@feelflow/ffid-sdk 7.1.0 → 8.0.0

package/dist/server/index.cjs

@@ -155,7 +155,7 @@ function normalizeUserinfo(raw) {
     emailVerified: raw.email_verified,
     name: raw.name,
     picture: raw.picture,
-    companyName: raw.company_name ?? null,
+    companyName: null,
     department: raw.department ?? null,
     position: raw.position ?? null,
     phoneNumber: raw.phone_number ?? null,
@@ -223,13 +223,18 @@ function mapUserinfoSubscriptionToSession(userinfo, serviceCode) {
   ];
 }
 var JWKS_ENDPOINT = "/.well-known/jwks.json";
-var JWT_ISSUER = "https://id.feelflow.net";
+var LEGACY_JWT_ISSUER = "https://id.feelflow.net";
 var JWT_ALGORITHM = "ES256";
 var JWT_CLOCK_TOLERANCE_SECONDS = 30;
+function resolveAcceptedIssuers(baseUrl) {
+  const deployedOrigin = new URL(baseUrl).origin;
+  return deployedOrigin === LEGACY_JWT_ISSUER ? [LEGACY_JWT_ISSUER] : [deployedOrigin, LEGACY_JWT_ISSUER];
+}
 function createJwtVerifier(deps) {
   const { baseUrl, serviceCode, logger, createError, errorCodes } = deps;
   const jwksUrl = new URL(JWKS_ENDPOINT, baseUrl);
   const jwks = jose.createRemoteJWKSet(jwksUrl);
+  const acceptedIssuers = resolveAcceptedIssuers(baseUrl);
   async function verifyJwt(accessToken) {
     if (!accessToken || !accessToken.trim()) {
       return {
@@ -242,7 +247,7 @@ function createJwtVerifier(deps) {
     try {
       const { payload } = await jose.jwtVerify(accessToken, jwks, {
         algorithms: [JWT_ALGORITHM],
-        issuer: JWT_ISSUER,
+        issuer: acceptedIssuers,
         audience: serviceCode,
         clockTolerance: JWT_CLOCK_TOLERANCE_SECONDS
       });
@@ -459,7 +464,7 @@ function createVerifyAccessToken(deps) {
       email_verified: introspectResponse.email_verified,
       name: introspectResponse.name ?? null,
       picture: introspectResponse.picture ?? null,
-      company_name: introspectResponse.company_name ?? null,
+      company_name: null,
       department: introspectResponse.department ?? null,
       position: introspectResponse.position ?? null,
       phone_number: introspectResponse.phone_number ?? null,
@@ -710,6 +715,24 @@ function validateSeatChangePreview(preview) {
       `SDK: server returned malformed SeatChangePreview \u2014 estimateReason must be one of 'no_stripe_data' | 'custom_pricing' | 'stripe_error' (got ${JSON.stringify(p.estimateReason)})`
     );
   }
+  if (p.willApplyAtPeriodEnd !== void 0 && typeof p.willApplyAtPeriodEnd !== "boolean") {
+    throw new FFIDSDKError(
+      MALFORMED_SEAT_PREVIEW_CODE,
+      `SDK: server returned malformed SeatChangePreview \u2014 willApplyAtPeriodEnd must be boolean when present (got ${typeof p.willApplyAtPeriodEnd})`
+    );
+  }
+  if (p.effectiveDate !== void 0 && p.effectiveDate !== null && typeof p.effectiveDate !== "string") {
+    throw new FFIDSDKError(
+      MALFORMED_SEAT_PREVIEW_CODE,
+      `SDK: server returned malformed SeatChangePreview \u2014 effectiveDate must be string or null when present (got ${typeof p.effectiveDate})`
+    );
+  }
+  if (p.willApplyAtPeriodEnd === true && p.proratedAmount !== 0) {
+    throw new FFIDSDKError(
+      MALFORMED_SEAT_PREVIEW_CODE,
+      `SDK: server returned malformed SeatChangePreview \u2014 willApplyAtPeriodEnd=true requires proratedAmount=0 (got ${JSON.stringify(p.proratedAmount)})`
+    );
+  }
   if (!Array.isArray(p.lineItems)) {
     throw new FFIDSDKError(
       MALFORMED_SEAT_PREVIEW_CODE,
@@ -1350,7 +1373,7 @@ var FFID_ORGANIZATION_PROFILE_ERROR_CODES = {
 };
 
 // src/client/version-check.ts
-var SDK_VERSION = "7.1.0";
+var SDK_VERSION = "8.0.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -2509,6 +2532,86 @@ function cleanupStateStorage(logger) {
   }
 }
 
+// src/client/agency-invite-token.ts
+var AGENCY_INVITE_TOKEN_PARAM = "invite";
+var AGENCY_INVITE_COOKIE_NAME = "ffid_invite";
+var AGENCY_INVITE_TOKEN_REDACTION = "[REDACTED]";
+function hasDocument() {
+  return typeof document !== "undefined";
+}
+function toQueryString(source) {
+  const queryStart = source.indexOf("?");
+  if (queryStart < 0) return "";
+  const afterQuery = source.slice(queryStart);
+  const fragmentStart = afterQuery.indexOf("#");
+  return fragmentStart < 0 ? afterQuery : afterQuery.slice(0, fragmentStart);
+}
+function readTokenFromUrl(options) {
+  const source = options.url ?? (typeof window !== "undefined" ? window.location.search : void 0);
+  if (source === void 0) return void 0;
+  const params = new URLSearchParams(toQueryString(source));
+  return params.get(AGENCY_INVITE_TOKEN_PARAM)?.trim() || void 0;
+}
+function readAgencyInviteCookie() {
+  if (!hasDocument()) return void 0;
+  const prefix = `${AGENCY_INVITE_COOKIE_NAME}=`;
+  const raw = document.cookie.split(";").map((entry) => entry.trim()).find((entry) => entry.startsWith(prefix));
+  if (!raw) return void 0;
+  try {
+    return decodeURIComponent(raw.slice(prefix.length)).trim() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readAgencyInviteToken(options = {}) {
+  return readTokenFromUrl(options) ?? readAgencyInviteCookie();
+}
+var REDACT_BOUNDARIES = [
+  "%2526",
+  "%2523",
+  "%253B",
+  "%26",
+  "%23",
+  "%3B",
+  "&",
+  "#",
+  ";"
+];
+var REDACT_LEADS = ["%253F", "%3F", "?", ...REDACT_BOUNDARIES];
+var REDACT_SEPARATORS = ["%253D", "%3D", "="];
+function escapeForRegExp(literal) {
+  return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var REDACT_PATTERN = new RegExp(
+  [
+    // 先頭区切り。`\b` が使えないのは、入れ子形 (`%3Finvite%3D`) では `F` と `i` が
+    // どちらも単語文字なので単語境界が存在しないため。
+    `(^|${REDACT_LEADS.map(escapeForRegExp).join("|")})`,
+    // パラメータ名と区切りはキャプチャして再出力する。`i` フラグがあるので、
+    // 入力の `INVITE=` / `%3d` などの元の表記を保つ必要がある。
+    `(${AGENCY_INVITE_TOKEN_PARAM})`,
+    `(${REDACT_SEPARATORS.map(escapeForRegExp).join("|")})`,
+    // 値。境界の直前まで貪欲に食う。`\s` は終端にしない — 生の空白や改行を含む
+    // トークンでマスクが途中で切れ、後半が漏れる。
+    `(?:(?!${REDACT_BOUNDARIES.map(escapeForRegExp).join("|")})[^&#;])*`
+  ].join(""),
+  "gi"
+);
+function redactAgencyInviteToken(url) {
+  return url.replace(
+    REDACT_PATTERN,
+    // 文字列 replacement（`'$1$2$3[REDACTED]'`）にしないのは、
+    // `AGENCY_INVITE_TOKEN_REDACTION` に `$` が入った瞬間に置換パターンとして
+    // 解釈される罠を作らないため。
+    (_match, lead, name, separator) => `${lead}${name}${separator}${AGENCY_INVITE_TOKEN_REDACTION}`
+  );
+}
+function appendAgencyInviteToken(signupUrl, token) {
+  if (token === void 0) return signupUrl;
+  const separator = signupUrl.includes("?") ? "&" : "?";
+  return `${signupUrl}${separator}${AGENCY_INVITE_TOKEN_PARAM}=${encodeURIComponent(token)}`;
+}
+
 // src/client/redirect.ts
 var OAUTH_AUTHORIZE_ENDPOINT = "/api/v1/oauth/authorize";
 var AUTH_LOGOUT_ENDPOINT = "/api/v1/auth/logout";
@@ -2521,6 +2624,7 @@ var REDIRECT_LOOP_WINDOW_MS = 6e4;
 var REDIRECT_LOOP_THRESHOLD = 3;
 var storageReadFailureLogged = false;
 var storageWriteFailureLogged = false;
+var ssrInviteTokenUnavailableLogged = false;
 function isLoopDetectionDegraded() {
   return storageReadFailureLogged || storageWriteFailureLogged;
 }
@@ -2699,12 +2803,16 @@ function createRedirectMethods(deps) {
     }
     if (options?.screenHint === SCREEN_HINT_SIGNUP) {
       params.set(SCREEN_HINT_PARAM, SCREEN_HINT_SIGNUP);
+      const inviteToken = readAgencyInviteToken();
+      if (inviteToken !== void 0) {
+        params.set(AGENCY_INVITE_TOKEN_PARAM, inviteToken);
+      }
     }
     if (options?.prompt) {
       params.set("prompt", options.prompt);
     }
     const authorizeUrl = `${baseUrl}${OAUTH_AUTHORIZE_ENDPOINT}?${params.toString()}`;
-    logger.debug("Redirecting to authorize:", authorizeUrl);
+    logger.debug("Redirecting to authorize:", redactAgencyInviteToken(authorizeUrl));
     recordRedirectAttempt(authorizeKey, now, logger);
     try {
       window.location.href = authorizeUrl;
@@ -2723,7 +2831,7 @@ function createRedirectMethods(deps) {
       return redirectToAuthorize(options);
     }
     const targetUrl = options?.screenHint === SCREEN_HINT_SIGNUP ? getSignupUrl() : getLoginUrl(void 0, options?.prompt ? { prompt: options.prompt } : void 0);
-    logger.debug("Redirecting to auth page:", targetUrl);
+    logger.debug("Redirecting to auth page:", redactAgencyInviteToken(targetUrl));
     window.location.href = targetUrl;
     return { success: true };
   }
@@ -2740,7 +2848,7 @@ function createRedirectMethods(deps) {
     const promptSuffix = options?.prompt ? `&prompt=${encodeURIComponent(options.prompt)}` : "";
     return `${baseUrl}/login?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}${promptSuffix}`;
   }
-  function getSignupUrl(redirectUrl) {
+  function getSignupUrl(redirectUrl, options) {
     let redirect;
     if (redirectUrl != null) {
       redirect = redirectUrl;
@@ -2750,7 +2858,22 @@ function createRedirectMethods(deps) {
       logger.warn("getSignupUrl: SSR \u74B0\u5883\u3067 redirectUrl \u304C\u672A\u6307\u5B9A\u306E\u305F\u3081\u7A7A\u6587\u5B57\u306B\u30D5\u30A9\u30FC\u30EB\u30D0\u30C3\u30AF\u3057\u307E\u3059");
       redirect = "";
     }
-    return `${baseUrl}/signup?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}`;
+    let inviteToken = options?.inviteToken;
+    if (inviteToken === void 0) {
+      inviteToken = readAgencyInviteToken();
+      if (inviteToken === void 0 && typeof window === "undefined") {
+        if (!ssrInviteTokenUnavailableLogged) {
+          ssrInviteTokenUnavailableLogged = true;
+          logger.warn(
+            "[FFID SDK] getSignupUrl: SSR \u3067\u306F\u62DB\u5F85\u30C8\u30FC\u30AF\u30F3\uFF08invite\uFF09\u3092\u8AAD\u3081\u307E\u305B\u3093\u3002\u4EE3\u7406\u5E97\u306E\u62DB\u5F85\u30EA\u30F3\u30AF\u3092\u4F7F\u3046\u5834\u5408\u306F options.inviteToken \u306B\u6E21\u3057\u3066\u304F\u3060\u3055\u3044\uFF08\u4F7F\u3063\u3066\u3044\u306A\u3044\u5834\u5408\u306F\u3053\u306E\u8B66\u544A\u3092\u7121\u8996\u3057\u3066\u3088\u3044\uFF09"
+          );
+        }
+      }
+    }
+    return appendAgencyInviteToken(
+      `${baseUrl}/signup?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}`,
+      inviteToken
+    );
   }
   function getLogoutUrl(postLogoutRedirectUri) {
     const url = new URL(`${baseUrl}${AUTH_LOGOUT_ENDPOINT}`);
@@ -2766,7 +2889,7 @@ function createRedirectMethods(deps) {
       return { success: false, error: "SSR \u74B0\u5883\u3067\u306F\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3067\u304D\u307E\u305B\u3093" };
     }
     const logoutUrl = getLogoutUrl(postLogoutRedirectUri);
-    logger.debug("Redirecting to logout:", logoutUrl);
+    logger.debug("Redirecting to logout:", redactAgencyInviteToken(logoutUrl));
     window.location.href = logoutUrl;
     return { success: true };
   }
@@ -4320,9 +4443,9 @@ function createServerAuthClient(config) {
 var FFID_SESSION_COOKIE_NAME = "ffid_session";
 var DEFAULT_PATH = "/";
 var DEFAULT_SAME_SITE = "lax";
-var HOURS_PER_DAY2 = 24;
+var HOURS_PER_DAY3 = 24;
 var DEFAULT_MAX_AGE_DAYS = 30;
-var DEFAULT_MAX_AGE_SECONDS = 60 * 60 * HOURS_PER_DAY2 * DEFAULT_MAX_AGE_DAYS;
+var DEFAULT_MAX_AGE_SECONDS = 60 * 60 * HOURS_PER_DAY3 * DEFAULT_MAX_AGE_DAYS;
 var BASE64_GROUP = 4;
 function base64UrlEncode2(input) {
   const bytes = new TextEncoder().encode(input);

package/dist/server/index.d.cts

@@ -1,5 +1,5 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo, f as FFIDCatalogEnvironment, g as FFIDBillingInterval, h as FFIDTaxBehavior, i as FFIDPublishedCatalog } from '../ffid-client-BFgoVPOZ.cjs';
-export { j as FFIDAddMemberParams, k as FFIDAddMemberRequest, l as FFIDAddMemberResponse, m as FFIDAllowedLogoMimeType, n as FFIDAssignableMemberRole, o as FFIDCacheConfig, p as FFIDCatalogPublication, q as FFIDCatalogPublicationStatus, r as FFIDClient, s as FFIDCompanySizeCode, t as FFIDConfig, u as FFIDIndustryCode, v as FFIDListMembersResponse, w as FFIDListingConsentInput, x as FFIDLogoWallEntry, y as FFIDLogoWallResponse, z as FFIDMemberRole, A as FFIDOrganization, B as FFIDOrganizationLogoUploadResponse, C as FFIDOrganizationMember, D as FFIDOrganizationProfile, E as FFIDOrganizationProfileErrorCode, G as FFIDOrganizationProfileResponse, H as FFIDOtpSendResponse, I as FFIDOtpVerifyResponse, J as FFIDPasswordResetConfirmResponse, K as FFIDPasswordResetResponse, L as FFIDPasswordResetVerifyResponse, M as FFIDProfileCallOptions, N as FFIDProvisionMemberPlan, O as FFIDProvisionMemberPlanStatus, P as FFIDProvisionMemberResult, Q as FFIDProvisionMemberStatus, R as FFIDProvisionOrganizationDryRun, S as FFIDProvisionOrganizationMemberInput, T as FFIDProvisionOrganizationOutcome, U as FFIDProvisionOrganizationParams, V as FFIDProvisionOrganizationResponse, W as FFIDProvisionUserDryRun, X as FFIDProvisionUserOutcome, Y as FFIDProvisionUserParams, Z as FFIDProvisionUserProfileInput, _ as FFIDProvisionUserResponse, $ as FFIDProvisionedOrganization, a0 as FFIDProvisionedUser, a1 as FFIDPublishedPlan, a2 as FFIDRemoveMemberResponse, a3 as FFIDResetSessionResponse, a4 as FFIDSubscription, a5 as FFIDUpdateMemberRoleResponse, a6 as FFIDUpdateUserProfileRequest, a7 as FFIDUploadOrganizationLogoParams, a8 as FFIDUpsertOrganizationProfileParams, a9 as FFIDUpsertOrganizationProfileRequest, aa as FFIDUser, ab as FFIDUserProfile, ac as FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, ad as FFID_CATALOG_ENVIRONMENTS, ae as FFID_CATALOG_PUBLICATION_STATUSES, af as FFID_COMPANY_SIZE_CODES, ag as FFID_INDUSTRY_CODES, ah as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, ai as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, aj as FFID_ORGANIZATION_PROFILE_ERROR_CODES, ak as TokenData, al as TokenStore, am as createFFIDClient, an as createTokenStore } from '../ffid-client-BFgoVPOZ.cjs';
+import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo, f as FFIDCatalogEnvironment, g as FFIDBillingInterval, h as FFIDTaxBehavior, i as FFIDPublishedCatalog } from '../ffid-client-BaEmw7jP.cjs';
+export { j as FFIDAddMemberParams, k as FFIDAddMemberRequest, l as FFIDAddMemberResponse, m as FFIDAllowedLogoMimeType, n as FFIDAssignableMemberRole, o as FFIDCacheConfig, p as FFIDCatalogPublication, q as FFIDCatalogPublicationStatus, r as FFIDClient, s as FFIDCompanySizeCode, t as FFIDConfig, u as FFIDIndustryCode, v as FFIDListMembersResponse, w as FFIDListingConsentInput, x as FFIDLogoWallEntry, y as FFIDLogoWallResponse, z as FFIDMemberRole, A as FFIDOrganization, B as FFIDOrganizationLogoUploadResponse, C as FFIDOrganizationMember, D as FFIDOrganizationProfile, E as FFIDOrganizationProfileErrorCode, G as FFIDOrganizationProfileResponse, H as FFIDOtpSendResponse, I as FFIDOtpVerifyResponse, J as FFIDPasswordResetConfirmResponse, K as FFIDPasswordResetResponse, L as FFIDPasswordResetVerifyResponse, M as FFIDProfileCallOptions, N as FFIDProvisionMemberPlan, O as FFIDProvisionMemberPlanStatus, P as FFIDProvisionMemberResult, Q as FFIDProvisionMemberStatus, R as FFIDProvisionOrganizationDryRun, S as FFIDProvisionOrganizationMemberInput, T as FFIDProvisionOrganizationOutcome, U as FFIDProvisionOrganizationParams, V as FFIDProvisionOrganizationResponse, W as FFIDProvisionUserDryRun, X as FFIDProvisionUserOutcome, Y as FFIDProvisionUserParams, Z as FFIDProvisionUserProfileInput, _ as FFIDProvisionUserResponse, $ as FFIDProvisionedOrganization, a0 as FFIDProvisionedUser, a1 as FFIDPublishedPlan, a2 as FFIDRemoveMemberResponse, a3 as FFIDResetSessionResponse, a4 as FFIDSubscription, a5 as FFIDUpdateMemberRoleResponse, a6 as FFIDUpdateUserProfileRequest, a7 as FFIDUploadOrganizationLogoParams, a8 as FFIDUpsertOrganizationProfileParams, a9 as FFIDUpsertOrganizationProfileRequest, aa as FFIDUser, ab as FFIDUserProfile, ac as FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, ad as FFID_CATALOG_ENVIRONMENTS, ae as FFID_CATALOG_PUBLICATION_STATUSES, af as FFID_COMPANY_SIZE_CODES, ag as FFID_INDUSTRY_CODES, ah as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, ai as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, aj as FFID_ORGANIZATION_PROFILE_ERROR_CODES, ak as TokenData, al as TokenStore, am as createFFIDClient, an as createTokenStore } from '../ffid-client-BaEmw7jP.cjs';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-Ce2eXQtB.cjs';
 import { z } from 'zod';
 import '../types-Cjb9J0rL.cjs';

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo, f as FFIDCatalogEnvironment, g as FFIDBillingInterval, h as FFIDTaxBehavior, i as FFIDPublishedCatalog } from '../ffid-client-QNEFA3mv.js';
-export { j as FFIDAddMemberParams, k as FFIDAddMemberRequest, l as FFIDAddMemberResponse, m as FFIDAllowedLogoMimeType, n as FFIDAssignableMemberRole, o as FFIDCacheConfig, p as FFIDCatalogPublication, q as FFIDCatalogPublicationStatus, r as FFIDClient, s as FFIDCompanySizeCode, t as FFIDConfig, u as FFIDIndustryCode, v as FFIDListMembersResponse, w as FFIDListingConsentInput, x as FFIDLogoWallEntry, y as FFIDLogoWallResponse, z as FFIDMemberRole, A as FFIDOrganization, B as FFIDOrganizationLogoUploadResponse, C as FFIDOrganizationMember, D as FFIDOrganizationProfile, E as FFIDOrganizationProfileErrorCode, G as FFIDOrganizationProfileResponse, H as FFIDOtpSendResponse, I as FFIDOtpVerifyResponse, J as FFIDPasswordResetConfirmResponse, K as FFIDPasswordResetResponse, L as FFIDPasswordResetVerifyResponse, M as FFIDProfileCallOptions, N as FFIDProvisionMemberPlan, O as FFIDProvisionMemberPlanStatus, P as FFIDProvisionMemberResult, Q as FFIDProvisionMemberStatus, R as FFIDProvisionOrganizationDryRun, S as FFIDProvisionOrganizationMemberInput, T as FFIDProvisionOrganizationOutcome, U as FFIDProvisionOrganizationParams, V as FFIDProvisionOrganizationResponse, W as FFIDProvisionUserDryRun, X as FFIDProvisionUserOutcome, Y as FFIDProvisionUserParams, Z as FFIDProvisionUserProfileInput, _ as FFIDProvisionUserResponse, $ as FFIDProvisionedOrganization, a0 as FFIDProvisionedUser, a1 as FFIDPublishedPlan, a2 as FFIDRemoveMemberResponse, a3 as FFIDResetSessionResponse, a4 as FFIDSubscription, a5 as FFIDUpdateMemberRoleResponse, a6 as FFIDUpdateUserProfileRequest, a7 as FFIDUploadOrganizationLogoParams, a8 as FFIDUpsertOrganizationProfileParams, a9 as FFIDUpsertOrganizationProfileRequest, aa as FFIDUser, ab as FFIDUserProfile, ac as FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, ad as FFID_CATALOG_ENVIRONMENTS, ae as FFID_CATALOG_PUBLICATION_STATUSES, af as FFID_COMPANY_SIZE_CODES, ag as FFID_INDUSTRY_CODES, ah as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, ai as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, aj as FFID_ORGANIZATION_PROFILE_ERROR_CODES, ak as TokenData, al as TokenStore, am as createFFIDClient, an as createTokenStore } from '../ffid-client-QNEFA3mv.js';
+import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo, f as FFIDCatalogEnvironment, g as FFIDBillingInterval, h as FFIDTaxBehavior, i as FFIDPublishedCatalog } from '../ffid-client-5GAPcRIG.js';
+export { j as FFIDAddMemberParams, k as FFIDAddMemberRequest, l as FFIDAddMemberResponse, m as FFIDAllowedLogoMimeType, n as FFIDAssignableMemberRole, o as FFIDCacheConfig, p as FFIDCatalogPublication, q as FFIDCatalogPublicationStatus, r as FFIDClient, s as FFIDCompanySizeCode, t as FFIDConfig, u as FFIDIndustryCode, v as FFIDListMembersResponse, w as FFIDListingConsentInput, x as FFIDLogoWallEntry, y as FFIDLogoWallResponse, z as FFIDMemberRole, A as FFIDOrganization, B as FFIDOrganizationLogoUploadResponse, C as FFIDOrganizationMember, D as FFIDOrganizationProfile, E as FFIDOrganizationProfileErrorCode, G as FFIDOrganizationProfileResponse, H as FFIDOtpSendResponse, I as FFIDOtpVerifyResponse, J as FFIDPasswordResetConfirmResponse, K as FFIDPasswordResetResponse, L as FFIDPasswordResetVerifyResponse, M as FFIDProfileCallOptions, N as FFIDProvisionMemberPlan, O as FFIDProvisionMemberPlanStatus, P as FFIDProvisionMemberResult, Q as FFIDProvisionMemberStatus, R as FFIDProvisionOrganizationDryRun, S as FFIDProvisionOrganizationMemberInput, T as FFIDProvisionOrganizationOutcome, U as FFIDProvisionOrganizationParams, V as FFIDProvisionOrganizationResponse, W as FFIDProvisionUserDryRun, X as FFIDProvisionUserOutcome, Y as FFIDProvisionUserParams, Z as FFIDProvisionUserProfileInput, _ as FFIDProvisionUserResponse, $ as FFIDProvisionedOrganization, a0 as FFIDProvisionedUser, a1 as FFIDPublishedPlan, a2 as FFIDRemoveMemberResponse, a3 as FFIDResetSessionResponse, a4 as FFIDSubscription, a5 as FFIDUpdateMemberRoleResponse, a6 as FFIDUpdateUserProfileRequest, a7 as FFIDUploadOrganizationLogoParams, a8 as FFIDUpsertOrganizationProfileParams, a9 as FFIDUpsertOrganizationProfileRequest, aa as FFIDUser, ab as FFIDUserProfile, ac as FFID_ALLOWED_ORGANIZATION_LOGO_MIME_TYPES, ad as FFID_CATALOG_ENVIRONMENTS, ae as FFID_CATALOG_PUBLICATION_STATUSES, af as FFID_COMPANY_SIZE_CODES, ag as FFID_INDUSTRY_CODES, ah as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_BYTES, ai as FFID_MAX_ORGANIZATION_LOGO_FILE_SIZE_MB, aj as FFID_ORGANIZATION_PROFILE_ERROR_CODES, ak as TokenData, al as TokenStore, am as createFFIDClient, an as createTokenStore } from '../ffid-client-5GAPcRIG.js';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-Ce2eXQtB.js';
 import { z } from 'zod';
 import '../types-Cjb9J0rL.js';

package/dist/server/index.js

@@ -154,7 +154,7 @@ function normalizeUserinfo(raw) {
     emailVerified: raw.email_verified,
     name: raw.name,
     picture: raw.picture,
-    companyName: raw.company_name ?? null,
+    companyName: null,
     department: raw.department ?? null,
     position: raw.position ?? null,
     phoneNumber: raw.phone_number ?? null,
@@ -222,13 +222,18 @@ function mapUserinfoSubscriptionToSession(userinfo, serviceCode) {
   ];
 }
 var JWKS_ENDPOINT = "/.well-known/jwks.json";
-var JWT_ISSUER = "https://id.feelflow.net";
+var LEGACY_JWT_ISSUER = "https://id.feelflow.net";
 var JWT_ALGORITHM = "ES256";
 var JWT_CLOCK_TOLERANCE_SECONDS = 30;
+function resolveAcceptedIssuers(baseUrl) {
+  const deployedOrigin = new URL(baseUrl).origin;
+  return deployedOrigin === LEGACY_JWT_ISSUER ? [LEGACY_JWT_ISSUER] : [deployedOrigin, LEGACY_JWT_ISSUER];
+}
 function createJwtVerifier(deps) {
   const { baseUrl, serviceCode, logger, createError, errorCodes } = deps;
   const jwksUrl = new URL(JWKS_ENDPOINT, baseUrl);
   const jwks = createRemoteJWKSet(jwksUrl);
+  const acceptedIssuers = resolveAcceptedIssuers(baseUrl);
   async function verifyJwt(accessToken) {
     if (!accessToken || !accessToken.trim()) {
       return {
@@ -241,7 +246,7 @@ function createJwtVerifier(deps) {
     try {
       const { payload } = await jwtVerify(accessToken, jwks, {
         algorithms: [JWT_ALGORITHM],
-        issuer: JWT_ISSUER,
+        issuer: acceptedIssuers,
         audience: serviceCode,
         clockTolerance: JWT_CLOCK_TOLERANCE_SECONDS
       });
@@ -458,7 +463,7 @@ function createVerifyAccessToken(deps) {
       email_verified: introspectResponse.email_verified,
       name: introspectResponse.name ?? null,
       picture: introspectResponse.picture ?? null,
-      company_name: introspectResponse.company_name ?? null,
+      company_name: null,
       department: introspectResponse.department ?? null,
       position: introspectResponse.position ?? null,
       phone_number: introspectResponse.phone_number ?? null,
@@ -709,6 +714,24 @@ function validateSeatChangePreview(preview) {
       `SDK: server returned malformed SeatChangePreview \u2014 estimateReason must be one of 'no_stripe_data' | 'custom_pricing' | 'stripe_error' (got ${JSON.stringify(p.estimateReason)})`
     );
   }
+  if (p.willApplyAtPeriodEnd !== void 0 && typeof p.willApplyAtPeriodEnd !== "boolean") {
+    throw new FFIDSDKError(
+      MALFORMED_SEAT_PREVIEW_CODE,
+      `SDK: server returned malformed SeatChangePreview \u2014 willApplyAtPeriodEnd must be boolean when present (got ${typeof p.willApplyAtPeriodEnd})`
+    );
+  }
+  if (p.effectiveDate !== void 0 && p.effectiveDate !== null && typeof p.effectiveDate !== "string") {
+    throw new FFIDSDKError(
+      MALFORMED_SEAT_PREVIEW_CODE,
+      `SDK: server returned malformed SeatChangePreview \u2014 effectiveDate must be string or null when present (got ${typeof p.effectiveDate})`
+    );
+  }
+  if (p.willApplyAtPeriodEnd === true && p.proratedAmount !== 0) {
+    throw new FFIDSDKError(
+      MALFORMED_SEAT_PREVIEW_CODE,
+      `SDK: server returned malformed SeatChangePreview \u2014 willApplyAtPeriodEnd=true requires proratedAmount=0 (got ${JSON.stringify(p.proratedAmount)})`
+    );
+  }
   if (!Array.isArray(p.lineItems)) {
     throw new FFIDSDKError(
       MALFORMED_SEAT_PREVIEW_CODE,
@@ -1349,7 +1372,7 @@ var FFID_ORGANIZATION_PROFILE_ERROR_CODES = {
 };
 
 // src/client/version-check.ts
-var SDK_VERSION = "7.1.0";
+var SDK_VERSION = "8.0.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -2508,6 +2531,86 @@ function cleanupStateStorage(logger) {
   }
 }
 
+// src/client/agency-invite-token.ts
+var AGENCY_INVITE_TOKEN_PARAM = "invite";
+var AGENCY_INVITE_COOKIE_NAME = "ffid_invite";
+var AGENCY_INVITE_TOKEN_REDACTION = "[REDACTED]";
+function hasDocument() {
+  return typeof document !== "undefined";
+}
+function toQueryString(source) {
+  const queryStart = source.indexOf("?");
+  if (queryStart < 0) return "";
+  const afterQuery = source.slice(queryStart);
+  const fragmentStart = afterQuery.indexOf("#");
+  return fragmentStart < 0 ? afterQuery : afterQuery.slice(0, fragmentStart);
+}
+function readTokenFromUrl(options) {
+  const source = options.url ?? (typeof window !== "undefined" ? window.location.search : void 0);
+  if (source === void 0) return void 0;
+  const params = new URLSearchParams(toQueryString(source));
+  return params.get(AGENCY_INVITE_TOKEN_PARAM)?.trim() || void 0;
+}
+function readAgencyInviteCookie() {
+  if (!hasDocument()) return void 0;
+  const prefix = `${AGENCY_INVITE_COOKIE_NAME}=`;
+  const raw = document.cookie.split(";").map((entry) => entry.trim()).find((entry) => entry.startsWith(prefix));
+  if (!raw) return void 0;
+  try {
+    return decodeURIComponent(raw.slice(prefix.length)).trim() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readAgencyInviteToken(options = {}) {
+  return readTokenFromUrl(options) ?? readAgencyInviteCookie();
+}
+var REDACT_BOUNDARIES = [
+  "%2526",
+  "%2523",
+  "%253B",
+  "%26",
+  "%23",
+  "%3B",
+  "&",
+  "#",
+  ";"
+];
+var REDACT_LEADS = ["%253F", "%3F", "?", ...REDACT_BOUNDARIES];
+var REDACT_SEPARATORS = ["%253D", "%3D", "="];
+function escapeForRegExp(literal) {
+  return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var REDACT_PATTERN = new RegExp(
+  [
+    // 先頭区切り。`\b` が使えないのは、入れ子形 (`%3Finvite%3D`) では `F` と `i` が
+    // どちらも単語文字なので単語境界が存在しないため。
+    `(^|${REDACT_LEADS.map(escapeForRegExp).join("|")})`,
+    // パラメータ名と区切りはキャプチャして再出力する。`i` フラグがあるので、
+    // 入力の `INVITE=` / `%3d` などの元の表記を保つ必要がある。
+    `(${AGENCY_INVITE_TOKEN_PARAM})`,
+    `(${REDACT_SEPARATORS.map(escapeForRegExp).join("|")})`,
+    // 値。境界の直前まで貪欲に食う。`\s` は終端にしない — 生の空白や改行を含む
+    // トークンでマスクが途中で切れ、後半が漏れる。
+    `(?:(?!${REDACT_BOUNDARIES.map(escapeForRegExp).join("|")})[^&#;])*`
+  ].join(""),
+  "gi"
+);
+function redactAgencyInviteToken(url) {
+  return url.replace(
+    REDACT_PATTERN,
+    // 文字列 replacement（`'$1$2$3[REDACTED]'`）にしないのは、
+    // `AGENCY_INVITE_TOKEN_REDACTION` に `$` が入った瞬間に置換パターンとして
+    // 解釈される罠を作らないため。
+    (_match, lead, name, separator) => `${lead}${name}${separator}${AGENCY_INVITE_TOKEN_REDACTION}`
+  );
+}
+function appendAgencyInviteToken(signupUrl, token) {
+  if (token === void 0) return signupUrl;
+  const separator = signupUrl.includes("?") ? "&" : "?";
+  return `${signupUrl}${separator}${AGENCY_INVITE_TOKEN_PARAM}=${encodeURIComponent(token)}`;
+}
+
 // src/client/redirect.ts
 var OAUTH_AUTHORIZE_ENDPOINT = "/api/v1/oauth/authorize";
 var AUTH_LOGOUT_ENDPOINT = "/api/v1/auth/logout";
@@ -2520,6 +2623,7 @@ var REDIRECT_LOOP_WINDOW_MS = 6e4;
 var REDIRECT_LOOP_THRESHOLD = 3;
 var storageReadFailureLogged = false;
 var storageWriteFailureLogged = false;
+var ssrInviteTokenUnavailableLogged = false;
 function isLoopDetectionDegraded() {
   return storageReadFailureLogged || storageWriteFailureLogged;
 }
@@ -2698,12 +2802,16 @@ function createRedirectMethods(deps) {
     }
     if (options?.screenHint === SCREEN_HINT_SIGNUP) {
       params.set(SCREEN_HINT_PARAM, SCREEN_HINT_SIGNUP);
+      const inviteToken = readAgencyInviteToken();
+      if (inviteToken !== void 0) {
+        params.set(AGENCY_INVITE_TOKEN_PARAM, inviteToken);
+      }
     }
     if (options?.prompt) {
       params.set("prompt", options.prompt);
     }
     const authorizeUrl = `${baseUrl}${OAUTH_AUTHORIZE_ENDPOINT}?${params.toString()}`;
-    logger.debug("Redirecting to authorize:", authorizeUrl);
+    logger.debug("Redirecting to authorize:", redactAgencyInviteToken(authorizeUrl));
     recordRedirectAttempt(authorizeKey, now, logger);
     try {
       window.location.href = authorizeUrl;
@@ -2722,7 +2830,7 @@ function createRedirectMethods(deps) {
       return redirectToAuthorize(options);
     }
     const targetUrl = options?.screenHint === SCREEN_HINT_SIGNUP ? getSignupUrl() : getLoginUrl(void 0, options?.prompt ? { prompt: options.prompt } : void 0);
-    logger.debug("Redirecting to auth page:", targetUrl);
+    logger.debug("Redirecting to auth page:", redactAgencyInviteToken(targetUrl));
     window.location.href = targetUrl;
     return { success: true };
   }
@@ -2739,7 +2847,7 @@ function createRedirectMethods(deps) {
     const promptSuffix = options?.prompt ? `&prompt=${encodeURIComponent(options.prompt)}` : "";
     return `${baseUrl}/login?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}${promptSuffix}`;
   }
-  function getSignupUrl(redirectUrl) {
+  function getSignupUrl(redirectUrl, options) {
     let redirect;
     if (redirectUrl != null) {
       redirect = redirectUrl;
@@ -2749,7 +2857,22 @@ function createRedirectMethods(deps) {
       logger.warn("getSignupUrl: SSR \u74B0\u5883\u3067 redirectUrl \u304C\u672A\u6307\u5B9A\u306E\u305F\u3081\u7A7A\u6587\u5B57\u306B\u30D5\u30A9\u30FC\u30EB\u30D0\u30C3\u30AF\u3057\u307E\u3059");
       redirect = "";
     }
-    return `${baseUrl}/signup?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}`;
+    let inviteToken = options?.inviteToken;
+    if (inviteToken === void 0) {
+      inviteToken = readAgencyInviteToken();
+      if (inviteToken === void 0 && typeof window === "undefined") {
+        if (!ssrInviteTokenUnavailableLogged) {
+          ssrInviteTokenUnavailableLogged = true;
+          logger.warn(
+            "[FFID SDK] getSignupUrl: SSR \u3067\u306F\u62DB\u5F85\u30C8\u30FC\u30AF\u30F3\uFF08invite\uFF09\u3092\u8AAD\u3081\u307E\u305B\u3093\u3002\u4EE3\u7406\u5E97\u306E\u62DB\u5F85\u30EA\u30F3\u30AF\u3092\u4F7F\u3046\u5834\u5408\u306F options.inviteToken \u306B\u6E21\u3057\u3066\u304F\u3060\u3055\u3044\uFF08\u4F7F\u3063\u3066\u3044\u306A\u3044\u5834\u5408\u306F\u3053\u306E\u8B66\u544A\u3092\u7121\u8996\u3057\u3066\u3088\u3044\uFF09"
+          );
+        }
+      }
+    }
+    return appendAgencyInviteToken(
+      `${baseUrl}/signup?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}`,
+      inviteToken
+    );
   }
   function getLogoutUrl(postLogoutRedirectUri) {
     const url = new URL(`${baseUrl}${AUTH_LOGOUT_ENDPOINT}`);
@@ -2765,7 +2888,7 @@ function createRedirectMethods(deps) {
       return { success: false, error: "SSR \u74B0\u5883\u3067\u306F\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3067\u304D\u307E\u305B\u3093" };
     }
     const logoutUrl = getLogoutUrl(postLogoutRedirectUri);
-    logger.debug("Redirecting to logout:", logoutUrl);
+    logger.debug("Redirecting to logout:", redactAgencyInviteToken(logoutUrl));
     window.location.href = logoutUrl;
     return { success: true };
   }
@@ -4319,9 +4442,9 @@ function createServerAuthClient(config) {
 var FFID_SESSION_COOKIE_NAME = "ffid_session";
 var DEFAULT_PATH = "/";
 var DEFAULT_SAME_SITE = "lax";
-var HOURS_PER_DAY2 = 24;
+var HOURS_PER_DAY3 = 24;
 var DEFAULT_MAX_AGE_DAYS = 30;
-var DEFAULT_MAX_AGE_SECONDS = 60 * 60 * HOURS_PER_DAY2 * DEFAULT_MAX_AGE_DAYS;
+var DEFAULT_MAX_AGE_SECONDS = 60 * 60 * HOURS_PER_DAY3 * DEFAULT_MAX_AGE_DAYS;
 var BASE64_GROUP = 4;
 function base64UrlEncode2(input) {
   const bytes = new TextEncoder().encode(input);

package/dist/server/test/index.d.cts

@@ -1,4 +1,4 @@
-import { r as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-BFgoVPOZ.cjs';
+import { r as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-BaEmw7jP.cjs';
 import '../../types-Cjb9J0rL.cjs';
 
 /**

package/dist/server/test/index.d.ts

@@ -1,4 +1,4 @@
-import { r as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-QNEFA3mv.js';
+import { r as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-5GAPcRIG.js';
 import '../../types-Cjb9J0rL.js';
 
 /**

package/dist/webhooks/index.d.cts

@@ -47,7 +47,7 @@ declare class FFIDWebhookPayloadError extends FFIDWebhookError {
  */
 
 /** All supported webhook event types */
-type FFIDWebhookEventType = 'subscription.created' | 'subscription.updated' | 'subscription.canceled' | 'subscription.downgrade_scheduled' | 'subscription.downgrade_applied' | 'subscription.downgrade_canceled' | 'subscription.trial_ending' | 'subscription.payment_failed' | 'user.created' | 'user.updated' | 'user.deleted' | 'user.deletion_requested' | 'organization.created' | 'organization.updated' | 'organization.member.added' | 'organization.member.removed' | 'organization.member.role_changed' | 'legal.document.updated' | 'legal.agreement.required' | 'system.maintenance.scheduled' | 'system.maintenance.started' | 'system.maintenance.completed' | 'announcement.published' | 'test.ping';
+type FFIDWebhookEventType = 'subscription.created' | 'subscription.reactivated' | 'subscription.updated' | 'subscription.canceled' | 'subscription.downgrade_scheduled' | 'subscription.downgrade_applied' | 'subscription.downgrade_canceled' | 'subscription.trial_ending' | 'subscription.payment_failed' | 'user.created' | 'user.updated' | 'user.deleted' | 'user.deletion_requested' | 'organization.created' | 'organization.updated' | 'organization.member.added' | 'organization.member.removed' | 'organization.member.role_changed' | 'legal.document.updated' | 'legal.agreement.required' | 'system.maintenance.scheduled' | 'system.maintenance.started' | 'system.maintenance.completed' | 'announcement.published' | 'test.ping';
 interface FFIDSubscriptionCreatedPayload {
     subscriptionId: string;
     organizationId?: string;
@@ -65,6 +65,46 @@ interface FFIDSubscriptionUpdatedPayload {
     effectiveStatus?: EffectiveSubscriptionStatus;
     gracePeriodEndsAt?: string | null;
 }
+/**
+ * `subscription.reactivated` (8.0.0): a cancellation reserved until the period end was
+ * withdrawn in the FFID portal, so the subscription continues. It pairs with the
+ * reservation-time `subscription.canceled` (`source: 'user_initiated'`,
+ * `reactivatable: true`). Sent only for contracts billed through Stripe.
+ */
+interface FFIDSubscriptionReactivatedPayload {
+    subscriptionId: string;
+    organizationId?: string;
+    /** Plan code */
+    plan?: string;
+    status?: string;
+    effectiveStatus?: EffectiveSubscriptionStatus;
+    gracePeriodEndsAt?: string | null;
+    stripeSubscriptionId: string;
+    stripeCustomerId: string;
+    /** Code of the service the subscription belongs to (resolved by FFID when the event is sent) */
+    serviceCode?: string;
+}
+/**
+ * `subscription.canceled`.
+ *
+ * A contract billed through Stripe is canceled in two steps (FFID #6327), so **two events
+ * arrive per cancellation**:
+ *
+ * 1. At the reservation — `source: 'user_initiated'`, `reactivatable: true`, `cancelAt` /
+ *    `expiredAt` = the period end, no `effectiveStatus`. **Access continues until `cancelAt`**;
+ *    do not revoke it here. The reservation may still be withdrawn
+ *    (`subscription.reactivated`).
+ * 2. At the period end — `source: 'stripe_confirmed'`, `effectiveStatus: 'canceled'`. Revoke
+ *    access on this one.
+ *
+ * **Rule for consumers:** only an event with `source === 'user_initiated'` **and** a
+ * `cancelAt` is a reservation (keep access until `cancelAt`). Every other
+ * `subscription.canceled` ends access: the final `stripe_confirmed`, an immediate
+ * cancellation (`user_initiated` without `cancelAt` — a contract that cannot be reserved,
+ * e.g. no Stripe subscription or no period end yet; `expiredAt` is the cancellation time),
+ * and `payment_failure_auto_cancel` (automatic cancellation after unpaid invoices).
+ * Do not key the decision on `effectiveStatus`: it is set only on Stripe's deletion notice.
+ */
 interface FFIDSubscriptionCanceledPayload {
     /** FFID subscription UUID. */
     subscriptionId: string;
@@ -80,20 +120,28 @@ interface FFIDSubscriptionCanceledPayload {
      */
     stripeSubscriptionId: string | null;
     reason?: string;
+    /** When a reserved cancellation takes effect (the period end) */
     cancelAt?: string;
     /**
      * Origin of the cancellation. Always emitted by the FFID server — required
-     * by the wire shape in `SubscriptionCanceledPayload`.
+     * by the wire shape in `SubscriptionCanceledPayload`. Distinguishes the reservation
+     * (`user_initiated`) from the final event (`stripe_confirmed`); see the interface doc.
      */
     source: 'user_initiated' | 'stripe_confirmed' | 'payment_failure_auto_cancel';
     /** Whether this cancellation can be resumed via resubscribe flow. */
     reactivatable?: boolean;
     /**
-     * ISO timestamp at which access was actually lost. May differ from `cancelAt`
-     * when Stripe runs out the paid period before emitting the deletion event.
+     * ISO timestamp at which access is (or was) lost. On the reservation event this is the
+     * future period end. May differ from `cancelAt` when Stripe runs out the paid period
+     * before emitting the deletion event.
      */
     expiredAt?: string;
-    /** Cancellation always leaves the canonical access-control status as `canceled`. */
+    /**
+     * `canceled` only on Stripe's deletion notice (e.g. the final `stripe_confirmed`). Absent on
+     * the reservation event, on immediate cancellations and on the cron's
+     * `payment_failure_auto_cancel` — so its absence does not mean "still usable"; decide by
+     * `source` + `cancelAt` (see the interface doc).
+     */
     effectiveStatus?: EffectiveSubscriptionStatus;
     /** Always null for cancellation events because no grace window remains. */
     gracePeriodEndsAt?: string | null;
@@ -279,6 +327,7 @@ interface FFIDTestPingPayload {
 /** Maps event type strings to their typed payloads */
 interface FFIDWebhookEventMap {
     'subscription.created': FFIDSubscriptionCreatedPayload;
+    'subscription.reactivated': FFIDSubscriptionReactivatedPayload;
     'subscription.updated': FFIDSubscriptionUpdatedPayload;
     'subscription.canceled': FFIDSubscriptionCanceledPayload;
     'subscription.downgrade_scheduled': FFIDSubscriptionDowngradeScheduledPayload;
@@ -426,4 +475,4 @@ declare function createFFIDWebhookHandler(config: FFIDWebhookHandlerConfig): {
 /** Type of the FFID Webhook handler */
 type FFIDWebhookHandler = ReturnType<typeof createFFIDWebhookHandler>;
 
-export { DEFAULT_TOLERANCE_SECONDS, type FFIDLegalAgreementRequiredPayload, type FFIDLegalDocumentUpdatedPayload, type FFIDOrganizationCreatedPayload, type FFIDOrganizationMemberAddedPayload, type FFIDOrganizationMemberRemovedPayload, type FFIDOrganizationMemberRoleChangedPayload, type FFIDOrganizationUpdatedPayload, type FFIDSubscriptionCanceledPayload, type FFIDSubscriptionCreatedPayload, type FFIDSubscriptionDowngradeAppliedPayload, type FFIDSubscriptionDowngradeCanceledPayload, type FFIDSubscriptionDowngradeScheduledPayload, type FFIDSubscriptionPaymentFailedPayload, type FFIDSubscriptionTrialEndingPayload, type FFIDSubscriptionUpdatedPayload, type FFIDSystemMaintenancePayload, type FFIDTestPingPayload, type FFIDUserCreatedPayload, type FFIDUserDeletedPayload, type FFIDUserDeletionRequestedPayload, type FFIDUserUpdatedPayload, FFIDWebhookError, type FFIDWebhookEvent, type FFIDWebhookEventHandler, type FFIDWebhookEventMap, type FFIDWebhookEventType, type FFIDWebhookHandler, type FFIDWebhookHandlerConfig, type FFIDWebhookLogger, FFIDWebhookPayloadError, FFIDWebhookSignatureError, FFIDWebhookTimestampError, FFID_WEBHOOK_EVENT_ID_HEADER, FFID_WEBHOOK_SIGNATURE_HEADER, FFID_WEBHOOK_SIGNATURE_VERSION, FFID_WEBHOOK_TIMESTAMP_HEADER, computeSignature, createFFIDWebhookHandler, parseSignatureHeader, verifyWebhookSignature };
+export { DEFAULT_TOLERANCE_SECONDS, type FFIDLegalAgreementRequiredPayload, type FFIDLegalDocumentUpdatedPayload, type FFIDOrganizationCreatedPayload, type FFIDOrganizationMemberAddedPayload, type FFIDOrganizationMemberRemovedPayload, type FFIDOrganizationMemberRoleChangedPayload, type FFIDOrganizationUpdatedPayload, type FFIDSubscriptionCanceledPayload, type FFIDSubscriptionCreatedPayload, type FFIDSubscriptionDowngradeAppliedPayload, type FFIDSubscriptionDowngradeCanceledPayload, type FFIDSubscriptionDowngradeScheduledPayload, type FFIDSubscriptionPaymentFailedPayload, type FFIDSubscriptionReactivatedPayload, type FFIDSubscriptionTrialEndingPayload, type FFIDSubscriptionUpdatedPayload, type FFIDSystemMaintenancePayload, type FFIDTestPingPayload, type FFIDUserCreatedPayload, type FFIDUserDeletedPayload, type FFIDUserDeletionRequestedPayload, type FFIDUserUpdatedPayload, FFIDWebhookError, type FFIDWebhookEvent, type FFIDWebhookEventHandler, type FFIDWebhookEventMap, type FFIDWebhookEventType, type FFIDWebhookHandler, type FFIDWebhookHandlerConfig, type FFIDWebhookLogger, FFIDWebhookPayloadError, FFIDWebhookSignatureError, FFIDWebhookTimestampError, FFID_WEBHOOK_EVENT_ID_HEADER, FFID_WEBHOOK_SIGNATURE_HEADER, FFID_WEBHOOK_SIGNATURE_VERSION, FFID_WEBHOOK_TIMESTAMP_HEADER, computeSignature, createFFIDWebhookHandler, parseSignatureHeader, verifyWebhookSignature };