@feelflow/ffid-sdk 2.16.0 → 2.17.0

package/dist/{chunk-4IWCKZJV.js → chunk-O2YI5N6S.js}

@@ -808,7 +808,7 @@ function createProfileMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "2.16.0";
+var SDK_VERSION = "2.17.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1262,6 +1262,9 @@ function createSessionMethods(deps) {
 
 // src/auth/pkce.ts
 var VERIFIER_STORAGE_KEY = "ffid_code_verifier";
+var VERIFIER_FALLBACK_STORAGE_KEY = "ffid_code_verifier_fb";
+var VERIFIER_FALLBACK_TIMESTAMP_KEY = "ffid_code_verifier_fb_ts";
+var CODE_VERIFIER_MAX_AGE_MS = 5 * 60 * 1e3;
 var CODE_VERIFIER_MIN_LENGTH = 43;
 var UNRESERVED_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
 function generateCodeVerifier() {
@@ -1281,30 +1284,77 @@ async function generateCodeChallenge(verifier) {
   return base64UrlEncode(digest);
 }
 function storeCodeVerifier(verifier, logger) {
+  if (typeof window === "undefined") {
+    logger?.warn("storeCodeVerifier: storage is not available in SSR context");
+    return false;
+  }
+  let sessionStored = false;
   try {
-    if (typeof window === "undefined") {
-      logger?.warn("storeCodeVerifier: sessionStorage is not available in SSR context");
-      return false;
-    }
     window.sessionStorage.setItem(VERIFIER_STORAGE_KEY, verifier);
-    return true;
+    sessionStored = true;
   } catch (error) {
     logger?.warn("storeCodeVerifier: sessionStorage \u3078\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
-    return false;
   }
+  let localStored = false;
+  try {
+    window.localStorage.setItem(VERIFIER_FALLBACK_STORAGE_KEY, verifier);
+    window.localStorage.setItem(VERIFIER_FALLBACK_TIMESTAMP_KEY, String(Date.now()));
+    localStored = true;
+  } catch (error) {
+    logger?.warn("storeCodeVerifier: localStorage fallback \u3078\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  return sessionStored || localStored;
 }
 function retrieveCodeVerifier(logger) {
+  if (typeof window === "undefined") return null;
+  let sessionVerifier = null;
   try {
-    if (typeof window === "undefined") return null;
-    const verifier = window.sessionStorage.getItem(VERIFIER_STORAGE_KEY);
-    if (verifier) {
-      window.sessionStorage.removeItem(VERIFIER_STORAGE_KEY);
-    }
-    return verifier;
+    sessionVerifier = window.sessionStorage.getItem(VERIFIER_STORAGE_KEY);
   } catch (error) {
     logger?.warn("retrieveCodeVerifier: sessionStorage \u304B\u3089\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  if (sessionVerifier) {
+    cleanupVerifierStorage(logger);
+    return sessionVerifier;
+  }
+  let fallbackVerifier = null;
+  let fallbackTimestamp = null;
+  try {
+    fallbackVerifier = window.localStorage.getItem(VERIFIER_FALLBACK_STORAGE_KEY);
+    fallbackTimestamp = window.localStorage.getItem(VERIFIER_FALLBACK_TIMESTAMP_KEY);
+  } catch (error) {
+    logger?.warn("retrieveCodeVerifier: localStorage fallback \u304B\u3089\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+    cleanupVerifierStorage(logger);
+    return null;
+  }
+  if (!fallbackVerifier || !fallbackTimestamp) {
+    cleanupVerifierStorage(logger);
     return null;
   }
+  const ts = Number(fallbackTimestamp);
+  const age = Date.now() - ts;
+  if (!Number.isFinite(ts) || age < 0 || age > CODE_VERIFIER_MAX_AGE_MS) {
+    cleanupVerifierStorage(logger);
+    return null;
+  }
+  logger?.warn(
+    "retrieveCodeVerifier: sessionStorage was empty, recovered code_verifier from localStorage fallback"
+  );
+  cleanupVerifierStorage(logger);
+  return fallbackVerifier;
+}
+function cleanupVerifierStorage(logger) {
+  try {
+    window.sessionStorage.removeItem(VERIFIER_STORAGE_KEY);
+  } catch (error) {
+    logger?.warn("retrieveCodeVerifier: sessionStorage \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  try {
+    window.localStorage.removeItem(VERIFIER_FALLBACK_STORAGE_KEY);
+    window.localStorage.removeItem(VERIFIER_FALLBACK_TIMESTAMP_KEY);
+  } catch (error) {
+    logger?.warn("retrieveCodeVerifier: localStorage \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
 }
 function base64UrlEncode(buffer) {
   const bytes = new Uint8Array(buffer);
@@ -2496,7 +2546,7 @@ function FFIDProvider({
     const code = urlParams.get("code");
     if (!code) return;
     client.logger.debug("Authorization code detected, exchanging for tokens");
-    const codeVerifier = retrieveCodeVerifier();
+    const codeVerifier = retrieveCodeVerifier(client.logger);
     client.exchangeCodeForTokens(code, codeVerifier ?? void 0).then((result) => {
       if (result.error) {
         client.logger.error("Token exchange failed:", result.error);

package/dist/{chunk-PA6S2M7C.cjs → chunk-OWE6EPWE.cjs}

@@ -810,7 +810,7 @@ function createProfileMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "2.16.0";
+var SDK_VERSION = "2.17.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1264,6 +1264,9 @@ function createSessionMethods(deps) {
 
 // src/auth/pkce.ts
 var VERIFIER_STORAGE_KEY = "ffid_code_verifier";
+var VERIFIER_FALLBACK_STORAGE_KEY = "ffid_code_verifier_fb";
+var VERIFIER_FALLBACK_TIMESTAMP_KEY = "ffid_code_verifier_fb_ts";
+var CODE_VERIFIER_MAX_AGE_MS = 5 * 60 * 1e3;
 var CODE_VERIFIER_MIN_LENGTH = 43;
 var UNRESERVED_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
 function generateCodeVerifier() {
@@ -1283,30 +1286,77 @@ async function generateCodeChallenge(verifier) {
   return base64UrlEncode(digest);
 }
 function storeCodeVerifier(verifier, logger) {
+  if (typeof window === "undefined") {
+    logger?.warn("storeCodeVerifier: storage is not available in SSR context");
+    return false;
+  }
+  let sessionStored = false;
   try {
-    if (typeof window === "undefined") {
-      logger?.warn("storeCodeVerifier: sessionStorage is not available in SSR context");
-      return false;
-    }
     window.sessionStorage.setItem(VERIFIER_STORAGE_KEY, verifier);
-    return true;
+    sessionStored = true;
   } catch (error) {
     logger?.warn("storeCodeVerifier: sessionStorage \u3078\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
-    return false;
   }
+  let localStored = false;
+  try {
+    window.localStorage.setItem(VERIFIER_FALLBACK_STORAGE_KEY, verifier);
+    window.localStorage.setItem(VERIFIER_FALLBACK_TIMESTAMP_KEY, String(Date.now()));
+    localStored = true;
+  } catch (error) {
+    logger?.warn("storeCodeVerifier: localStorage fallback \u3078\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  return sessionStored || localStored;
 }
 function retrieveCodeVerifier(logger) {
+  if (typeof window === "undefined") return null;
+  let sessionVerifier = null;
   try {
-    if (typeof window === "undefined") return null;
-    const verifier = window.sessionStorage.getItem(VERIFIER_STORAGE_KEY);
-    if (verifier) {
-      window.sessionStorage.removeItem(VERIFIER_STORAGE_KEY);
-    }
-    return verifier;
+    sessionVerifier = window.sessionStorage.getItem(VERIFIER_STORAGE_KEY);
   } catch (error) {
     logger?.warn("retrieveCodeVerifier: sessionStorage \u304B\u3089\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  if (sessionVerifier) {
+    cleanupVerifierStorage(logger);
+    return sessionVerifier;
+  }
+  let fallbackVerifier = null;
+  let fallbackTimestamp = null;
+  try {
+    fallbackVerifier = window.localStorage.getItem(VERIFIER_FALLBACK_STORAGE_KEY);
+    fallbackTimestamp = window.localStorage.getItem(VERIFIER_FALLBACK_TIMESTAMP_KEY);
+  } catch (error) {
+    logger?.warn("retrieveCodeVerifier: localStorage fallback \u304B\u3089\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+    cleanupVerifierStorage(logger);
+    return null;
+  }
+  if (!fallbackVerifier || !fallbackTimestamp) {
+    cleanupVerifierStorage(logger);
     return null;
   }
+  const ts = Number(fallbackTimestamp);
+  const age = Date.now() - ts;
+  if (!Number.isFinite(ts) || age < 0 || age > CODE_VERIFIER_MAX_AGE_MS) {
+    cleanupVerifierStorage(logger);
+    return null;
+  }
+  logger?.warn(
+    "retrieveCodeVerifier: sessionStorage was empty, recovered code_verifier from localStorage fallback"
+  );
+  cleanupVerifierStorage(logger);
+  return fallbackVerifier;
+}
+function cleanupVerifierStorage(logger) {
+  try {
+    window.sessionStorage.removeItem(VERIFIER_STORAGE_KEY);
+  } catch (error) {
+    logger?.warn("retrieveCodeVerifier: sessionStorage \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  try {
+    window.localStorage.removeItem(VERIFIER_FALLBACK_STORAGE_KEY);
+    window.localStorage.removeItem(VERIFIER_FALLBACK_TIMESTAMP_KEY);
+  } catch (error) {
+    logger?.warn("retrieveCodeVerifier: localStorage \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
 }
 function base64UrlEncode(buffer) {
   const bytes = new Uint8Array(buffer);
@@ -2498,7 +2548,7 @@ function FFIDProvider({
     const code = urlParams.get("code");
     if (!code) return;
     client.logger.debug("Authorization code detected, exchanging for tokens");
-    const codeVerifier = retrieveCodeVerifier();
+    const codeVerifier = retrieveCodeVerifier(client.logger);
     client.exchangeCodeForTokens(code, codeVerifier ?? void 0).then((result) => {
       if (result.error) {
         client.logger.error("Token exchange failed:", result.error);

package/dist/components/index.cjs

@@ -1,34 +1,34 @@
 'use strict';
 
-var chunkPA6S2M7C_cjs = require('../chunk-PA6S2M7C.cjs');
+var chunkOWE6EPWE_cjs = require('../chunk-OWE6EPWE.cjs');
 
 
 
 Object.defineProperty(exports, "FFIDAnnouncementBadge", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFIDAnnouncementBadge; }
+  get: function () { return chunkOWE6EPWE_cjs.FFIDAnnouncementBadge; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementList", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFIDAnnouncementList; }
+  get: function () { return chunkOWE6EPWE_cjs.FFIDAnnouncementList; }
 });
 Object.defineProperty(exports, "FFIDInquiryForm", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFIDInquiryForm; }
+  get: function () { return chunkOWE6EPWE_cjs.FFIDInquiryForm; }
 });
 Object.defineProperty(exports, "FFIDLoginButton", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFIDLoginButton; }
+  get: function () { return chunkOWE6EPWE_cjs.FFIDLoginButton; }
 });
 Object.defineProperty(exports, "FFIDOrganizationSwitcher", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFIDOrganizationSwitcher; }
+  get: function () { return chunkOWE6EPWE_cjs.FFIDOrganizationSwitcher; }
 });
 Object.defineProperty(exports, "FFIDSubscriptionBadge", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFIDSubscriptionBadge; }
+  get: function () { return chunkOWE6EPWE_cjs.FFIDSubscriptionBadge; }
 });
 Object.defineProperty(exports, "FFIDUserMenu", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFIDUserMenu; }
+  get: function () { return chunkOWE6EPWE_cjs.FFIDUserMenu; }
 });

package/dist/components/index.js

@@ -1 +1 @@
-export { FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDSubscriptionBadge, FFIDUserMenu } from '../chunk-4IWCKZJV.js';
+export { FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDSubscriptionBadge, FFIDUserMenu } from '../chunk-O2YI5N6S.js';

package/dist/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkPA6S2M7C_cjs = require('./chunk-PA6S2M7C.cjs');
+var chunkOWE6EPWE_cjs = require('./chunk-OWE6EPWE.cjs');
 var react = require('react');
 var jsxRuntime = require('react/jsx-runtime');
 
@@ -46,7 +46,7 @@ function createKVCacheAdapter(kv) {
 }
 function withFFIDAuth(Component, options = {}) {
   const WrappedComponent = (props) => {
-    const { isLoading, isAuthenticated, login } = chunkPA6S2M7C_cjs.useFFIDContext();
+    const { isLoading, isAuthenticated, login } = chunkOWE6EPWE_cjs.useFFIDContext();
     const hasRedirected = react.useRef(false);
     react.useEffect(() => {
       if (!isLoading && !isAuthenticated && options.redirectToLogin && !hasRedirected.current) {
@@ -74,107 +74,107 @@ var FFID_NEWSLETTER_TYPES = ["inquiry_followup", "general"];
 
 Object.defineProperty(exports, "DEFAULT_API_BASE_URL", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.DEFAULT_API_BASE_URL; }
+  get: function () { return chunkOWE6EPWE_cjs.DEFAULT_API_BASE_URL; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementBadge", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFIDAnnouncementBadge; }
+  get: function () { return chunkOWE6EPWE_cjs.FFIDAnnouncementBadge; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementList", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFIDAnnouncementList; }
+  get: function () { return chunkOWE6EPWE_cjs.FFIDAnnouncementList; }
 });
 Object.defineProperty(exports, "FFIDInquiryForm", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFIDInquiryForm; }
+  get: function () { return chunkOWE6EPWE_cjs.FFIDInquiryForm; }
 });
 Object.defineProperty(exports, "FFIDLoginButton", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFIDLoginButton; }
+  get: function () { return chunkOWE6EPWE_cjs.FFIDLoginButton; }
 });
 Object.defineProperty(exports, "FFIDOrganizationSwitcher", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFIDOrganizationSwitcher; }
+  get: function () { return chunkOWE6EPWE_cjs.FFIDOrganizationSwitcher; }
 });
 Object.defineProperty(exports, "FFIDProvider", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFIDProvider; }
+  get: function () { return chunkOWE6EPWE_cjs.FFIDProvider; }
 });
 Object.defineProperty(exports, "FFIDSDKError", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFIDSDKError; }
+  get: function () { return chunkOWE6EPWE_cjs.FFIDSDKError; }
 });
 Object.defineProperty(exports, "FFIDSubscriptionBadge", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFIDSubscriptionBadge; }
+  get: function () { return chunkOWE6EPWE_cjs.FFIDSubscriptionBadge; }
 });
 Object.defineProperty(exports, "FFIDUserMenu", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFIDUserMenu; }
+  get: function () { return chunkOWE6EPWE_cjs.FFIDUserMenu; }
 });
 Object.defineProperty(exports, "FFID_ANNOUNCEMENTS_ERROR_CODES", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFID_ANNOUNCEMENTS_ERROR_CODES; }
+  get: function () { return chunkOWE6EPWE_cjs.FFID_ANNOUNCEMENTS_ERROR_CODES; }
 });
 Object.defineProperty(exports, "FFID_INQUIRY_CATEGORIES", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFID_INQUIRY_CATEGORIES; }
+  get: function () { return chunkOWE6EPWE_cjs.FFID_INQUIRY_CATEGORIES; }
 });
 Object.defineProperty(exports, "FFID_INQUIRY_CATEGORIES_SITE_2026", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.FFID_INQUIRY_CATEGORIES_SITE_2026; }
+  get: function () { return chunkOWE6EPWE_cjs.FFID_INQUIRY_CATEGORIES_SITE_2026; }
 });
 Object.defineProperty(exports, "createFFIDAnnouncementsClient", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.createFFIDAnnouncementsClient; }
+  get: function () { return chunkOWE6EPWE_cjs.createFFIDAnnouncementsClient; }
 });
 Object.defineProperty(exports, "createFFIDClient", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.createFFIDClient; }
+  get: function () { return chunkOWE6EPWE_cjs.createFFIDClient; }
 });
 Object.defineProperty(exports, "createTokenStore", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.createTokenStore; }
+  get: function () { return chunkOWE6EPWE_cjs.createTokenStore; }
 });
 Object.defineProperty(exports, "generateCodeChallenge", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.generateCodeChallenge; }
+  get: function () { return chunkOWE6EPWE_cjs.generateCodeChallenge; }
 });
 Object.defineProperty(exports, "generateCodeVerifier", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.generateCodeVerifier; }
+  get: function () { return chunkOWE6EPWE_cjs.generateCodeVerifier; }
 });
 Object.defineProperty(exports, "isFFIDInquiryCategorySite2026", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.isFFIDInquiryCategorySite2026; }
+  get: function () { return chunkOWE6EPWE_cjs.isFFIDInquiryCategorySite2026; }
 });
 Object.defineProperty(exports, "normalizeRedirectUri", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.normalizeRedirectUri; }
+  get: function () { return chunkOWE6EPWE_cjs.normalizeRedirectUri; }
 });
 Object.defineProperty(exports, "retrieveCodeVerifier", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.retrieveCodeVerifier; }
+  get: function () { return chunkOWE6EPWE_cjs.retrieveCodeVerifier; }
 });
 Object.defineProperty(exports, "storeCodeVerifier", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.storeCodeVerifier; }
+  get: function () { return chunkOWE6EPWE_cjs.storeCodeVerifier; }
 });
 Object.defineProperty(exports, "useFFID", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.useFFID; }
+  get: function () { return chunkOWE6EPWE_cjs.useFFID; }
 });
 Object.defineProperty(exports, "useFFIDAnnouncements", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.useFFIDAnnouncements; }
+  get: function () { return chunkOWE6EPWE_cjs.useFFIDAnnouncements; }
 });
 Object.defineProperty(exports, "useSubscription", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.useSubscription; }
+  get: function () { return chunkOWE6EPWE_cjs.useSubscription; }
 });
 Object.defineProperty(exports, "withSubscription", {
   enumerable: true,
-  get: function () { return chunkPA6S2M7C_cjs.withSubscription; }
+  get: function () { return chunkOWE6EPWE_cjs.withSubscription; }
 });
 exports.FFID_NEWSLETTER_TYPES = FFID_NEWSLETTER_TYPES;
 exports.createKVCacheAdapter = createKVCacheAdapter;

package/dist/index.d.cts

@@ -73,20 +73,23 @@ interface PKCELogger {
     warn: (...args: unknown[]) => void;
 }
 /**
- * Store code verifier in sessionStorage for later retrieval.
- * Uses window.sessionStorage explicitly to ensure browser Web Storage API.
+ * Store code verifier for later retrieval.
+ *
+ * Writes to both sessionStorage (primary) and localStorage (fallback for iOS
+ * WebKit sessionStorage eviction during external OAuth bounces). Returns true
+ * if at least one write succeeded.
  *
  * @param verifier - The code verifier to store
  * @param logger - Optional logger for warning on storage failure
- * @returns true if stored successfully, false otherwise
+ * @returns true if stored in at least one storage, false otherwise
  */
 declare function storeCodeVerifier(verifier: string, logger?: PKCELogger): boolean;
 /**
- * Retrieve and remove the code verifier from sessionStorage.
- * Uses window.sessionStorage explicitly to ensure browser Web Storage API.
+ * Retrieve and remove the code verifier.
  *
- * Returns null if no verifier is stored or if storage is unavailable.
- * Removes the verifier after retrieval (one-time use).
+ * Reads from sessionStorage first, falls back to localStorage (with 5-minute TTL).
+ * Removes from all storages after retrieval (one-time use). Returns null if no
+ * verifier is stored, the fallback is stale (>5 min), or storage is unavailable.
  *
  * @param logger - Optional logger for warning on storage failure
  */

package/dist/index.d.ts

@@ -73,20 +73,23 @@ interface PKCELogger {
     warn: (...args: unknown[]) => void;
 }
 /**
- * Store code verifier in sessionStorage for later retrieval.
- * Uses window.sessionStorage explicitly to ensure browser Web Storage API.
+ * Store code verifier for later retrieval.
+ *
+ * Writes to both sessionStorage (primary) and localStorage (fallback for iOS
+ * WebKit sessionStorage eviction during external OAuth bounces). Returns true
+ * if at least one write succeeded.
  *
  * @param verifier - The code verifier to store
  * @param logger - Optional logger for warning on storage failure
- * @returns true if stored successfully, false otherwise
+ * @returns true if stored in at least one storage, false otherwise
  */
 declare function storeCodeVerifier(verifier: string, logger?: PKCELogger): boolean;
 /**
- * Retrieve and remove the code verifier from sessionStorage.
- * Uses window.sessionStorage explicitly to ensure browser Web Storage API.
+ * Retrieve and remove the code verifier.
  *
- * Returns null if no verifier is stored or if storage is unavailable.
- * Removes the verifier after retrieval (one-time use).
+ * Reads from sessionStorage first, falls back to localStorage (with 5-minute TTL).
+ * Removes from all storages after retrieval (one-time use). Returns null if no
+ * verifier is stored, the fallback is stale (>5 min), or storage is unavailable.
  *
  * @param logger - Optional logger for warning on storage failure
  */

package/dist/index.js

@@ -1,5 +1,5 @@
-import { useFFIDContext } from './chunk-4IWCKZJV.js';
-export { DEFAULT_API_BASE_URL, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, storeCodeVerifier, useFFID, useFFIDAnnouncements, useSubscription, withSubscription } from './chunk-4IWCKZJV.js';
+import { useFFIDContext } from './chunk-O2YI5N6S.js';
+export { DEFAULT_API_BASE_URL, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, storeCodeVerifier, useFFID, useFFIDAnnouncements, useSubscription, withSubscription } from './chunk-O2YI5N6S.js';
 import { useRef, useEffect } from 'react';
 import { jsx, Fragment } from 'react/jsx-runtime';
 

package/dist/server/index.cjs

@@ -806,7 +806,7 @@ function createProfileMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "2.16.0";
+var SDK_VERSION = "2.17.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1260,6 +1260,8 @@ function createSessionMethods(deps) {
 
 // src/auth/pkce.ts
 var VERIFIER_STORAGE_KEY = "ffid_code_verifier";
+var VERIFIER_FALLBACK_STORAGE_KEY = "ffid_code_verifier_fb";
+var VERIFIER_FALLBACK_TIMESTAMP_KEY = "ffid_code_verifier_fb_ts";
 var CODE_VERIFIER_MIN_LENGTH = 43;
 var UNRESERVED_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
 function generateCodeVerifier() {
@@ -1279,17 +1281,26 @@ async function generateCodeChallenge(verifier) {
   return base64UrlEncode(digest);
 }
 function storeCodeVerifier(verifier, logger) {
+  if (typeof window === "undefined") {
+    logger?.warn("storeCodeVerifier: storage is not available in SSR context");
+    return false;
+  }
+  let sessionStored = false;
   try {
-    if (typeof window === "undefined") {
-      logger?.warn("storeCodeVerifier: sessionStorage is not available in SSR context");
-      return false;
-    }
     window.sessionStorage.setItem(VERIFIER_STORAGE_KEY, verifier);
-    return true;
+    sessionStored = true;
   } catch (error) {
     logger?.warn("storeCodeVerifier: sessionStorage \u3078\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
-    return false;
   }
+  let localStored = false;
+  try {
+    window.localStorage.setItem(VERIFIER_FALLBACK_STORAGE_KEY, verifier);
+    window.localStorage.setItem(VERIFIER_FALLBACK_TIMESTAMP_KEY, String(Date.now()));
+    localStored = true;
+  } catch (error) {
+    logger?.warn("storeCodeVerifier: localStorage fallback \u3078\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  return sessionStored || localStored;
 }
 function base64UrlEncode(buffer) {
   const bytes = new Uint8Array(buffer);

package/dist/server/index.js

@@ -805,7 +805,7 @@ function createProfileMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "2.16.0";
+var SDK_VERSION = "2.17.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1259,6 +1259,8 @@ function createSessionMethods(deps) {
 
 // src/auth/pkce.ts
 var VERIFIER_STORAGE_KEY = "ffid_code_verifier";
+var VERIFIER_FALLBACK_STORAGE_KEY = "ffid_code_verifier_fb";
+var VERIFIER_FALLBACK_TIMESTAMP_KEY = "ffid_code_verifier_fb_ts";
 var CODE_VERIFIER_MIN_LENGTH = 43;
 var UNRESERVED_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
 function generateCodeVerifier() {
@@ -1278,17 +1280,26 @@ async function generateCodeChallenge(verifier) {
   return base64UrlEncode(digest);
 }
 function storeCodeVerifier(verifier, logger) {
+  if (typeof window === "undefined") {
+    logger?.warn("storeCodeVerifier: storage is not available in SSR context");
+    return false;
+  }
+  let sessionStored = false;
   try {
-    if (typeof window === "undefined") {
-      logger?.warn("storeCodeVerifier: sessionStorage is not available in SSR context");
-      return false;
-    }
     window.sessionStorage.setItem(VERIFIER_STORAGE_KEY, verifier);
-    return true;
+    sessionStored = true;
   } catch (error) {
     logger?.warn("storeCodeVerifier: sessionStorage \u3078\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
-    return false;
   }
+  let localStored = false;
+  try {
+    window.localStorage.setItem(VERIFIER_FALLBACK_STORAGE_KEY, verifier);
+    window.localStorage.setItem(VERIFIER_FALLBACK_TIMESTAMP_KEY, String(Date.now()));
+    localStored = true;
+  } catch (error) {
+    logger?.warn("storeCodeVerifier: localStorage fallback \u3078\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  return sessionStored || localStored;
 }
 function base64UrlEncode(buffer) {
   const bytes = new Uint8Array(buffer);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feelflow/ffid-sdk",
-  "version": "2.16.0",
+  "version": "2.17.0",
   "description": "FeelFlow ID Platform SDK for React/Next.js applications",
   "keywords": [
     "feelflow",