@feelflow/ffid-sdk 7.1.0 → 8.0.0

package/dist/{chunk-Y4TUICQZ.js → chunk-YKBAFPX5.js}

@@ -158,7 +158,7 @@ function normalizeUserinfo(raw) {
     emailVerified: raw.email_verified,
     name: raw.name,
     picture: raw.picture,
-    companyName: raw.company_name ?? null,
+    companyName: null,
     department: raw.department ?? null,
     position: raw.position ?? null,
     phoneNumber: raw.phone_number ?? null,
@@ -226,13 +226,18 @@ function mapUserinfoSubscriptionToSession(userinfo, serviceCode) {
   ];
 }
 var JWKS_ENDPOINT = "/.well-known/jwks.json";
-var JWT_ISSUER = "https://id.feelflow.net";
+var LEGACY_JWT_ISSUER = "https://id.feelflow.net";
 var JWT_ALGORITHM = "ES256";
 var JWT_CLOCK_TOLERANCE_SECONDS = 30;
+function resolveAcceptedIssuers(baseUrl) {
+  const deployedOrigin = new URL(baseUrl).origin;
+  return deployedOrigin === LEGACY_JWT_ISSUER ? [LEGACY_JWT_ISSUER] : [deployedOrigin, LEGACY_JWT_ISSUER];
+}
 function createJwtVerifier(deps) {
   const { baseUrl, serviceCode, logger, createError, errorCodes } = deps;
   const jwksUrl = new URL(JWKS_ENDPOINT, baseUrl);
   const jwks = createRemoteJWKSet(jwksUrl);
+  const acceptedIssuers = resolveAcceptedIssuers(baseUrl);
   async function verifyJwt(accessToken) {
     if (!accessToken || !accessToken.trim()) {
       return {
@@ -245,7 +250,7 @@ function createJwtVerifier(deps) {
     try {
       const { payload } = await jwtVerify(accessToken, jwks, {
         algorithms: [JWT_ALGORITHM],
-        issuer: JWT_ISSUER,
+        issuer: acceptedIssuers,
         audience: serviceCode,
         clockTolerance: JWT_CLOCK_TOLERANCE_SECONDS
       });
@@ -462,7 +467,7 @@ function createVerifyAccessToken(deps) {
       email_verified: introspectResponse.email_verified,
       name: introspectResponse.name ?? null,
       picture: introspectResponse.picture ?? null,
-      company_name: introspectResponse.company_name ?? null,
+      company_name: null,
       department: introspectResponse.department ?? null,
       position: introspectResponse.position ?? null,
       phone_number: introspectResponse.phone_number ?? null,
@@ -713,6 +718,24 @@ function validateSeatChangePreview(preview) {
       `SDK: server returned malformed SeatChangePreview \u2014 estimateReason must be one of 'no_stripe_data' | 'custom_pricing' | 'stripe_error' (got ${JSON.stringify(p.estimateReason)})`
     );
   }
+  if (p.willApplyAtPeriodEnd !== void 0 && typeof p.willApplyAtPeriodEnd !== "boolean") {
+    throw new FFIDSDKError(
+      MALFORMED_SEAT_PREVIEW_CODE,
+      `SDK: server returned malformed SeatChangePreview \u2014 willApplyAtPeriodEnd must be boolean when present (got ${typeof p.willApplyAtPeriodEnd})`
+    );
+  }
+  if (p.effectiveDate !== void 0 && p.effectiveDate !== null && typeof p.effectiveDate !== "string") {
+    throw new FFIDSDKError(
+      MALFORMED_SEAT_PREVIEW_CODE,
+      `SDK: server returned malformed SeatChangePreview \u2014 effectiveDate must be string or null when present (got ${typeof p.effectiveDate})`
+    );
+  }
+  if (p.willApplyAtPeriodEnd === true && p.proratedAmount !== 0) {
+    throw new FFIDSDKError(
+      MALFORMED_SEAT_PREVIEW_CODE,
+      `SDK: server returned malformed SeatChangePreview \u2014 willApplyAtPeriodEnd=true requires proratedAmount=0 (got ${JSON.stringify(p.proratedAmount)})`
+    );
+  }
   if (!Array.isArray(p.lineItems)) {
     throw new FFIDSDKError(
       MALFORMED_SEAT_PREVIEW_CODE,
@@ -1353,7 +1376,7 @@ var FFID_ORGANIZATION_PROFILE_ERROR_CODES = {
 };
 
 // src/client/version-check.ts
-var SDK_VERSION = "7.1.0";
+var SDK_VERSION = "8.0.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -2607,6 +2630,129 @@ function cleanupStateStorage(logger) {
   }
 }
 
+// src/client/agency-invite-token.ts
+var AGENCY_INVITE_TOKEN_PARAM = "invite";
+var AGENCY_INVITE_COOKIE_NAME = "ffid_invite";
+var SECONDS_PER_MINUTE = 60;
+var MINUTES_PER_HOUR = 60;
+var HOURS_PER_DAY = 24;
+var RETENTION_DAYS = 30;
+var AGENCY_INVITE_COOKIE_MAX_AGE_SEC = SECONDS_PER_MINUTE * MINUTES_PER_HOUR * HOURS_PER_DAY * RETENTION_DAYS;
+var AGENCY_INVITE_TOKEN_REDACTION = "[REDACTED]";
+function hasDocument() {
+  return typeof document !== "undefined";
+}
+function defaultSecure() {
+  if (typeof process === "undefined") return true;
+  return process.env?.NODE_ENV === "production";
+}
+function toQueryString(source) {
+  const queryStart = source.indexOf("?");
+  if (queryStart < 0) return "";
+  const afterQuery = source.slice(queryStart);
+  const fragmentStart = afterQuery.indexOf("#");
+  return fragmentStart < 0 ? afterQuery : afterQuery.slice(0, fragmentStart);
+}
+function readTokenFromUrl(options) {
+  const source = options.url ?? (typeof window !== "undefined" ? window.location.search : void 0);
+  if (source === void 0) return void 0;
+  const params = new URLSearchParams(toQueryString(source));
+  return params.get(AGENCY_INVITE_TOKEN_PARAM)?.trim() || void 0;
+}
+function readAgencyInviteCookie() {
+  if (!hasDocument()) return void 0;
+  const prefix = `${AGENCY_INVITE_COOKIE_NAME}=`;
+  const raw = document.cookie.split(";").map((entry) => entry.trim()).find((entry) => entry.startsWith(prefix));
+  if (!raw) return void 0;
+  try {
+    return decodeURIComponent(raw.slice(prefix.length)).trim() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readAgencyInviteToken(options = {}) {
+  return readTokenFromUrl(options) ?? readAgencyInviteCookie();
+}
+function buildAgencyInviteCookie(value, maxAgeSec, options) {
+  const attrs = [
+    `${AGENCY_INVITE_COOKIE_NAME}=${value}`,
+    `Max-Age=${maxAgeSec}`,
+    `Path=${options.path ?? "/"}`,
+    "SameSite=Lax"
+  ];
+  if (options.domain) attrs.push(`Domain=${options.domain}`);
+  if (options.secure ?? defaultSecure()) attrs.push("Secure");
+  return attrs.join("; ");
+}
+function writeAgencyInviteCookie(token, options) {
+  if (!hasDocument()) return void 0;
+  document.cookie = buildAgencyInviteCookie(
+    encodeURIComponent(token),
+    AGENCY_INVITE_COOKIE_MAX_AGE_SEC,
+    options
+  );
+  return readAgencyInviteCookie() === token;
+}
+function clearAgencyInviteToken(options = {}) {
+  if (!hasDocument()) return void 0;
+  const CLEAR_MAX_AGE = 0;
+  document.cookie = buildAgencyInviteCookie("", CLEAR_MAX_AGE, options);
+  return readAgencyInviteCookie() === void 0;
+}
+function captureAgencyInviteToken(options = {}) {
+  const fromUrl = readTokenFromUrl(options);
+  if (fromUrl !== void 0) {
+    return { source: "url", token: fromUrl, persisted: writeAgencyInviteCookie(fromUrl, options) };
+  }
+  const fromCookie = readAgencyInviteCookie();
+  return fromCookie !== void 0 ? { source: "cookie", token: fromCookie, persisted: void 0 } : { source: "none", token: void 0, persisted: void 0 };
+}
+var REDACT_BOUNDARIES = [
+  "%2526",
+  "%2523",
+  "%253B",
+  "%26",
+  "%23",
+  "%3B",
+  "&",
+  "#",
+  ";"
+];
+var REDACT_LEADS = ["%253F", "%3F", "?", ...REDACT_BOUNDARIES];
+var REDACT_SEPARATORS = ["%253D", "%3D", "="];
+function escapeForRegExp(literal) {
+  return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var REDACT_PATTERN = new RegExp(
+  [
+    // 先頭区切り。`\b` が使えないのは、入れ子形 (`%3Finvite%3D`) では `F` と `i` が
+    // どちらも単語文字なので単語境界が存在しないため。
+    `(^|${REDACT_LEADS.map(escapeForRegExp).join("|")})`,
+    // パラメータ名と区切りはキャプチャして再出力する。`i` フラグがあるので、
+    // 入力の `INVITE=` / `%3d` などの元の表記を保つ必要がある。
+    `(${AGENCY_INVITE_TOKEN_PARAM})`,
+    `(${REDACT_SEPARATORS.map(escapeForRegExp).join("|")})`,
+    // 値。境界の直前まで貪欲に食う。`\s` は終端にしない — 生の空白や改行を含む
+    // トークンでマスクが途中で切れ、後半が漏れる。
+    `(?:(?!${REDACT_BOUNDARIES.map(escapeForRegExp).join("|")})[^&#;])*`
+  ].join(""),
+  "gi"
+);
+function redactAgencyInviteToken(url) {
+  return url.replace(
+    REDACT_PATTERN,
+    // 文字列 replacement（`'$1$2$3[REDACTED]'`）にしないのは、
+    // `AGENCY_INVITE_TOKEN_REDACTION` に `$` が入った瞬間に置換パターンとして
+    // 解釈される罠を作らないため。
+    (_match, lead, name, separator) => `${lead}${name}${separator}${AGENCY_INVITE_TOKEN_REDACTION}`
+  );
+}
+function appendAgencyInviteToken(signupUrl, token) {
+  if (token === void 0) return signupUrl;
+  const separator = signupUrl.includes("?") ? "&" : "?";
+  return `${signupUrl}${separator}${AGENCY_INVITE_TOKEN_PARAM}=${encodeURIComponent(token)}`;
+}
+
 // src/client/redirect.ts
 var OAUTH_AUTHORIZE_ENDPOINT = "/api/v1/oauth/authorize";
 var AUTH_LOGOUT_ENDPOINT = "/api/v1/auth/logout";
@@ -2619,6 +2765,7 @@ var REDIRECT_LOOP_WINDOW_MS = 6e4;
 var REDIRECT_LOOP_THRESHOLD = 3;
 var storageReadFailureLogged = false;
 var storageWriteFailureLogged = false;
+var ssrInviteTokenUnavailableLogged = false;
 function isLoopDetectionDegraded() {
   return storageReadFailureLogged || storageWriteFailureLogged;
 }
@@ -2797,12 +2944,16 @@ function createRedirectMethods(deps) {
     }
     if (options?.screenHint === SCREEN_HINT_SIGNUP) {
       params.set(SCREEN_HINT_PARAM, SCREEN_HINT_SIGNUP);
+      const inviteToken = readAgencyInviteToken();
+      if (inviteToken !== void 0) {
+        params.set(AGENCY_INVITE_TOKEN_PARAM, inviteToken);
+      }
     }
     if (options?.prompt) {
       params.set("prompt", options.prompt);
     }
     const authorizeUrl = `${baseUrl}${OAUTH_AUTHORIZE_ENDPOINT}?${params.toString()}`;
-    logger.debug("Redirecting to authorize:", authorizeUrl);
+    logger.debug("Redirecting to authorize:", redactAgencyInviteToken(authorizeUrl));
     recordRedirectAttempt(authorizeKey, now, logger);
     try {
       window.location.href = authorizeUrl;
@@ -2821,7 +2972,7 @@ function createRedirectMethods(deps) {
       return redirectToAuthorize(options);
     }
     const targetUrl = options?.screenHint === SCREEN_HINT_SIGNUP ? getSignupUrl() : getLoginUrl(void 0, options?.prompt ? { prompt: options.prompt } : void 0);
-    logger.debug("Redirecting to auth page:", targetUrl);
+    logger.debug("Redirecting to auth page:", redactAgencyInviteToken(targetUrl));
     window.location.href = targetUrl;
     return { success: true };
   }
@@ -2838,7 +2989,7 @@ function createRedirectMethods(deps) {
     const promptSuffix = options?.prompt ? `&prompt=${encodeURIComponent(options.prompt)}` : "";
     return `${baseUrl}/login?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}${promptSuffix}`;
   }
-  function getSignupUrl(redirectUrl) {
+  function getSignupUrl(redirectUrl, options) {
     let redirect;
     if (redirectUrl != null) {
       redirect = redirectUrl;
@@ -2848,7 +2999,22 @@ function createRedirectMethods(deps) {
       logger.warn("getSignupUrl: SSR \u74B0\u5883\u3067 redirectUrl \u304C\u672A\u6307\u5B9A\u306E\u305F\u3081\u7A7A\u6587\u5B57\u306B\u30D5\u30A9\u30FC\u30EB\u30D0\u30C3\u30AF\u3057\u307E\u3059");
       redirect = "";
     }
-    return `${baseUrl}/signup?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}`;
+    let inviteToken = options?.inviteToken;
+    if (inviteToken === void 0) {
+      inviteToken = readAgencyInviteToken();
+      if (inviteToken === void 0 && typeof window === "undefined") {
+        if (!ssrInviteTokenUnavailableLogged) {
+          ssrInviteTokenUnavailableLogged = true;
+          logger.warn(
+            "[FFID SDK] getSignupUrl: SSR \u3067\u306F\u62DB\u5F85\u30C8\u30FC\u30AF\u30F3\uFF08invite\uFF09\u3092\u8AAD\u3081\u307E\u305B\u3093\u3002\u4EE3\u7406\u5E97\u306E\u62DB\u5F85\u30EA\u30F3\u30AF\u3092\u4F7F\u3046\u5834\u5408\u306F options.inviteToken \u306B\u6E21\u3057\u3066\u304F\u3060\u3055\u3044\uFF08\u4F7F\u3063\u3066\u3044\u306A\u3044\u5834\u5408\u306F\u3053\u306E\u8B66\u544A\u3092\u7121\u8996\u3057\u3066\u3088\u3044\uFF09"
+          );
+        }
+      }
+    }
+    return appendAgencyInviteToken(
+      `${baseUrl}/signup?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}`,
+      inviteToken
+    );
   }
   function getLogoutUrl(postLogoutRedirectUri) {
     const url = new URL(`${baseUrl}${AUTH_LOGOUT_ENDPOINT}`);
@@ -2864,7 +3030,7 @@ function createRedirectMethods(deps) {
       return { success: false, error: "SSR \u74B0\u5883\u3067\u306F\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3067\u304D\u307E\u305B\u3093" };
     }
     const logoutUrl = getLogoutUrl(postLogoutRedirectUri);
-    logger.debug("Redirecting to logout:", logoutUrl);
+    logger.debug("Redirecting to logout:", redactAgencyInviteToken(logoutUrl));
     window.location.href = logoutUrl;
     return { success: true };
   }
@@ -3477,11 +3643,11 @@ var EFFECTIVE_SUBSCRIPTION_STATUSES = [
   "expired"
 ];
 var PAST_DUE_GRACE_PERIOD_DAYS = 7;
-var HOURS_PER_DAY = 24;
-var MINUTES_PER_HOUR = 60;
-var SECONDS_PER_MINUTE = 60;
+var HOURS_PER_DAY2 = 24;
+var MINUTES_PER_HOUR2 = 60;
+var SECONDS_PER_MINUTE2 = 60;
 var MS_PER_SECOND2 = 1e3;
-var MS_PER_DAY = HOURS_PER_DAY * MINUTES_PER_HOUR * SECONDS_PER_MINUTE * MS_PER_SECOND2;
+var MS_PER_DAY = HOURS_PER_DAY2 * MINUTES_PER_HOUR2 * SECONDS_PER_MINUTE2 * MS_PER_SECOND2;
 
 // src/subscriptions/compute-effective-status.ts
 function isExpired(isoTimestamp, nowMs) {
@@ -3634,6 +3800,18 @@ var FFID_ERROR_CODES = {
   TOKEN_EXPIRED: "TOKEN_EXPIRED",
   STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR"
 };
+var FFID_SUBSCRIPTION_ERROR_CODES = {
+  CANCELLATION_SCHEDULED: "CANCELLATION_SCHEDULED",
+  PENDING_CHANGE_EXISTS: "PENDING_CHANGE_EXISTS",
+  CHANGE_DIRECTION_MIXED: "CHANGE_DIRECTION_MIXED",
+  CHANGE_PAYMENT_FAILED: "CHANGE_PAYMENT_FAILED",
+  SAME_PLAN_SELECTED: "SAME_PLAN_SELECTED",
+  NO_PENDING_DOWNGRADE: "NO_PENDING_DOWNGRADE",
+  SUBSCRIPTION_NOT_CANCELABLE: "SUBSCRIPTION_NOT_CANCELABLE",
+  SUBSCRIPTION_ALREADY_CANCELED: "SUBSCRIPTION_ALREADY_CANCELED",
+  FREE_DOWNGRADE_NOT_ALLOWED: "FREE_DOWNGRADE_NOT_ALLOWED",
+  PAYMENT_METHOD_REQUIRED: "PAYMENT_METHOD_REQUIRED"
+};
 
 // src/client/ffid-client.ts
 var UNAUTHORIZED_STATUS2 = 401;
@@ -4317,6 +4495,15 @@ function FFIDProvider({
     }),
     [serviceCode, scope, apiBaseUrl, debug, logger, authMode, clientId, timeout, tokenStore]
   );
+  useEffect(() => {
+    const captured = captureAgencyInviteToken();
+    if (captured.persisted === false) {
+      client.logger.debug(
+        "[FFID SDK] \u62DB\u5F85\u30C8\u30FC\u30AF\u30F3\u306E cookie \u4FDD\u6301\u306B\u5931\u6557\u3057\u307E\u3057\u305F\uFF08\u5225\u30DA\u30FC\u30B8\u3078\u56DE\u904A\u3059\u308B\u3068\u4EE3\u7406\u5E97\u306E\u7D10\u4ED8\u3051\u304C\u5931\u308F\u308C\u307E\u3059\uFF09",
+        { source: captured.source }
+      );
+    }
+  }, [client]);
   const refresh = useCallback(async () => {
     client.logger.debug("Refreshing session...");
     try {
@@ -6292,4 +6479,4 @@ function FFIDInquiryForm({
   );
 }
 
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, CATALOG_HASH_PATTERN, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDCatalogHashError, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_CATALOG_ENVIRONMENTS, FFID_CATALOG_PUBLICATION_STATUSES, FFID_COMPANY_SIZE_CODES, FFID_ERROR_CODES, FFID_INDUSTRY_CODES, FFID_INQUIRY_ACQUISITION_SOURCES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, FFID_ORGANIZATION_PROFILE_ERROR_CODES, canonicalizeCatalogValue, cleanupStateStorage, computeEffectiveStatusFromSession, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, hashCanonicalJson, isBlockedFromUserinfo, isFFIDInquiryAcquisitionSource, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, sha256Hex, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useFFIDContext, useSubscription, validatePublishedCatalog, withSubscription };
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, AGENCY_INVITE_COOKIE_MAX_AGE_SEC, AGENCY_INVITE_COOKIE_NAME, AGENCY_INVITE_TOKEN_PARAM, AGENCY_INVITE_TOKEN_REDACTION, BLOCKING_EFFECTIVE_STATUSES, CATALOG_HASH_PATTERN, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDCatalogHashError, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_CATALOG_ENVIRONMENTS, FFID_CATALOG_PUBLICATION_STATUSES, FFID_COMPANY_SIZE_CODES, FFID_ERROR_CODES, FFID_INDUSTRY_CODES, FFID_INQUIRY_ACQUISITION_SOURCES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, FFID_ORGANIZATION_PROFILE_ERROR_CODES, FFID_SUBSCRIPTION_ERROR_CODES, canonicalizeCatalogValue, captureAgencyInviteToken, cleanupStateStorage, clearAgencyInviteToken, computeEffectiveStatusFromSession, computeFFIDCheckoutCopyHash, computeLegalDisclosureHash, computePaymentConfigurationHash, computePraxisCopyHash, computeScopeHash, computeTaxConfigurationHash, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, hashCanonicalJson, isBlockedFromUserinfo, isFFIDInquiryAcquisitionSource, isFFIDInquiryCategorySite2026, normalizeRedirectUri, readAgencyInviteCookie, readAgencyInviteToken, redactAgencyInviteToken, retrieveCodeVerifier, retrieveState, sha256Hex, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useFFIDContext, useSubscription, validatePublishedCatalog, withSubscription };

package/dist/components/index.cjs

@@ -1,34 +1,34 @@
 'use strict';
 
-var chunkCI4N7KJK_cjs = require('../chunk-CI4N7KJK.cjs');
+var chunkRNCK5E3Y_cjs = require('../chunk-RNCK5E3Y.cjs');
 
 
 
 Object.defineProperty(exports, "FFIDAnnouncementBadge", {
   enumerable: true,
-  get: function () { return chunkCI4N7KJK_cjs.FFIDAnnouncementBadge; }
+  get: function () { return chunkRNCK5E3Y_cjs.FFIDAnnouncementBadge; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementList", {
   enumerable: true,
-  get: function () { return chunkCI4N7KJK_cjs.FFIDAnnouncementList; }
+  get: function () { return chunkRNCK5E3Y_cjs.FFIDAnnouncementList; }
 });
 Object.defineProperty(exports, "FFIDInquiryForm", {
   enumerable: true,
-  get: function () { return chunkCI4N7KJK_cjs.FFIDInquiryForm; }
+  get: function () { return chunkRNCK5E3Y_cjs.FFIDInquiryForm; }
 });
 Object.defineProperty(exports, "FFIDLoginButton", {
   enumerable: true,
-  get: function () { return chunkCI4N7KJK_cjs.FFIDLoginButton; }
+  get: function () { return chunkRNCK5E3Y_cjs.FFIDLoginButton; }
 });
 Object.defineProperty(exports, "FFIDOrganizationSwitcher", {
   enumerable: true,
-  get: function () { return chunkCI4N7KJK_cjs.FFIDOrganizationSwitcher; }
+  get: function () { return chunkRNCK5E3Y_cjs.FFIDOrganizationSwitcher; }
 });
 Object.defineProperty(exports, "FFIDSubscriptionBadge", {
   enumerable: true,
-  get: function () { return chunkCI4N7KJK_cjs.FFIDSubscriptionBadge; }
+  get: function () { return chunkRNCK5E3Y_cjs.FFIDSubscriptionBadge; }
 });
 Object.defineProperty(exports, "FFIDUserMenu", {
   enumerable: true,
-  get: function () { return chunkCI4N7KJK_cjs.FFIDUserMenu; }
+  get: function () { return chunkRNCK5E3Y_cjs.FFIDUserMenu; }
 });

package/dist/components/index.d.cts

@@ -1,3 +1,3 @@
-export { H as FFIDAnnouncementBadge, an as FFIDAnnouncementBadgeClassNames, ao as FFIDAnnouncementBadgeProps, I as FFIDAnnouncementList, ap as FFIDAnnouncementListClassNames, aq as FFIDAnnouncementListProps, U as FFIDInquiryForm, V as FFIDInquiryFormCategoryItem, W as FFIDInquiryFormClassNames, X as FFIDInquiryFormLegalLayout, Y as FFIDInquiryFormOrganization, Z as FFIDInquiryFormPlaceholderContext, _ as FFIDInquiryFormPrefill, $ as FFIDInquiryFormProps, a0 as FFIDInquiryFormSubmitData, a1 as FFIDInquiryFormSubmitResult, a3 as FFIDLoginButton, ar as FFIDLoginButtonProps, a5 as FFIDOrganizationSwitcher, as as FFIDOrganizationSwitcherClassNames, at as FFIDOrganizationSwitcherProps, ab as FFIDSubscriptionBadge, au as FFIDSubscriptionBadgeClassNames, av as FFIDSubscriptionBadgeProps, ac as FFIDUserMenu, aw as FFIDUserMenuClassNames, ax as FFIDUserMenuProps } from '../index-BMKhKhzF.cjs';
+export { H as FFIDAnnouncementBadge, an as FFIDAnnouncementBadgeClassNames, ao as FFIDAnnouncementBadgeProps, I as FFIDAnnouncementList, ap as FFIDAnnouncementListClassNames, aq as FFIDAnnouncementListProps, U as FFIDInquiryForm, V as FFIDInquiryFormCategoryItem, W as FFIDInquiryFormClassNames, X as FFIDInquiryFormLegalLayout, Y as FFIDInquiryFormOrganization, Z as FFIDInquiryFormPlaceholderContext, _ as FFIDInquiryFormPrefill, $ as FFIDInquiryFormProps, a0 as FFIDInquiryFormSubmitData, a1 as FFIDInquiryFormSubmitResult, a3 as FFIDLoginButton, ar as FFIDLoginButtonProps, a5 as FFIDOrganizationSwitcher, as as FFIDOrganizationSwitcherClassNames, at as FFIDOrganizationSwitcherProps, ab as FFIDSubscriptionBadge, au as FFIDSubscriptionBadgeClassNames, av as FFIDSubscriptionBadgeProps, ac as FFIDUserMenu, aw as FFIDUserMenuClassNames, ax as FFIDUserMenuProps } from '../index-BG7g99pK.cjs';
 import 'react/jsx-runtime';
 import 'react';

package/dist/components/index.d.ts

@@ -1,3 +1,3 @@
-export { H as FFIDAnnouncementBadge, an as FFIDAnnouncementBadgeClassNames, ao as FFIDAnnouncementBadgeProps, I as FFIDAnnouncementList, ap as FFIDAnnouncementListClassNames, aq as FFIDAnnouncementListProps, U as FFIDInquiryForm, V as FFIDInquiryFormCategoryItem, W as FFIDInquiryFormClassNames, X as FFIDInquiryFormLegalLayout, Y as FFIDInquiryFormOrganization, Z as FFIDInquiryFormPlaceholderContext, _ as FFIDInquiryFormPrefill, $ as FFIDInquiryFormProps, a0 as FFIDInquiryFormSubmitData, a1 as FFIDInquiryFormSubmitResult, a3 as FFIDLoginButton, ar as FFIDLoginButtonProps, a5 as FFIDOrganizationSwitcher, as as FFIDOrganizationSwitcherClassNames, at as FFIDOrganizationSwitcherProps, ab as FFIDSubscriptionBadge, au as FFIDSubscriptionBadgeClassNames, av as FFIDSubscriptionBadgeProps, ac as FFIDUserMenu, aw as FFIDUserMenuClassNames, ax as FFIDUserMenuProps } from '../index-BMKhKhzF.js';
+export { H as FFIDAnnouncementBadge, an as FFIDAnnouncementBadgeClassNames, ao as FFIDAnnouncementBadgeProps, I as FFIDAnnouncementList, ap as FFIDAnnouncementListClassNames, aq as FFIDAnnouncementListProps, U as FFIDInquiryForm, V as FFIDInquiryFormCategoryItem, W as FFIDInquiryFormClassNames, X as FFIDInquiryFormLegalLayout, Y as FFIDInquiryFormOrganization, Z as FFIDInquiryFormPlaceholderContext, _ as FFIDInquiryFormPrefill, $ as FFIDInquiryFormProps, a0 as FFIDInquiryFormSubmitData, a1 as FFIDInquiryFormSubmitResult, a3 as FFIDLoginButton, ar as FFIDLoginButtonProps, a5 as FFIDOrganizationSwitcher, as as FFIDOrganizationSwitcherClassNames, at as FFIDOrganizationSwitcherProps, ab as FFIDSubscriptionBadge, au as FFIDSubscriptionBadgeClassNames, av as FFIDSubscriptionBadgeProps, ac as FFIDUserMenu, aw as FFIDUserMenuClassNames, ax as FFIDUserMenuProps } from '../index-BG7g99pK.js';
 import 'react/jsx-runtime';
 import 'react';

package/dist/components/index.js

@@ -1 +1 @@
-export { FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDSubscriptionBadge, FFIDUserMenu } from '../chunk-Y4TUICQZ.js';
+export { FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDSubscriptionBadge, FFIDUserMenu } from '../chunk-YKBAFPX5.js';

package/dist/{ffid-client-QNEFA3mv.d.ts → ffid-client-5GAPcRIG.d.ts}

@@ -450,12 +450,31 @@ interface FFIDSubscriptionDetail {
     trialStart: string | null;
     trialEnd: string | null;
     canceledAt: string | null;
+    /**
+     * `true` while a cancellation is reserved until the period end. `status` stays
+     * `active` until then; the subscription becomes `canceled` at `currentPeriodEnd`.
+     * The reservation can only be withdrawn in the FFID portal (there is no SDK method).
+     */
     cancelAtPeriodEnd: boolean;
-    /** Pending period-end downgrade info (null = no scheduled downgrade) */
+    /**
+     * Change reserved until the period end (null = nothing reserved).
+     *
+     * Every decrease — a lower plan, paid → free, fewer seats, yearly → monthly — is
+     * reserved instead of applied immediately (FFID #6327). The current plan, seats and
+     * interval stay in effect until `scheduledAt`. Withdraw it with `cancelPendingDowngrade()`.
+     */
     pendingDowngrade: {
+        /** Plan in effect after the period end. Equals `planCode` for a seat-only or interval-only reservation. */
         planCode: string;
         planName: string;
+        /** Billing interval in effect after the period end */
         billingInterval: FFIDBillingInterval;
+        /**
+         * Seat count in effect after the period end. `null` = the seat count does not change.
+         * Seat reductions are made in the FFID portal; this lets you show them (8.0.0).
+         * FFID servers released before #6327 omit it, so compare with `== null` at runtime.
+         */
+        quantity: number | null;
         scheduledAt: string;
         requestedAt: string;
     } | null;
@@ -522,7 +541,17 @@ interface FFIDChangePlanParams {
     /** New billing interval (default: keeps current) */
     billingInterval?: FFIDBillingInterval;
 }
-/** Response from change plan endpoint */
+/**
+ * Response from change plan endpoint.
+ *
+ * - An increase (higher plan / monthly → yearly) applies immediately and the difference up to
+ *   the current period end is charged now. `pendingDowngrade` is absent.
+ * - A decrease (lower plan / paid → free / yearly → monthly) is reserved until the period end:
+ *   `pendingDowngrade` is present and `subscription.planCode` is still the current plan.
+ *   Nothing is charged or refunded. A contract that cannot be reserved still changes
+ *   immediately, without a refund: one with no period end, or a paid → paid decrease on a
+ *   contract without a Stripe subscription.
+ */
 interface FFIDChangePlanResponse {
     message: string;
     subscription: {
@@ -535,7 +564,7 @@ interface FFIDChangePlanResponse {
         status: FFIDSubscriptionStatus;
         isUpgrade: boolean;
     };
-    /** Present when downgrade is scheduled for period end instead of immediate */
+    /** Present when the change is a decrease reserved until the period end */
     pendingDowngrade?: {
         planCode: string;
         planName: string;
@@ -551,17 +580,41 @@ interface FFIDCancelSubscriptionParams {
     /** Additional cancellation details */
     reasonDetails?: string;
 }
-/** Response from cancel subscription endpoint */
+/**
+ * Response from cancel subscription endpoint.
+ *
+ * Since 8.0.0 a contract billed through Stripe is **reserved** for cancellation at the period
+ * end (FFID #6327): `status` stays `active`, `cancelAtPeriodEnd` is `true` and `cancelAt` is the
+ * period end. Access continues until then and nothing is refunded. A contract that cannot be
+ * reserved (no Stripe subscription, no period end yet, or Stripe not configured on FFID) is
+ * canceled immediately (`status: 'canceled'`, `cancelAtPeriodEnd: false`, `cancelAt: null`).
+ * Branch on `cancelAtPeriodEnd`, not on whether the contract uses Stripe.
+ *
+ * Do not treat this response as "access revoked". The `subscription.canceled` webhook arrives
+ * at reservation (`source: 'user_initiated'`) and again at the period end
+ * (`source: 'stripe_confirmed'`); see `FFIDSubscriptionCanceledPayload`.
+ */
 interface FFIDCancelSubscriptionResponse {
     message: string;
     subscription: {
         id: string;
         organizationId: string;
+        /** `active` while the cancellation is reserved; `canceled` only for an immediate cancellation */
         status: FFIDSubscriptionStatus;
         canceledAt: string | null;
+        /** `true` when the cancellation is reserved until the period end */
+        cancelAtPeriodEnd: boolean;
+        /** When the reserved cancellation takes effect (the period end). `null` for an immediate cancellation */
+        cancelAt: string | null;
     };
 }
-/** Response from cancel pending downgrade endpoint */
+/**
+ * Response from cancel pending downgrade endpoint.
+ *
+ * Withdraws the reserved change on the Stripe side as well, so the current plan, seats and
+ * interval simply continue after the period end. It does not withdraw a reserved
+ * cancellation — that is done in the FFID portal.
+ */
 interface FFIDCancelPendingDowngradeResponse {
     message: string;
     subscription: {
@@ -616,14 +669,18 @@ interface FFIDPlanChangePreviewBase {
     lineItems: FFIDPlanChangeLineItem[];
 }
 /**
- * Plan change proration preview.
+ * Plan change proration preview. It is computed with the same rules as `changePlan()`.
  *
  * `willApplyAtPeriodEnd` is a discriminant that constrains related fields at the type level:
- * - `true`: period-end-deferred downgrade. `proratedAmount` is always 0; `effectiveDate` mirrors
- *   the subscription's `currentPeriodEnd` (may be `null` when the subscription has no active
- *   billing cycle yet — e.g. a pre-Stripe trial or a subscription whose billing cycle is unset).
- * - `false`: immediate change. `effectiveDate` is always `null`; `proratedAmount` is the live
- *   (possibly Stripe-refined) day-basis difference.
+ * - `true`: a decrease reserved until the period end. `proratedAmount` is always 0 (nothing is
+ *   charged or refunded now); `effectiveDate` mirrors the subscription's `currentPeriodEnd`
+ *   (may be `null` when the subscription has no active billing cycle yet).
+ * - `false`: immediate change. `effectiveDate` is always `null`. For an increase,
+ *   `proratedAmount` is the difference up to the current period end that is charged now
+ *   (possibly Stripe-refined). A decrease on a contract that cannot be reserved also lands here:
+ *   `0` for a contract without a Stripe subscription (no refund), but Stripe's prorated amount —
+ *   negative, credited on the next invoice — for a Stripe contract with no period end yet
+ *   (e.g. during a trial).
  */
 type FFIDPlanChangePreview = FFIDPlanChangePreviewBase & ({
     willApplyAtPeriodEnd: true;
@@ -633,7 +690,7 @@ type FFIDPlanChangePreview = FFIDPlanChangePreviewBase & ({
 } | {
     willApplyAtPeriodEnd: false;
     effectiveDate: null;
-    /** Prorated difference charged within the current billing period */
+    /** Difference up to the current period end charged now (see the type doc for the decrease cases) */
     proratedAmount: number;
 });
 /** Response from plan change preview endpoint */
@@ -658,14 +715,27 @@ interface FFIDSeatChangeLineItem {
  * Sister type to `FFIDPlanChangePreview`. The shared `type` discriminant lets
  * consumers narrow a preview payload without inspecting unrelated fields.
  *
+ * - `willApplyAtPeriodEnd=true`: a seat reduction reserved until the period end.
+ *   `proratedAmount` is 0 and `effectiveDate` is when the new seat count applies.
+ * - Otherwise the change applies immediately. For an increase, `proratedAmount` is the amount
+ *   charged now up to the current period end. A reduction that cannot be reserved is normally
+ *   `0`, but can be negative (a credit on the next invoice) for a Stripe contract with no period
+ *   end yet or when only the contract unit price is known.
  * - `isEstimate=true` (default when Stripe is not configured or data is unavailable):
- *   `proratedAmount` is computed locally as `(newQuantity - currentQuantity) * unitPrice`.
- * - `isEstimate=false`: `proratedAmount` reflects Stripe's live proration calculation.
+ *   `proratedAmount` is computed locally. `isEstimate=false`: it reflects Stripe's live
+ *   proration calculation.
  *
  * `nextInvoiceAmount` is always a local estimate (`unitPrice * newQuantity`).
  *
- * `pricingUnavailable=true` indicates the plan uses custom pricing with a zero unit
- * price (Enterprise). Consumers should hide monetary amounts in this case.
+ * `pricingUnavailable=true` means custom pricing or an unverified contracted Stripe
+ * Price. Hide amounts; zero is not a quote. `custom_pricing` permits the existing
+ * unbilled seat-change flow. Require another preview before confirmation only when
+ * pricing is unavailable and the reason is not `custom_pricing`. `stripe_error` also
+ * covers invoice/address failures after the contract price is known; use
+ * `pricingUnavailable`, not the reason alone, to decide whether to hide amounts.
+ * `no_stripe_data` means invoice proration is unavailable even if the contract unit
+ * price is known. Portal seat PUT independently enforces subscription limits;
+ * external consumers should guide users to the FFID portal for seat changes.
  */
 interface FFIDSeatChangePreview {
     /** Discriminant for preview response variants (pairs with `FFIDPlanChangePreview.type`) */
@@ -676,20 +746,28 @@ interface FFIDSeatChangePreview {
     unitPrice: number;
     billingInterval: FFIDBillingInterval;
     /**
-     * Prorated cost for the current billing period. Negative when seats are decreased
-     * (credit). `0` when `pricingUnavailable === true` (Enterprise custom pricing).
+     * Amount charged now for the rest of the current billing period. A reserved seat reduction
+     * (`willApplyAtPeriodEnd: true`) is always `0`; see the type doc for reductions that cannot
+     * be reserved. Also `0` when `pricingUnavailable === true`; hide it instead of quoting zero.
      */
     proratedAmount: number;
     /** Next invoice full amount — always a local estimate (`unitPrice * newQuantity`) */
     nextInvoiceAmount: number;
     nextInvoiceDate: string | null;
     currency: FFIDSupportedCurrency;
-    /** true when proratedAmount is estimated from local prices rather than Stripe proration data */
+    /** true when proratedAmount is a local estimate rather than Stripe invoice/proration data */
     isEstimate: boolean;
-    /** true when unit price is 0 due to custom pricing (Enterprise) — hide monetary amounts */
+    /** Hide amounts: custom pricing or contracted Stripe Price could not be verified. */
     pricingUnavailable?: boolean;
     /** Reason why `isEstimate` is true. Only meaningful when `isEstimate === true`. */
     estimateReason?: 'no_stripe_data' | 'custom_pricing' | 'stripe_error';
+    /**
+     * `true` when the seat reduction would be reserved until the period end (8.0.0).
+     * Absent or `false` = the change applies immediately.
+     */
+    willApplyAtPeriodEnd?: boolean;
+    /** When the reserved seat count applies (present when `willApplyAtPeriodEnd` is `true`) */
+    effectiveDate?: string | null;
     lineItems: FFIDSeatChangeLineItem[];
 }
 /** Response from seat change preview endpoint */
@@ -774,6 +852,7 @@ interface FFIDProvisionUserProfileInput {
     /** Display name (1–255 chars). */
     displayName?: string;
     /** Company name (≤255 chars). */
+    /** @deprecated Accepted for compatibility but ignored by FFID. */
     companyName?: string;
     /** Department (≤255 chars). */
     department?: string;
@@ -1475,7 +1554,7 @@ interface FFIDUserProfile {
     avatarUrl: string | null;
     /** Phone number (nullable when not set) */
     phone: string | null;
-    /** Company name (nullable when not set) */
+    /** @deprecated Individual employer name is retired; this field is always null. Use the organization entity's name. */
     companyName: string | null;
     /** Department (nullable when not set) */
     department: string | null;
@@ -1556,7 +1635,7 @@ interface FFIDUpdateUserProfileRequest {
     displayName?: string | null;
     /** Phone number (null clears the field) */
     phone?: string | null;
-    /** Company name (null clears the field) */
+    /** @deprecated Accepted for compatibility but ignored. Use the organization entity's name. */
     companyName?: string | null;
     /** Department (null clears the field) */
     department?: string | null;
@@ -1922,6 +2001,7 @@ interface FFIDOAuthUserInfo {
     emailVerified?: boolean | undefined;
     name: string | null;
     picture: string | null;
+    /** @deprecated Individual employer name is retired; always null. Use organizationName. */
     companyName?: string | null | undefined;
     department?: string | null | undefined;
     position?: string | null | undefined;
@@ -2356,7 +2436,9 @@ declare function createFFIDClient(config: FFIDConfig): {
         prompt?: FFIDPrompt;
     }) => string;
     getLogoutUrl: (postLogoutRedirectUri?: string) => string;
-    getSignupUrl: (redirectUrl?: string) => string;
+    getSignupUrl: (redirectUrl?: string, options?: {
+        inviteToken?: string;
+    }) => string;
     createError: (code: string, message: string) => FFIDError;
     exchangeCodeForTokens: (code: string, codeVerifier?: string, opts?: ExchangeCodeForTokensOptions) => Promise<FFIDApiResponse<void>>;
     refreshAccessToken: () => Promise<FFIDApiResponse<void>>;