismissalTimestamp; }
 });
 Object.defineProperty(exports, "clearConsentSessionMirror", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.clearConsentSessionMirror; }
+  get: function () { return chunkQZN4WZCV_cjs.clearConsentSessionMirror; }
 });
 Object.defineProperty(exports, "clearDeviceId", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.clearDeviceId; }
+  get: function () { return chunkQZN4WZCV_cjs.clearDeviceId; }
 });
 Object.defineProperty(exports, "createConsentClient", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.createConsentClient; }
+  get: function () { return chunkQZN4WZCV_cjs.createConsentClient; }
 });
 Object.defineProperty(exports, "createGtagBridge", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.createGtagBridge; }
+  get: function () { return chunkQZN4WZCV_cjs.createGtagBridge; }
 });
 Object.defineProperty(exports, "decodeConsentCookie", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.decodeConsentCookie; }
+  get: function () { return chunkQZN4WZCV_cjs.decodeConsentCookie; }
 });
 Object.defineProperty(exports, "deleteConsentCookie", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.deleteConsentCookie; }
+  get: function () { return chunkQZN4WZCV_cjs.deleteConsentCookie; }
 });
 Object.defineProperty(exports, "encodeConsentCookie", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.encodeConsentCookie; }
+  get: function () { return chunkQZN4WZCV_cjs.encodeConsentCookie; }
 });
 Object.defineProperty(exports, "generateDeviceId", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.generateDeviceId; }
+  get: function () { return chunkQZN4WZCV_cjs.generateDeviceId; }
 });
 Object.defineProperty(exports, "getOrCreateDeviceId", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.getOrCreateDeviceId; }
+  get: function () { return chunkQZN4WZCV_cjs.getOrCreateDeviceId; }
 });
 Object.defineProperty(exports, "isUuidV7", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.isUuidV7; }
+  get: function () { return chunkQZN4WZCV_cjs.isUuidV7; }
 });
 Object.defineProperty(exports, "isValidDeviceId", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.isValidDeviceId; }
+  get: function () { return chunkQZN4WZCV_cjs.isValidDeviceId; }
 });
 Object.defineProperty(exports, "mapCategoriesToGtagParams", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.mapCategoriesToGtagParams; }
+  get: function () { return chunkQZN4WZCV_cjs.mapCategoriesToGtagParams; }
 });
 Object.defineProperty(exports, "mapConsentWireToState", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.mapConsentWireToState; }
+  get: function () { return chunkQZN4WZCV_cjs.mapConsentWireToState; }
 });
 Object.defineProperty(exports, "mapMeWireToState", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.mapMeWireToState; }
+  get: function () { return chunkQZN4WZCV_cjs.mapMeWireToState; }
 });
 Object.defineProperty(exports, "mapSyncWireToResult", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.mapSyncWireToResult; }
+  get: function () { return chunkQZN4WZCV_cjs.mapSyncWireToResult; }
 });
 Object.defineProperty(exports, "mapWithdrawWireToState", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.mapWithdrawWireToState; }
+  get: function () { return chunkQZN4WZCV_cjs.mapWithdrawWireToState; }
 });
 Object.defineProperty(exports, "readConsentCookie", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.readConsentCookie; }
+  get: function () { return chunkQZN4WZCV_cjs.readConsentCookie; }
 });
 Object.defineProperty(exports, "readConsentDismissalTimestamp", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.readConsentDismissalTimestamp; }
+  get: function () { return chunkQZN4WZCV_cjs.readConsentDismissalTimestamp; }
 });
 Object.defineProperty(exports, "readConsentSessionMirror", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.readConsentSessionMirror; }
+  get: function () { return chunkQZN4WZCV_cjs.readConsentSessionMirror; }
 });
 Object.defineProperty(exports, "useFFIDConsent", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.useFFIDConsent; }
+  get: function () { return chunkQZN4WZCV_cjs.useFFIDConsent; }
 });
 Object.defineProperty(exports, "useFFIDConsentPreferences", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.useFFIDConsentPreferences; }
+  get: function () { return chunkQZN4WZCV_cjs.useFFIDConsentPreferences; }
 });
 Object.defineProperty(exports, "writeConsentCookie", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.writeConsentCookie; }
+  get: function () { return chunkQZN4WZCV_cjs.writeConsentCookie; }
 });
 Object.defineProperty(exports, "writeConsentDismissalTimestamp", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.writeConsentDismissalTimestamp; }
+  get: function () { return chunkQZN4WZCV_cjs.writeConsentDismissalTimestamp; }
 });
 Object.defineProperty(exports, "writeConsentSessionMirror", {
   enumerable: true,
-  get: function () { return chunk3NSKF6TB_cjs.writeConsentSessionMirror; }
+  get: function () { return chunkQZN4WZCV_cjs.writeConsentSessionMirror; }
 });

package/dist/consent/index.js

@@ -1 +1 @@
-export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_MAX_AGE_SEC, CONSENT_COOKIE_NAME, CONSENT_DISMISSAL_TIMESTAMP_KEY, CONSENT_SESSION_STORAGE_KEY, COOKIE_VERSION, DEFAULT_CONSENT_ERROR_MESSAGES, DEFAULT_MERGE_WARNING_MESSAGES, DEVICE_ID_LOCAL_STORAGE_KEY, DEVICE_ID_SESSION_STORAGE_KEY, DeviceIdSchema, FFIDAnalyticsProvider, FFIDConsentCategoriesSchema, FFIDConsentCategoryCodeSchema, FFIDConsentCategoryMetadataSchema, FFIDConsentContext, FFIDConsentError, FFIDConsentMergeStrategySchema, FFIDConsentMergeWarningSchema, FFIDConsentSourceSchema, FFIDConsentStateSchema, FFIDConsentUpdateSchema, FFIDCookieBanner, FFIDCookieLink, FFIDCookiePolicySchema, FFIDCookieSettings, FFIDInternalConsentSourceSchema, FFIDPublicConsentSourceSchema, FFID_CONSENT_ERROR_CODES, FFID_CONSENT_NOT_DECIDED_STATE, GetCategoriesWireSchema, GetConsentMeWireSchema, GetDocumentWireSchema, PostConsentRequestSchema, PostConsentWireSchema, PostSyncRequestSchema, PostSyncWireSchema, PostWithdrawWireSchema, clearConsentDismissalTimestamp, clearConsentSessionMirror, clearDeviceId, createConsentClient, createGtagBridge, decodeConsentCookie, deleteConsentCookie, encodeConsentCookie, generateDeviceId, getOrCreateDeviceId, isUuidV7, isValidDeviceId, mapCategoriesToGtagParams, mapConsentWireToState, mapMeWireToState, mapSyncWireToResult, mapWithdrawWireToState, readConsentCookie, readConsentDismissalTimestamp, readConsentSessionMirror, useFFIDConsent, useFFIDConsentPreferences, writeConsentCookie, writeConsentDismissalTimestamp, writeConsentSessionMirror } from '../chunk-HF3BM6K6.js';
+export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_MAX_AGE_SEC, CONSENT_COOKIE_NAME, CONSENT_DISMISSAL_TIMESTAMP_KEY, CONSENT_SESSION_STORAGE_KEY, COOKIE_VERSION, DEFAULT_CONSENT_ERROR_MESSAGES, DEFAULT_MERGE_WARNING_MESSAGES, DEVICE_ID_LOCAL_STORAGE_KEY, DEVICE_ID_SESSION_STORAGE_KEY, DeviceIdSchema, FFIDAnalyticsProvider, FFIDConsentCategoriesSchema, FFIDConsentCategoryCodeSchema, FFIDConsentCategoryMetadataSchema, FFIDConsentContext, FFIDConsentError, FFIDConsentMergeStrategySchema, FFIDConsentMergeWarningSchema, FFIDConsentSourceSchema, FFIDConsentStateSchema, FFIDConsentUpdateSchema, FFIDCookieBanner, FFIDCookieLink, FFIDCookiePolicySchema, FFIDCookieSettings, FFIDInternalConsentSourceSchema, FFIDPublicConsentSourceSchema, FFID_CONSENT_ERROR_CODES, FFID_CONSENT_NOT_DECIDED_STATE, GetCategoriesWireSchema, GetConsentMeWireSchema, GetDocumentWireSchema, PostConsentRequestSchema, PostConsentWireSchema, PostSyncRequestSchema, PostSyncWireSchema, PostWithdrawWireSchema, clearConsentDismissalTimestamp, clearConsentSessionMirror, clearDeviceId, createConsentClient, createGtagBridge, decodeConsentCookie, deleteConsentCookie, encodeConsentCookie, generateDeviceId, getOrCreateDeviceId, isUuidV7, isValidDeviceId, mapCategoriesToGtagParams, mapConsentWireToState, mapMeWireToState, mapSyncWireToResult, mapWithdrawWireToState, readConsentCookie, readConsentDismissalTimestamp, readConsentSessionMirror, useFFIDConsent, useFFIDConsentPreferences, writeConsentCookie, writeConsentDismissalTimestamp, writeConsentSessionMirror } from '../chunk-IVKFKMLQ.js';

package/dist/{ffid-client-DgprK2ec.d.cts → ffid-client-CARfFhtf.d.cts}

@@ -674,13 +674,27 @@ interface FFIDSubscription {
 interface FFIDOAuthUserInfoSubscription {
     subscriptionId: string | null;
     status: FFIDSubscriptionStatus | null;
+    /**
+     * Access-control-oriented effective status (since SDK 5.3.0 / FFID #3353).
+     *
+     * Mirrors `computeEffectiveStatus` on FFID so external callers can branch on
+     * a single value without re-implementing grace-period math. Will be `null`
+     * when serving an older FFID that does not populate the field.
+     */
+    effectiveStatus: EffectiveSubscriptionStatus | null;
     planCode: string | null;
     seatModel: FFIDSeatModel | null;
     memberRole: FFIDOAuthUserInfoMemberRole | null;
     organizationId: string | null;
     hasSeatAssignment: boolean | null;
 }
-/** OAuth userinfo response exposed by FFID */
+/**
+ * Unified user-identity shape returned by `getSession()` (→ `/oauth/userinfo`)
+ * and `verifyAccessToken()` (JWT or introspect path). `subscription` and
+ * `organizationId` are scope-gated on `/oauth/userinfo` (FFID #3380, requires
+ * `subscription:read`); JWT-verify additionally omits `subscription` always.
+ * See per-field JSDoc — misreading `undefined` is a security regression.
+ */
 interface FFIDOAuthUserInfo {
     sub: string;
     email: string | null;
@@ -690,7 +704,28 @@ interface FFIDOAuthUserInfo {
     department?: string | null | undefined;
     position?: string | null | undefined;
     phoneNumber?: string | null | undefined;
+    /**
+     * Organization UUID, `null` if token is not org-bound, or `undefined` if the
+     * granted scope omits `subscription:read` (FFID #3380; widen scope to receive
+     * — NOT "no organization").
+     */
     organizationId?: string | null | undefined;
+    /**
+     * Subscription summary for `(user, service, organization)`. Branch on
+     * `effectiveStatus` (5.3.0+) for access decisions.
+     *
+     * `undefined` here means either (a) `/oauth/userinfo` granted scope omits
+     * `subscription:read` (FFID #3380), or (b) caller used `verifyAccessToken`
+     * with `verifyStrategy: 'jwt'` (and no `includeProfile: true`) — JWT payload
+     * does not carry subscription claims. NEITHER means "no contract":
+     * contractless users hit HTTP 403 upstream and never reach this field.
+     * Treating `undefined` as "no contract" is a **security regression** that
+     * would grant non-paying UX to a paying user. `DEFAULT_OAUTH_SCOPES` grants
+     * `subscription:read`; narrow-scope or jwt-only callers should branch
+     * explicitly instead of `userinfo.subscription!`.
+     *
+     * @see {@link FFIDOAuthUserInfoSubscription.effectiveStatus}
+     */
     subscription?: FFIDOAuthUserInfoSubscription | undefined;
 }
 /** Options for verifyAccessToken */

package/dist/{ffid-client-BaStAONh.d.ts → ffid-client-w1s-JnFf.d.ts}

@@ -674,13 +674,27 @@ interface FFIDSubscription {
 interface FFIDOAuthUserInfoSubscription {
     subscriptionId: string | null;
     status: FFIDSubscriptionStatus | null;
+    /**
+     * Access-control-oriented effective status (since SDK 5.3.0 / FFID #3353).
+     *
+     * Mirrors `computeEffectiveStatus` on FFID so external callers can branch on
+     * a single value without re-implementing grace-period math. Will be `null`
+     * when serving an older FFID that does not populate the field.
+     */
+    effectiveStatus: EffectiveSubscriptionStatus | null;
     planCode: string | null;
     seatModel: FFIDSeatModel | null;
     memberRole: FFIDOAuthUserInfoMemberRole | null;
     organizationId: string | null;
     hasSeatAssignment: boolean | null;
 }
-/** OAuth userinfo response exposed by FFID */
+/**
+ * Unified user-identity shape returned by `getSession()` (→ `/oauth/userinfo`)
+ * and `verifyAccessToken()` (JWT or introspect path). `subscription` and
+ * `organizationId` are scope-gated on `/oauth/userinfo` (FFID #3380, requires
+ * `subscription:read`); JWT-verify additionally omits `subscription` always.
+ * See per-field JSDoc — misreading `undefined` is a security regression.
+ */
 interface FFIDOAuthUserInfo {
     sub: string;
     email: string | null;
@@ -690,7 +704,28 @@ interface FFIDOAuthUserInfo {
     department?: string | null | undefined;
     position?: string | null | undefined;
     phoneNumber?: string | null | undefined;
+    /**
+     * Organization UUID, `null` if token is not org-bound, or `undefined` if the
+     * granted scope omits `subscription:read` (FFID #3380; widen scope to receive
+     * — NOT "no organization").
+     */
     organizationId?: string | null | undefined;
+    /**
+     * Subscription summary for `(user, service, organization)`. Branch on
+     * `effectiveStatus` (5.3.0+) for access decisions.
+     *
+     * `undefined` here means either (a) `/oauth/userinfo` granted scope omits
+     * `subscription:read` (FFID #3380), or (b) caller used `verifyAccessToken`
+     * with `verifyStrategy: 'jwt'` (and no `includeProfile: true`) — JWT payload
+     * does not carry subscription claims. NEITHER means "no contract":
+     * contractless users hit HTTP 403 upstream and never reach this field.
+     * Treating `undefined` as "no contract" is a **security regression** that
+     * would grant non-paying UX to a paying user. `DEFAULT_OAUTH_SCOPES` grants
+     * `subscription:read`; narrow-scope or jwt-only callers should branch
+     * explicitly instead of `userinfo.subscription!`.
+     *
+     * @see {@link FFIDOAuthUserInfoSubscription.effectiveStatus}
+     */
     subscription?: FFIDOAuthUserInfoSubscription | undefined;
 }
 /** Options for verifyAccessToken */

package/dist/{index-CInGR4I9.d.cts → index-DfnHXRMX.d.cts}

@@ -241,13 +241,27 @@ interface FFIDSubscription {
 interface FFIDOAuthUserInfoSubscription {
     subscriptionId: string | null;
     status: FFIDSubscriptionStatus | null;
+    /**
+     * Access-control-oriented effective status (since SDK 5.3.0 / FFID #3353).
+     *
+     * Mirrors `computeEffectiveStatus` on FFID so external callers can branch on
+     * a single value without re-implementing grace-period math. Will be `null`
+     * when serving an older FFID that does not populate the field.
+     */
+    effectiveStatus: EffectiveSubscriptionStatus | null;
     planCode: string | null;
     seatModel: FFIDSeatModel | null;
     memberRole: FFIDOAuthUserInfoMemberRole | null;
     organizationId: string | null;
     hasSeatAssignment: boolean | null;
 }
-/** OAuth userinfo response exposed by FFID */
+/**
+ * Unified user-identity shape returned by `getSession()` (→ `/oauth/userinfo`)
+ * and `verifyAccessToken()` (JWT or introspect path). `subscription` and
+ * `organizationId` are scope-gated on `/oauth/userinfo` (FFID #3380, requires
+ * `subscription:read`); JWT-verify additionally omits `subscription` always.
+ * See per-field JSDoc — misreading `undefined` is a security regression.
+ */
 interface FFIDOAuthUserInfo {
     sub: string;
     email: string | null;
@@ -257,7 +271,28 @@ interface FFIDOAuthUserInfo {
     department?: string | null | undefined;
     position?: string | null | undefined;
     phoneNumber?: string | null | undefined;
+    /**
+     * Organization UUID, `null` if token is not org-bound, or `undefined` if the
+     * granted scope omits `subscription:read` (FFID #3380; widen scope to receive
+     * — NOT "no organization").
+     */
     organizationId?: string | null | undefined;
+    /**
+     * Subscription summary for `(user, service, organization)`. Branch on
+     * `effectiveStatus` (5.3.0+) for access decisions.
+     *
+     * `undefined` here means either (a) `/oauth/userinfo` granted scope omits
+     * `subscription:read` (FFID #3380), or (b) caller used `verifyAccessToken`
+     * with `verifyStrategy: 'jwt'` (and no `includeProfile: true`) — JWT payload
+     * does not carry subscription claims. NEITHER means "no contract":
+     * contractless users hit HTTP 403 upstream and never reach this field.
+     * Treating `undefined` as "no contract" is a **security regression** that
+     * would grant non-paying UX to a paying user. `DEFAULT_OAUTH_SCOPES` grants
+     * `subscription:read`; narrow-scope or jwt-only callers should branch
+     * explicitly instead of `userinfo.subscription!`.
+     *
+     * @see {@link FFIDOAuthUserInfoSubscription.effectiveStatus}
+     */
     subscription?: FFIDOAuthUserInfoSubscription | undefined;
 }
 /** Options for verifyAccessToken */
@@ -826,6 +861,8 @@ interface FFIDTokenIntrospectionResponse {
     subscription?: {
         subscription_id: string | null;
         status: FFIDOAuthUserInfoSubscription['status'];
+        /** Optional for backward compat with older FFID (< 5.3.0 / #3353). */
+        effective_status?: FFIDOAuthUserInfoSubscription['effectiveStatus'];
         plan_code: string | null;
         seat_model: FFIDOAuthUserInfoSubscription['seatModel'];
         member_role: FFIDOAuthUserInfoSubscription['memberRole'];

package/dist/{index-CInGR4I9.d.ts → index-DfnHXRMX.d.ts}

@@ -241,13 +241,27 @@ interface FFIDSubscription {
 interface FFIDOAuthUserInfoSubscription {
     subscriptionId: string | null;
     status: FFIDSubscriptionStatus | null;
+    /**
+     * Access-control-oriented effective status (since SDK 5.3.0 / FFID #3353).
+     *
+     * Mirrors `computeEffectiveStatus` on FFID so external callers can branch on
+     * a single value without re-implementing grace-period math. Will be `null`
+     * when serving an older FFID that does not populate the field.
+     */
+    effectiveStatus: EffectiveSubscriptionStatus | null;
     planCode: string | null;
     seatModel: FFIDSeatModel | null;
     memberRole: FFIDOAuthUserInfoMemberRole | null;
     organizationId: string | null;
     hasSeatAssignment: boolean | null;
 }
-/** OAuth userinfo response exposed by FFID */
+/**
+ * Unified user-identity shape returned by `getSession()` (→ `/oauth/userinfo`)
+ * and `verifyAccessToken()` (JWT or introspect path). `subscription` and
+ * `organizationId` are scope-gated on `/oauth/userinfo` (FFID #3380, requires
+ * `subscription:read`); JWT-verify additionally omits `subscription` always.
+ * See per-field JSDoc — misreading `undefined` is a security regression.
+ */
 interface FFIDOAuthUserInfo {
     sub: string;
     email: string | null;
@@ -257,7 +271,28 @@ interface FFIDOAuthUserInfo {
     department?: string | null | undefined;
     position?: string | null | undefined;
     phoneNumber?: string | null | undefined;
+    /**
+     * Organization UUID, `null` if token is not org-bound, or `undefined` if the
+     * granted scope omits `subscription:read` (FFID #3380; widen scope to receive
+     * — NOT "no organization").
+     */
     organizationId?: string | null | undefined;
+    /**
+     * Subscription summary for `(user, service, organization)`. Branch on
+     * `effectiveStatus` (5.3.0+) for access decisions.
+     *
+     * `undefined` here means either (a) `/oauth/userinfo` granted scope omits
+     * `subscription:read` (FFID #3380), or (b) caller used `verifyAccessToken`
+     * with `verifyStrategy: 'jwt'` (and no `includeProfile: true`) — JWT payload
+     * does not carry subscription claims. NEITHER means "no contract":
+     * contractless users hit HTTP 403 upstream and never reach this field.
+     * Treating `undefined` as "no contract" is a **security regression** that
+     * would grant non-paying UX to a paying user. `DEFAULT_OAUTH_SCOPES` grants
+     * `subscription:read`; narrow-scope or jwt-only callers should branch
+     * explicitly instead of `userinfo.subscription!`.
+     *
+     * @see {@link FFIDOAuthUserInfoSubscription.effectiveStatus}
+     */
     subscription?: FFIDOAuthUserInfoSubscription | undefined;
 }
 /** Options for verifyAccessToken */
@@ -826,6 +861,8 @@ interface FFIDTokenIntrospectionResponse {
     subscription?: {
         subscription_id: string | null;
         status: FFIDOAuthUserInfoSubscription['status'];
+        /** Optional for backward compat with older FFID (< 5.3.0 / #3353). */
+        effective_status?: FFIDOAuthUserInfoSubscription['effectiveStatus'];
         plan_code: string | null;
         seat_model: FFIDOAuthUserInfoSubscription['seatModel'];
         member_role: FFIDOAuthUserInfoSubscription['memberRole'];