@feelflow/ffid-sdk 5.24.0 → 5.24.1

package/dist/{chunk-7A2P3NII.js → chunk-C4RNFEME.js}

@@ -89,7 +89,9 @@ function createMemoryStore() {
 function isTokenData(value) {
   if (typeof value !== "object" || value === null) return false;
   const obj = value;
-  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && typeof obj.expiresAt === "number";
+  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && // Number.isFinite also rejects NaN/Infinity (e.g. a crafted `1e999` JSON
+  // literal parses to Infinity and would never trip the expiry check — #4271)
+  typeof obj.expiresAt === "number" && Number.isFinite(obj.expiresAt);
 }
 function createTokenStore(storageType) {
   if (storageType === "memory") {
@@ -1225,7 +1227,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.24.0";
+var SDK_VERSION = "5.24.1";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1280,7 +1282,7 @@ function validateTokenResponse(tokenResponse) {
   if (!tokenResponse.refresh_token) {
     invalid.push("refresh_token");
   }
-  if (typeof tokenResponse.expires_in !== "number" || tokenResponse.expires_in <= 0) {
+  if (typeof tokenResponse.expires_in !== "number" || !Number.isFinite(tokenResponse.expires_in) || tokenResponse.expires_in <= 0) {
     invalid.push("expires_in");
   }
   if (invalid.length > 0) {

package/dist/{chunk-D7QD57HL.cjs → chunk-L5SBAHY3.cjs}

@@ -91,7 +91,9 @@ function createMemoryStore() {
 function isTokenData(value) {
   if (typeof value !== "object" || value === null) return false;
   const obj = value;
-  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && typeof obj.expiresAt === "number";
+  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && // Number.isFinite also rejects NaN/Infinity (e.g. a crafted `1e999` JSON
+  // literal parses to Infinity and would never trip the expiry check — #4271)
+  typeof obj.expiresAt === "number" && Number.isFinite(obj.expiresAt);
 }
 function createTokenStore(storageType) {
   if (storageType === "memory") {
@@ -1227,7 +1229,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.24.0";
+var SDK_VERSION = "5.24.1";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1282,7 +1284,7 @@ function validateTokenResponse(tokenResponse) {
   if (!tokenResponse.refresh_token) {
     invalid.push("refresh_token");
   }
-  if (typeof tokenResponse.expires_in !== "number" || tokenResponse.expires_in <= 0) {
+  if (typeof tokenResponse.expires_in !== "number" || !Number.isFinite(tokenResponse.expires_in) || tokenResponse.expires_in <= 0) {
     invalid.push("expires_in");
   }
   if (invalid.length > 0) {

package/dist/components/index.cjs

@@ -1,34 +1,34 @@
 'use strict';
 
-var chunkD7QD57HL_cjs = require('../chunk-D7QD57HL.cjs');
+var chunkL5SBAHY3_cjs = require('../chunk-L5SBAHY3.cjs');
 
 
 
 Object.defineProperty(exports, "FFIDAnnouncementBadge", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDAnnouncementBadge; }
+  get: function () { return chunkL5SBAHY3_cjs.FFIDAnnouncementBadge; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementList", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDAnnouncementList; }
+  get: function () { return chunkL5SBAHY3_cjs.FFIDAnnouncementList; }
 });
 Object.defineProperty(exports, "FFIDInquiryForm", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDInquiryForm; }
+  get: function () { return chunkL5SBAHY3_cjs.FFIDInquiryForm; }
 });
 Object.defineProperty(exports, "FFIDLoginButton", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDLoginButton; }
+  get: function () { return chunkL5SBAHY3_cjs.FFIDLoginButton; }
 });
 Object.defineProperty(exports, "FFIDOrganizationSwitcher", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDOrganizationSwitcher; }
+  get: function () { return chunkL5SBAHY3_cjs.FFIDOrganizationSwitcher; }
 });
 Object.defineProperty(exports, "FFIDSubscriptionBadge", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDSubscriptionBadge; }
+  get: function () { return chunkL5SBAHY3_cjs.FFIDSubscriptionBadge; }
 });
 Object.defineProperty(exports, "FFIDUserMenu", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDUserMenu; }
+  get: function () { return chunkL5SBAHY3_cjs.FFIDUserMenu; }
 });

package/dist/components/index.js

@@ -1 +1 @@
-export { FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDSubscriptionBadge, FFIDUserMenu } from '../chunk-7A2P3NII.js';
+export { FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDSubscriptionBadge, FFIDUserMenu } from '../chunk-C4RNFEME.js';

package/dist/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkD7QD57HL_cjs = require('./chunk-D7QD57HL.cjs');
+var chunkL5SBAHY3_cjs = require('./chunk-L5SBAHY3.cjs');
 var chunkH5O2CCAY_cjs = require('./chunk-H5O2CCAY.cjs');
 var react = require('react');
 var jsxRuntime = require('react/jsx-runtime');
@@ -54,8 +54,8 @@ function defaultRedirect(url) {
 }
 function useRequireActiveSubscription(options) {
   const { redirectTo, allowGrace = true, onRedirect } = options;
-  const { isLoading, error } = chunkD7QD57HL_cjs.useFFIDContext();
-  const { effectiveStatus, isBlocked, isGrace } = chunkD7QD57HL_cjs.useSubscription();
+  const { isLoading, error } = chunkL5SBAHY3_cjs.useFFIDContext();
+  const { effectiveStatus, isBlocked, isGrace } = chunkL5SBAHY3_cjs.useSubscription();
   const hasFetchError = error !== null && effectiveStatus === null;
   const shouldRedirect = !isLoading && !hasFetchError && (isBlocked || !allowGrace && isGrace || effectiveStatus === null);
   react.useEffect(() => {
@@ -76,7 +76,7 @@ function useRequireActiveSubscription(options) {
 }
 function withFFIDAuth(Component, options = {}) {
   const WrappedComponent = (props) => {
-    const { isLoading, isAuthenticated, login } = chunkD7QD57HL_cjs.useFFIDContext();
+    const { isLoading, isAuthenticated, login } = chunkL5SBAHY3_cjs.useFFIDContext();
     const hasRedirected = react.useRef(false);
     react.useEffect(() => {
       if (!isLoading && !isAuthenticated && options.redirectToLogin && !hasRedirected.current) {
@@ -105,155 +105,155 @@ var FFID_NEWSLETTER_DISPATCH_MAX_RECIPIENTS = 1e3;
 
 Object.defineProperty(exports, "ACCESS_GRANTING_EFFECTIVE_STATUSES", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.ACCESS_GRANTING_EFFECTIVE_STATUSES; }
+  get: function () { return chunkL5SBAHY3_cjs.ACCESS_GRANTING_EFFECTIVE_STATUSES; }
 });
 Object.defineProperty(exports, "BLOCKING_EFFECTIVE_STATUSES", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.BLOCKING_EFFECTIVE_STATUSES; }
+  get: function () { return chunkL5SBAHY3_cjs.BLOCKING_EFFECTIVE_STATUSES; }
 });
 Object.defineProperty(exports, "DEFAULT_API_BASE_URL", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.DEFAULT_API_BASE_URL; }
+  get: function () { return chunkL5SBAHY3_cjs.DEFAULT_API_BASE_URL; }
 });
 Object.defineProperty(exports, "DEFAULT_OAUTH_SCOPES", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.DEFAULT_OAUTH_SCOPES; }
+  get: function () { return chunkL5SBAHY3_cjs.DEFAULT_OAUTH_SCOPES; }
 });
 Object.defineProperty(exports, "EFFECTIVE_SUBSCRIPTION_STATUSES", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.EFFECTIVE_SUBSCRIPTION_STATUSES; }
+  get: function () { return chunkL5SBAHY3_cjs.EFFECTIVE_SUBSCRIPTION_STATUSES; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementBadge", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDAnnouncementBadge; }
+  get: function () { return chunkL5SBAHY3_cjs.FFIDAnnouncementBadge; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementList", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDAnnouncementList; }
+  get: function () { return chunkL5SBAHY3_cjs.FFIDAnnouncementList; }
 });
 Object.defineProperty(exports, "FFIDInquiryForm", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDInquiryForm; }
+  get: function () { return chunkL5SBAHY3_cjs.FFIDInquiryForm; }
 });
 Object.defineProperty(exports, "FFIDLoginButton", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDLoginButton; }
+  get: function () { return chunkL5SBAHY3_cjs.FFIDLoginButton; }
 });
 Object.defineProperty(exports, "FFIDOrganizationSwitcher", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDOrganizationSwitcher; }
+  get: function () { return chunkL5SBAHY3_cjs.FFIDOrganizationSwitcher; }
 });
 Object.defineProperty(exports, "FFIDProvider", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDProvider; }
+  get: function () { return chunkL5SBAHY3_cjs.FFIDProvider; }
 });
 Object.defineProperty(exports, "FFIDSDKError", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDSDKError; }
+  get: function () { return chunkL5SBAHY3_cjs.FFIDSDKError; }
 });
 Object.defineProperty(exports, "FFIDSubscriptionBadge", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDSubscriptionBadge; }
+  get: function () { return chunkL5SBAHY3_cjs.FFIDSubscriptionBadge; }
 });
 Object.defineProperty(exports, "FFIDUserMenu", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDUserMenu; }
+  get: function () { return chunkL5SBAHY3_cjs.FFIDUserMenu; }
 });
 Object.defineProperty(exports, "FFID_ANNOUNCEMENTS_ERROR_CODES", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFID_ANNOUNCEMENTS_ERROR_CODES; }
+  get: function () { return chunkL5SBAHY3_cjs.FFID_ANNOUNCEMENTS_ERROR_CODES; }
 });
 Object.defineProperty(exports, "FFID_ERROR_CODES", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFID_ERROR_CODES; }
+  get: function () { return chunkL5SBAHY3_cjs.FFID_ERROR_CODES; }
 });
 Object.defineProperty(exports, "FFID_INQUIRY_CATEGORIES", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFID_INQUIRY_CATEGORIES; }
+  get: function () { return chunkL5SBAHY3_cjs.FFID_INQUIRY_CATEGORIES; }
 });
 Object.defineProperty(exports, "FFID_INQUIRY_CATEGORIES_SITE_2026", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFID_INQUIRY_CATEGORIES_SITE_2026; }
+  get: function () { return chunkL5SBAHY3_cjs.FFID_INQUIRY_CATEGORIES_SITE_2026; }
 });
 Object.defineProperty(exports, "clearState", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.cleanupStateStorage; }
+  get: function () { return chunkL5SBAHY3_cjs.cleanupStateStorage; }
 });
 Object.defineProperty(exports, "computeEffectiveStatusFromSession", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.computeEffectiveStatusFromSession; }
+  get: function () { return chunkL5SBAHY3_cjs.computeEffectiveStatusFromSession; }
 });
 Object.defineProperty(exports, "createFFIDAnnouncementsClient", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.createFFIDAnnouncementsClient; }
+  get: function () { return chunkL5SBAHY3_cjs.createFFIDAnnouncementsClient; }
 });
 Object.defineProperty(exports, "createFFIDClient", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.createFFIDClient; }
+  get: function () { return chunkL5SBAHY3_cjs.createFFIDClient; }
 });
 Object.defineProperty(exports, "createTokenStore", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.createTokenStore; }
+  get: function () { return chunkL5SBAHY3_cjs.createTokenStore; }
 });
 Object.defineProperty(exports, "generateCodeChallenge", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.generateCodeChallenge; }
+  get: function () { return chunkL5SBAHY3_cjs.generateCodeChallenge; }
 });
 Object.defineProperty(exports, "generateCodeVerifier", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.generateCodeVerifier; }
+  get: function () { return chunkL5SBAHY3_cjs.generateCodeVerifier; }
 });
 Object.defineProperty(exports, "handleRedirectCallback", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.handleRedirectCallback; }
+  get: function () { return chunkL5SBAHY3_cjs.handleRedirectCallback; }
 });
 Object.defineProperty(exports, "hasAccessFromUserinfo", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.hasAccessFromUserinfo; }
+  get: function () { return chunkL5SBAHY3_cjs.hasAccessFromUserinfo; }
 });
 Object.defineProperty(exports, "isBlockedFromUserinfo", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.isBlockedFromUserinfo; }
+  get: function () { return chunkL5SBAHY3_cjs.isBlockedFromUserinfo; }
 });
 Object.defineProperty(exports, "isFFIDInquiryCategorySite2026", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.isFFIDInquiryCategorySite2026; }
+  get: function () { return chunkL5SBAHY3_cjs.isFFIDInquiryCategorySite2026; }
 });
 Object.defineProperty(exports, "normalizeRedirectUri", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.normalizeRedirectUri; }
+  get: function () { return chunkL5SBAHY3_cjs.normalizeRedirectUri; }
 });
 Object.defineProperty(exports, "retrieveCodeVerifier", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.retrieveCodeVerifier; }
+  get: function () { return chunkL5SBAHY3_cjs.retrieveCodeVerifier; }
 });
 Object.defineProperty(exports, "retrieveState", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.retrieveState; }
+  get: function () { return chunkL5SBAHY3_cjs.retrieveState; }
 });
 Object.defineProperty(exports, "storeCodeVerifier", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.storeCodeVerifier; }
+  get: function () { return chunkL5SBAHY3_cjs.storeCodeVerifier; }
 });
 Object.defineProperty(exports, "storeState", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.storeState; }
+  get: function () { return chunkL5SBAHY3_cjs.storeState; }
 });
 Object.defineProperty(exports, "useFFID", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.useFFID; }
+  get: function () { return chunkL5SBAHY3_cjs.useFFID; }
 });
 Object.defineProperty(exports, "useFFIDAnnouncements", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.useFFIDAnnouncements; }
+  get: function () { return chunkL5SBAHY3_cjs.useFFIDAnnouncements; }
 });
 Object.defineProperty(exports, "useSubscription", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.useSubscription; }
+  get: function () { return chunkL5SBAHY3_cjs.useSubscription; }
 });
 Object.defineProperty(exports, "withSubscription", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.withSubscription; }
+  get: function () { return chunkL5SBAHY3_cjs.withSubscription; }
 });
 Object.defineProperty(exports, "ALL_DENIED_EXCEPT_NECESSARY", {
   enumerable: true,

package/dist/index.js

@@ -1,5 +1,5 @@
-import { useFFIDContext, useSubscription } from './chunk-7A2P3NII.js';
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useSubscription, withSubscription } from './chunk-7A2P3NII.js';
+import { useFFIDContext, useSubscription } from './chunk-C4RNFEME.js';
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useSubscription, withSubscription } from './chunk-C4RNFEME.js';
 export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, CONSENT_DISMISSAL_TIMESTAMP_KEY, COOKIE_VERSION, DEFAULT_CONSENT_ERROR_MESSAGES, FFIDAnalyticsProvider, FFIDConsentError, FFIDCookieBanner, FFIDCookieLink, FFIDCookieSettings, FFID_CONSENT_ERROR_CODES, clearConsentDismissalTimestamp, decodeConsentCookie, encodeConsentCookie, readConsentCookie, readConsentDismissalTimestamp, useFFIDConsent, useFFIDConsentPreferences, writeConsentCookie, writeConsentDismissalTimestamp } from './chunk-G7VOX64X.js';
 import { useEffect, useRef } from 'react';
 import { jsx, Fragment } from 'react/jsx-runtime';

package/dist/server/index.cjs

@@ -86,7 +86,9 @@ function createMemoryStore() {
 function isTokenData(value) {
   if (typeof value !== "object" || value === null) return false;
   const obj = value;
-  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && typeof obj.expiresAt === "number";
+  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && // Number.isFinite also rejects NaN/Infinity (e.g. a crafted `1e999` JSON
+  // literal parses to Infinity and would never trip the expiry check — #4271)
+  typeof obj.expiresAt === "number" && Number.isFinite(obj.expiresAt);
 }
 function createTokenStore(storageType) {
   if (storageType === "memory") {
@@ -1222,7 +1224,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.24.0";
+var SDK_VERSION = "5.24.1";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1277,7 +1279,7 @@ function validateTokenResponse(tokenResponse) {
   if (!tokenResponse.refresh_token) {
     invalid.push("refresh_token");
   }
-  if (typeof tokenResponse.expires_in !== "number" || tokenResponse.expires_in <= 0) {
+  if (typeof tokenResponse.expires_in !== "number" || !Number.isFinite(tokenResponse.expires_in) || tokenResponse.expires_in <= 0) {
     invalid.push("expires_in");
   }
   if (invalid.length > 0) {

package/dist/server/index.js

@@ -85,7 +85,9 @@ function createMemoryStore() {
 function isTokenData(value) {
   if (typeof value !== "object" || value === null) return false;
   const obj = value;
-  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && typeof obj.expiresAt === "number";
+  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && // Number.isFinite also rejects NaN/Infinity (e.g. a crafted `1e999` JSON
+  // literal parses to Infinity and would never trip the expiry check — #4271)
+  typeof obj.expiresAt === "number" && Number.isFinite(obj.expiresAt);
 }
 function createTokenStore(storageType) {
   if (storageType === "memory") {
@@ -1221,7 +1223,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.24.0";
+var SDK_VERSION = "5.24.1";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1276,7 +1278,7 @@ function validateTokenResponse(tokenResponse) {
   if (!tokenResponse.refresh_token) {
     invalid.push("refresh_token");
   }
-  if (typeof tokenResponse.expires_in !== "number" || tokenResponse.expires_in <= 0) {
+  if (typeof tokenResponse.expires_in !== "number" || !Number.isFinite(tokenResponse.expires_in) || tokenResponse.expires_in <= 0) {
     invalid.push("expires_in");
   }
   if (invalid.length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feelflow/ffid-sdk",
-  "version": "5.24.0",
+  "version": "5.24.1",
   "description": "FeelFlow ID Platform SDK for React/Next.js applications",
   "keywords": [
     "feelflow",