@feelflow/ffid-sdk 5.24.2 → 5.25.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { F as FFIDSubscriptionStatus, a as FFIDPrompt, b as FFIDConfig, c as FFIDApiResponse, d as FFIDSessionResponse, e as FFIDSignOutResult, f as FFIDRedirectResult, g as FFIDError, h as FFIDSubscriptionCheckResponse, i as FFIDCheckServiceAccessParams, j as FFIDServiceAccessDecision, k as FFIDAnalyticsConfig, l as FFIDVerifyAccessTokenOptions, m as FFIDOAuthUserInfo, n as FFIDInquiryCreateParams, o as FFIDInquiryCreateResponse, p as FFIDAuthMode, q as FFIDLogger, r as FFIDCacheAdapter, s as FFIDUser, t as FFIDOrganization, u as FFIDSubscription, v as FFIDSubscriptionContextValue, E as EffectiveSubscriptionStatus, w as FFIDOAuthUserInfoSubscription, x as FFIDAnnouncementsClientConfig, L as ListAnnouncementsOptions, y as FFIDAnnouncementsApiResponse, A as AnnouncementListResponse, z as FFIDAnnouncementsLogger } from './index-GqflEaKi.js';
-export { B as Announcement, C as AnnouncementStatus, D as AnnouncementType, G as EFFECTIVE_SUBSCRIPTION_STATUSES, H as FFIDAnnouncementBadge, I as FFIDAnnouncementList, J as FFIDAnnouncementsError, K as FFIDAnnouncementsErrorCode, M as FFIDAnnouncementsServerResponse, N as FFIDApiResponseMeta, O as FFIDCacheConfig, P as FFIDContextValue, Q as FFIDInquiryCategory, R as FFIDInquiryCategorySite2026, S as FFIDInquiryForm, T as FFIDInquiryFormCategoryItem, U as FFIDInquiryFormClassNames, V as FFIDInquiryFormLegalLayout, W as FFIDInquiryFormOrganization, X as FFIDInquiryFormPlaceholderContext, Y as FFIDInquiryFormPrefill, Z as FFIDInquiryFormProps, _ as FFIDInquiryFormSubmitData, $ as FFIDInquiryFormSubmitResult, a0 as FFIDJwtClaims, a1 as FFIDLoginButton, a2 as FFIDOAuthTokenResponse, a3 as FFIDOAuthUserInfoMemberRole, a4 as FFIDOrganizationSwitcher, a5 as FFIDRedirectErrorCode, a6 as FFIDSeatModel, a7 as FFIDServiceAccessDenialReason, a8 as FFIDServiceAccessFailPolicy, a9 as FFIDSubscriptionBadge, aa as FFIDTokenIntrospectionResponse, ab as FFIDUserMenu, ac as FFID_INQUIRY_CATEGORIES, ad as FFID_INQUIRY_CATEGORIES_SITE_2026, ae as UseFFIDAnnouncementsOptions, af as UseFFIDAnnouncementsReturn, ag as isFFIDInquiryCategorySite2026, ah as useFFIDAnnouncements } from './index-GqflEaKi.js';
+import { F as FFIDSubscriptionStatus, a as FFIDOAuthUserInfoSubscription, b as FFIDPrompt, c as FFIDConfig, d as FFIDApiResponse, e as FFIDSessionResponse, f as FFIDSignOutResult, g as FFIDError, h as FFIDSubscriptionCheckResponse, i as FFIDCheckServiceAccessParams, j as FFIDServiceAccessDecision, k as FFIDAnalyticsConfig, l as FFIDVerifyAccessTokenOptions, m as FFIDOAuthUserInfo, n as FFIDInquiryCreateParams, o as FFIDInquiryCreateResponse, T as TokenStore, p as FFIDAuthMode, q as FFIDLogger, r as FFIDCacheAdapter, s as FFIDUser, t as FFIDOrganization, u as FFIDSubscription, v as FFIDSubscriptionContextValue, E as EffectiveSubscriptionStatus, w as FFIDAnnouncementsClientConfig, L as ListAnnouncementsOptions, x as FFIDAnnouncementsApiResponse, A as AnnouncementListResponse, y as FFIDAnnouncementsLogger } from './index-Dd6CMIBd.js';
+export { z as Announcement, B as AnnouncementStatus, C as AnnouncementType, D as EFFECTIVE_SUBSCRIPTION_STATUSES, G as FFIDAnnouncementBadge, H as FFIDAnnouncementList, I as FFIDAnnouncementsError, J as FFIDAnnouncementsErrorCode, K as FFIDAnnouncementsServerResponse, M as FFIDApiResponseMeta, N as FFIDCacheConfig, O as FFIDContextValue, P as FFIDInquiryCategory, Q as FFIDInquiryCategorySite2026, R as FFIDInquiryForm, S as FFIDInquiryFormCategoryItem, U as FFIDInquiryFormClassNames, V as FFIDInquiryFormLegalLayout, W as FFIDInquiryFormOrganization, X as FFIDInquiryFormPlaceholderContext, Y as FFIDInquiryFormPrefill, Z as FFIDInquiryFormProps, _ as FFIDInquiryFormSubmitData, $ as FFIDInquiryFormSubmitResult, a0 as FFIDJwtClaims, a1 as FFIDLoginButton, a2 as FFIDOAuthUserInfoMemberRole, a3 as FFIDOrganizationSwitcher, a4 as FFIDSeatModel, a5 as FFIDServiceAccessDenialReason, a6 as FFIDServiceAccessFailPolicy, a7 as FFIDSubscriptionBadge, a8 as FFIDUserMenu, a9 as FFID_INQUIRY_CATEGORIES, aa as FFID_INQUIRY_CATEGORIES_SITE_2026, ab as TokenData, ac as UseFFIDAnnouncementsOptions, ad as UseFFIDAnnouncementsReturn, ae as createTokenStore, af as isFFIDInquiryCategorySite2026, ag as useFFIDAnnouncements } from './index-Dd6CMIBd.js';
 export { A as ALL_DENIED_EXCEPT_NECESSARY, i as CONSENT_COOKIE_NAME, j as CONSENT_DISMISSAL_TIMESTAMP_KEY, l as COOKIE_VERSION, D as DEFAULT_CONSENT_ERROR_MESSAGES, o as FFIDAnalyticsProvider, p as FFIDAnalyticsProviderProps, c as FFIDConsentCategories, r as FFIDConsentCategoryCode, e as FFIDConsentCategoryMetadata, w as FFIDConsentError, x as FFIDConsentErrorCode, y as FFIDConsentMergeStrategy, B as FFIDConsentMergeWarning, E as FFIDConsentMergeWarningEvent, F as FFIDConsentResult, I as FFIDConsentSource, a as FFIDConsentState, d as FFIDConsentSyncResult, M as FFIDCookieBanner, N as FFIDCookieBannerClassNames, O as FFIDCookieBannerProps, Q as FFIDCookieLink, R as FFIDCookieLinkProps, f as FFIDCookiePolicy, T as FFIDCookieSettings, U as FFIDCookieSettingsClassNames, V as FFIDCookieSettingsProps, _ as FFID_CONSENT_ERROR_CODES, ae as UseFFIDConsentPreferencesReturn, af as UseFFIDConsentReturn, ag as clearConsentDismissalTimestamp, aj as decodeConsentCookie, al as encodeConsentCookie, an as readConsentCookie, ao as readConsentDismissalTimestamp, aq as useFFIDConsent, ar as useFFIDConsentPreferences, as as writeConsentCookie, at as writeConsentDismissalTimestamp } from './FFIDCookieLink-BJgVcJyw.js';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode, ComponentType, FC } from 'react';
@@ -39,47 +39,6 @@ declare const DEFAULT_API_BASE_URL = "https://id.feelflow.net";
  */
 declare const DEFAULT_OAUTH_SCOPES = "openid email profile subscription:read legal:read";
 
-/**
- * Token Store
- *
- * Manages OAuth 2.0 tokens (access + refresh) with dual-storage support.
- * Falls back to in-memory storage when localStorage is unavailable
- * (e.g., Safari private browsing mode).
- */
-/**
- * Token data stored by the token store
- */
-interface TokenData {
-    /** OAuth 2.0 access token */
-    accessToken: string;
-    /** OAuth 2.0 refresh token */
-    refreshToken: string;
-    /** Expiration timestamp in milliseconds (Unix epoch) */
-    expiresAt: number;
-}
-/**
- * Token store interface for managing OAuth tokens
- */
-interface TokenStore {
-    /** Get stored tokens (null if not stored) */
-    getTokens(): TokenData | null;
-    /** Store new tokens */
-    setTokens(tokens: TokenData): void;
-    /** Clear all stored tokens */
-    clearTokens(): void;
-    /** Check if access token is expired (with 30s buffer) */
-    isAccessTokenExpired(): boolean;
-}
-/**
- * Create a token store with the specified storage type.
- *
- * When storageType is 'localStorage' (default in browser), falls back
- * to memory if localStorage is not available (e.g., Safari private mode).
- *
- * @param storageType - 'localStorage' (default) or 'memory'
- */
-declare function createTokenStore(storageType?: 'localStorage' | 'memory'): TokenStore;
-
 /**
  * Generate a random code verifier (43-128 characters, RFC 7636 Section 4.1).
  *
@@ -1192,6 +1151,112 @@ interface FFIDUpdateUserProfileRequest {
     preferences?: Record<string, unknown> | null;
 }
 
+/**
+ * OAuth flow types: client-side redirect results and OAuth token / RFC 7662
+ * introspection payloads.
+ *
+ * Extracted from `types/index.ts` to keep that barrel under the 800-line hard
+ * limit (`scripts/check-file-size.sh`). Re-exported from `types/index.ts`, so
+ * the public API is unchanged — import from `@feelflow/ffid-sdk` as before.
+ */
+
+/**
+ * Discriminant for redirect failures that callers need to handle
+ * programmatically (vs. logging the human-readable `error` string).
+ *
+ * - `'redirect_loop_detected'`: `redirectToAuthorize()` detected that the
+ *   same authorize URL (keyed by `baseUrl + client_id + organization_id`)
+ *   has been fired **3 times within 60 seconds**. Caller should surface a
+ *   manual "再度ログインする" UI rather than retry automatically (#2406 / #2411).
+ *
+ * - `'state_persistence_failed'`: `redirectToAuthorize()` could not persist
+ *   the OAuth CSRF `state` (storage unavailable / quota). Redirect is aborted
+ *   fail-closed (#4136) — callers should surface a manual retry UI.
+ *
+ * Other failure paths (SSR environment, PKCE generation failure, empty
+ * organizationId) currently return `error` without a `code`. Treat this union
+ * as forward-extensible and do NOT exhaustively `switch` over it without a
+ * `default` branch for consumer code that must stay compatible across SDK
+ * upgrades.
+ */
+type FFIDRedirectErrorCode = 'redirect_loop_detected' | 'state_persistence_failed';
+/**
+ * Result of a redirect operation (redirectToLogin / redirectToAuthorize / redirectToLogout)
+ *
+ * Structured return type so callers can inspect failure reasons
+ * instead of receiving a bare `false`. When `code` is set, branch on it
+ * for programmatic handling; otherwise log `error` for humans.
+ *
+ * `loopDetectionDisabled` (#4119): set to `true` when sessionStorage is
+ * unavailable (iOS WebKit private mode / eviction) so redirect-loop detection
+ * ran **fail-open** — the redirect fired, but repeated-redirect protection is
+ * disabled for this browser session. Callers that need loop protection on
+ * such browsers should add their own max-retry guard.
+ */
+type FFIDRedirectResult = {
+    success: true;
+    loopDetectionDisabled?: boolean;
+} | {
+    success: false;
+    error: string;
+    code?: FFIDRedirectErrorCode;
+};
+/**
+ * OAuth 2.0 token response from FFID token endpoint
+ */
+interface FFIDOAuthTokenResponse {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    refresh_token: string;
+}
+/**
+ * RFC 7662 Token Introspection response (raw format from server)
+ *
+ * Used internally by verifyAccessToken(). Consumers receive the normalized
+ * FFIDOAuthUserInfo type instead.
+ *
+ * @see https://tools.ietf.org/html/rfc7662
+ */
+interface FFIDTokenIntrospectionResponse {
+    active: boolean;
+    sub?: string;
+    email?: string;
+    /** Whether the user's email is verified (#3791). Optional for backward compat with older FFID. */
+    email_verified?: boolean;
+    name?: string;
+    picture?: string | null;
+    company_name?: string | null;
+    department?: string | null;
+    position?: string | null;
+    phone_number?: string | null;
+    scope?: string | null;
+    exp?: number;
+    iat?: number;
+    iss?: string;
+    token_type?: 'Bearer';
+    client_id?: string;
+    organization_id?: string | null;
+    organization_name?: string | null;
+    subscription?: {
+        subscription_id: string | null;
+        status: FFIDOAuthUserInfoSubscription['status'];
+        /** Optional for backward compat with older FFID (< 5.3.0 / #3353). */
+        effective_status?: FFIDOAuthUserInfoSubscription['effectiveStatus'];
+        plan_code: string | null;
+        seat_model: FFIDOAuthUserInfoSubscription['seatModel'];
+        member_role: FFIDOAuthUserInfoSubscription['memberRole'];
+        organization_id: string | null;
+        organization_name?: string | null;
+        has_seat_assignment?: boolean;
+        /**
+         * Optional for backward compat with older FFID (< #4333), and omitted when
+         * the service API key has `token:introspect` without `subscription:read`.
+         */
+        entitlements?: readonly string[];
+    };
+}
+
 /** OTP / magic link methods - sendOtp / verifyOtp */
 
 /** Response from sendOtp */
@@ -1478,6 +1543,11 @@ declare function createFFIDClient(config: FFIDConfig): {
     };
     /** Token store (token mode only) */
     tokenStore: TokenStore;
+    /**
+     * Return the currently-valid access token, or null (token mode only; #4318).
+     * Live-reads the store and applies the 30s expiry buffer.
+     */
+    getAccessToken: () => string | null;
     /** Resolved auth mode */
     authMode: FFIDAuthMode;
     /** Resolved logger instance */
@@ -1643,7 +1713,7 @@ interface FFIDProviderProps extends FFIDConfig {
  * - Automatic session refresh
  * - Token mode: automatic code exchange and token refresh
  */
-declare function FFIDProvider({ children, serviceCode, scope, apiBaseUrl, debug, logger, refreshInterval, onAuthStateChange, onError, authMode, clientId, timeout, cleanCallbackUrl, }: FFIDProviderProps): react_jsx_runtime.JSX.Element;
+declare function FFIDProvider({ children, serviceCode, scope, apiBaseUrl, debug, logger, refreshInterval, onAuthStateChange, onError, authMode, clientId, timeout, tokenStore, cleanCallbackUrl, }: FFIDProviderProps): react_jsx_runtime.JSX.Element;
 
 /**
  * Return type for useFFID hook
@@ -1707,6 +1777,14 @@ interface UseFFIDReturn {
     switchOrganization: (organizationId: string) => void;
     /** Refresh session data */
     refresh: () => Promise<void>;
+    /**
+     * Token mode: return the currently-valid access token, or `null` when there is
+     * none or it is expired (30s buffer). Live-reads the shared token store on each
+     * call, so a token refreshed in the background — or cleared on logout — is
+     * reflected without the host caching or polling it. Always `null` in
+     * cookie / service-key mode. Stable function reference (#4318).
+     */
+    getAccessToken: () => string | null;
     /** Get login URL with redirect parameter */
     getLoginUrl: (redirectUrl?: string) => string;
     /** Get signup URL with redirect parameter */
@@ -2316,4 +2394,4 @@ declare function createInquiryMethods(deps: InquiryMethodsDeps): {
 };
 type FFIDInquiryClient = ReturnType<typeof createInquiryMethods>;
 
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, AnnouncementListResponse, BLOCKING_EFFECTIVE_STATUSES, type ComputeEffectiveStatusInput, type ContractWizardFlowType, type ContractWizardResubscribeOptions, type ContractWizardSubscribeOptions, type ContractWizardSubscriptionOptions, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EffectiveSubscriptionStatus, type ExchangeCodeForTokensOptions, type FFIDAddMemberParams, type FFIDAddMemberRequest, type FFIDAddMemberResponse, FFIDAnnouncementsApiResponse, type FFIDAnnouncementsClient, FFIDAnnouncementsClientConfig, FFIDAnnouncementsLogger, FFIDApiResponse, type FFIDAssignableMemberRole, type FFIDBillingInterval, FFIDCacheAdapter, type FFIDCancelPendingDowngradeResponse, type FFIDCancelSubscriptionParams, type FFIDCancelSubscriptionResponse, type FFIDChangePlanParams, type FFIDChangePlanResponse, FFIDCheckServiceAccessParams, type FFIDCheckoutSessionResponse, type FFIDClient, FFIDConfig, type FFIDCreateCheckoutParams, type FFIDCreatePortalParams, FFIDError, type FFIDErrorCode, type FFIDInquiryClient, FFIDInquiryCreateParams, FFIDInquiryCreateResponse, type FFIDInvitationStatus, type FFIDInviteMemberRequest, type FFIDInviteMemberResponse, type FFIDLeaveOrganizationParams, type FFIDLeaveOrganizationResponse, type FFIDListMembersResponse, type FFIDListPlansResponse, FFIDLogger, type FFIDLoginHistoryEntry, type FFIDLoginHistoryResponse, type FFIDMemberRole, type FFIDMemberStatus, type FFIDNewsletterBodySource, type FFIDNewsletterCampaignStatus, type FFIDNewsletterClient, type FFIDNewsletterConfirmParams, type FFIDNewsletterConfirmResponse, type FFIDNewsletterDispatchParams, type FFIDNewsletterDispatchResponse, type FFIDNewsletterSegment, type FFIDNewsletterSubscribeParams, type FFIDNewsletterSubscribeResponse, type FFIDNewsletterType, type FFIDNewsletterUnsubscribeParams, type FFIDNewsletterUnsubscribeResponse, FFIDOAuthUserInfo, FFIDOAuthUserInfoSubscription, FFIDOrganization, type FFIDOrganizationDomain, type FFIDOrganizationDomainsResponse, type FFIDOrganizationMember, type FFIDOrganizationNotificationPreferences, type FFIDOrganizationNotificationPreferencesResponse, type FFIDOtpSendResponse, type FFIDOtpVerifyResponse, type FFIDPasswordResetConfirmResponse, type FFIDPasswordResetResponse, type FFIDPasswordResetVerifyResponse, type FFIDPlanChangeLineItem, type FFIDPlanChangePreview, type FFIDPlanChangePreviewResponse, type FFIDPlanInfo, type FFIDPortalSessionResponse, type FFIDPreviewPlanChangeParams, type FFIDPreviewSeatChangeParams, type FFIDProfileCallOptions, FFIDProvider, type FFIDProviderProps, type FFIDProvisionMemberPlan, type FFIDProvisionMemberPlanStatus, type FFIDProvisionMemberResult, type FFIDProvisionMemberStatus, type FFIDProvisionOrganizationDryRun, type FFIDProvisionOrganizationMemberInput, type FFIDProvisionOrganizationOutcome, type FFIDProvisionOrganizationParams, type FFIDProvisionOrganizationResponse, type FFIDProvisionUserDryRun, type FFIDProvisionUserOutcome, type FFIDProvisionUserParams, type FFIDProvisionUserProfileInput, type FFIDProvisionUserResponse, type FFIDProvisionedOrganization, type FFIDProvisionedUser, FFIDRedirectResult, type FFIDRemoveMemberResponse, type FFIDResetSessionResponse, FFIDSDKError, type FFIDSeatChangeLineItem, type FFIDSeatChangePreview, type FFIDSeatChangePreviewResponse, FFIDServiceAccessDecision, type FFIDServiceInfo, FFIDSessionResponse, FFIDSignOutResult, type FFIDSubscribeParams, type FFIDSubscribeResponse, FFIDSubscription, FFIDSubscriptionCheckResponse, FFIDSubscriptionContextValue, type FFIDSubscriptionDetail, FFIDSubscriptionStatus, type FFIDSubscriptionSummary, type FFIDSupportedCurrency, type FFIDUpdateMemberRoleResponse, type FFIDUpdateNotificationPreferencesRequest, type FFIDUpdateUserProfileRequest, FFIDUser, type FFIDUserProfile, FFIDVerifyAccessTokenOptions, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_ERROR_CODES, FFID_NEWSLETTER_DISPATCH_MAX_RECIPIENTS, FFID_NEWSLETTER_TYPES, type HandleRedirectCallbackClient, type HandleRedirectCallbackOptions, type KVNamespaceLike, ListAnnouncementsOptions, type NormalizeRedirectUriResult, type RedirectToAuthorizeOptions, type TokenData, type TokenStore, type UseFFIDReturn, type UseRequireActiveSubscriptionOptions, type UseRequireActiveSubscriptionReturn, type WithFFIDAuthOptions, type WithSubscriptionOptions, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createKVCacheAdapter, createMemoryCacheAdapter, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useRequireActiveSubscription, useSubscription, withFFIDAuth, withSubscription };
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, AnnouncementListResponse, BLOCKING_EFFECTIVE_STATUSES, type ComputeEffectiveStatusInput, type ContractWizardFlowType, type ContractWizardResubscribeOptions, type ContractWizardSubscribeOptions, type ContractWizardSubscriptionOptions, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EffectiveSubscriptionStatus, type ExchangeCodeForTokensOptions, type FFIDAddMemberParams, type FFIDAddMemberRequest, type FFIDAddMemberResponse, FFIDAnnouncementsApiResponse, type FFIDAnnouncementsClient, FFIDAnnouncementsClientConfig, FFIDAnnouncementsLogger, FFIDApiResponse, type FFIDAssignableMemberRole, type FFIDBillingInterval, FFIDCacheAdapter, type FFIDCancelPendingDowngradeResponse, type FFIDCancelSubscriptionParams, type FFIDCancelSubscriptionResponse, type FFIDChangePlanParams, type FFIDChangePlanResponse, FFIDCheckServiceAccessParams, type FFIDCheckoutSessionResponse, type FFIDClient, FFIDConfig, type FFIDCreateCheckoutParams, type FFIDCreatePortalParams, FFIDError, type FFIDErrorCode, type FFIDInquiryClient, FFIDInquiryCreateParams, FFIDInquiryCreateResponse, type FFIDInvitationStatus, type FFIDInviteMemberRequest, type FFIDInviteMemberResponse, type FFIDLeaveOrganizationParams, type FFIDLeaveOrganizationResponse, type FFIDListMembersResponse, type FFIDListPlansResponse, FFIDLogger, type FFIDLoginHistoryEntry, type FFIDLoginHistoryResponse, type FFIDMemberRole, type FFIDMemberStatus, type FFIDNewsletterBodySource, type FFIDNewsletterCampaignStatus, type FFIDNewsletterClient, type FFIDNewsletterConfirmParams, type FFIDNewsletterConfirmResponse, type FFIDNewsletterDispatchParams, type FFIDNewsletterDispatchResponse, type FFIDNewsletterSegment, type FFIDNewsletterSubscribeParams, type FFIDNewsletterSubscribeResponse, type FFIDNewsletterType, type FFIDNewsletterUnsubscribeParams, type FFIDNewsletterUnsubscribeResponse, type FFIDOAuthTokenResponse, FFIDOAuthUserInfo, FFIDOAuthUserInfoSubscription, FFIDOrganization, type FFIDOrganizationDomain, type FFIDOrganizationDomainsResponse, type FFIDOrganizationMember, type FFIDOrganizationNotificationPreferences, type FFIDOrganizationNotificationPreferencesResponse, type FFIDOtpSendResponse, type FFIDOtpVerifyResponse, type FFIDPasswordResetConfirmResponse, type FFIDPasswordResetResponse, type FFIDPasswordResetVerifyResponse, type FFIDPlanChangeLineItem, type FFIDPlanChangePreview, type FFIDPlanChangePreviewResponse, type FFIDPlanInfo, type FFIDPortalSessionResponse, type FFIDPreviewPlanChangeParams, type FFIDPreviewSeatChangeParams, type FFIDProfileCallOptions, FFIDProvider, type FFIDProviderProps, type FFIDProvisionMemberPlan, type FFIDProvisionMemberPlanStatus, type FFIDProvisionMemberResult, type FFIDProvisionMemberStatus, type FFIDProvisionOrganizationDryRun, type FFIDProvisionOrganizationMemberInput, type FFIDProvisionOrganizationOutcome, type FFIDProvisionOrganizationParams, type FFIDProvisionOrganizationResponse, type FFIDProvisionUserDryRun, type FFIDProvisionUserOutcome, type FFIDProvisionUserParams, type FFIDProvisionUserProfileInput, type FFIDProvisionUserResponse, type FFIDProvisionedOrganization, type FFIDProvisionedUser, type FFIDRedirectErrorCode, type FFIDRedirectResult, type FFIDRemoveMemberResponse, type FFIDResetSessionResponse, FFIDSDKError, type FFIDSeatChangeLineItem, type FFIDSeatChangePreview, type FFIDSeatChangePreviewResponse, FFIDServiceAccessDecision, type FFIDServiceInfo, FFIDSessionResponse, FFIDSignOutResult, type FFIDSubscribeParams, type FFIDSubscribeResponse, FFIDSubscription, FFIDSubscriptionCheckResponse, FFIDSubscriptionContextValue, type FFIDSubscriptionDetail, FFIDSubscriptionStatus, type FFIDSubscriptionSummary, type FFIDSupportedCurrency, type FFIDTokenIntrospectionResponse, type FFIDUpdateMemberRoleResponse, type FFIDUpdateNotificationPreferencesRequest, type FFIDUpdateUserProfileRequest, FFIDUser, type FFIDUserProfile, FFIDVerifyAccessTokenOptions, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_ERROR_CODES, FFID_NEWSLETTER_DISPATCH_MAX_RECIPIENTS, FFID_NEWSLETTER_TYPES, type HandleRedirectCallbackClient, type HandleRedirectCallbackOptions, type KVNamespaceLike, ListAnnouncementsOptions, type NormalizeRedirectUriResult, type RedirectToAuthorizeOptions, TokenStore, type UseFFIDReturn, type UseRequireActiveSubscriptionOptions, type UseRequireActiveSubscriptionReturn, type WithFFIDAuthOptions, type WithSubscriptionOptions, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createKVCacheAdapter, createMemoryCacheAdapter, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useRequireActiveSubscription, useSubscription, withFFIDAuth, withSubscription };

package/dist/index.js

@@ -1,5 +1,5 @@
-import { useFFIDContext, useSubscription } from './chunk-Q7ZEF3EN.js';
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useSubscription, withSubscription } from './chunk-Q7ZEF3EN.js';
+import { useFFIDContext, useSubscription } from './chunk-HIKX4AVY.js';
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useSubscription, withSubscription } from './chunk-HIKX4AVY.js';
 export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, CONSENT_DISMISSAL_TIMESTAMP_KEY, COOKIE_VERSION, DEFAULT_CONSENT_ERROR_MESSAGES, FFIDAnalyticsProvider, FFIDConsentError, FFIDCookieBanner, FFIDCookieLink, FFIDCookieSettings, FFID_CONSENT_ERROR_CODES, clearConsentDismissalTimestamp, decodeConsentCookie, encodeConsentCookie, readConsentCookie, readConsentDismissalTimestamp, useFFIDConsent, useFFIDConsentPreferences, writeConsentCookie, writeConsentDismissalTimestamp } from './chunk-G7VOX64X.js';
 import { useEffect, useRef } from 'react';
 import { jsx, Fragment } from 'react/jsx-runtime';

package/dist/server/index.cjs

@@ -111,6 +111,14 @@ function isSessionEligibleSubscriptionStatus(value) {
 function hasOwnKey(value, key) {
   return Object.prototype.hasOwnProperty.call(value, key);
 }
+function normalizeEntitlements(raw) {
+  if (!Array.isArray(raw)) return [];
+  return raw.flatMap((code) => {
+    if (typeof code !== "string") return [];
+    const trimmed = code.trim();
+    return trimmed.length > 0 ? [trimmed] : [];
+  });
+}
 function normalizeUserinfo(raw) {
   const hasOrganizationId = hasOwnKey(raw, "organization_id");
   const hasOrganizationName = hasOwnKey(raw, "organization_name");
@@ -151,7 +159,10 @@ function normalizeUserinfo(raw) {
       // `'active_canceling'`) for legacy backends. Defaulting to `false`
       // here keeps the downstream contract a plain boolean.
       cancelAtPeriodEnd: raw.subscription.cancel_at_period_end ?? false,
-      currentPeriodEnd: raw.subscription.current_period_end ?? null
+      currentPeriodEnd: raw.subscription.current_period_end ?? null,
+      // #4333: legacy FFID (< this issue) omits the field on the wire; the
+      // guard defaults to `[]` so consumers always get a plain string[].
+      entitlements: normalizeEntitlements(raw.subscription.entitlements)
     } : void 0
   };
 }
@@ -438,7 +449,11 @@ function createVerifyAccessToken(deps) {
         member_role: introspectResponse.subscription.member_role,
         organization_id: introspectResponse.subscription.organization_id,
         organization_name: introspectResponse.subscription.organization_name ?? null,
-        has_seat_assignment: introspectResponse.subscription.has_seat_assignment ?? false
+        has_seat_assignment: introspectResponse.subscription.has_seat_assignment ?? false,
+        // #4333: forward pack entitlement codes through the introspect →
+        // userinfo normalization boundary. normalizeUserinfo guards the
+        // value, so an older FFID that omits it degrades to `[]`.
+        entitlements: introspectResponse.subscription.entitlements
       }
     } : base;
     const userinfo = normalizeUserinfo(raw);
@@ -1223,8 +1238,35 @@ function createNonContractMethods(deps) {
   };
 }
 
+// src/shared/token-response.ts
+function invalidTokenFields(tokenResponse) {
+  const invalid = [];
+  if (typeof tokenResponse.access_token !== "string" || tokenResponse.access_token.length === 0) {
+    invalid.push("access_token");
+  }
+  if (typeof tokenResponse.refresh_token !== "string" || tokenResponse.refresh_token.length === 0) {
+    invalid.push("refresh_token");
+  }
+  if (typeof tokenResponse.expires_in !== "number" || !Number.isFinite(tokenResponse.expires_in) || tokenResponse.expires_in <= 0) {
+    invalid.push("expires_in");
+  }
+  return invalid;
+}
+function hasValidatedTokens(tokenResponse) {
+  return invalidTokenFields(tokenResponse).length === 0;
+}
+function validateTokenResponse(tokenResponse) {
+  if (hasValidatedTokens(tokenResponse)) {
+    return { ok: true, tokens: tokenResponse };
+  }
+  return {
+    ok: false,
+    message: `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalidTokenFields(tokenResponse).join(", ")}`
+  };
+}
+
 // src/client/version-check.ts
-var SDK_VERSION = "5.24.2";
+var SDK_VERSION = "5.25.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1271,31 +1313,6 @@ npm install @feelflow/ffid-sdk@latest \u3067\u30A2\u30C3\u30D7\u30C7\u30FC\u30C8
 var OAUTH_TOKEN_ENDPOINT = "/api/v1/oauth/token";
 var OAUTH_REVOKE_ENDPOINT = "/api/v1/oauth/revoke";
 var MS_PER_SECOND = 1e3;
-function invalidTokenFields(tokenResponse) {
-  const invalid = [];
-  if (!tokenResponse.access_token) {
-    invalid.push("access_token");
-  }
-  if (!tokenResponse.refresh_token) {
-    invalid.push("refresh_token");
-  }
-  if (typeof tokenResponse.expires_in !== "number" || !Number.isFinite(tokenResponse.expires_in) || tokenResponse.expires_in <= 0) {
-    invalid.push("expires_in");
-  }
-  return invalid;
-}
-function hasValidatedTokens(tokenResponse) {
-  return invalidTokenFields(tokenResponse).length === 0;
-}
-function validateTokenResponse(tokenResponse) {
-  if (hasValidatedTokens(tokenResponse)) {
-    return { ok: true, tokens: tokenResponse };
-  }
-  return {
-    ok: false,
-    message: `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalidTokenFields(tokenResponse).join(", ")}`
-  };
-}
 function createOAuthTokenMethods(deps) {
   const {
     baseUrl,
@@ -2846,10 +2863,16 @@ function createFFIDClient(config) {
   }
   const logger = config.logger ?? (config.debug ? consoleLogger : noopLogger);
   const resolvedRedirectUri = resolveRedirectUri(rawRedirectUri, logger);
-  const tokenStore = authMode === "token" ? createTokenStore() : createTokenStore("memory");
+  const tokenStore = authMode === "token" ? config.tokenStore ?? createTokenStore() : createTokenStore("memory");
   function createError(code, message) {
     return { code, message };
   }
+  function getAccessToken() {
+    if (authMode !== "token") return null;
+    if (tokenStore.isAccessTokenExpired()) return null;
+    const accessToken = tokenStore.getTokens()?.accessToken;
+    return accessToken && accessToken.length > 0 ? accessToken : null;
+  }
   function buildFetchOptions(options, authOverride) {
     if (authOverride) {
       return {
@@ -3259,6 +3282,11 @@ function createFFIDClient(config) {
     inquiry,
     /** Token store (token mode only) */
     tokenStore,
+    /**
+     * Return the currently-valid access token, or null (token mode only; #4318).
+     * Live-reads the store and applies the 30s expiry buffer.
+     */
+    getAccessToken,
     /** Resolved auth mode */
     authMode,
     /** Resolved logger instance */
@@ -3420,27 +3448,6 @@ function withTimeout(init, timeout) {
   }
   return init;
 }
-function invalidTokenFields2(r) {
-  const invalid = [];
-  if (!r.access_token) invalid.push("access_token");
-  if (!r.refresh_token) invalid.push("refresh_token");
-  if (typeof r.expires_in !== "number" || !Number.isFinite(r.expires_in) || r.expires_in <= 0) {
-    invalid.push("expires_in");
-  }
-  return invalid;
-}
-function hasValidatedTokens2(r) {
-  return invalidTokenFields2(r).length === 0;
-}
-function validateTokenResponse2(r) {
-  if (hasValidatedTokens2(r)) {
-    return { ok: true, tokens: r };
-  }
-  return {
-    ok: false,
-    message: `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalidTokenFields2(r).join(", ")}`
-  };
-}
 function toTokens(r) {
   return {
     accessToken: r.access_token,
@@ -3486,7 +3493,7 @@ async function postToken(deps, body, fallbackErrorCode) {
     const errorBody = json;
     return fail(errorBody.error ?? fallbackErrorCode, errorBody.error_description ?? "\u30C8\u30FC\u30AF\u30F3\u51E6\u7406\u306B\u5931\u6557\u3057\u307E\u3057\u305F");
   }
-  const validation = validateTokenResponse2(json);
+  const validation = validateTokenResponse(json);
   if (!validation.ok) {
     return fail(fallbackErrorCode, validation.message);
   }

package/dist/server/index.d.cts

@@ -1,5 +1,5 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-D0Jh4bO7.cjs';
-export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDProvisionMemberPlan, x as FFIDProvisionMemberPlanStatus, y as FFIDProvisionMemberResult, z as FFIDProvisionMemberStatus, A as FFIDProvisionOrganizationDryRun, B as FFIDProvisionOrganizationMemberInput, C as FFIDProvisionOrganizationOutcome, D as FFIDProvisionOrganizationParams, E as FFIDProvisionOrganizationResponse, G as FFIDProvisionUserDryRun, H as FFIDProvisionUserOutcome, I as FFIDProvisionUserParams, J as FFIDProvisionUserProfileInput, K as FFIDProvisionUserResponse, L as FFIDProvisionedOrganization, M as FFIDProvisionedUser, N as FFIDRemoveMemberResponse, O as FFIDResetSessionResponse, P as FFIDSubscription, Q as FFIDUpdateMemberRoleResponse, R as FFIDUpdateUserProfileRequest, S as FFIDUser, T as FFIDUserProfile, U as TokenData, V as TokenStore, W as createFFIDClient, X as createTokenStore } from '../ffid-client-D0Jh4bO7.cjs';
+import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-BZERrMAF.cjs';
+export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDProvisionMemberPlan, x as FFIDProvisionMemberPlanStatus, y as FFIDProvisionMemberResult, z as FFIDProvisionMemberStatus, A as FFIDProvisionOrganizationDryRun, B as FFIDProvisionOrganizationMemberInput, C as FFIDProvisionOrganizationOutcome, D as FFIDProvisionOrganizationParams, E as FFIDProvisionOrganizationResponse, G as FFIDProvisionUserDryRun, H as FFIDProvisionUserOutcome, I as FFIDProvisionUserParams, J as FFIDProvisionUserProfileInput, K as FFIDProvisionUserResponse, L as FFIDProvisionedOrganization, M as FFIDProvisionedUser, N as FFIDRemoveMemberResponse, O as FFIDResetSessionResponse, P as FFIDSubscription, Q as FFIDUpdateMemberRoleResponse, R as FFIDUpdateUserProfileRequest, S as FFIDUser, T as FFIDUserProfile, U as TokenData, V as TokenStore, W as createFFIDClient, X as createTokenStore } from '../ffid-client-BZERrMAF.cjs';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-D61jqRIO.cjs';
 import { z } from 'zod';
 import '../types-Cjb9J0rL.cjs';

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-DX2PTTFr.js';
-export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDProvisionMemberPlan, x as FFIDProvisionMemberPlanStatus, y as FFIDProvisionMemberResult, z as FFIDProvisionMemberStatus, A as FFIDProvisionOrganizationDryRun, B as FFIDProvisionOrganizationMemberInput, C as FFIDProvisionOrganizationOutcome, D as FFIDProvisionOrganizationParams, E as FFIDProvisionOrganizationResponse, G as FFIDProvisionUserDryRun, H as FFIDProvisionUserOutcome, I as FFIDProvisionUserParams, J as FFIDProvisionUserProfileInput, K as FFIDProvisionUserResponse, L as FFIDProvisionedOrganization, M as FFIDProvisionedUser, N as FFIDRemoveMemberResponse, O as FFIDResetSessionResponse, P as FFIDSubscription, Q as FFIDUpdateMemberRoleResponse, R as FFIDUpdateUserProfileRequest, S as FFIDUser, T as FFIDUserProfile, U as TokenData, V as TokenStore, W as createFFIDClient, X as createTokenStore } from '../ffid-client-DX2PTTFr.js';
+import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-CFZPX5ej.js';
+export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDProvisionMemberPlan, x as FFIDProvisionMemberPlanStatus, y as FFIDProvisionMemberResult, z as FFIDProvisionMemberStatus, A as FFIDProvisionOrganizationDryRun, B as FFIDProvisionOrganizationMemberInput, C as FFIDProvisionOrganizationOutcome, D as FFIDProvisionOrganizationParams, E as FFIDProvisionOrganizationResponse, G as FFIDProvisionUserDryRun, H as FFIDProvisionUserOutcome, I as FFIDProvisionUserParams, J as FFIDProvisionUserProfileInput, K as FFIDProvisionUserResponse, L as FFIDProvisionedOrganization, M as FFIDProvisionedUser, N as FFIDRemoveMemberResponse, O as FFIDResetSessionResponse, P as FFIDSubscription, Q as FFIDUpdateMemberRoleResponse, R as FFIDUpdateUserProfileRequest, S as FFIDUser, T as FFIDUserProfile, U as TokenData, V as TokenStore, W as createFFIDClient, X as createTokenStore } from '../ffid-client-CFZPX5ej.js';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-D61jqRIO.js';
 import { z } from 'zod';
 import '../types-Cjb9J0rL.js';

package/dist/server/index.js

@@ -110,6 +110,14 @@ function isSessionEligibleSubscriptionStatus(value) {
 function hasOwnKey(value, key) {
   return Object.prototype.hasOwnProperty.call(value, key);
 }
+function normalizeEntitlements(raw) {
+  if (!Array.isArray(raw)) return [];
+  return raw.flatMap((code) => {
+    if (typeof code !== "string") return [];
+    const trimmed = code.trim();
+    return trimmed.length > 0 ? [trimmed] : [];
+  });
+}
 function normalizeUserinfo(raw) {
   const hasOrganizationId = hasOwnKey(raw, "organization_id");
   const hasOrganizationName = hasOwnKey(raw, "organization_name");
@@ -150,7 +158,10 @@ function normalizeUserinfo(raw) {
       // `'active_canceling'`) for legacy backends. Defaulting to `false`
       // here keeps the downstream contract a plain boolean.
       cancelAtPeriodEnd: raw.subscription.cancel_at_period_end ?? false,
-      currentPeriodEnd: raw.subscription.current_period_end ?? null
+      currentPeriodEnd: raw.subscription.current_period_end ?? null,
+      // #4333: legacy FFID (< this issue) omits the field on the wire; the
+      // guard defaults to `[]` so consumers always get a plain string[].
+      entitlements: normalizeEntitlements(raw.subscription.entitlements)
     } : void 0
   };
 }
@@ -437,7 +448,11 @@ function createVerifyAccessToken(deps) {
         member_role: introspectResponse.subscription.member_role,
         organization_id: introspectResponse.subscription.organization_id,
         organization_name: introspectResponse.subscription.organization_name ?? null,
-        has_seat_assignment: introspectResponse.subscription.has_seat_assignment ?? false
+        has_seat_assignment: introspectResponse.subscription.has_seat_assignment ?? false,
+        // #4333: forward pack entitlement codes through the introspect →
+        // userinfo normalization boundary. normalizeUserinfo guards the
+        // value, so an older FFID that omits it degrades to `[]`.
+        entitlements: introspectResponse.subscription.entitlements
       }
     } : base;
     const userinfo = normalizeUserinfo(raw);
@@ -1222,8 +1237,35 @@ function createNonContractMethods(deps) {
   };
 }
 
+// src/shared/token-response.ts
+function invalidTokenFields(tokenResponse) {
+  const invalid = [];
+  if (typeof tokenResponse.access_token !== "string" || tokenResponse.access_token.length === 0) {
+    invalid.push("access_token");
+  }
+  if (typeof tokenResponse.refresh_token !== "string" || tokenResponse.refresh_token.length === 0) {
+    invalid.push("refresh_token");
+  }
+  if (typeof tokenResponse.expires_in !== "number" || !Number.isFinite(tokenResponse.expires_in) || tokenResponse.expires_in <= 0) {
+    invalid.push("expires_in");
+  }
+  return invalid;
+}
+function hasValidatedTokens(tokenResponse) {
+  return invalidTokenFields(tokenResponse).length === 0;
+}
+function validateTokenResponse(tokenResponse) {
+  if (hasValidatedTokens(tokenResponse)) {
+    return { ok: true, tokens: tokenResponse };
+  }
+  return {
+    ok: false,
+    message: `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalidTokenFields(tokenResponse).join(", ")}`
+  };
+}
+
 // src/client/version-check.ts
-var SDK_VERSION = "5.24.2";
+var SDK_VERSION = "5.25.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1270,31 +1312,6 @@ npm install @feelflow/ffid-sdk@latest \u3067\u30A2\u30C3\u30D7\u30C7\u30FC\u30C8
 var OAUTH_TOKEN_ENDPOINT = "/api/v1/oauth/token";
 var OAUTH_REVOKE_ENDPOINT = "/api/v1/oauth/revoke";
 var MS_PER_SECOND = 1e3;
-function invalidTokenFields(tokenResponse) {
-  const invalid = [];
-  if (!tokenResponse.access_token) {
-    invalid.push("access_token");
-  }
-  if (!tokenResponse.refresh_token) {
-    invalid.push("refresh_token");
-  }
-  if (typeof tokenResponse.expires_in !== "number" || !Number.isFinite(tokenResponse.expires_in) || tokenResponse.expires_in <= 0) {
-    invalid.push("expires_in");
-  }
-  return invalid;
-}
-function hasValidatedTokens(tokenResponse) {
-  return invalidTokenFields(tokenResponse).length === 0;
-}
-function validateTokenResponse(tokenResponse) {
-  if (hasValidatedTokens(tokenResponse)) {
-    return { ok: true, tokens: tokenResponse };
-  }
-  return {
-    ok: false,
-    message: `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalidTokenFields(tokenResponse).join(", ")}`
-  };
-}
 function createOAuthTokenMethods(deps) {
   const {
     baseUrl,
@@ -2845,10 +2862,16 @@ function createFFIDClient(config) {
   }
   const logger = config.logger ?? (config.debug ? consoleLogger : noopLogger);
   const resolvedRedirectUri = resolveRedirectUri(rawRedirectUri, logger);
-  const tokenStore = authMode === "token" ? createTokenStore() : createTokenStore("memory");
+  const tokenStore = authMode === "token" ? config.tokenStore ?? createTokenStore() : createTokenStore("memory");
   function createError(code, message) {
     return { code, message };
   }
+  function getAccessToken() {
+    if (authMode !== "token") return null;
+    if (tokenStore.isAccessTokenExpired()) return null;
+    const accessToken = tokenStore.getTokens()?.accessToken;
+    return accessToken && accessToken.length > 0 ? accessToken : null;
+  }
   function buildFetchOptions(options, authOverride) {
     if (authOverride) {
       return {
@@ -3258,6 +3281,11 @@ function createFFIDClient(config) {
     inquiry,
     /** Token store (token mode only) */
     tokenStore,
+    /**
+     * Return the currently-valid access token, or null (token mode only; #4318).
+     * Live-reads the store and applies the 30s expiry buffer.
+     */
+    getAccessToken,
     /** Resolved auth mode */
     authMode,
     /** Resolved logger instance */
@@ -3419,27 +3447,6 @@ function withTimeout(init, timeout) {
   }
   return init;
 }
-function invalidTokenFields2(r) {
-  const invalid = [];
-  if (!r.access_token) invalid.push("access_token");
-  if (!r.refresh_token) invalid.push("refresh_token");
-  if (typeof r.expires_in !== "number" || !Number.isFinite(r.expires_in) || r.expires_in <= 0) {
-    invalid.push("expires_in");
-  }
-  return invalid;
-}
-function hasValidatedTokens2(r) {
-  return invalidTokenFields2(r).length === 0;
-}
-function validateTokenResponse2(r) {
-  if (hasValidatedTokens2(r)) {
-    return { ok: true, tokens: r };
-  }
-  return {
-    ok: false,
-    message: `\u30C8\u30FC\u30AF\u30F3\u30EC\u30B9\u30DD\u30F3\u30B9\u306B\u4E0D\u6B63\u306A\u30D5\u30A3\u30FC\u30EB\u30C9\u304C\u3042\u308A\u307E\u3059: ${invalidTokenFields2(r).join(", ")}`
-  };
-}
 function toTokens(r) {
   return {
     accessToken: r.access_token,
@@ -3485,7 +3492,7 @@ async function postToken(deps, body, fallbackErrorCode) {
     const errorBody = json;
     return fail(errorBody.error ?? fallbackErrorCode, errorBody.error_description ?? "\u30C8\u30FC\u30AF\u30F3\u51E6\u7406\u306B\u5931\u6557\u3057\u307E\u3057\u305F");
   }
-  const validation = validateTokenResponse2(json);
+  const validation = validateTokenResponse(json);
   if (!validation.ok) {
     return fail(fallbackErrorCode, validation.message);
   }

package/dist/server/test/index.d.cts

@@ -1,4 +1,4 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-D0Jh4bO7.cjs';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-BZERrMAF.cjs';
 import '../../types-Cjb9J0rL.cjs';
 
 /**

package/dist/server/test/index.d.ts

@@ -1,4 +1,4 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-DX2PTTFr.js';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-CFZPX5ej.js';
 import '../../types-Cjb9J0rL.js';
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feelflow/ffid-sdk",
-  "version": "5.24.2",
+  "version": "5.25.0",
   "description": "FeelFlow ID Platform SDK for React/Next.js applications",
   "keywords": [
     "feelflow",