@feelflow/ffid-sdk 5.16.1 → 5.17.0

package/dist/index.d.cts

@@ -1,6 +1,6 @@
-import { F as FFIDSubscriptionStatus, a as FFIDConfig, b as FFIDApiResponse, c as FFIDSessionResponse, d as FFIDRedirectResult, e as FFIDError, f as FFIDSubscriptionCheckResponse, g as FFIDCheckServiceAccessParams, h as FFIDServiceAccessDecision, i as FFIDAnalyticsConfig, j as FFIDVerifyAccessTokenOptions, k as FFIDOAuthUserInfo, l as FFIDInquiryCreateParams, m as FFIDInquiryCreateResponse, n as FFIDAuthMode, o as FFIDLogger, p as FFIDCacheAdapter, q as FFIDUser, r as FFIDOrganization, s as FFIDSubscription, t as FFIDSubscriptionContextValue, E as EffectiveSubscriptionStatus, u as FFIDOAuthUserInfoSubscription, v as FFIDAnnouncementsClientConfig, L as ListAnnouncementsOptions, w as FFIDAnnouncementsApiResponse, A as AnnouncementListResponse, x as FFIDAnnouncementsLogger } from './index-CsVJTuPv.cjs';
-export { y as Announcement, z as AnnouncementStatus, B as AnnouncementType, C as EFFECTIVE_SUBSCRIPTION_STATUSES, D as FFIDAnnouncementBadge, G as FFIDAnnouncementList, H as FFIDAnnouncementsError, I as FFIDAnnouncementsErrorCode, J as FFIDAnnouncementsServerResponse, K as FFIDCacheConfig, M as FFIDContextValue, N as FFIDInquiryCategory, O as FFIDInquiryCategorySite2026, P as FFIDInquiryForm, Q as FFIDInquiryFormCategoryItem, R as FFIDInquiryFormClassNames, S as FFIDInquiryFormLegalLayout, T as FFIDInquiryFormOrganization, U as FFIDInquiryFormPlaceholderContext, V as FFIDInquiryFormPrefill, W as FFIDInquiryFormProps, X as FFIDInquiryFormSubmitData, Y as FFIDInquiryFormSubmitResult, Z as FFIDJwtClaims, _ as FFIDLoginButton, $ as FFIDOAuthTokenResponse, a0 as FFIDOAuthUserInfoMemberRole, a1 as FFIDOrganizationSwitcher, a2 as FFIDRedirectErrorCode, a3 as FFIDSeatModel, a4 as FFIDServiceAccessDenialReason, a5 as FFIDServiceAccessFailPolicy, a6 as FFIDSubscriptionBadge, a7 as FFIDTokenIntrospectionResponse, a8 as FFIDUserMenu, a9 as FFID_INQUIRY_CATEGORIES, aa as FFID_INQUIRY_CATEGORIES_SITE_2026, ab as UseFFIDAnnouncementsOptions, ac as UseFFIDAnnouncementsReturn, ad as isFFIDInquiryCategorySite2026, ae as useFFIDAnnouncements } from './index-CsVJTuPv.cjs';
-export { A as ALL_DENIED_EXCEPT_NECESSARY, i as CONSENT_COOKIE_NAME, j as CONSENT_DISMISSAL_TIMESTAMP_KEY, l as COOKIE_VERSION, D as DEFAULT_CONSENT_ERROR_MESSAGES, o as FFIDAnalyticsProvider, p as FFIDAnalyticsProviderProps, c as FFIDConsentCategories, r as FFIDConsentCategoryCode, e as FFIDConsentCategoryMetadata, w as FFIDConsentError, x as FFIDConsentErrorCode, y as FFIDConsentMergeStrategy, B as FFIDConsentMergeWarning, E as FFIDConsentMergeWarningEvent, F as FFIDConsentResult, I as FFIDConsentSource, a as FFIDConsentState, d as FFIDConsentSyncResult, M as FFIDCookieBanner, N as FFIDCookieBannerClassNames, O as FFIDCookieBannerProps, Q as FFIDCookieLink, R as FFIDCookieLinkProps, f as FFIDCookiePolicy, T as FFIDCookieSettings, U as FFIDCookieSettingsClassNames, V as FFIDCookieSettingsProps, _ as FFID_CONSENT_ERROR_CODES, ae as UseFFIDConsentPreferencesReturn, af as UseFFIDConsentReturn, ag as clearConsentDismissalTimestamp, aj as decodeConsentCookie, al as encodeConsentCookie, an as readConsentCookie, ao as readConsentDismissalTimestamp, aq as useFFIDConsent, ar as useFFIDConsentPreferences, as as writeConsentCookie, at as writeConsentDismissalTimestamp } from './FFIDCookieLink-DrF5UXkd.cjs';
+import { F as FFIDSubscriptionStatus, a as FFIDPrompt, b as FFIDConfig, c as FFIDApiResponse, d as FFIDSessionResponse, e as FFIDRedirectResult, f as FFIDError, g as FFIDSubscriptionCheckResponse, h as FFIDCheckServiceAccessParams, i as FFIDServiceAccessDecision, j as FFIDAnalyticsConfig, k as FFIDVerifyAccessTokenOptions, l as FFIDOAuthUserInfo, m as FFIDInquiryCreateParams, n as FFIDInquiryCreateResponse, o as FFIDAuthMode, p as FFIDLogger, q as FFIDCacheAdapter, r as FFIDUser, s as FFIDOrganization, t as FFIDSubscription, u as FFIDSubscriptionContextValue, E as EffectiveSubscriptionStatus, v as FFIDOAuthUserInfoSubscription, w as FFIDAnnouncementsClientConfig, L as ListAnnouncementsOptions, x as FFIDAnnouncementsApiResponse, A as AnnouncementListResponse, y as FFIDAnnouncementsLogger } from './index-CG0vObax.cjs';
+export { z as Announcement, B as AnnouncementStatus, C as AnnouncementType, D as EFFECTIVE_SUBSCRIPTION_STATUSES, G as FFIDAnnouncementBadge, H as FFIDAnnouncementList, I as FFIDAnnouncementsError, J as FFIDAnnouncementsErrorCode, K as FFIDAnnouncementsServerResponse, M as FFIDCacheConfig, N as FFIDContextValue, O as FFIDInquiryCategory, P as FFIDInquiryCategorySite2026, Q as FFIDInquiryForm, R as FFIDInquiryFormCategoryItem, S as FFIDInquiryFormClassNames, T as FFIDInquiryFormLegalLayout, U as FFIDInquiryFormOrganization, V as FFIDInquiryFormPlaceholderContext, W as FFIDInquiryFormPrefill, X as FFIDInquiryFormProps, Y as FFIDInquiryFormSubmitData, Z as FFIDInquiryFormSubmitResult, _ as FFIDJwtClaims, $ as FFIDLoginButton, a0 as FFIDOAuthTokenResponse, a1 as FFIDOAuthUserInfoMemberRole, a2 as FFIDOrganizationSwitcher, a3 as FFIDRedirectErrorCode, a4 as FFIDSeatModel, a5 as FFIDServiceAccessDenialReason, a6 as FFIDServiceAccessFailPolicy, a7 as FFIDSubscriptionBadge, a8 as FFIDTokenIntrospectionResponse, a9 as FFIDUserMenu, aa as FFID_INQUIRY_CATEGORIES, ab as FFID_INQUIRY_CATEGORIES_SITE_2026, ac as UseFFIDAnnouncementsOptions, ad as UseFFIDAnnouncementsReturn, ae as isFFIDInquiryCategorySite2026, af as useFFIDAnnouncements } from './index-CG0vObax.cjs';
+export { A as ALL_DENIED_EXCEPT_NECESSARY, i as CONSENT_COOKIE_NAME, j as CONSENT_DISMISSAL_TIMESTAMP_KEY, l as COOKIE_VERSION, D as DEFAULT_CONSENT_ERROR_MESSAGES, o as FFIDAnalyticsProvider, p as FFIDAnalyticsProviderProps, c as FFIDConsentCategories, r as FFIDConsentCategoryCode, e as FFIDConsentCategoryMetadata, w as FFIDConsentError, x as FFIDConsentErrorCode, y as FFIDConsentMergeStrategy, B as FFIDConsentMergeWarning, E as FFIDConsentMergeWarningEvent, F as FFIDConsentResult, I as FFIDConsentSource, a as FFIDConsentState, d as FFIDConsentSyncResult, M as FFIDCookieBanner, N as FFIDCookieBannerClassNames, O as FFIDCookieBannerProps, Q as FFIDCookieLink, R as FFIDCookieLinkProps, f as FFIDCookiePolicy, T as FFIDCookieSettings, U as FFIDCookieSettingsClassNames, V as FFIDCookieSettingsProps, _ as FFID_CONSENT_ERROR_CODES, ae as UseFFIDConsentPreferencesReturn, af as UseFFIDConsentReturn, ag as clearConsentDismissalTimestamp, aj as decodeConsentCookie, al as encodeConsentCookie, an as readConsentCookie, ao as readConsentDismissalTimestamp, aq as useFFIDConsent, ar as useFFIDConsentPreferences, as as writeConsentCookie, at as writeConsentDismissalTimestamp } from './FFIDCookieLink-BJgVcJyw.cjs';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode, ComponentType, FC } from 'react';
 import 'zod';
@@ -1111,6 +1111,20 @@ interface RedirectToAuthorizeOptions {
      * regardless of `authMode`.
      */
     screenHint?: typeof SCREEN_HINT_SIGNUP | 'login';
+    /**
+     * OIDC `prompt` to forward to FFID `/oauth/authorize` (#4027).
+     *
+     * - `'select_account'`: forwards `prompt=select_account` so the upstream IdP
+     *   (Google) account chooser is shown — used by {@link switchAccount} to enable
+     *   RP-initiated account switching after logout (residual upstream sessions would
+     *   otherwise auto-re-authenticate the same account).
+     * - `'login'`: forces re-authentication (FFID `/login` is shown even with an
+     *   active session).
+     *
+     * Token mode: added to the `/oauth/authorize` query. Cookie mode: forwarded as
+     * `?prompt=…` on the `/login` URL (ignored for the signup screen).
+     */
+    prompt?: FFIDPrompt;
 }
 
 /** Creates an FFID API client instance */
@@ -1120,7 +1134,12 @@ declare function createFFIDClient(config: FFIDConfig): {
     redirectToLogin: (options?: RedirectToAuthorizeOptions) => Promise<FFIDRedirectResult>;
     redirectToAuthorize: (options?: RedirectToAuthorizeOptions) => Promise<FFIDRedirectResult>;
     redirectToLogout: (postLogoutRedirectUri?: string) => FFIDRedirectResult;
-    getLoginUrl: (redirectUrl?: string) => string;
+    switchAccount: (options?: {
+        organizationId?: string;
+    }) => Promise<FFIDRedirectResult>;
+    getLoginUrl: (redirectUrl?: string, options?: {
+        prompt?: FFIDPrompt;
+    }) => string;
     getLogoutUrl: (postLogoutRedirectUri?: string) => string;
     getSignupUrl: (redirectUrl?: string) => string;
     createError: (code: string, message: string) => FFIDError;
@@ -1375,12 +1394,36 @@ interface UseFFIDReturn {
      *   (forwards `screen_hint=signup` in token mode / redirects to `/signup`
      *   in cookie mode). `'login'` and `undefined` use the default login flow.
      *   See `RedirectToAuthorizeOptions` (#2908 / #2911).
+     * @param options.prompt OIDC `prompt` forwarded to FFID `/oauth/authorize`
+     *   (e.g. `'select_account'` to force the upstream account chooser). For account
+     *   switching, prefer the dedicated {@link UseFFIDReturn.switchAccount} helper (#4027).
      */
     login: (options?: {
         screenHint?: 'signup' | 'login';
+        prompt?: FFIDPrompt;
     }) => void;
-    /** Sign out */
+    /** Sign out (client-side: clears local session via the signout API) */
     logout: () => Promise<void>;
+    /**
+     * Get the FFID SSO logout URL (RP-initiated logout). Includes `client_id` for
+     * `post_logout_redirect_uri` validation. Use for cross-origin browser navigation
+     * that must clear the SSO session cookie (#4027).
+     */
+    getLogoutUrl: (postLogoutRedirectUri?: string) => string;
+    /**
+     * Redirect to the FFID SSO logout endpoint (clears the SSO session cookie via a
+     * top-level browser navigation, so SameSite=Lax cookies are sent). #4027.
+     */
+    redirectToLogout: (postLogoutRedirectUri?: string) => FFIDRedirectResult;
+    /**
+     * Switch / add account: forces the upstream Google account chooser via
+     * `prompt=select_account` so RP-initiated account switching is not silently
+     * re-authenticated against the residual upstream session. Pair with
+     * {@link UseFFIDReturn.redirectToLogout} if an explicit signed-out step is needed (#4027).
+     */
+    switchAccount: (options?: {
+        organizationId?: string;
+    }) => Promise<FFIDRedirectResult>;
     /**
      * Switch current organization.
      * Cookie mode: local state change. Token mode: OAuth re-authorization redirect.

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { F as FFIDSubscriptionStatus, a as FFIDConfig, b as FFIDApiResponse, c as FFIDSessionResponse, d as FFIDRedirectResult, e as FFIDError, f as FFIDSubscriptionCheckResponse, g as FFIDCheckServiceAccessParams, h as FFIDServiceAccessDecision, i as FFIDAnalyticsConfig, j as FFIDVerifyAccessTokenOptions, k as FFIDOAuthUserInfo, l as FFIDInquiryCreateParams, m as FFIDInquiryCreateResponse, n as FFIDAuthMode, o as FFIDLogger, p as FFIDCacheAdapter, q as FFIDUser, r as FFIDOrganization, s as FFIDSubscription, t as FFIDSubscriptionContextValue, E as EffectiveSubscriptionStatus, u as FFIDOAuthUserInfoSubscription, v as FFIDAnnouncementsClientConfig, L as ListAnnouncementsOptions, w as FFIDAnnouncementsApiResponse, A as AnnouncementListResponse, x as FFIDAnnouncementsLogger } from './index-CsVJTuPv.js';
-export { y as Announcement, z as AnnouncementStatus, B as AnnouncementType, C as EFFECTIVE_SUBSCRIPTION_STATUSES, D as FFIDAnnouncementBadge, G as FFIDAnnouncementList, H as FFIDAnnouncementsError, I as FFIDAnnouncementsErrorCode, J as FFIDAnnouncementsServerResponse, K as FFIDCacheConfig, M as FFIDContextValue, N as FFIDInquiryCategory, O as FFIDInquiryCategorySite2026, P as FFIDInquiryForm, Q as FFIDInquiryFormCategoryItem, R as FFIDInquiryFormClassNames, S as FFIDInquiryFormLegalLayout, T as FFIDInquiryFormOrganization, U as FFIDInquiryFormPlaceholderContext, V as FFIDInquiryFormPrefill, W as FFIDInquiryFormProps, X as FFIDInquiryFormSubmitData, Y as FFIDInquiryFormSubmitResult, Z as FFIDJwtClaims, _ as FFIDLoginButton, $ as FFIDOAuthTokenResponse, a0 as FFIDOAuthUserInfoMemberRole, a1 as FFIDOrganizationSwitcher, a2 as FFIDRedirectErrorCode, a3 as FFIDSeatModel, a4 as FFIDServiceAccessDenialReason, a5 as FFIDServiceAccessFailPolicy, a6 as FFIDSubscriptionBadge, a7 as FFIDTokenIntrospectionResponse, a8 as FFIDUserMenu, a9 as FFID_INQUIRY_CATEGORIES, aa as FFID_INQUIRY_CATEGORIES_SITE_2026, ab as UseFFIDAnnouncementsOptions, ac as UseFFIDAnnouncementsReturn, ad as isFFIDInquiryCategorySite2026, ae as useFFIDAnnouncements } from './index-CsVJTuPv.js';
-export { A as ALL_DENIED_EXCEPT_NECESSARY, i as CONSENT_COOKIE_NAME, j as CONSENT_DISMISSAL_TIMESTAMP_KEY, l as COOKIE_VERSION, D as DEFAULT_CONSENT_ERROR_MESSAGES, o as FFIDAnalyticsProvider, p as FFIDAnalyticsProviderProps, c as FFIDConsentCategories, r as FFIDConsentCategoryCode, e as FFIDConsentCategoryMetadata, w as FFIDConsentError, x as FFIDConsentErrorCode, y as FFIDConsentMergeStrategy, B as FFIDConsentMergeWarning, E as FFIDConsentMergeWarningEvent, F as FFIDConsentResult, I as FFIDConsentSource, a as FFIDConsentState, d as FFIDConsentSyncResult, M as FFIDCookieBanner, N as FFIDCookieBannerClassNames, O as FFIDCookieBannerProps, Q as FFIDCookieLink, R as FFIDCookieLinkProps, f as FFIDCookiePolicy, T as FFIDCookieSettings, U as FFIDCookieSettingsClassNames, V as FFIDCookieSettingsProps, _ as FFID_CONSENT_ERROR_CODES, ae as UseFFIDConsentPreferencesReturn, af as UseFFIDConsentReturn, ag as clearConsentDismissalTimestamp, aj as decodeConsentCookie, al as encodeConsentCookie, an as readConsentCookie, ao as readConsentDismissalTimestamp, aq as useFFIDConsent, ar as useFFIDConsentPreferences, as as writeConsentCookie, at as writeConsentDismissalTimestamp } from './FFIDCookieLink-DrF5UXkd.js';
+import { F as FFIDSubscriptionStatus, a as FFIDPrompt, b as FFIDConfig, c as FFIDApiResponse, d as FFIDSessionResponse, e as FFIDRedirectResult, f as FFIDError, g as FFIDSubscriptionCheckResponse, h as FFIDCheckServiceAccessParams, i as FFIDServiceAccessDecision, j as FFIDAnalyticsConfig, k as FFIDVerifyAccessTokenOptions, l as FFIDOAuthUserInfo, m as FFIDInquiryCreateParams, n as FFIDInquiryCreateResponse, o as FFIDAuthMode, p as FFIDLogger, q as FFIDCacheAdapter, r as FFIDUser, s as FFIDOrganization, t as FFIDSubscription, u as FFIDSubscriptionContextValue, E as EffectiveSubscriptionStatus, v as FFIDOAuthUserInfoSubscription, w as FFIDAnnouncementsClientConfig, L as ListAnnouncementsOptions, x as FFIDAnnouncementsApiResponse, A as AnnouncementListResponse, y as FFIDAnnouncementsLogger } from './index-CG0vObax.js';
+export { z as Announcement, B as AnnouncementStatus, C as AnnouncementType, D as EFFECTIVE_SUBSCRIPTION_STATUSES, G as FFIDAnnouncementBadge, H as FFIDAnnouncementList, I as FFIDAnnouncementsError, J as FFIDAnnouncementsErrorCode, K as FFIDAnnouncementsServerResponse, M as FFIDCacheConfig, N as FFIDContextValue, O as FFIDInquiryCategory, P as FFIDInquiryCategorySite2026, Q as FFIDInquiryForm, R as FFIDInquiryFormCategoryItem, S as FFIDInquiryFormClassNames, T as FFIDInquiryFormLegalLayout, U as FFIDInquiryFormOrganization, V as FFIDInquiryFormPlaceholderContext, W as FFIDInquiryFormPrefill, X as FFIDInquiryFormProps, Y as FFIDInquiryFormSubmitData, Z as FFIDInquiryFormSubmitResult, _ as FFIDJwtClaims, $ as FFIDLoginButton, a0 as FFIDOAuthTokenResponse, a1 as FFIDOAuthUserInfoMemberRole, a2 as FFIDOrganizationSwitcher, a3 as FFIDRedirectErrorCode, a4 as FFIDSeatModel, a5 as FFIDServiceAccessDenialReason, a6 as FFIDServiceAccessFailPolicy, a7 as FFIDSubscriptionBadge, a8 as FFIDTokenIntrospectionResponse, a9 as FFIDUserMenu, aa as FFID_INQUIRY_CATEGORIES, ab as FFID_INQUIRY_CATEGORIES_SITE_2026, ac as UseFFIDAnnouncementsOptions, ad as UseFFIDAnnouncementsReturn, ae as isFFIDInquiryCategorySite2026, af as useFFIDAnnouncements } from './index-CG0vObax.js';
+export { A as ALL_DENIED_EXCEPT_NECESSARY, i as CONSENT_COOKIE_NAME, j as CONSENT_DISMISSAL_TIMESTAMP_KEY, l as COOKIE_VERSION, D as DEFAULT_CONSENT_ERROR_MESSAGES, o as FFIDAnalyticsProvider, p as FFIDAnalyticsProviderProps, c as FFIDConsentCategories, r as FFIDConsentCategoryCode, e as FFIDConsentCategoryMetadata, w as FFIDConsentError, x as FFIDConsentErrorCode, y as FFIDConsentMergeStrategy, B as FFIDConsentMergeWarning, E as FFIDConsentMergeWarningEvent, F as FFIDConsentResult, I as FFIDConsentSource, a as FFIDConsentState, d as FFIDConsentSyncResult, M as FFIDCookieBanner, N as FFIDCookieBannerClassNames, O as FFIDCookieBannerProps, Q as FFIDCookieLink, R as FFIDCookieLinkProps, f as FFIDCookiePolicy, T as FFIDCookieSettings, U as FFIDCookieSettingsClassNames, V as FFIDCookieSettingsProps, _ as FFID_CONSENT_ERROR_CODES, ae as UseFFIDConsentPreferencesReturn, af as UseFFIDConsentReturn, ag as clearConsentDismissalTimestamp, aj as decodeConsentCookie, al as encodeConsentCookie, an as readConsentCookie, ao as readConsentDismissalTimestamp, aq as useFFIDConsent, ar as useFFIDConsentPreferences, as as writeConsentCookie, at as writeConsentDismissalTimestamp } from './FFIDCookieLink-BJgVcJyw.js';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode, ComponentType, FC } from 'react';
 import 'zod';
@@ -1111,6 +1111,20 @@ interface RedirectToAuthorizeOptions {
      * regardless of `authMode`.
      */
     screenHint?: typeof SCREEN_HINT_SIGNUP | 'login';
+    /**
+     * OIDC `prompt` to forward to FFID `/oauth/authorize` (#4027).
+     *
+     * - `'select_account'`: forwards `prompt=select_account` so the upstream IdP
+     *   (Google) account chooser is shown — used by {@link switchAccount} to enable
+     *   RP-initiated account switching after logout (residual upstream sessions would
+     *   otherwise auto-re-authenticate the same account).
+     * - `'login'`: forces re-authentication (FFID `/login` is shown even with an
+     *   active session).
+     *
+     * Token mode: added to the `/oauth/authorize` query. Cookie mode: forwarded as
+     * `?prompt=…` on the `/login` URL (ignored for the signup screen).
+     */
+    prompt?: FFIDPrompt;
 }
 
 /** Creates an FFID API client instance */
@@ -1120,7 +1134,12 @@ declare function createFFIDClient(config: FFIDConfig): {
     redirectToLogin: (options?: RedirectToAuthorizeOptions) => Promise<FFIDRedirectResult>;
     redirectToAuthorize: (options?: RedirectToAuthorizeOptions) => Promise<FFIDRedirectResult>;
     redirectToLogout: (postLogoutRedirectUri?: string) => FFIDRedirectResult;
-    getLoginUrl: (redirectUrl?: string) => string;
+    switchAccount: (options?: {
+        organizationId?: string;
+    }) => Promise<FFIDRedirectResult>;
+    getLoginUrl: (redirectUrl?: string, options?: {
+        prompt?: FFIDPrompt;
+    }) => string;
     getLogoutUrl: (postLogoutRedirectUri?: string) => string;
     getSignupUrl: (redirectUrl?: string) => string;
     createError: (code: string, message: string) => FFIDError;
@@ -1375,12 +1394,36 @@ interface UseFFIDReturn {
      *   (forwards `screen_hint=signup` in token mode / redirects to `/signup`
      *   in cookie mode). `'login'` and `undefined` use the default login flow.
      *   See `RedirectToAuthorizeOptions` (#2908 / #2911).
+     * @param options.prompt OIDC `prompt` forwarded to FFID `/oauth/authorize`
+     *   (e.g. `'select_account'` to force the upstream account chooser). For account
+     *   switching, prefer the dedicated {@link UseFFIDReturn.switchAccount} helper (#4027).
      */
     login: (options?: {
         screenHint?: 'signup' | 'login';
+        prompt?: FFIDPrompt;
     }) => void;
-    /** Sign out */
+    /** Sign out (client-side: clears local session via the signout API) */
     logout: () => Promise<void>;
+    /**
+     * Get the FFID SSO logout URL (RP-initiated logout). Includes `client_id` for
+     * `post_logout_redirect_uri` validation. Use for cross-origin browser navigation
+     * that must clear the SSO session cookie (#4027).
+     */
+    getLogoutUrl: (postLogoutRedirectUri?: string) => string;
+    /**
+     * Redirect to the FFID SSO logout endpoint (clears the SSO session cookie via a
+     * top-level browser navigation, so SameSite=Lax cookies are sent). #4027.
+     */
+    redirectToLogout: (postLogoutRedirectUri?: string) => FFIDRedirectResult;
+    /**
+     * Switch / add account: forces the upstream Google account chooser via
+     * `prompt=select_account` so RP-initiated account switching is not silently
+     * re-authenticated against the residual upstream session. Pair with
+     * {@link UseFFIDReturn.redirectToLogout} if an explicit signed-out step is needed (#4027).
+     */
+    switchAccount: (options?: {
+        organizationId?: string;
+    }) => Promise<FFIDRedirectResult>;
     /**
      * Switch current organization.
      * Cookie mode: local state change. Token mode: OAuth re-authorization redirect.

package/dist/index.js

@@ -1,6 +1,6 @@
-import { useFFIDContext, useSubscription } from './chunk-XT4BAOKZ.js';
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useSubscription, withSubscription } from './chunk-XT4BAOKZ.js';
-export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, CONSENT_DISMISSAL_TIMESTAMP_KEY, COOKIE_VERSION, DEFAULT_CONSENT_ERROR_MESSAGES, FFIDAnalyticsProvider, FFIDConsentError, FFIDCookieBanner, FFIDCookieLink, FFIDCookieSettings, FFID_CONSENT_ERROR_CODES, clearConsentDismissalTimestamp, decodeConsentCookie, encodeConsentCookie, readConsentCookie, readConsentDismissalTimestamp, useFFIDConsent, useFFIDConsentPreferences, writeConsentCookie, writeConsentDismissalTimestamp } from './chunk-HAR75DTJ.js';
+import { useFFIDContext, useSubscription } from './chunk-HLCHSKAF.js';
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useSubscription, withSubscription } from './chunk-HLCHSKAF.js';
+export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, CONSENT_DISMISSAL_TIMESTAMP_KEY, COOKIE_VERSION, DEFAULT_CONSENT_ERROR_MESSAGES, FFIDAnalyticsProvider, FFIDConsentError, FFIDCookieBanner, FFIDCookieLink, FFIDCookieSettings, FFID_CONSENT_ERROR_CODES, clearConsentDismissalTimestamp, decodeConsentCookie, encodeConsentCookie, readConsentCookie, readConsentDismissalTimestamp, useFFIDConsent, useFFIDConsentPreferences, writeConsentCookie, writeConsentDismissalTimestamp } from './chunk-G7VOX64X.js';
 import { useEffect, useRef } from 'react';
 import { jsx, Fragment } from 'react/jsx-runtime';
 

package/dist/server/index.cjs

@@ -1090,7 +1090,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.16.1";
+var SDK_VERSION = "5.17.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1841,6 +1841,9 @@ function createRedirectMethods(deps) {
     if (options?.screenHint === SCREEN_HINT_SIGNUP) {
       params.set(SCREEN_HINT_PARAM, SCREEN_HINT_SIGNUP);
     }
+    if (options?.prompt) {
+      params.set("prompt", options.prompt);
+    }
     const authorizeUrl = `${baseUrl}${OAUTH_AUTHORIZE_ENDPOINT}?${params.toString()}`;
     logger.debug("Redirecting to authorize:", authorizeUrl);
     recordRedirectAttempt(authorizeKey, now, logger);
@@ -1860,12 +1863,12 @@ function createRedirectMethods(deps) {
     if (authMode === "token") {
       return redirectToAuthorize(options);
     }
-    const targetUrl = options?.screenHint === SCREEN_HINT_SIGNUP ? getSignupUrl() : getLoginUrl();
+    const targetUrl = options?.screenHint === SCREEN_HINT_SIGNUP ? getSignupUrl() : getLoginUrl(void 0, options?.prompt ? { prompt: options.prompt } : void 0);
     logger.debug("Redirecting to auth page:", targetUrl);
     window.location.href = targetUrl;
     return { success: true };
   }
-  function getLoginUrl(redirectUrl) {
+  function getLoginUrl(redirectUrl, options) {
     let redirect;
     if (redirectUrl != null) {
       redirect = redirectUrl;
@@ -1875,7 +1878,8 @@ function createRedirectMethods(deps) {
       logger.warn("getLoginUrl: SSR \u74B0\u5883\u3067 redirectUrl \u304C\u672A\u6307\u5B9A\u306E\u305F\u3081\u7A7A\u6587\u5B57\u306B\u30D5\u30A9\u30FC\u30EB\u30D0\u30C3\u30AF\u3057\u307E\u3059");
       redirect = "";
     }
-    return `${baseUrl}/login?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}`;
+    const promptSuffix = options?.prompt ? `&prompt=${encodeURIComponent(options.prompt)}` : "";
+    return `${baseUrl}/login?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}${promptSuffix}`;
   }
   function getSignupUrl(redirectUrl) {
     let redirect;
@@ -1907,7 +1911,10 @@ function createRedirectMethods(deps) {
     window.location.href = logoutUrl;
     return { success: true };
   }
-  return { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout };
+  async function switchAccount(options) {
+    return redirectToLogin({ ...options, prompt: "select_account" });
+  }
+  return { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout, switchAccount };
 }
 
 // src/client/redirect-uri.ts
@@ -2806,7 +2813,7 @@ function createFFIDClient(config) {
     }
     return signOutCookie();
   }
-  const { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout } = createRedirectMethods({
+  const { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout, switchAccount } = createRedirectMethods({
     authMode,
     baseUrl,
     clientId,
@@ -3000,6 +3007,7 @@ function createFFIDClient(config) {
     redirectToLogin,
     redirectToAuthorize,
     redirectToLogout,
+    switchAccount,
     getLoginUrl,
     getLogoutUrl,
     getSignupUrl,

package/dist/server/index.d.cts

@@ -1,5 +1,5 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-CKFxY60u.cjs';
-export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDRemoveMemberResponse, x as FFIDResetSessionResponse, y as FFIDSubscription, z as FFIDUpdateMemberRoleResponse, A as FFIDUpdateUserProfileRequest, B as FFIDUser, C as FFIDUserProfile, T as TokenData, D as TokenStore, E as createFFIDClient, G as createTokenStore } from '../ffid-client-CKFxY60u.cjs';
+import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-DZEK3tkP.cjs';
+export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDRemoveMemberResponse, x as FFIDResetSessionResponse, y as FFIDSubscription, z as FFIDUpdateMemberRoleResponse, A as FFIDUpdateUserProfileRequest, B as FFIDUser, C as FFIDUserProfile, T as TokenData, D as TokenStore, E as createFFIDClient, G as createTokenStore } from '../ffid-client-DZEK3tkP.cjs';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-D61jqRIO.cjs';
 import { z } from 'zod';
 import '../types-BeVl-z12.cjs';

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-9-lh0G_h.js';
-export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDRemoveMemberResponse, x as FFIDResetSessionResponse, y as FFIDSubscription, z as FFIDUpdateMemberRoleResponse, A as FFIDUpdateUserProfileRequest, B as FFIDUser, C as FFIDUserProfile, T as TokenData, D as TokenStore, E as createFFIDClient, G as createTokenStore } from '../ffid-client-9-lh0G_h.js';
+import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-BtS84epg.js';
+export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDRemoveMemberResponse, x as FFIDResetSessionResponse, y as FFIDSubscription, z as FFIDUpdateMemberRoleResponse, A as FFIDUpdateUserProfileRequest, B as FFIDUser, C as FFIDUserProfile, T as TokenData, D as TokenStore, E as createFFIDClient, G as createTokenStore } from '../ffid-client-BtS84epg.js';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-D61jqRIO.js';
 import { z } from 'zod';
 import '../types-BeVl-z12.js';

package/dist/server/index.js

@@ -1089,7 +1089,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.16.1";
+var SDK_VERSION = "5.17.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1840,6 +1840,9 @@ function createRedirectMethods(deps) {
     if (options?.screenHint === SCREEN_HINT_SIGNUP) {
       params.set(SCREEN_HINT_PARAM, SCREEN_HINT_SIGNUP);
     }
+    if (options?.prompt) {
+      params.set("prompt", options.prompt);
+    }
     const authorizeUrl = `${baseUrl}${OAUTH_AUTHORIZE_ENDPOINT}?${params.toString()}`;
     logger.debug("Redirecting to authorize:", authorizeUrl);
     recordRedirectAttempt(authorizeKey, now, logger);
@@ -1859,12 +1862,12 @@ function createRedirectMethods(deps) {
     if (authMode === "token") {
       return redirectToAuthorize(options);
     }
-    const targetUrl = options?.screenHint === SCREEN_HINT_SIGNUP ? getSignupUrl() : getLoginUrl();
+    const targetUrl = options?.screenHint === SCREEN_HINT_SIGNUP ? getSignupUrl() : getLoginUrl(void 0, options?.prompt ? { prompt: options.prompt } : void 0);
     logger.debug("Redirecting to auth page:", targetUrl);
     window.location.href = targetUrl;
     return { success: true };
   }
-  function getLoginUrl(redirectUrl) {
+  function getLoginUrl(redirectUrl, options) {
     let redirect;
     if (redirectUrl != null) {
       redirect = redirectUrl;
@@ -1874,7 +1877,8 @@ function createRedirectMethods(deps) {
       logger.warn("getLoginUrl: SSR \u74B0\u5883\u3067 redirectUrl \u304C\u672A\u6307\u5B9A\u306E\u305F\u3081\u7A7A\u6587\u5B57\u306B\u30D5\u30A9\u30FC\u30EB\u30D0\u30C3\u30AF\u3057\u307E\u3059");
       redirect = "";
     }
-    return `${baseUrl}/login?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}`;
+    const promptSuffix = options?.prompt ? `&prompt=${encodeURIComponent(options.prompt)}` : "";
+    return `${baseUrl}/login?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}${promptSuffix}`;
   }
   function getSignupUrl(redirectUrl) {
     let redirect;
@@ -1906,7 +1910,10 @@ function createRedirectMethods(deps) {
     window.location.href = logoutUrl;
     return { success: true };
   }
-  return { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout };
+  async function switchAccount(options) {
+    return redirectToLogin({ ...options, prompt: "select_account" });
+  }
+  return { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout, switchAccount };
 }
 
 // src/client/redirect-uri.ts
@@ -2805,7 +2812,7 @@ function createFFIDClient(config) {
     }
     return signOutCookie();
   }
-  const { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout } = createRedirectMethods({
+  const { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout, switchAccount } = createRedirectMethods({
     authMode,
     baseUrl,
     clientId,
@@ -2999,6 +3006,7 @@ function createFFIDClient(config) {
     redirectToLogin,
     redirectToAuthorize,
     redirectToLogout,
+    switchAccount,
     getLoginUrl,
     getLogoutUrl,
     getSignupUrl,

package/dist/server/test/index.d.cts

@@ -1,4 +1,4 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-CKFxY60u.cjs';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-DZEK3tkP.cjs';
 import '../../types-BeVl-z12.cjs';
 
 /**

package/dist/server/test/index.d.ts

@@ -1,4 +1,4 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-9-lh0G_h.js';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-BtS84epg.js';
 import '../../types-BeVl-z12.js';
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feelflow/ffid-sdk",
-  "version": "5.16.1",
+  "version": "5.17.0",
   "description": "FeelFlow ID Platform SDK for React/Next.js applications",
   "keywords": [
     "feelflow",