@feelflow/ffid-sdk 5.24.0 → 5.24.2

package/dist/{chunk-7A2P3NII.js → chunk-Q7ZEF3EN.js}

@@ -89,7 +89,9 @@ function createMemoryStore() {
 function isTokenData(value) {
   if (typeof value !== "object" || value === null) return false;
   const obj = value;
-  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && typeof obj.expiresAt === "number";
+  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && // Number.isFinite also rejects NaN/Infinity (e.g. a crafted `1e999` JSON
+  // literal parses to Infinity and would never trip the expiry check — #4271)
+  typeof obj.expiresAt === "number" && Number.isFinite(obj.expiresAt);
 }
 function createTokenStore(storageType) {
   if (storageType === "memory") {
@@ -1225,7 +1227,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.24.0";
+var SDK_VERSION = "5.24.2";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1272,7 +1274,7 @@ npm install @feelflow/ffid-sdk@latest \u3067\u30A2\u30C3\u30D7\u30C7\u30FC\u30C8
 var OAUTH_TOKEN_ENDPOINT = "/api/v1/oauth/token";
 var OAUTH_REVOKE_ENDPOINT = "/api/v1/oauth/revoke";
 var MS_PER_SECOND = 1e3;
-function validateTokenResponse(tokenResponse) {
+function invalidTokenFields(tokenResponse) {
   const invalid = [];
   if (!tokenResponse.access_token) {
     invalid.push("access_token");
@@ -1280,13 +1282,22 @@ function validateTokenResponse(tokenResponse) {
   if (!tokenResponse.refresh_token) {
     invalid.push("refresh_token");
   }
-  if (typeof tokenResponse.expires_in !== "number" || tokenResponse.expires_in <= 0) {
+  if (typeof tokenResponse.expires_in !== "number" || !Number.isFinite(tokenResponse.expires_in) || tokenResponse.expires_in <= 0) {
     invalid.push("expires_in");
   }
-  if (invalid.length > 0) {
-    return `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalid.join(", ")}`;
+  return invalid;
+}
+function hasValidatedTokens(tokenResponse) {
+  return invalidTokenFields(tokenResponse).length === 0;
+}
+function validateTokenResponse(tokenResponse) {
+  if (hasValidatedTokens(tokenResponse)) {
+    return { ok: true, tokens: tokenResponse };
   }
-  return null;
+  return {
+    ok: false,
+    message: `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalidTokenFields(tokenResponse).join(", ")}`
+  };
 }
 function createOAuthTokenMethods(deps) {
   const {
@@ -1375,20 +1386,20 @@ function createOAuthTokenMethods(deps) {
         }
       };
     }
-    const validationError = validateTokenResponse(tokenResponse);
-    if (validationError) {
-      logger.error("Token exchange validation failed:", validationError);
+    const validation = validateTokenResponse(tokenResponse);
+    if (!validation.ok) {
+      logger.error("Token exchange validation failed:", validation.message);
       return {
         error: {
           code: errorCodes.TOKEN_EXCHANGE_ERROR,
-          message: validationError
+          message: validation.message
         }
       };
     }
     tokenStore.setTokens({
-      accessToken: tokenResponse.access_token,
-      refreshToken: tokenResponse.refresh_token,
-      expiresAt: Date.now() + tokenResponse.expires_in * MS_PER_SECOND
+      accessToken: validation.tokens.access_token,
+      refreshToken: validation.tokens.refresh_token,
+      expiresAt: Date.now() + validation.tokens.expires_in * MS_PER_SECOND
     });
     logger.debug("Token exchange successful");
     return { data: void 0 };
@@ -1453,20 +1464,20 @@ function createOAuthTokenMethods(deps) {
         }
       };
     }
-    const validationError = validateTokenResponse(tokenResponse);
-    if (validationError) {
-      logger.error("Token refresh validation failed:", validationError);
+    const validation = validateTokenResponse(tokenResponse);
+    if (!validation.ok) {
+      logger.error("Token refresh validation failed:", validation.message);
       return {
         error: {
           code: errorCodes.TOKEN_REFRESH_ERROR,
-          message: validationError
+          message: validation.message
         }
       };
     }
     tokenStore.setTokens({
-      accessToken: tokenResponse.access_token,
-      refreshToken: tokenResponse.refresh_token,
-      expiresAt: Date.now() + tokenResponse.expires_in * MS_PER_SECOND
+      accessToken: validation.tokens.access_token,
+      refreshToken: validation.tokens.refresh_token,
+      expiresAt: Date.now() + validation.tokens.expires_in * MS_PER_SECOND
     });
     logger.debug("Token refresh successful");
     return { data: void 0 };

package/dist/{chunk-D7QD57HL.cjs → chunk-QMWUOVZK.cjs}

@@ -91,7 +91,9 @@ function createMemoryStore() {
 function isTokenData(value) {
   if (typeof value !== "object" || value === null) return false;
   const obj = value;
-  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && typeof obj.expiresAt === "number";
+  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && // Number.isFinite also rejects NaN/Infinity (e.g. a crafted `1e999` JSON
+  // literal parses to Infinity and would never trip the expiry check — #4271)
+  typeof obj.expiresAt === "number" && Number.isFinite(obj.expiresAt);
 }
 function createTokenStore(storageType) {
   if (storageType === "memory") {
@@ -1227,7 +1229,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.24.0";
+var SDK_VERSION = "5.24.2";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1274,7 +1276,7 @@ npm install @feelflow/ffid-sdk@latest \u3067\u30A2\u30C3\u30D7\u30C7\u30FC\u30C8
 var OAUTH_TOKEN_ENDPOINT = "/api/v1/oauth/token";
 var OAUTH_REVOKE_ENDPOINT = "/api/v1/oauth/revoke";
 var MS_PER_SECOND = 1e3;
-function validateTokenResponse(tokenResponse) {
+function invalidTokenFields(tokenResponse) {
   const invalid = [];
   if (!tokenResponse.access_token) {
     invalid.push("access_token");
@@ -1282,13 +1284,22 @@ function validateTokenResponse(tokenResponse) {
   if (!tokenResponse.refresh_token) {
     invalid.push("refresh_token");
   }
-  if (typeof tokenResponse.expires_in !== "number" || tokenResponse.expires_in <= 0) {
+  if (typeof tokenResponse.expires_in !== "number" || !Number.isFinite(tokenResponse.expires_in) || tokenResponse.expires_in <= 0) {
     invalid.push("expires_in");
   }
-  if (invalid.length > 0) {
-    return `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalid.join(", ")}`;
+  return invalid;
+}
+function hasValidatedTokens(tokenResponse) {
+  return invalidTokenFields(tokenResponse).length === 0;
+}
+function validateTokenResponse(tokenResponse) {
+  if (hasValidatedTokens(tokenResponse)) {
+    return { ok: true, tokens: tokenResponse };
   }
-  return null;
+  return {
+    ok: false,
+    message: `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalidTokenFields(tokenResponse).join(", ")}`
+  };
 }
 function createOAuthTokenMethods(deps) {
   const {
@@ -1377,20 +1388,20 @@ function createOAuthTokenMethods(deps) {
         }
       };
     }
-    const validationError = validateTokenResponse(tokenResponse);
-    if (validationError) {
-      logger.error("Token exchange validation failed:", validationError);
+    const validation = validateTokenResponse(tokenResponse);
+    if (!validation.ok) {
+      logger.error("Token exchange validation failed:", validation.message);
       return {
         error: {
           code: errorCodes.TOKEN_EXCHANGE_ERROR,
-          message: validationError
+          message: validation.message
         }
       };
     }
     tokenStore.setTokens({
-      accessToken: tokenResponse.access_token,
-      refreshToken: tokenResponse.refresh_token,
-      expiresAt: Date.now() + tokenResponse.expires_in * MS_PER_SECOND
+      accessToken: validation.tokens.access_token,
+      refreshToken: validation.tokens.refresh_token,
+      expiresAt: Date.now() + validation.tokens.expires_in * MS_PER_SECOND
     });
     logger.debug("Token exchange successful");
     return { data: void 0 };
@@ -1455,20 +1466,20 @@ function createOAuthTokenMethods(deps) {
         }
       };
     }
-    const validationError = validateTokenResponse(tokenResponse);
-    if (validationError) {
-      logger.error("Token refresh validation failed:", validationError);
+    const validation = validateTokenResponse(tokenResponse);
+    if (!validation.ok) {
+      logger.error("Token refresh validation failed:", validation.message);
       return {
         error: {
           code: errorCodes.TOKEN_REFRESH_ERROR,
-          message: validationError
+          message: validation.message
         }
       };
     }
     tokenStore.setTokens({
-      accessToken: tokenResponse.access_token,
-      refreshToken: tokenResponse.refresh_token,
-      expiresAt: Date.now() + tokenResponse.expires_in * MS_PER_SECOND
+      accessToken: validation.tokens.access_token,
+      refreshToken: validation.tokens.refresh_token,
+      expiresAt: Date.now() + validation.tokens.expires_in * MS_PER_SECOND
     });
     logger.debug("Token refresh successful");
     return { data: void 0 };

package/dist/components/index.cjs

@@ -1,34 +1,34 @@
 'use strict';
 
-var chunkD7QD57HL_cjs = require('../chunk-D7QD57HL.cjs');
+var chunkQMWUOVZK_cjs = require('../chunk-QMWUOVZK.cjs');
 
 
 
 Object.defineProperty(exports, "FFIDAnnouncementBadge", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDAnnouncementBadge; }
+  get: function () { return chunkQMWUOVZK_cjs.FFIDAnnouncementBadge; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementList", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDAnnouncementList; }
+  get: function () { return chunkQMWUOVZK_cjs.FFIDAnnouncementList; }
 });
 Object.defineProperty(exports, "FFIDInquiryForm", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDInquiryForm; }
+  get: function () { return chunkQMWUOVZK_cjs.FFIDInquiryForm; }
 });
 Object.defineProperty(exports, "FFIDLoginButton", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDLoginButton; }
+  get: function () { return chunkQMWUOVZK_cjs.FFIDLoginButton; }
 });
 Object.defineProperty(exports, "FFIDOrganizationSwitcher", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDOrganizationSwitcher; }
+  get: function () { return chunkQMWUOVZK_cjs.FFIDOrganizationSwitcher; }
 });
 Object.defineProperty(exports, "FFIDSubscriptionBadge", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDSubscriptionBadge; }
+  get: function () { return chunkQMWUOVZK_cjs.FFIDSubscriptionBadge; }
 });
 Object.defineProperty(exports, "FFIDUserMenu", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDUserMenu; }
+  get: function () { return chunkQMWUOVZK_cjs.FFIDUserMenu; }
 });

package/dist/components/index.js

@@ -1 +1 @@
-export { FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDSubscriptionBadge, FFIDUserMenu } from '../chunk-7A2P3NII.js';
+export { FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDSubscriptionBadge, FFIDUserMenu } from '../chunk-Q7ZEF3EN.js';

package/dist/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkD7QD57HL_cjs = require('./chunk-D7QD57HL.cjs');
+var chunkQMWUOVZK_cjs = require('./chunk-QMWUOVZK.cjs');
 var chunkH5O2CCAY_cjs = require('./chunk-H5O2CCAY.cjs');
 var react = require('react');
 var jsxRuntime = require('react/jsx-runtime');
@@ -54,8 +54,8 @@ function defaultRedirect(url) {
 }
 function useRequireActiveSubscription(options) {
   const { redirectTo, allowGrace = true, onRedirect } = options;
-  const { isLoading, error } = chunkD7QD57HL_cjs.useFFIDContext();
-  const { effectiveStatus, isBlocked, isGrace } = chunkD7QD57HL_cjs.useSubscription();
+  const { isLoading, error } = chunkQMWUOVZK_cjs.useFFIDContext();
+  const { effectiveStatus, isBlocked, isGrace } = chunkQMWUOVZK_cjs.useSubscription();
   const hasFetchError = error !== null && effectiveStatus === null;
   const shouldRedirect = !isLoading && !hasFetchError && (isBlocked || !allowGrace && isGrace || effectiveStatus === null);
   react.useEffect(() => {
@@ -76,7 +76,7 @@ function useRequireActiveSubscription(options) {
 }
 function withFFIDAuth(Component, options = {}) {
   const WrappedComponent = (props) => {
-    const { isLoading, isAuthenticated, login } = chunkD7QD57HL_cjs.useFFIDContext();
+    const { isLoading, isAuthenticated, login } = chunkQMWUOVZK_cjs.useFFIDContext();
     const hasRedirected = react.useRef(false);
     react.useEffect(() => {
       if (!isLoading && !isAuthenticated && options.redirectToLogin && !hasRedirected.current) {
@@ -105,155 +105,155 @@ var FFID_NEWSLETTER_DISPATCH_MAX_RECIPIENTS = 1e3;
 
 Object.defineProperty(exports, "ACCESS_GRANTING_EFFECTIVE_STATUSES", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.ACCESS_GRANTING_EFFECTIVE_STATUSES; }
+  get: function () { return chunkQMWUOVZK_cjs.ACCESS_GRANTING_EFFECTIVE_STATUSES; }
 });
 Object.defineProperty(exports, "BLOCKING_EFFECTIVE_STATUSES", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.BLOCKING_EFFECTIVE_STATUSES; }
+  get: function () { return chunkQMWUOVZK_cjs.BLOCKING_EFFECTIVE_STATUSES; }
 });
 Object.defineProperty(exports, "DEFAULT_API_BASE_URL", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.DEFAULT_API_BASE_URL; }
+  get: function () { return chunkQMWUOVZK_cjs.DEFAULT_API_BASE_URL; }
 });
 Object.defineProperty(exports, "DEFAULT_OAUTH_SCOPES", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.DEFAULT_OAUTH_SCOPES; }
+  get: function () { return chunkQMWUOVZK_cjs.DEFAULT_OAUTH_SCOPES; }
 });
 Object.defineProperty(exports, "EFFECTIVE_SUBSCRIPTION_STATUSES", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.EFFECTIVE_SUBSCRIPTION_STATUSES; }
+  get: function () { return chunkQMWUOVZK_cjs.EFFECTIVE_SUBSCRIPTION_STATUSES; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementBadge", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDAnnouncementBadge; }
+  get: function () { return chunkQMWUOVZK_cjs.FFIDAnnouncementBadge; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementList", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDAnnouncementList; }
+  get: function () { return chunkQMWUOVZK_cjs.FFIDAnnouncementList; }
 });
 Object.defineProperty(exports, "FFIDInquiryForm", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDInquiryForm; }
+  get: function () { return chunkQMWUOVZK_cjs.FFIDInquiryForm; }
 });
 Object.defineProperty(exports, "FFIDLoginButton", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDLoginButton; }
+  get: function () { return chunkQMWUOVZK_cjs.FFIDLoginButton; }
 });
 Object.defineProperty(exports, "FFIDOrganizationSwitcher", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDOrganizationSwitcher; }
+  get: function () { return chunkQMWUOVZK_cjs.FFIDOrganizationSwitcher; }
 });
 Object.defineProperty(exports, "FFIDProvider", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDProvider; }
+  get: function () { return chunkQMWUOVZK_cjs.FFIDProvider; }
 });
 Object.defineProperty(exports, "FFIDSDKError", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDSDKError; }
+  get: function () { return chunkQMWUOVZK_cjs.FFIDSDKError; }
 });
 Object.defineProperty(exports, "FFIDSubscriptionBadge", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDSubscriptionBadge; }
+  get: function () { return chunkQMWUOVZK_cjs.FFIDSubscriptionBadge; }
 });
 Object.defineProperty(exports, "FFIDUserMenu", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFIDUserMenu; }
+  get: function () { return chunkQMWUOVZK_cjs.FFIDUserMenu; }
 });
 Object.defineProperty(exports, "FFID_ANNOUNCEMENTS_ERROR_CODES", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFID_ANNOUNCEMENTS_ERROR_CODES; }
+  get: function () { return chunkQMWUOVZK_cjs.FFID_ANNOUNCEMENTS_ERROR_CODES; }
 });
 Object.defineProperty(exports, "FFID_ERROR_CODES", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFID_ERROR_CODES; }
+  get: function () { return chunkQMWUOVZK_cjs.FFID_ERROR_CODES; }
 });
 Object.defineProperty(exports, "FFID_INQUIRY_CATEGORIES", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFID_INQUIRY_CATEGORIES; }
+  get: function () { return chunkQMWUOVZK_cjs.FFID_INQUIRY_CATEGORIES; }
 });
 Object.defineProperty(exports, "FFID_INQUIRY_CATEGORIES_SITE_2026", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.FFID_INQUIRY_CATEGORIES_SITE_2026; }
+  get: function () { return chunkQMWUOVZK_cjs.FFID_INQUIRY_CATEGORIES_SITE_2026; }
 });
 Object.defineProperty(exports, "clearState", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.cleanupStateStorage; }
+  get: function () { return chunkQMWUOVZK_cjs.cleanupStateStorage; }
 });
 Object.defineProperty(exports, "computeEffectiveStatusFromSession", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.computeEffectiveStatusFromSession; }
+  get: function () { return chunkQMWUOVZK_cjs.computeEffectiveStatusFromSession; }
 });
 Object.defineProperty(exports, "createFFIDAnnouncementsClient", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.createFFIDAnnouncementsClient; }
+  get: function () { return chunkQMWUOVZK_cjs.createFFIDAnnouncementsClient; }
 });
 Object.defineProperty(exports, "createFFIDClient", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.createFFIDClient; }
+  get: function () { return chunkQMWUOVZK_cjs.createFFIDClient; }
 });
 Object.defineProperty(exports, "createTokenStore", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.createTokenStore; }
+  get: function () { return chunkQMWUOVZK_cjs.createTokenStore; }
 });
 Object.defineProperty(exports, "generateCodeChallenge", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.generateCodeChallenge; }
+  get: function () { return chunkQMWUOVZK_cjs.generateCodeChallenge; }
 });
 Object.defineProperty(exports, "generateCodeVerifier", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.generateCodeVerifier; }
+  get: function () { return chunkQMWUOVZK_cjs.generateCodeVerifier; }
 });
 Object.defineProperty(exports, "handleRedirectCallback", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.handleRedirectCallback; }
+  get: function () { return chunkQMWUOVZK_cjs.handleRedirectCallback; }
 });
 Object.defineProperty(exports, "hasAccessFromUserinfo", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.hasAccessFromUserinfo; }
+  get: function () { return chunkQMWUOVZK_cjs.hasAccessFromUserinfo; }
 });
 Object.defineProperty(exports, "isBlockedFromUserinfo", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.isBlockedFromUserinfo; }
+  get: function () { return chunkQMWUOVZK_cjs.isBlockedFromUserinfo; }
 });
 Object.defineProperty(exports, "isFFIDInquiryCategorySite2026", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.isFFIDInquiryCategorySite2026; }
+  get: function () { return chunkQMWUOVZK_cjs.isFFIDInquiryCategorySite2026; }
 });
 Object.defineProperty(exports, "normalizeRedirectUri", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.normalizeRedirectUri; }
+  get: function () { return chunkQMWUOVZK_cjs.normalizeRedirectUri; }
 });
 Object.defineProperty(exports, "retrieveCodeVerifier", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.retrieveCodeVerifier; }
+  get: function () { return chunkQMWUOVZK_cjs.retrieveCodeVerifier; }
 });
 Object.defineProperty(exports, "retrieveState", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.retrieveState; }
+  get: function () { return chunkQMWUOVZK_cjs.retrieveState; }
 });
 Object.defineProperty(exports, "storeCodeVerifier", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.storeCodeVerifier; }
+  get: function () { return chunkQMWUOVZK_cjs.storeCodeVerifier; }
 });
 Object.defineProperty(exports, "storeState", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.storeState; }
+  get: function () { return chunkQMWUOVZK_cjs.storeState; }
 });
 Object.defineProperty(exports, "useFFID", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.useFFID; }
+  get: function () { return chunkQMWUOVZK_cjs.useFFID; }
 });
 Object.defineProperty(exports, "useFFIDAnnouncements", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.useFFIDAnnouncements; }
+  get: function () { return chunkQMWUOVZK_cjs.useFFIDAnnouncements; }
 });
 Object.defineProperty(exports, "useSubscription", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.useSubscription; }
+  get: function () { return chunkQMWUOVZK_cjs.useSubscription; }
 });
 Object.defineProperty(exports, "withSubscription", {
   enumerable: true,
-  get: function () { return chunkD7QD57HL_cjs.withSubscription; }
+  get: function () { return chunkQMWUOVZK_cjs.withSubscription; }
 });
 Object.defineProperty(exports, "ALL_DENIED_EXCEPT_NECESSARY", {
   enumerable: true,

package/dist/index.js

@@ -1,5 +1,5 @@
-import { useFFIDContext, useSubscription } from './chunk-7A2P3NII.js';
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useSubscription, withSubscription } from './chunk-7A2P3NII.js';
+import { useFFIDContext, useSubscription } from './chunk-Q7ZEF3EN.js';
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useSubscription, withSubscription } from './chunk-Q7ZEF3EN.js';
 export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, CONSENT_DISMISSAL_TIMESTAMP_KEY, COOKIE_VERSION, DEFAULT_CONSENT_ERROR_MESSAGES, FFIDAnalyticsProvider, FFIDConsentError, FFIDCookieBanner, FFIDCookieLink, FFIDCookieSettings, FFID_CONSENT_ERROR_CODES, clearConsentDismissalTimestamp, decodeConsentCookie, encodeConsentCookie, readConsentCookie, readConsentDismissalTimestamp, useFFIDConsent, useFFIDConsentPreferences, writeConsentCookie, writeConsentDismissalTimestamp } from './chunk-G7VOX64X.js';
 import { useEffect, useRef } from 'react';
 import { jsx, Fragment } from 'react/jsx-runtime';

package/dist/server/index.cjs

@@ -86,7 +86,9 @@ function createMemoryStore() {
 function isTokenData(value) {
   if (typeof value !== "object" || value === null) return false;
   const obj = value;
-  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && typeof obj.expiresAt === "number";
+  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && // Number.isFinite also rejects NaN/Infinity (e.g. a crafted `1e999` JSON
+  // literal parses to Infinity and would never trip the expiry check — #4271)
+  typeof obj.expiresAt === "number" && Number.isFinite(obj.expiresAt);
 }
 function createTokenStore(storageType) {
   if (storageType === "memory") {
@@ -1222,7 +1224,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.24.0";
+var SDK_VERSION = "5.24.2";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1269,7 +1271,7 @@ npm install @feelflow/ffid-sdk@latest \u3067\u30A2\u30C3\u30D7\u30C7\u30FC\u30C8
 var OAUTH_TOKEN_ENDPOINT = "/api/v1/oauth/token";
 var OAUTH_REVOKE_ENDPOINT = "/api/v1/oauth/revoke";
 var MS_PER_SECOND = 1e3;
-function validateTokenResponse(tokenResponse) {
+function invalidTokenFields(tokenResponse) {
   const invalid = [];
   if (!tokenResponse.access_token) {
     invalid.push("access_token");
@@ -1277,13 +1279,22 @@ function validateTokenResponse(tokenResponse) {
   if (!tokenResponse.refresh_token) {
     invalid.push("refresh_token");
   }
-  if (typeof tokenResponse.expires_in !== "number" || tokenResponse.expires_in <= 0) {
+  if (typeof tokenResponse.expires_in !== "number" || !Number.isFinite(tokenResponse.expires_in) || tokenResponse.expires_in <= 0) {
     invalid.push("expires_in");
   }
-  if (invalid.length > 0) {
-    return `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalid.join(", ")}`;
+  return invalid;
+}
+function hasValidatedTokens(tokenResponse) {
+  return invalidTokenFields(tokenResponse).length === 0;
+}
+function validateTokenResponse(tokenResponse) {
+  if (hasValidatedTokens(tokenResponse)) {
+    return { ok: true, tokens: tokenResponse };
   }
-  return null;
+  return {
+    ok: false,
+    message: `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalidTokenFields(tokenResponse).join(", ")}`
+  };
 }
 function createOAuthTokenMethods(deps) {
   const {
@@ -1372,20 +1383,20 @@ function createOAuthTokenMethods(deps) {
         }
       };
     }
-    const validationError = validateTokenResponse(tokenResponse);
-    if (validationError) {
-      logger.error("Token exchange validation failed:", validationError);
+    const validation = validateTokenResponse(tokenResponse);
+    if (!validation.ok) {
+      logger.error("Token exchange validation failed:", validation.message);
       return {
         error: {
           code: errorCodes.TOKEN_EXCHANGE_ERROR,
-          message: validationError
+          message: validation.message
         }
       };
     }
     tokenStore.setTokens({
-      accessToken: tokenResponse.access_token,
-      refreshToken: tokenResponse.refresh_token,
-      expiresAt: Date.now() + tokenResponse.expires_in * MS_PER_SECOND
+      accessToken: validation.tokens.access_token,
+      refreshToken: validation.tokens.refresh_token,
+      expiresAt: Date.now() + validation.tokens.expires_in * MS_PER_SECOND
     });
     logger.debug("Token exchange successful");
     return { data: void 0 };
@@ -1450,20 +1461,20 @@ function createOAuthTokenMethods(deps) {
         }
       };
     }
-    const validationError = validateTokenResponse(tokenResponse);
-    if (validationError) {
-      logger.error("Token refresh validation failed:", validationError);
+    const validation = validateTokenResponse(tokenResponse);
+    if (!validation.ok) {
+      logger.error("Token refresh validation failed:", validation.message);
       return {
         error: {
           code: errorCodes.TOKEN_REFRESH_ERROR,
-          message: validationError
+          message: validation.message
         }
       };
     }
     tokenStore.setTokens({
-      accessToken: tokenResponse.access_token,
-      refreshToken: tokenResponse.refresh_token,
-      expiresAt: Date.now() + tokenResponse.expires_in * MS_PER_SECOND
+      accessToken: validation.tokens.access_token,
+      refreshToken: validation.tokens.refresh_token,
+      expiresAt: Date.now() + validation.tokens.expires_in * MS_PER_SECOND
     });
     logger.debug("Token refresh successful");
     return { data: void 0 };
@@ -3409,14 +3420,26 @@ function withTimeout(init, timeout) {
   }
   return init;
 }
-function validateTokenResponse2(r) {
+function invalidTokenFields2(r) {
   const invalid = [];
   if (!r.access_token) invalid.push("access_token");
   if (!r.refresh_token) invalid.push("refresh_token");
   if (typeof r.expires_in !== "number" || !Number.isFinite(r.expires_in) || r.expires_in <= 0) {
     invalid.push("expires_in");
   }
-  return invalid.length > 0 ? `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalid.join(", ")}` : null;
+  return invalid;
+}
+function hasValidatedTokens2(r) {
+  return invalidTokenFields2(r).length === 0;
+}
+function validateTokenResponse2(r) {
+  if (hasValidatedTokens2(r)) {
+    return { ok: true, tokens: r };
+  }
+  return {
+    ok: false,
+    message: `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalidTokenFields2(r).join(", ")}`
+  };
 }
 function toTokens(r) {
   return {
@@ -3463,11 +3486,11 @@ async function postToken(deps, body, fallbackErrorCode) {
     const errorBody = json;
     return fail(errorBody.error ?? fallbackErrorCode, errorBody.error_description ?? "\u30C8\u30FC\u30AF\u30F3\u51E6\u7406\u306B\u5931\u6557\u3057\u307E\u3057\u305F");
   }
-  const validationError = validateTokenResponse2(json);
-  if (validationError) {
-    return fail(fallbackErrorCode, validationError);
+  const validation = validateTokenResponse2(json);
+  if (!validation.ok) {
+    return fail(fallbackErrorCode, validation.message);
   }
-  return { tokens: toTokens(json) };
+  return { tokens: toTokens(validation.tokens) };
 }
 function exchangeAuthorizationCodeServer(deps, code) {
   return postToken(

package/dist/server/index.js

@@ -85,7 +85,9 @@ function createMemoryStore() {
 function isTokenData(value) {
   if (typeof value !== "object" || value === null) return false;
   const obj = value;
-  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && typeof obj.expiresAt === "number";
+  return typeof obj.accessToken === "string" && typeof obj.refreshToken === "string" && // Number.isFinite also rejects NaN/Infinity (e.g. a crafted `1e999` JSON
+  // literal parses to Infinity and would never trip the expiry check — #4271)
+  typeof obj.expiresAt === "number" && Number.isFinite(obj.expiresAt);
 }
 function createTokenStore(storageType) {
   if (storageType === "memory") {
@@ -1221,7 +1223,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.24.0";
+var SDK_VERSION = "5.24.2";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1268,7 +1270,7 @@ npm install @feelflow/ffid-sdk@latest \u3067\u30A2\u30C3\u30D7\u30C7\u30FC\u30C8
 var OAUTH_TOKEN_ENDPOINT = "/api/v1/oauth/token";
 var OAUTH_REVOKE_ENDPOINT = "/api/v1/oauth/revoke";
 var MS_PER_SECOND = 1e3;
-function validateTokenResponse(tokenResponse) {
+function invalidTokenFields(tokenResponse) {
   const invalid = [];
   if (!tokenResponse.access_token) {
     invalid.push("access_token");
@@ -1276,13 +1278,22 @@ function validateTokenResponse(tokenResponse) {
   if (!tokenResponse.refresh_token) {
     invalid.push("refresh_token");
   }
-  if (typeof tokenResponse.expires_in !== "number" || tokenResponse.expires_in <= 0) {
+  if (typeof tokenResponse.expires_in !== "number" || !Number.isFinite(tokenResponse.expires_in) || tokenResponse.expires_in <= 0) {
     invalid.push("expires_in");
   }
-  if (invalid.length > 0) {
-    return `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalid.join(", ")}`;
+  return invalid;
+}
+function hasValidatedTokens(tokenResponse) {
+  return invalidTokenFields(tokenResponse).length === 0;
+}
+function validateTokenResponse(tokenResponse) {
+  if (hasValidatedTokens(tokenResponse)) {
+    return { ok: true, tokens: tokenResponse };
   }
-  return null;
+  return {
+    ok: false,
+    message: `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalidTokenFields(tokenResponse).join(", ")}`
+  };
 }
 function createOAuthTokenMethods(deps) {
   const {
@@ -1371,20 +1382,20 @@ function createOAuthTokenMethods(deps) {
         }
       };
     }
-    const validationError = validateTokenResponse(tokenResponse);
-    if (validationError) {
-      logger.error("Token exchange validation failed:", validationError);
+    const validation = validateTokenResponse(tokenResponse);
+    if (!validation.ok) {
+      logger.error("Token exchange validation failed:", validation.message);
       return {
         error: {
           code: errorCodes.TOKEN_EXCHANGE_ERROR,
-          message: validationError
+          message: validation.message
         }
       };
     }
     tokenStore.setTokens({
-      accessToken: tokenResponse.access_token,
-      refreshToken: tokenResponse.refresh_token,
-      expiresAt: Date.now() + tokenResponse.expires_in * MS_PER_SECOND
+      accessToken: validation.tokens.access_token,
+      refreshToken: validation.tokens.refresh_token,
+      expiresAt: Date.now() + validation.tokens.expires_in * MS_PER_SECOND
     });
     logger.debug("Token exchange successful");
     return { data: void 0 };
@@ -1449,20 +1460,20 @@ function createOAuthTokenMethods(deps) {
         }
       };
     }
-    const validationError = validateTokenResponse(tokenResponse);
-    if (validationError) {
-      logger.error("Token refresh validation failed:", validationError);
+    const validation = validateTokenResponse(tokenResponse);
+    if (!validation.ok) {
+      logger.error("Token refresh validation failed:", validation.message);
       return {
         error: {
           code: errorCodes.TOKEN_REFRESH_ERROR,
-          message: validationError
+          message: validation.message
         }
       };
     }
     tokenStore.setTokens({
-      accessToken: tokenResponse.access_token,
-      refreshToken: tokenResponse.refresh_token,
-      expiresAt: Date.now() + tokenResponse.expires_in * MS_PER_SECOND
+      accessToken: validation.tokens.access_token,
+      refreshToken: validation.tokens.refresh_token,
+      expiresAt: Date.now() + validation.tokens.expires_in * MS_PER_SECOND
     });
     logger.debug("Token refresh successful");
     return { data: void 0 };
@@ -3408,14 +3419,26 @@ function withTimeout(init, timeout) {
   }
   return init;
 }
-function validateTokenResponse2(r) {
+function invalidTokenFields2(r) {
   const invalid = [];
   if (!r.access_token) invalid.push("access_token");
   if (!r.refresh_token) invalid.push("refresh_token");
   if (typeof r.expires_in !== "number" || !Number.isFinite(r.expires_in) || r.expires_in <= 0) {
     invalid.push("expires_in");
   }
-  return invalid.length > 0 ? `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalid.join(", ")}` : null;
+  return invalid;
+}
+function hasValidatedTokens2(r) {
+  return invalidTokenFields2(r).length === 0;
+}
+function validateTokenResponse2(r) {
+  if (hasValidatedTokens2(r)) {
+    return { ok: true, tokens: r };
+  }
+  return {
+    ok: false,
+    message: `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalidTokenFields2(r).join(", ")}`
+  };
 }
 function toTokens(r) {
   return {
@@ -3462,11 +3485,11 @@ async function postToken(deps, body, fallbackErrorCode) {
     const errorBody = json;
     return fail(errorBody.error ?? fallbackErrorCode, errorBody.error_description ?? "\u30C8\u30FC\u30AF\u30F3\u51E6\u7406\u306B\u5931\u6557\u3057\u307E\u3057\u305F");
   }
-  const validationError = validateTokenResponse2(json);
-  if (validationError) {
-    return fail(fallbackErrorCode, validationError);
+  const validation = validateTokenResponse2(json);
+  if (!validation.ok) {
+    return fail(fallbackErrorCode, validation.message);
   }
-  return { tokens: toTokens(json) };
+  return { tokens: toTokens(validation.tokens) };
 }
 function exchangeAuthorizationCodeServer(deps, code) {
   return postToken(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feelflow/ffid-sdk",
-  "version": "5.24.0",
+  "version": "5.24.2",
   "description": "FeelFlow ID Platform SDK for React/Next.js applications",
   "keywords": [
     "feelflow",