@feelflow/ffid-sdk 5.24.3 → 5.27.0

package/dist/server/index.js

@@ -110,6 +110,24 @@ function isSessionEligibleSubscriptionStatus(value) {
 function hasOwnKey(value, key) {
   return Object.prototype.hasOwnProperty.call(value, key);
 }
+function normalizeEntitlements(raw) {
+  if (!Array.isArray(raw)) return [];
+  return raw.flatMap((code) => {
+    if (typeof code !== "string") return [];
+    const trimmed = code.trim();
+    return trimmed.length > 0 ? [trimmed] : [];
+  });
+}
+function normalizeSeatAssignmentClaim(raw, organizationId, subscriptionId) {
+  if (!raw || typeof raw !== "object") return null;
+  const { organization_id, subscription_id, status } = raw;
+  if (typeof organization_id !== "string" || typeof subscription_id !== "string" || typeof status !== "string" || !["active", "revoking", "revoked"].includes(status) || organization_id !== organizationId || subscription_id !== subscriptionId) return null;
+  return {
+    organizationId: organization_id,
+    subscriptionId: subscription_id,
+    status
+  };
+}
 function normalizeUserinfo(raw) {
   const hasOrganizationId = hasOwnKey(raw, "organization_id");
   const hasOrganizationName = hasOwnKey(raw, "organization_name");
@@ -143,6 +161,11 @@ function normalizeUserinfo(raw) {
       organizationId: raw.subscription.organization_id ?? null,
       organizationName: hasOwnKey(raw.subscription, "organization_name") ? raw.subscription.organization_name ?? null : null,
       hasSeatAssignment: raw.subscription.has_seat_assignment ?? false,
+      seatAssignment: hasOwnKey(raw.subscription, "seat_assignment") ? normalizeSeatAssignmentClaim(
+        raw.subscription.seat_assignment,
+        raw.subscription.organization_id ?? null,
+        raw.subscription.subscription_id ?? null
+      ) : void 0,
       // #3464: legacy FFID (< this issue) omits the field on the wire.
       // The "unknown" axis is unused — no consumer differentiates "server
       // didn't tell us" from "definitely not scheduled" because the
@@ -150,7 +173,10 @@ function normalizeUserinfo(raw) {
       // `'active_canceling'`) for legacy backends. Defaulting to `false`
       // here keeps the downstream contract a plain boolean.
       cancelAtPeriodEnd: raw.subscription.cancel_at_period_end ?? false,
-      currentPeriodEnd: raw.subscription.current_period_end ?? null
+      currentPeriodEnd: raw.subscription.current_period_end ?? null,
+      // #4333: legacy FFID (< this issue) omits the field on the wire; the
+      // guard defaults to `[]` so consumers always get a plain string[].
+      entitlements: normalizeEntitlements(raw.subscription.entitlements)
     } : void 0
   };
 }
@@ -437,7 +463,12 @@ function createVerifyAccessToken(deps) {
         member_role: introspectResponse.subscription.member_role,
         organization_id: introspectResponse.subscription.organization_id,
         organization_name: introspectResponse.subscription.organization_name ?? null,
-        has_seat_assignment: introspectResponse.subscription.has_seat_assignment ?? false
+        has_seat_assignment: introspectResponse.subscription.has_seat_assignment ?? false,
+        ...Object.prototype.hasOwnProperty.call(introspectResponse.subscription, "seat_assignment") ? { seat_assignment: introspectResponse.subscription.seat_assignment } : {},
+        // #4333: forward pack entitlement codes through the introspect →
+        // userinfo normalization boundary. normalizeUserinfo guards the
+        // value, so an older FFID that omits it degrades to `[]`.
+        entitlements: introspectResponse.subscription.entitlements
       }
     } : base;
     const userinfo = normalizeUserinfo(raw);
@@ -808,6 +839,213 @@ function createSubscriptionMethods(deps) {
   };
 }
 
+// src/types/published-catalog.ts
+var FFID_CATALOG_ENVIRONMENTS = ["staging", "production"];
+var FFID_CATALOG_PUBLICATION_STATUSES = [
+  "approved",
+  "superseded",
+  "revoking",
+  "revoked"
+];
+
+// src/shared/catalog-hash.ts
+var CATALOG_HASH_PATTERN = /^[0-9a-f]{64}$/;
+
+// src/client/catalog-methods.ts
+var EXT_CATALOG_ENDPOINT = "/api/v1/subscriptions/ext/catalog";
+var MALFORMED_CATALOG_CODE = "MALFORMED_PUBLISHED_CATALOG";
+var PUBLICATION_STATUSES = new Set(
+  FFID_CATALOG_PUBLICATION_STATUSES
+);
+var CATALOG_ENVIRONMENTS = new Set(FFID_CATALOG_ENVIRONMENTS);
+var BILLING_INTERVALS = /* @__PURE__ */ new Set(["monthly", "yearly"]);
+var TAX_BEHAVIORS = /* @__PURE__ */ new Set(["inclusive", "exclusive"]);
+var PUBLICATION_HASH_FIELDS = [
+  "praxisCopyHash",
+  "ffidCheckoutCopyHash",
+  "legalDisclosureHash",
+  "taxConfigurationHash",
+  "paymentConfigurationHash",
+  "scopeHash"
+];
+var PUBLICATION_REQUIRED_TIMESTAMP_FIELDS = ["reviewedAt", "effectiveAt"];
+var PUBLICATION_NULLABLE_TIMESTAMP_FIELDS = [
+  "supersededAt",
+  "sellThroughUntil",
+  "revocationEffectiveAt"
+];
+function malformed(detail) {
+  return new FFIDSDKError(
+    MALFORMED_CATALOG_CODE,
+    `SDK: server returned malformed PublishedCatalog \u2014 ${detail}`
+  );
+}
+function isNullableIsoString(value) {
+  return value === null || typeof value === "string" && value.trim() !== "";
+}
+function isNonNegativeIntOrNull(value) {
+  return value === null || typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+function validatePublishedPlan(plan, index) {
+  if (plan === null || typeof plan !== "object") {
+    throw malformed(`plans[${index}] must be an object`);
+  }
+  const record = plan;
+  for (const key of Object.keys(record)) {
+    if (/stripe/i.test(key)) {
+      throw malformed(
+        `plans[${index}] contains a Stripe identifier field (${JSON.stringify(key)}) \u2014 published catalogs must never expose Stripe IDs`
+      );
+    }
+  }
+  if (isBlankString(record.code)) {
+    throw malformed(`plans[${index}].code must be a non-empty string`);
+  }
+  if (isBlankString(record.name)) {
+    throw malformed(`plans[${index}].name must be a non-empty string`);
+  }
+  if (record.description !== null && typeof record.description !== "string") {
+    throw malformed(`plans[${index}].description must be string or null`);
+  }
+  if (isBlankString(record.currency)) {
+    throw malformed(`plans[${index}].currency must be a non-empty string`);
+  }
+  if (!isNonNegativeIntOrNull(record.priceMonthly)) {
+    throw malformed(`plans[${index}].priceMonthly must be a non-negative integer or null`);
+  }
+  if (!isNonNegativeIntOrNull(record.priceYearly)) {
+    throw malformed(`plans[${index}].priceYearly must be a non-negative integer or null`);
+  }
+  if (typeof record.taxBehavior !== "string" || !TAX_BEHAVIORS.has(record.taxBehavior)) {
+    throw malformed(
+      `plans[${index}].taxBehavior must be inclusive | exclusive (got ${JSON.stringify(record.taxBehavior)})`
+    );
+  }
+  const intervals = record.billingIntervals;
+  if (!Array.isArray(intervals) || intervals.length === 0 || intervals.some((interval) => typeof interval !== "string" || !BILLING_INTERVALS.has(interval))) {
+    throw malformed(
+      `plans[${index}].billingIntervals must be a non-empty array of monthly | yearly`
+    );
+  }
+  if (intervals.includes("monthly") && record.priceMonthly === null) {
+    throw malformed(`plans[${index}] offers monthly billing but priceMonthly is null`);
+  }
+  if (intervals.includes("yearly") && record.priceYearly === null) {
+    throw malformed(`plans[${index}] offers yearly billing but priceYearly is null`);
+  }
+  if (typeof record.minSeats !== "number" || !Number.isInteger(record.minSeats) || record.minSeats < 1) {
+    throw malformed(`plans[${index}].minSeats must be a positive integer`);
+  }
+  if (record.maxSeats !== null && (typeof record.maxSeats !== "number" || !Number.isInteger(record.maxSeats) || record.maxSeats < 1)) {
+    throw malformed(`plans[${index}].maxSeats must be a positive integer or null`);
+  }
+  if (record.maxSeats !== null && record.maxSeats < record.minSeats) {
+    throw malformed(`plans[${index}].maxSeats must be >= minSeats`);
+  }
+  if (typeof record.displayOrder !== "number" || !Number.isInteger(record.displayOrder)) {
+    throw malformed(`plans[${index}].displayOrder must be an integer`);
+  }
+}
+function validatePublishedCatalog(catalog) {
+  if (catalog === null || typeof catalog !== "object") {
+    throw malformed(
+      `expected object, got ${catalog === null ? "null" : typeof catalog}`
+    );
+  }
+  const c = catalog;
+  const service = c.service;
+  if (service === null || typeof service !== "object") {
+    throw malformed("service must be an object");
+  }
+  const s = service;
+  if (isBlankString(s.code)) {
+    throw malformed("service.code must be a non-empty string");
+  }
+  if (isBlankString(s.name)) {
+    throw malformed("service.name must be a non-empty string");
+  }
+  if (isBlankString(c.catalogVersion)) {
+    throw malformed("catalogVersion must be a non-empty string");
+  }
+  const publication = c.publication;
+  if (publication === null || typeof publication !== "object") {
+    throw malformed("publication must be an object");
+  }
+  const p = publication;
+  if (isBlankString(p.serviceCode)) {
+    throw malformed("publication.serviceCode must be a non-empty string");
+  }
+  if (typeof p.environment !== "string" || !CATALOG_ENVIRONMENTS.has(p.environment)) {
+    throw malformed(
+      `publication.environment must be staging | production (got ${JSON.stringify(p.environment)})`
+    );
+  }
+  if (p.catalogVersion !== c.catalogVersion) {
+    throw malformed(
+      `publication.catalogVersion (${JSON.stringify(p.catalogVersion)}) does not match top-level catalogVersion (${JSON.stringify(c.catalogVersion)})`
+    );
+  }
+  if (typeof p.status !== "string" || !PUBLICATION_STATUSES.has(p.status)) {
+    throw malformed(
+      `publication.status must be one of approved | superseded | revoking | revoked (got ${JSON.stringify(p.status)})`
+    );
+  }
+  for (const field of PUBLICATION_HASH_FIELDS) {
+    const value = p[field];
+    if (typeof value !== "string" || !CATALOG_HASH_PATTERN.test(value)) {
+      throw malformed(`publication.${field} must be lowercase SHA-256 hex (64 chars)`);
+    }
+  }
+  if (typeof p.salesEpoch !== "number" || !Number.isInteger(p.salesEpoch) || p.salesEpoch < 1) {
+    throw malformed(
+      `publication.salesEpoch must be a positive integer (got ${JSON.stringify(p.salesEpoch)})`
+    );
+  }
+  if (isBlankString(p.approvalId)) {
+    throw malformed("publication.approvalId must be a non-empty string");
+  }
+  for (const field of PUBLICATION_REQUIRED_TIMESTAMP_FIELDS) {
+    if (isBlankString(p[field])) {
+      throw malformed(`publication.${field} must be a non-empty ISO 8601 string`);
+    }
+  }
+  for (const field of PUBLICATION_NULLABLE_TIMESTAMP_FIELDS) {
+    if (!isNullableIsoString(p[field])) {
+      throw malformed(`publication.${field} must be a non-empty ISO 8601 string or null`);
+    }
+  }
+  if (!Array.isArray(c.plans)) {
+    throw malformed(`plans must be an array (got ${typeof c.plans})`);
+  }
+  for (const [index, plan] of c.plans.entries()) {
+    validatePublishedPlan(plan, index);
+  }
+}
+function createCatalogMethods(deps) {
+  const { fetchWithAuth, createError } = deps;
+  async function getPublishedCatalog(serviceCode) {
+    if (isBlankString(serviceCode)) {
+      return {
+        error: createError("VALIDATION_ERROR", "serviceCode \u306F\u5FC5\u9808\u3067\u3059")
+      };
+    }
+    const requestedCode = serviceCode.trim();
+    const response = await fetchWithAuth(
+      `${EXT_CATALOG_ENDPOINT}/${encodeURIComponent(requestedCode)}`
+    );
+    if (response.data !== void 0) {
+      validatePublishedCatalog(response.data);
+      if (response.data.service.code !== requestedCode || response.data.publication.serviceCode !== requestedCode) {
+        throw malformed(
+          `response is for service ${JSON.stringify(response.data.service.code)} (publication: ${JSON.stringify(response.data.publication.serviceCode)}) but ${JSON.stringify(requestedCode)} was requested`
+        );
+      }
+    }
+    return response;
+  }
+  return { getPublishedCatalog };
+}
+
 // src/client/members-methods.ts
 var EXT_MEMBERS_ENDPOINT = "/api/v1/organizations/ext/members";
 function createMembersMethods(deps) {
@@ -1250,7 +1488,7 @@ function validateTokenResponse(tokenResponse) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.24.3";
+var SDK_VERSION = "5.27.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -2694,39 +2932,7 @@ var BLOCKING_EFFECTIVE_STATUSES = [
   "trial_expired"
 ];
 
-// src/client/error-codes.ts
-var FFID_ERROR_CODES = {
-  NETWORK_ERROR: "NETWORK_ERROR",
-  PARSE_ERROR: "PARSE_ERROR",
-  UNKNOWN_ERROR: "UNKNOWN_ERROR",
-  TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR",
-  TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR",
-  NO_TOKENS: "NO_TOKENS",
-  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR",
-  TOKEN_EXPIRED: "TOKEN_EXPIRED",
-  STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR"
-};
-
-// src/client/ffid-client.ts
-var UNAUTHORIZED_STATUS2 = 401;
-var SDK_LOG_PREFIX = "[FFID SDK]";
-var noopLogger = {
-  debug: () => {
-  },
-  info: () => {
-  },
-  warn: () => {
-  },
-  error: () => {
-  }
-};
-var consoleLogger = {
-  debug: (...args) => console.debug(SDK_LOG_PREFIX, ...args),
-  info: (...args) => console.info(SDK_LOG_PREFIX, ...args),
-  warn: (...args) => console.warn(SDK_LOG_PREFIX, ...args),
-  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
-};
-var EXT_CHECK_ENDPOINT = "/api/v1/subscriptions/ext/check";
+// src/client/service-access-decision.ts
 var DEFAULT_ALLOW_GRACE = true;
 var DEFAULT_SERVICE_ACCESS_FAIL_POLICY = "failClosed";
 var SERVICE_ACCESS_DENIED_CODE = "SERVICE_ACCESS_DENIED";
@@ -2793,6 +2999,40 @@ function failClosedServiceAccessDecision(params, error) {
     error
   };
 }
+
+// src/client/error-codes.ts
+var FFID_ERROR_CODES = {
+  NETWORK_ERROR: "NETWORK_ERROR",
+  PARSE_ERROR: "PARSE_ERROR",
+  UNKNOWN_ERROR: "UNKNOWN_ERROR",
+  TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR",
+  TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR",
+  NO_TOKENS: "NO_TOKENS",
+  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR",
+  TOKEN_EXPIRED: "TOKEN_EXPIRED",
+  STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR"
+};
+
+// src/client/ffid-client.ts
+var UNAUTHORIZED_STATUS2 = 401;
+var SDK_LOG_PREFIX = "[FFID SDK]";
+var noopLogger = {
+  debug: () => {
+  },
+  info: () => {
+  },
+  warn: () => {
+  },
+  error: () => {
+  }
+};
+var consoleLogger = {
+  debug: (...args) => console.debug(SDK_LOG_PREFIX, ...args),
+  info: (...args) => console.info(SDK_LOG_PREFIX, ...args),
+  warn: (...args) => console.warn(SDK_LOG_PREFIX, ...args),
+  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
+};
+var EXT_CHECK_ENDPOINT = "/api/v1/subscriptions/ext/check";
 function resolveRedirectUri(raw, logger) {
   if (raw === null) return null;
   try {
@@ -3110,6 +3350,10 @@ function createFFIDClient(config) {
     fetchWithAuth,
     createError
   });
+  const { getPublishedCatalog } = createCatalogMethods({
+    fetchWithAuth,
+    createError
+  });
   const { listMembers, addMember, updateMemberRole, removeMember } = createMembersMethods({
     fetchWithAuth,
     createError,
@@ -3236,6 +3480,7 @@ function createFFIDClient(config) {
     assignSeats,
     unassignSeat,
     listPlans,
+    getPublishedCatalog,
     getSubscription,
     subscribe,
     changePlan,

package/dist/server/test/index.d.cts

@@ -1,4 +1,4 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-BjZphrz9.cjs';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-BlVuH6ja.cjs';
 import '../../types-Cjb9J0rL.cjs';
 
 /**

package/dist/server/test/index.d.ts

@@ -1,4 +1,4 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-B-xjtrCb.js';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-BqnzUmG7.js';
 import '../../types-Cjb9J0rL.js';
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feelflow/ffid-sdk",
-  "version": "5.24.3",
+  "version": "5.27.0",
   "description": "FeelFlow ID Platform SDK for React/Next.js applications",
   "keywords": [
     "feelflow",