@feelflow/ffid-sdk 5.16.2 → 5.17.1

package/dist/{chunk-C7PURRNI.js → chunk-26X62P76.js}

@@ -115,10 +115,13 @@ function hasOwnKey(value, key) {
 function normalizeUserinfo(raw) {
   const hasOrganizationId = hasOwnKey(raw, "organization_id");
   const hasOrganizationName = hasOwnKey(raw, "organization_name");
-  const organizationFields = hasOrganizationId ? {
-    organizationId: raw.organization_id ?? null,
-    organizationName: hasOrganizationName ? raw.organization_name ?? null : null
-  } : hasOrganizationName ? { organizationName: raw.organization_name ?? null } : {};
+  const hasOrganizationMemberRole = hasOwnKey(raw, "organization_member_role");
+  const organizationMemberRole = hasOrganizationMemberRole ? raw.organization_member_role ?? null : raw.subscription ? raw.subscription.member_role ?? null : void 0;
+  const organizationFields = {
+    ...hasOrganizationId ? { organizationId: raw.organization_id ?? null } : {},
+    ...hasOrganizationId || hasOrganizationName ? { organizationName: raw.organization_name ?? null } : {},
+    ...organizationMemberRole !== void 0 ? { organizationMemberRole } : {}
+  };
   return {
     sub: raw.sub,
     email: raw.email,
@@ -1093,7 +1096,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.16.2";
+var SDK_VERSION = "5.17.1";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1939,6 +1942,9 @@ function createRedirectMethods(deps) {
     if (options?.screenHint === SCREEN_HINT_SIGNUP) {
       params.set(SCREEN_HINT_PARAM, SCREEN_HINT_SIGNUP);
     }
+    if (options?.prompt) {
+      params.set("prompt", options.prompt);
+    }
     const authorizeUrl = `${baseUrl}${OAUTH_AUTHORIZE_ENDPOINT}?${params.toString()}`;
     logger.debug("Redirecting to authorize:", authorizeUrl);
     recordRedirectAttempt(authorizeKey, now, logger);
@@ -1958,12 +1964,12 @@ function createRedirectMethods(deps) {
     if (authMode === "token") {
       return redirectToAuthorize(options);
     }
-    const targetUrl = options?.screenHint === SCREEN_HINT_SIGNUP ? getSignupUrl() : getLoginUrl();
+    const targetUrl = options?.screenHint === SCREEN_HINT_SIGNUP ? getSignupUrl() : getLoginUrl(void 0, options?.prompt ? { prompt: options.prompt } : void 0);
     logger.debug("Redirecting to auth page:", targetUrl);
     window.location.href = targetUrl;
     return { success: true };
   }
-  function getLoginUrl(redirectUrl) {
+  function getLoginUrl(redirectUrl, options) {
     let redirect;
     if (redirectUrl != null) {
       redirect = redirectUrl;
@@ -1973,7 +1979,8 @@ function createRedirectMethods(deps) {
       logger.warn("getLoginUrl: SSR \u74B0\u5883\u3067 redirectUrl \u304C\u672A\u6307\u5B9A\u306E\u305F\u3081\u7A7A\u6587\u5B57\u306B\u30D5\u30A9\u30FC\u30EB\u30D0\u30C3\u30AF\u3057\u307E\u3059");
       redirect = "";
     }
-    return `${baseUrl}/login?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}`;
+    const promptSuffix = options?.prompt ? `&prompt=${encodeURIComponent(options.prompt)}` : "";
+    return `${baseUrl}/login?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}${promptSuffix}`;
   }
   function getSignupUrl(redirectUrl) {
     let redirect;
@@ -2005,7 +2012,10 @@ function createRedirectMethods(deps) {
     window.location.href = logoutUrl;
     return { success: true };
   }
-  return { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout };
+  async function switchAccount(options) {
+    return redirectToLogin({ ...options, prompt: "select_account" });
+  }
+  return { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout, switchAccount };
 }
 
 // src/client/redirect-uri.ts
@@ -2979,7 +2989,7 @@ function createFFIDClient(config) {
     }
     return signOutCookie();
   }
-  const { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout } = createRedirectMethods({
+  const { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout, switchAccount } = createRedirectMethods({
     authMode,
     baseUrl,
     clientId,
@@ -3173,6 +3183,7 @@ function createFFIDClient(config) {
     redirectToLogin,
     redirectToAuthorize,
     redirectToLogout,
+    switchAccount,
     getLoginUrl,
     getLogoutUrl,
     getSignupUrl,
@@ -3629,6 +3640,9 @@ function useFFID() {
     error: context.error,
     login: context.login,
     logout: context.logout,
+    getLogoutUrl: client.getLogoutUrl,
+    redirectToLogout: client.redirectToLogout,
+    switchAccount: client.switchAccount,
     switchOrganization: context.switchOrganization,
     refresh: context.refresh,
     getLoginUrl: client.getLoginUrl,

package/dist/{chunk-FLLTPPUP.cjs → chunk-A2KK6L63.cjs}

@@ -117,10 +117,13 @@ function hasOwnKey(value, key) {
 function normalizeUserinfo(raw) {
   const hasOrganizationId = hasOwnKey(raw, "organization_id");
   const hasOrganizationName = hasOwnKey(raw, "organization_name");
-  const organizationFields = hasOrganizationId ? {
-    organizationId: raw.organization_id ?? null,
-    organizationName: hasOrganizationName ? raw.organization_name ?? null : null
-  } : hasOrganizationName ? { organizationName: raw.organization_name ?? null } : {};
+  const hasOrganizationMemberRole = hasOwnKey(raw, "organization_member_role");
+  const organizationMemberRole = hasOrganizationMemberRole ? raw.organization_member_role ?? null : raw.subscription ? raw.subscription.member_role ?? null : void 0;
+  const organizationFields = {
+    ...hasOrganizationId ? { organizationId: raw.organization_id ?? null } : {},
+    ...hasOrganizationId || hasOrganizationName ? { organizationName: raw.organization_name ?? null } : {},
+    ...organizationMemberRole !== void 0 ? { organizationMemberRole } : {}
+  };
   return {
     sub: raw.sub,
     email: raw.email,
@@ -1095,7 +1098,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.16.2";
+var SDK_VERSION = "5.17.1";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1941,6 +1944,9 @@ function createRedirectMethods(deps) {
     if (options?.screenHint === SCREEN_HINT_SIGNUP) {
       params.set(SCREEN_HINT_PARAM, SCREEN_HINT_SIGNUP);
     }
+    if (options?.prompt) {
+      params.set("prompt", options.prompt);
+    }
     const authorizeUrl = `${baseUrl}${OAUTH_AUTHORIZE_ENDPOINT}?${params.toString()}`;
     logger.debug("Redirecting to authorize:", authorizeUrl);
     recordRedirectAttempt(authorizeKey, now, logger);
@@ -1960,12 +1966,12 @@ function createRedirectMethods(deps) {
     if (authMode === "token") {
       return redirectToAuthorize(options);
     }
-    const targetUrl = options?.screenHint === SCREEN_HINT_SIGNUP ? getSignupUrl() : getLoginUrl();
+    const targetUrl = options?.screenHint === SCREEN_HINT_SIGNUP ? getSignupUrl() : getLoginUrl(void 0, options?.prompt ? { prompt: options.prompt } : void 0);
     logger.debug("Redirecting to auth page:", targetUrl);
     window.location.href = targetUrl;
     return { success: true };
   }
-  function getLoginUrl(redirectUrl) {
+  function getLoginUrl(redirectUrl, options) {
     let redirect;
     if (redirectUrl != null) {
       redirect = redirectUrl;
@@ -1975,7 +1981,8 @@ function createRedirectMethods(deps) {
       logger.warn("getLoginUrl: SSR \u74B0\u5883\u3067 redirectUrl \u304C\u672A\u6307\u5B9A\u306E\u305F\u3081\u7A7A\u6587\u5B57\u306B\u30D5\u30A9\u30FC\u30EB\u30D0\u30C3\u30AF\u3057\u307E\u3059");
       redirect = "";
     }
-    return `${baseUrl}/login?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}`;
+    const promptSuffix = options?.prompt ? `&prompt=${encodeURIComponent(options.prompt)}` : "";
+    return `${baseUrl}/login?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}${promptSuffix}`;
   }
   function getSignupUrl(redirectUrl) {
     let redirect;
@@ -2007,7 +2014,10 @@ function createRedirectMethods(deps) {
     window.location.href = logoutUrl;
     return { success: true };
   }
-  return { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout };
+  async function switchAccount(options) {
+    return redirectToLogin({ ...options, prompt: "select_account" });
+  }
+  return { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout, switchAccount };
 }
 
 // src/client/redirect-uri.ts
@@ -2981,7 +2991,7 @@ function createFFIDClient(config) {
     }
     return signOutCookie();
   }
-  const { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout } = createRedirectMethods({
+  const { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout, switchAccount } = createRedirectMethods({
     authMode,
     baseUrl,
     clientId,
@@ -3175,6 +3185,7 @@ function createFFIDClient(config) {
     redirectToLogin,
     redirectToAuthorize,
     redirectToLogout,
+    switchAccount,
     getLoginUrl,
     getLogoutUrl,
     getSignupUrl,
@@ -3631,6 +3642,9 @@ function useFFID() {
     error: context.error,
     login: context.login,
     logout: context.logout,
+    getLogoutUrl: client.getLogoutUrl,
+    redirectToLogout: client.redirectToLogout,
+    switchAccount: client.switchAccount,
     switchOrganization: context.switchOrganization,
     refresh: context.refresh,
     getLoginUrl: client.getLoginUrl,

package/dist/components/index.cjs

@@ -1,34 +1,34 @@
 'use strict';
 
-var chunkFLLTPPUP_cjs = require('../chunk-FLLTPPUP.cjs');
+var chunkA2KK6L63_cjs = require('../chunk-A2KK6L63.cjs');
 
 
 
 Object.defineProperty(exports, "FFIDAnnouncementBadge", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFIDAnnouncementBadge; }
+  get: function () { return chunkA2KK6L63_cjs.FFIDAnnouncementBadge; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementList", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFIDAnnouncementList; }
+  get: function () { return chunkA2KK6L63_cjs.FFIDAnnouncementList; }
 });
 Object.defineProperty(exports, "FFIDInquiryForm", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFIDInquiryForm; }
+  get: function () { return chunkA2KK6L63_cjs.FFIDInquiryForm; }
 });
 Object.defineProperty(exports, "FFIDLoginButton", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFIDLoginButton; }
+  get: function () { return chunkA2KK6L63_cjs.FFIDLoginButton; }
 });
 Object.defineProperty(exports, "FFIDOrganizationSwitcher", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFIDOrganizationSwitcher; }
+  get: function () { return chunkA2KK6L63_cjs.FFIDOrganizationSwitcher; }
 });
 Object.defineProperty(exports, "FFIDSubscriptionBadge", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFIDSubscriptionBadge; }
+  get: function () { return chunkA2KK6L63_cjs.FFIDSubscriptionBadge; }
 });
 Object.defineProperty(exports, "FFIDUserMenu", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFIDUserMenu; }
+  get: function () { return chunkA2KK6L63_cjs.FFIDUserMenu; }
 });

package/dist/components/index.d.cts

@@ -1,3 +1,3 @@
-export { D as FFIDAnnouncementBadge, af as FFIDAnnouncementBadgeClassNames, ag as FFIDAnnouncementBadgeProps, G as FFIDAnnouncementList, ah as FFIDAnnouncementListClassNames, ai as FFIDAnnouncementListProps, P as FFIDInquiryForm, Q as FFIDInquiryFormCategoryItem, R as FFIDInquiryFormClassNames, S as FFIDInquiryFormLegalLayout, T as FFIDInquiryFormOrganization, U as FFIDInquiryFormPlaceholderContext, V as FFIDInquiryFormPrefill, W as FFIDInquiryFormProps, X as FFIDInquiryFormSubmitData, Y as FFIDInquiryFormSubmitResult, _ as FFIDLoginButton, aj as FFIDLoginButtonProps, a1 as FFIDOrganizationSwitcher, ak as FFIDOrganizationSwitcherClassNames, al as FFIDOrganizationSwitcherProps, a6 as FFIDSubscriptionBadge, am as FFIDSubscriptionBadgeClassNames, an as FFIDSubscriptionBadgeProps, a8 as FFIDUserMenu, ao as FFIDUserMenuClassNames, ap as FFIDUserMenuProps } from '../index-CsVJTuPv.cjs';
+export { G as FFIDAnnouncementBadge, ag as FFIDAnnouncementBadgeClassNames, ah as FFIDAnnouncementBadgeProps, H as FFIDAnnouncementList, ai as FFIDAnnouncementListClassNames, aj as FFIDAnnouncementListProps, Q as FFIDInquiryForm, R as FFIDInquiryFormCategoryItem, S as FFIDInquiryFormClassNames, T as FFIDInquiryFormLegalLayout, U as FFIDInquiryFormOrganization, V as FFIDInquiryFormPlaceholderContext, W as FFIDInquiryFormPrefill, X as FFIDInquiryFormProps, Y as FFIDInquiryFormSubmitData, Z as FFIDInquiryFormSubmitResult, $ as FFIDLoginButton, ak as FFIDLoginButtonProps, a2 as FFIDOrganizationSwitcher, al as FFIDOrganizationSwitcherClassNames, am as FFIDOrganizationSwitcherProps, a7 as FFIDSubscriptionBadge, an as FFIDSubscriptionBadgeClassNames, ao as FFIDSubscriptionBadgeProps, a9 as FFIDUserMenu, ap as FFIDUserMenuClassNames, aq as FFIDUserMenuProps } from '../index-Bkul-fRw.cjs';
 import 'react/jsx-runtime';
 import 'react';

package/dist/components/index.d.ts

@@ -1,3 +1,3 @@
-export { D as FFIDAnnouncementBadge, af as FFIDAnnouncementBadgeClassNames, ag as FFIDAnnouncementBadgeProps, G as FFIDAnnouncementList, ah as FFIDAnnouncementListClassNames, ai as FFIDAnnouncementListProps, P as FFIDInquiryForm, Q as FFIDInquiryFormCategoryItem, R as FFIDInquiryFormClassNames, S as FFIDInquiryFormLegalLayout, T as FFIDInquiryFormOrganization, U as FFIDInquiryFormPlaceholderContext, V as FFIDInquiryFormPrefill, W as FFIDInquiryFormProps, X as FFIDInquiryFormSubmitData, Y as FFIDInquiryFormSubmitResult, _ as FFIDLoginButton, aj as FFIDLoginButtonProps, a1 as FFIDOrganizationSwitcher, ak as FFIDOrganizationSwitcherClassNames, al as FFIDOrganizationSwitcherProps, a6 as FFIDSubscriptionBadge, am as FFIDSubscriptionBadgeClassNames, an as FFIDSubscriptionBadgeProps, a8 as FFIDUserMenu, ao as FFIDUserMenuClassNames, ap as FFIDUserMenuProps } from '../index-CsVJTuPv.js';
+export { G as FFIDAnnouncementBadge, ag as FFIDAnnouncementBadgeClassNames, ah as FFIDAnnouncementBadgeProps, H as FFIDAnnouncementList, ai as FFIDAnnouncementListClassNames, aj as FFIDAnnouncementListProps, Q as FFIDInquiryForm, R as FFIDInquiryFormCategoryItem, S as FFIDInquiryFormClassNames, T as FFIDInquiryFormLegalLayout, U as FFIDInquiryFormOrganization, V as FFIDInquiryFormPlaceholderContext, W as FFIDInquiryFormPrefill, X as FFIDInquiryFormProps, Y as FFIDInquiryFormSubmitData, Z as FFIDInquiryFormSubmitResult, $ as FFIDLoginButton, ak as FFIDLoginButtonProps, a2 as FFIDOrganizationSwitcher, al as FFIDOrganizationSwitcherClassNames, am as FFIDOrganizationSwitcherProps, a7 as FFIDSubscriptionBadge, an as FFIDSubscriptionBadgeClassNames, ao as FFIDSubscriptionBadgeProps, a9 as FFIDUserMenu, ap as FFIDUserMenuClassNames, aq as FFIDUserMenuProps } from '../index-Bkul-fRw.js';
 import 'react/jsx-runtime';
 import 'react';

package/dist/components/index.js

@@ -1 +1 @@
-export { FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDSubscriptionBadge, FFIDUserMenu } from '../chunk-C7PURRNI.js';
+export { FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDSubscriptionBadge, FFIDUserMenu } from '../chunk-26X62P76.js';

package/dist/{ffid-client-CKFxY60u.d.cts → ffid-client-Cwk6cG3b.d.cts}

@@ -1240,10 +1240,12 @@ interface FFIDOAuthUserInfoSubscription {
 /**
  * Unified user-identity shape returned by `getSession()` (→ `/oauth/userinfo`)
  * and `verifyAccessToken()` (JWT or introspect path). `subscription`,
- * `organizationId`, and `organizationName` are scope-gated on `/oauth/userinfo`
- * (FFID #3380, requires `subscription:read`); JWT-only verify additionally
- * omits `subscription` and `organizationName` when `includeProfile` is false
- * because the JWT has `org_id` but no `org_name` claim.
+ * `organizationId`, `organizationName`, and `organizationMemberRole` are
+ * scope-gated on `/oauth/userinfo` (FFID #3380 / #4060, requires
+ * `subscription:read`); JWT verification without `includeProfile`
+ * additionally omits `subscription`, `organizationName`, and
+ * `organizationMemberRole` because the JWT has `org_id` but no `org_name`
+ * or membership-role claim.
  * See per-field JSDoc — misreading `undefined` is a security regression.
  */
 interface FFIDOAuthUserInfo {
@@ -1280,6 +1282,19 @@ interface FFIDOAuthUserInfo {
      * claim.
      */
     organizationName?: string | null | undefined;
+    /**
+     * Organization membership role, `null` if FFID cannot resolve a role for the
+     * selected organization, or `undefined` if the granted scope omits
+     * `subscription:read` on `/oauth/userinfo` (FFID #4060), or if the caller
+     * used JWT verification without `includeProfile`. JWT payloads carry
+     * `org_id` but no membership-role claim.
+     *
+     * This duplicates `subscription.memberRole` at the top level so consumers can
+     * sync `(organizationId, organizationMemberRole)` without unpacking the full
+     * subscription blob. Older FFID responses that omit the top-level wire field
+     * are normalized from `subscription.member_role` when available.
+     */
+    organizationMemberRole?: FFIDOAuthUserInfoMemberRole | null | undefined;
     /**
      * Subscription summary for `(user, service, organization)`. Branch on
      * `effectiveStatus` (5.3.0+) for access decisions.
@@ -1380,6 +1395,14 @@ interface FFIDConfig {
      */
     timeout?: number | undefined;
 }
+/**
+ * OIDC `prompt` values the SDK forwards to FFID `/oauth/authorize` (#4027).
+ *
+ * - `select_account`: force the upstream IdP (Google) account chooser so RP-initiated
+ *   account switching is not silently re-authenticated against the residual session.
+ * - `login`: force re-authentication (FFID `/login` is shown even with an active session).
+ */
+type FFIDPrompt = 'select_account' | 'login';
 /**
  * Logger interface for SDK debug output
  *
@@ -1653,6 +1676,20 @@ interface RedirectToAuthorizeOptions {
      * regardless of `authMode`.
      */
     screenHint?: typeof SCREEN_HINT_SIGNUP | 'login';
+    /**
+     * OIDC `prompt` to forward to FFID `/oauth/authorize` (#4027).
+     *
+     * - `'select_account'`: forwards `prompt=select_account` so the upstream IdP
+     *   (Google) account chooser is shown — used by {@link switchAccount} to enable
+     *   RP-initiated account switching after logout (residual upstream sessions would
+     *   otherwise auto-re-authenticate the same account).
+     * - `'login'`: forces re-authentication (FFID `/login` is shown even with an
+     *   active session).
+     *
+     * Token mode: added to the `/oauth/authorize` query. Cookie mode: forwarded as
+     * `?prompt=…` on the `/login` URL (ignored for the signup screen).
+     */
+    prompt?: FFIDPrompt;
 }
 
 /** Creates an FFID API client instance */
@@ -1662,7 +1699,12 @@ declare function createFFIDClient(config: FFIDConfig): {
     redirectToLogin: (options?: RedirectToAuthorizeOptions) => Promise<FFIDRedirectResult>;
     redirectToAuthorize: (options?: RedirectToAuthorizeOptions) => Promise<FFIDRedirectResult>;
     redirectToLogout: (postLogoutRedirectUri?: string) => FFIDRedirectResult;
-    getLoginUrl: (redirectUrl?: string) => string;
+    switchAccount: (options?: {
+        organizationId?: string;
+    }) => Promise<FFIDRedirectResult>;
+    getLoginUrl: (redirectUrl?: string, options?: {
+        prompt?: FFIDPrompt;
+    }) => string;
     getLogoutUrl: (postLogoutRedirectUri?: string) => string;
     getSignupUrl: (redirectUrl?: string) => string;
     createError: (code: string, message: string) => FFIDError;

package/dist/{ffid-client-9-lh0G_h.d.ts → ffid-client-w8Twi5lD.d.ts}

@@ -1240,10 +1240,12 @@ interface FFIDOAuthUserInfoSubscription {
 /**
  * Unified user-identity shape returned by `getSession()` (→ `/oauth/userinfo`)
  * and `verifyAccessToken()` (JWT or introspect path). `subscription`,
- * `organizationId`, and `organizationName` are scope-gated on `/oauth/userinfo`
- * (FFID #3380, requires `subscription:read`); JWT-only verify additionally
- * omits `subscription` and `organizationName` when `includeProfile` is false
- * because the JWT has `org_id` but no `org_name` claim.
+ * `organizationId`, `organizationName`, and `organizationMemberRole` are
+ * scope-gated on `/oauth/userinfo` (FFID #3380 / #4060, requires
+ * `subscription:read`); JWT verification without `includeProfile`
+ * additionally omits `subscription`, `organizationName`, and
+ * `organizationMemberRole` because the JWT has `org_id` but no `org_name`
+ * or membership-role claim.
  * See per-field JSDoc — misreading `undefined` is a security regression.
  */
 interface FFIDOAuthUserInfo {
@@ -1280,6 +1282,19 @@ interface FFIDOAuthUserInfo {
      * claim.
      */
     organizationName?: string | null | undefined;
+    /**
+     * Organization membership role, `null` if FFID cannot resolve a role for the
+     * selected organization, or `undefined` if the granted scope omits
+     * `subscription:read` on `/oauth/userinfo` (FFID #4060), or if the caller
+     * used JWT verification without `includeProfile`. JWT payloads carry
+     * `org_id` but no membership-role claim.
+     *
+     * This duplicates `subscription.memberRole` at the top level so consumers can
+     * sync `(organizationId, organizationMemberRole)` without unpacking the full
+     * subscription blob. Older FFID responses that omit the top-level wire field
+     * are normalized from `subscription.member_role` when available.
+     */
+    organizationMemberRole?: FFIDOAuthUserInfoMemberRole | null | undefined;
     /**
      * Subscription summary for `(user, service, organization)`. Branch on
      * `effectiveStatus` (5.3.0+) for access decisions.
@@ -1380,6 +1395,14 @@ interface FFIDConfig {
      */
     timeout?: number | undefined;
 }
+/**
+ * OIDC `prompt` values the SDK forwards to FFID `/oauth/authorize` (#4027).
+ *
+ * - `select_account`: force the upstream IdP (Google) account chooser so RP-initiated
+ *   account switching is not silently re-authenticated against the residual session.
+ * - `login`: force re-authentication (FFID `/login` is shown even with an active session).
+ */
+type FFIDPrompt = 'select_account' | 'login';
 /**
  * Logger interface for SDK debug output
  *
@@ -1653,6 +1676,20 @@ interface RedirectToAuthorizeOptions {
      * regardless of `authMode`.
      */
     screenHint?: typeof SCREEN_HINT_SIGNUP | 'login';
+    /**
+     * OIDC `prompt` to forward to FFID `/oauth/authorize` (#4027).
+     *
+     * - `'select_account'`: forwards `prompt=select_account` so the upstream IdP
+     *   (Google) account chooser is shown — used by {@link switchAccount} to enable
+     *   RP-initiated account switching after logout (residual upstream sessions would
+     *   otherwise auto-re-authenticate the same account).
+     * - `'login'`: forces re-authentication (FFID `/login` is shown even with an
+     *   active session).
+     *
+     * Token mode: added to the `/oauth/authorize` query. Cookie mode: forwarded as
+     * `?prompt=…` on the `/login` URL (ignored for the signup screen).
+     */
+    prompt?: FFIDPrompt;
 }
 
 /** Creates an FFID API client instance */
@@ -1662,7 +1699,12 @@ declare function createFFIDClient(config: FFIDConfig): {
     redirectToLogin: (options?: RedirectToAuthorizeOptions) => Promise<FFIDRedirectResult>;
     redirectToAuthorize: (options?: RedirectToAuthorizeOptions) => Promise<FFIDRedirectResult>;
     redirectToLogout: (postLogoutRedirectUri?: string) => FFIDRedirectResult;
-    getLoginUrl: (redirectUrl?: string) => string;
+    switchAccount: (options?: {
+        organizationId?: string;
+    }) => Promise<FFIDRedirectResult>;
+    getLoginUrl: (redirectUrl?: string, options?: {
+        prompt?: FFIDPrompt;
+    }) => string;
     getLogoutUrl: (postLogoutRedirectUri?: string) => string;
     getSignupUrl: (redirectUrl?: string) => string;
     createError: (code: string, message: string) => FFIDError;

package/dist/{index-CsVJTuPv.d.cts → index-Bkul-fRw.d.cts}

@@ -316,10 +316,12 @@ interface FFIDOAuthUserInfoSubscription {
 /**
  * Unified user-identity shape returned by `getSession()` (→ `/oauth/userinfo`)
  * and `verifyAccessToken()` (JWT or introspect path). `subscription`,
- * `organizationId`, and `organizationName` are scope-gated on `/oauth/userinfo`
- * (FFID #3380, requires `subscription:read`); JWT-only verify additionally
- * omits `subscription` and `organizationName` when `includeProfile` is false
- * because the JWT has `org_id` but no `org_name` claim.
+ * `organizationId`, `organizationName`, and `organizationMemberRole` are
+ * scope-gated on `/oauth/userinfo` (FFID #3380 / #4060, requires
+ * `subscription:read`); JWT verification without `includeProfile`
+ * additionally omits `subscription`, `organizationName`, and
+ * `organizationMemberRole` because the JWT has `org_id` but no `org_name`
+ * or membership-role claim.
  * See per-field JSDoc — misreading `undefined` is a security regression.
  */
 interface FFIDOAuthUserInfo {
@@ -356,6 +358,19 @@ interface FFIDOAuthUserInfo {
      * claim.
      */
     organizationName?: string | null | undefined;
+    /**
+     * Organization membership role, `null` if FFID cannot resolve a role for the
+     * selected organization, or `undefined` if the granted scope omits
+     * `subscription:read` on `/oauth/userinfo` (FFID #4060), or if the caller
+     * used JWT verification without `includeProfile`. JWT payloads carry
+     * `org_id` but no membership-role claim.
+     *
+     * This duplicates `subscription.memberRole` at the top level so consumers can
+     * sync `(organizationId, organizationMemberRole)` without unpacking the full
+     * subscription blob. Older FFID responses that omit the top-level wire field
+     * are normalized from `subscription.member_role` when available.
+     */
+    organizationMemberRole?: FFIDOAuthUserInfoMemberRole | null | undefined;
     /**
      * Subscription summary for `(user, service, organization)`. Branch on
      * `effectiveStatus` (5.3.0+) for access decisions.
@@ -483,6 +498,14 @@ interface FFIDJwtClaims {
     /** Service UUID */
     svc_id: string;
 }
+/**
+ * OIDC `prompt` values the SDK forwards to FFID `/oauth/authorize` (#4027).
+ *
+ * - `select_account`: force the upstream IdP (Google) account chooser so RP-initiated
+ *   account switching is not silently re-authenticated against the residual session.
+ * - `login`: force re-authentication (FFID `/login` is shown even with an active session).
+ */
+type FFIDPrompt = 'select_account' | 'login';
 /**
  * FFID context value provided to consumers
  */
@@ -508,9 +531,14 @@ interface FFIDContextValue {
      *   (forwards `screen_hint=signup` in token mode / redirects to `/signup`
      *   in cookie mode). `'login'` and `undefined` use the default login flow.
      *   See `RedirectToAuthorizeOptions` (#2908 / #2911).
+     * @param options.prompt OIDC `prompt` to forward to FFID `/oauth/authorize`
+     *   (e.g. `'select_account'` to force the upstream account chooser). See
+     *   {@link FFIDPrompt} (#4027). Prefer {@link FFIDContextValue} consumers use
+     *   the dedicated `switchAccount()` helper on `useFFID()` for account switching.
      */
     login: (options?: {
         screenHint?: 'signup' | 'login';
+        prompt?: FFIDPrompt;
     }) => void;
     /** Sign out and clear session */
     logout: () => Promise<void>;
@@ -1448,4 +1476,4 @@ interface FFIDInquiryFormPlaceholderContext {
 }
 declare function FFIDInquiryForm({ mode, prefill, organizations, preselectedOrganizationId, categories, termsVersion, privacyVersion, termsHref, privacyHref, turnstileToken, turnstileSlot, onSubmit, onChange, legalLayout, messagePlaceholder, requireCategorySelection, unstyled, classNames, locale, className, }: FFIDInquiryFormProps): react_jsx_runtime.JSX.Element;
 
-export { type FFIDOAuthTokenResponse as $, type AnnouncementListResponse as A, type AnnouncementType as B, EFFECTIVE_SUBSCRIPTION_STATUSES as C, FFIDAnnouncementBadge as D, type EffectiveSubscriptionStatus as E, type FFIDSubscriptionStatus as F, FFIDAnnouncementList as G, type FFIDAnnouncementsError as H, type FFIDAnnouncementsErrorCode as I, type FFIDAnnouncementsServerResponse as J, type FFIDCacheConfig as K, type ListAnnouncementsOptions as L, type FFIDContextValue as M, type FFIDInquiryCategory as N, type FFIDInquiryCategorySite2026 as O, FFIDInquiryForm as P, type FFIDInquiryFormCategoryItem as Q, type FFIDInquiryFormClassNames as R, type FFIDInquiryFormLegalLayout as S, type FFIDInquiryFormOrganization as T, type FFIDInquiryFormPlaceholderContext as U, type FFIDInquiryFormPrefill as V, type FFIDInquiryFormProps as W, type FFIDInquiryFormSubmitData as X, type FFIDInquiryFormSubmitResult as Y, type FFIDJwtClaims as Z, FFIDLoginButton as _, type FFIDConfig as a, type FFIDOAuthUserInfoMemberRole as a0, FFIDOrganizationSwitcher as a1, type FFIDRedirectErrorCode as a2, type FFIDSeatModel as a3, type FFIDServiceAccessDenialReason as a4, type FFIDServiceAccessFailPolicy as a5, FFIDSubscriptionBadge as a6, type FFIDTokenIntrospectionResponse as a7, FFIDUserMenu as a8, FFID_INQUIRY_CATEGORIES as a9, FFID_INQUIRY_CATEGORIES_SITE_2026 as aa, type UseFFIDAnnouncementsOptions as ab, type UseFFIDAnnouncementsReturn as ac, isFFIDInquiryCategorySite2026 as ad, useFFIDAnnouncements as ae, type FFIDAnnouncementBadgeClassNames as af, type FFIDAnnouncementBadgeProps as ag, type FFIDAnnouncementListClassNames as ah, type FFIDAnnouncementListProps as ai, type FFIDLoginButtonProps as aj, type FFIDOrganizationSwitcherClassNames as ak, type FFIDOrganizationSwitcherProps as al, type FFIDSubscriptionBadgeClassNames as am, type FFIDSubscriptionBadgeProps as an, type FFIDUserMenuClassNames as ao, type FFIDUserMenuProps as ap, type FFIDApiResponse as b, type FFIDSessionResponse as c, type FFIDRedirectResult as d, type FFIDError as e, type FFIDSubscriptionCheckResponse as f, type FFIDCheckServiceAccessParams as g, type FFIDServiceAccessDecision as h, type FFIDAnalyticsConfig as i, type FFIDVerifyAccessTokenOptions as j, type FFIDOAuthUserInfo as k, type FFIDInquiryCreateParams as l, type FFIDInquiryCreateResponse as m, type FFIDAuthMode as n, type FFIDLogger as o, type FFIDCacheAdapter as p, type FFIDUser as q, type FFIDOrganization as r, type FFIDSubscription as s, type FFIDSubscriptionContextValue as t, type FFIDOAuthUserInfoSubscription as u, type FFIDAnnouncementsClientConfig as v, type FFIDAnnouncementsApiResponse as w, type FFIDAnnouncementsLogger as x, type Announcement as y, type AnnouncementStatus as z };
+export { FFIDLoginButton as $, type AnnouncementListResponse as A, type AnnouncementStatus as B, type AnnouncementType as C, EFFECTIVE_SUBSCRIPTION_STATUSES as D, type EffectiveSubscriptionStatus as E, type FFIDSubscriptionStatus as F, FFIDAnnouncementBadge as G, FFIDAnnouncementList as H, type FFIDAnnouncementsError as I, type FFIDAnnouncementsErrorCode as J, type FFIDAnnouncementsServerResponse as K, type ListAnnouncementsOptions as L, type FFIDCacheConfig as M, type FFIDContextValue as N, type FFIDInquiryCategory as O, type FFIDInquiryCategorySite2026 as P, FFIDInquiryForm as Q, type FFIDInquiryFormCategoryItem as R, type FFIDInquiryFormClassNames as S, type FFIDInquiryFormLegalLayout as T, type FFIDInquiryFormOrganization as U, type FFIDInquiryFormPlaceholderContext as V, type FFIDInquiryFormPrefill as W, type FFIDInquiryFormProps as X, type FFIDInquiryFormSubmitData as Y, type FFIDInquiryFormSubmitResult as Z, type FFIDJwtClaims as _, type FFIDPrompt as a, type FFIDOAuthTokenResponse as a0, type FFIDOAuthUserInfoMemberRole as a1, FFIDOrganizationSwitcher as a2, type FFIDRedirectErrorCode as a3, type FFIDSeatModel as a4, type FFIDServiceAccessDenialReason as a5, type FFIDServiceAccessFailPolicy as a6, FFIDSubscriptionBadge as a7, type FFIDTokenIntrospectionResponse as a8, FFIDUserMenu as a9, FFID_INQUIRY_CATEGORIES as aa, FFID_INQUIRY_CATEGORIES_SITE_2026 as ab, type UseFFIDAnnouncementsOptions as ac, type UseFFIDAnnouncementsReturn as ad, isFFIDInquiryCategorySite2026 as ae, useFFIDAnnouncements as af, type FFIDAnnouncementBadgeClassNames as ag, type FFIDAnnouncementBadgeProps as ah, type FFIDAnnouncementListClassNames as ai, type FFIDAnnouncementListProps as aj, type FFIDLoginButtonProps as ak, type FFIDOrganizationSwitcherClassNames as al, type FFIDOrganizationSwitcherProps as am, type FFIDSubscriptionBadgeClassNames as an, type FFIDSubscriptionBadgeProps as ao, type FFIDUserMenuClassNames as ap, type FFIDUserMenuProps as aq, type FFIDConfig as b, type FFIDApiResponse as c, type FFIDSessionResponse as d, type FFIDRedirectResult as e, type FFIDError as f, type FFIDSubscriptionCheckResponse as g, type FFIDCheckServiceAccessParams as h, type FFIDServiceAccessDecision as i, type FFIDAnalyticsConfig as j, type FFIDVerifyAccessTokenOptions as k, type FFIDOAuthUserInfo as l, type FFIDInquiryCreateParams as m, type FFIDInquiryCreateResponse as n, type FFIDAuthMode as o, type FFIDLogger as p, type FFIDCacheAdapter as q, type FFIDUser as r, type FFIDOrganization as s, type FFIDSubscription as t, type FFIDSubscriptionContextValue as u, type FFIDOAuthUserInfoSubscription as v, type FFIDAnnouncementsClientConfig as w, type FFIDAnnouncementsApiResponse as x, type FFIDAnnouncementsLogger as y, type Announcement as z };

package/dist/{index-CsVJTuPv.d.ts → index-Bkul-fRw.d.ts}

@@ -316,10 +316,12 @@ interface FFIDOAuthUserInfoSubscription {
 /**
  * Unified user-identity shape returned by `getSession()` (→ `/oauth/userinfo`)
  * and `verifyAccessToken()` (JWT or introspect path). `subscription`,
- * `organizationId`, and `organizationName` are scope-gated on `/oauth/userinfo`
- * (FFID #3380, requires `subscription:read`); JWT-only verify additionally
- * omits `subscription` and `organizationName` when `includeProfile` is false
- * because the JWT has `org_id` but no `org_name` claim.
+ * `organizationId`, `organizationName`, and `organizationMemberRole` are
+ * scope-gated on `/oauth/userinfo` (FFID #3380 / #4060, requires
+ * `subscription:read`); JWT verification without `includeProfile`
+ * additionally omits `subscription`, `organizationName`, and
+ * `organizationMemberRole` because the JWT has `org_id` but no `org_name`
+ * or membership-role claim.
  * See per-field JSDoc — misreading `undefined` is a security regression.
  */
 interface FFIDOAuthUserInfo {
@@ -356,6 +358,19 @@ interface FFIDOAuthUserInfo {
      * claim.
      */
     organizationName?: string | null | undefined;
+    /**
+     * Organization membership role, `null` if FFID cannot resolve a role for the
+     * selected organization, or `undefined` if the granted scope omits
+     * `subscription:read` on `/oauth/userinfo` (FFID #4060), or if the caller
+     * used JWT verification without `includeProfile`. JWT payloads carry
+     * `org_id` but no membership-role claim.
+     *
+     * This duplicates `subscription.memberRole` at the top level so consumers can
+     * sync `(organizationId, organizationMemberRole)` without unpacking the full
+     * subscription blob. Older FFID responses that omit the top-level wire field
+     * are normalized from `subscription.member_role` when available.
+     */
+    organizationMemberRole?: FFIDOAuthUserInfoMemberRole | null | undefined;
     /**
      * Subscription summary for `(user, service, organization)`. Branch on
      * `effectiveStatus` (5.3.0+) for access decisions.
@@ -483,6 +498,14 @@ interface FFIDJwtClaims {
     /** Service UUID */
     svc_id: string;
 }
+/**
+ * OIDC `prompt` values the SDK forwards to FFID `/oauth/authorize` (#4027).
+ *
+ * - `select_account`: force the upstream IdP (Google) account chooser so RP-initiated
+ *   account switching is not silently re-authenticated against the residual session.
+ * - `login`: force re-authentication (FFID `/login` is shown even with an active session).
+ */
+type FFIDPrompt = 'select_account' | 'login';
 /**
  * FFID context value provided to consumers
  */
@@ -508,9 +531,14 @@ interface FFIDContextValue {
      *   (forwards `screen_hint=signup` in token mode / redirects to `/signup`
      *   in cookie mode). `'login'` and `undefined` use the default login flow.
      *   See `RedirectToAuthorizeOptions` (#2908 / #2911).
+     * @param options.prompt OIDC `prompt` to forward to FFID `/oauth/authorize`
+     *   (e.g. `'select_account'` to force the upstream account chooser). See
+     *   {@link FFIDPrompt} (#4027). Prefer {@link FFIDContextValue} consumers use
+     *   the dedicated `switchAccount()` helper on `useFFID()` for account switching.
      */
     login: (options?: {
         screenHint?: 'signup' | 'login';
+        prompt?: FFIDPrompt;
     }) => void;
     /** Sign out and clear session */
     logout: () => Promise<void>;
@@ -1448,4 +1476,4 @@ interface FFIDInquiryFormPlaceholderContext {
 }
 declare function FFIDInquiryForm({ mode, prefill, organizations, preselectedOrganizationId, categories, termsVersion, privacyVersion, termsHref, privacyHref, turnstileToken, turnstileSlot, onSubmit, onChange, legalLayout, messagePlaceholder, requireCategorySelection, unstyled, classNames, locale, className, }: FFIDInquiryFormProps): react_jsx_runtime.JSX.Element;
 
-export { type FFIDOAuthTokenResponse as $, type AnnouncementListResponse as A, type AnnouncementType as B, EFFECTIVE_SUBSCRIPTION_STATUSES as C, FFIDAnnouncementBadge as D, type EffectiveSubscriptionStatus as E, type FFIDSubscriptionStatus as F, FFIDAnnouncementList as G, type FFIDAnnouncementsError as H, type FFIDAnnouncementsErrorCode as I, type FFIDAnnouncementsServerResponse as J, type FFIDCacheConfig as K, type ListAnnouncementsOptions as L, type FFIDContextValue as M, type FFIDInquiryCategory as N, type FFIDInquiryCategorySite2026 as O, FFIDInquiryForm as P, type FFIDInquiryFormCategoryItem as Q, type FFIDInquiryFormClassNames as R, type FFIDInquiryFormLegalLayout as S, type FFIDInquiryFormOrganization as T, type FFIDInquiryFormPlaceholderContext as U, type FFIDInquiryFormPrefill as V, type FFIDInquiryFormProps as W, type FFIDInquiryFormSubmitData as X, type FFIDInquiryFormSubmitResult as Y, type FFIDJwtClaims as Z, FFIDLoginButton as _, type FFIDConfig as a, type FFIDOAuthUserInfoMemberRole as a0, FFIDOrganizationSwitcher as a1, type FFIDRedirectErrorCode as a2, type FFIDSeatModel as a3, type FFIDServiceAccessDenialReason as a4, type FFIDServiceAccessFailPolicy as a5, FFIDSubscriptionBadge as a6, type FFIDTokenIntrospectionResponse as a7, FFIDUserMenu as a8, FFID_INQUIRY_CATEGORIES as a9, FFID_INQUIRY_CATEGORIES_SITE_2026 as aa, type UseFFIDAnnouncementsOptions as ab, type UseFFIDAnnouncementsReturn as ac, isFFIDInquiryCategorySite2026 as ad, useFFIDAnnouncements as ae, type FFIDAnnouncementBadgeClassNames as af, type FFIDAnnouncementBadgeProps as ag, type FFIDAnnouncementListClassNames as ah, type FFIDAnnouncementListProps as ai, type FFIDLoginButtonProps as aj, type FFIDOrganizationSwitcherClassNames as ak, type FFIDOrganizationSwitcherProps as al, type FFIDSubscriptionBadgeClassNames as am, type FFIDSubscriptionBadgeProps as an, type FFIDUserMenuClassNames as ao, type FFIDUserMenuProps as ap, type FFIDApiResponse as b, type FFIDSessionResponse as c, type FFIDRedirectResult as d, type FFIDError as e, type FFIDSubscriptionCheckResponse as f, type FFIDCheckServiceAccessParams as g, type FFIDServiceAccessDecision as h, type FFIDAnalyticsConfig as i, type FFIDVerifyAccessTokenOptions as j, type FFIDOAuthUserInfo as k, type FFIDInquiryCreateParams as l, type FFIDInquiryCreateResponse as m, type FFIDAuthMode as n, type FFIDLogger as o, type FFIDCacheAdapter as p, type FFIDUser as q, type FFIDOrganization as r, type FFIDSubscription as s, type FFIDSubscriptionContextValue as t, type FFIDOAuthUserInfoSubscription as u, type FFIDAnnouncementsClientConfig as v, type FFIDAnnouncementsApiResponse as w, type FFIDAnnouncementsLogger as x, type Announcement as y, type AnnouncementStatus as z };
+export { FFIDLoginButton as $, type AnnouncementListResponse as A, type AnnouncementStatus as B, type AnnouncementType as C, EFFECTIVE_SUBSCRIPTION_STATUSES as D, type EffectiveSubscriptionStatus as E, type FFIDSubscriptionStatus as F, FFIDAnnouncementBadge as G, FFIDAnnouncementList as H, type FFIDAnnouncementsError as I, type FFIDAnnouncementsErrorCode as J, type FFIDAnnouncementsServerResponse as K, type ListAnnouncementsOptions as L, type FFIDCacheConfig as M, type FFIDContextValue as N, type FFIDInquiryCategory as O, type FFIDInquiryCategorySite2026 as P, FFIDInquiryForm as Q, type FFIDInquiryFormCategoryItem as R, type FFIDInquiryFormClassNames as S, type FFIDInquiryFormLegalLayout as T, type FFIDInquiryFormOrganization as U, type FFIDInquiryFormPlaceholderContext as V, type FFIDInquiryFormPrefill as W, type FFIDInquiryFormProps as X, type FFIDInquiryFormSubmitData as Y, type FFIDInquiryFormSubmitResult as Z, type FFIDJwtClaims as _, type FFIDPrompt as a, type FFIDOAuthTokenResponse as a0, type FFIDOAuthUserInfoMemberRole as a1, FFIDOrganizationSwitcher as a2, type FFIDRedirectErrorCode as a3, type FFIDSeatModel as a4, type FFIDServiceAccessDenialReason as a5, type FFIDServiceAccessFailPolicy as a6, FFIDSubscriptionBadge as a7, type FFIDTokenIntrospectionResponse as a8, FFIDUserMenu as a9, FFID_INQUIRY_CATEGORIES as aa, FFID_INQUIRY_CATEGORIES_SITE_2026 as ab, type UseFFIDAnnouncementsOptions as ac, type UseFFIDAnnouncementsReturn as ad, isFFIDInquiryCategorySite2026 as ae, useFFIDAnnouncements as af, type FFIDAnnouncementBadgeClassNames as ag, type FFIDAnnouncementBadgeProps as ah, type FFIDAnnouncementListClassNames as ai, type FFIDAnnouncementListProps as aj, type FFIDLoginButtonProps as ak, type FFIDOrganizationSwitcherClassNames as al, type FFIDOrganizationSwitcherProps as am, type FFIDSubscriptionBadgeClassNames as an, type FFIDSubscriptionBadgeProps as ao, type FFIDUserMenuClassNames as ap, type FFIDUserMenuProps as aq, type FFIDConfig as b, type FFIDApiResponse as c, type FFIDSessionResponse as d, type FFIDRedirectResult as e, type FFIDError as f, type FFIDSubscriptionCheckResponse as g, type FFIDCheckServiceAccessParams as h, type FFIDServiceAccessDecision as i, type FFIDAnalyticsConfig as j, type FFIDVerifyAccessTokenOptions as k, type FFIDOAuthUserInfo as l, type FFIDInquiryCreateParams as m, type FFIDInquiryCreateResponse as n, type FFIDAuthMode as o, type FFIDLogger as p, type FFIDCacheAdapter as q, type FFIDUser as r, type FFIDOrganization as s, type FFIDSubscription as t, type FFIDSubscriptionContextValue as u, type FFIDOAuthUserInfoSubscription as v, type FFIDAnnouncementsClientConfig as w, type FFIDAnnouncementsApiResponse as x, type FFIDAnnouncementsLogger as y, type Announcement as z };

package/dist/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkFLLTPPUP_cjs = require('./chunk-FLLTPPUP.cjs');
+var chunkA2KK6L63_cjs = require('./chunk-A2KK6L63.cjs');
 var chunkH5O2CCAY_cjs = require('./chunk-H5O2CCAY.cjs');
 var react = require('react');
 var jsxRuntime = require('react/jsx-runtime');
@@ -54,8 +54,8 @@ function defaultRedirect(url) {
 }
 function useRequireActiveSubscription(options) {
   const { redirectTo, allowGrace = true, onRedirect } = options;
-  const { isLoading, error } = chunkFLLTPPUP_cjs.useFFIDContext();
-  const { effectiveStatus, isBlocked, isGrace } = chunkFLLTPPUP_cjs.useSubscription();
+  const { isLoading, error } = chunkA2KK6L63_cjs.useFFIDContext();
+  const { effectiveStatus, isBlocked, isGrace } = chunkA2KK6L63_cjs.useSubscription();
   const hasFetchError = error !== null && effectiveStatus === null;
   const shouldRedirect = !isLoading && !hasFetchError && (isBlocked || !allowGrace && isGrace || effectiveStatus === null);
   react.useEffect(() => {
@@ -76,7 +76,7 @@ function useRequireActiveSubscription(options) {
 }
 function withFFIDAuth(Component, options = {}) {
   const WrappedComponent = (props) => {
-    const { isLoading, isAuthenticated, login } = chunkFLLTPPUP_cjs.useFFIDContext();
+    const { isLoading, isAuthenticated, login } = chunkA2KK6L63_cjs.useFFIDContext();
     const hasRedirected = react.useRef(false);
     react.useEffect(() => {
       if (!isLoading && !isAuthenticated && options.redirectToLogin && !hasRedirected.current) {
@@ -105,151 +105,151 @@ var FFID_NEWSLETTER_DISPATCH_MAX_RECIPIENTS = 1e3;
 
 Object.defineProperty(exports, "ACCESS_GRANTING_EFFECTIVE_STATUSES", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.ACCESS_GRANTING_EFFECTIVE_STATUSES; }
+  get: function () { return chunkA2KK6L63_cjs.ACCESS_GRANTING_EFFECTIVE_STATUSES; }
 });
 Object.defineProperty(exports, "BLOCKING_EFFECTIVE_STATUSES", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.BLOCKING_EFFECTIVE_STATUSES; }
+  get: function () { return chunkA2KK6L63_cjs.BLOCKING_EFFECTIVE_STATUSES; }
 });
 Object.defineProperty(exports, "DEFAULT_API_BASE_URL", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.DEFAULT_API_BASE_URL; }
+  get: function () { return chunkA2KK6L63_cjs.DEFAULT_API_BASE_URL; }
 });
 Object.defineProperty(exports, "DEFAULT_OAUTH_SCOPES", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.DEFAULT_OAUTH_SCOPES; }
+  get: function () { return chunkA2KK6L63_cjs.DEFAULT_OAUTH_SCOPES; }
 });
 Object.defineProperty(exports, "EFFECTIVE_SUBSCRIPTION_STATUSES", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.EFFECTIVE_SUBSCRIPTION_STATUSES; }
+  get: function () { return chunkA2KK6L63_cjs.EFFECTIVE_SUBSCRIPTION_STATUSES; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementBadge", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFIDAnnouncementBadge; }
+  get: function () { return chunkA2KK6L63_cjs.FFIDAnnouncementBadge; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementList", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFIDAnnouncementList; }
+  get: function () { return chunkA2KK6L63_cjs.FFIDAnnouncementList; }
 });
 Object.defineProperty(exports, "FFIDInquiryForm", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFIDInquiryForm; }
+  get: function () { return chunkA2KK6L63_cjs.FFIDInquiryForm; }
 });
 Object.defineProperty(exports, "FFIDLoginButton", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFIDLoginButton; }
+  get: function () { return chunkA2KK6L63_cjs.FFIDLoginButton; }
 });
 Object.defineProperty(exports, "FFIDOrganizationSwitcher", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFIDOrganizationSwitcher; }
+  get: function () { return chunkA2KK6L63_cjs.FFIDOrganizationSwitcher; }
 });
 Object.defineProperty(exports, "FFIDProvider", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFIDProvider; }
+  get: function () { return chunkA2KK6L63_cjs.FFIDProvider; }
 });
 Object.defineProperty(exports, "FFIDSDKError", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFIDSDKError; }
+  get: function () { return chunkA2KK6L63_cjs.FFIDSDKError; }
 });
 Object.defineProperty(exports, "FFIDSubscriptionBadge", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFIDSubscriptionBadge; }
+  get: function () { return chunkA2KK6L63_cjs.FFIDSubscriptionBadge; }
 });
 Object.defineProperty(exports, "FFIDUserMenu", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFIDUserMenu; }
+  get: function () { return chunkA2KK6L63_cjs.FFIDUserMenu; }
 });
 Object.defineProperty(exports, "FFID_ANNOUNCEMENTS_ERROR_CODES", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFID_ANNOUNCEMENTS_ERROR_CODES; }
+  get: function () { return chunkA2KK6L63_cjs.FFID_ANNOUNCEMENTS_ERROR_CODES; }
 });
 Object.defineProperty(exports, "FFID_INQUIRY_CATEGORIES", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFID_INQUIRY_CATEGORIES; }
+  get: function () { return chunkA2KK6L63_cjs.FFID_INQUIRY_CATEGORIES; }
 });
 Object.defineProperty(exports, "FFID_INQUIRY_CATEGORIES_SITE_2026", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.FFID_INQUIRY_CATEGORIES_SITE_2026; }
+  get: function () { return chunkA2KK6L63_cjs.FFID_INQUIRY_CATEGORIES_SITE_2026; }
 });
 Object.defineProperty(exports, "clearState", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.cleanupStateStorage; }
+  get: function () { return chunkA2KK6L63_cjs.cleanupStateStorage; }
 });
 Object.defineProperty(exports, "computeEffectiveStatusFromSession", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.computeEffectiveStatusFromSession; }
+  get: function () { return chunkA2KK6L63_cjs.computeEffectiveStatusFromSession; }
 });
 Object.defineProperty(exports, "createFFIDAnnouncementsClient", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.createFFIDAnnouncementsClient; }
+  get: function () { return chunkA2KK6L63_cjs.createFFIDAnnouncementsClient; }
 });
 Object.defineProperty(exports, "createFFIDClient", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.createFFIDClient; }
+  get: function () { return chunkA2KK6L63_cjs.createFFIDClient; }
 });
 Object.defineProperty(exports, "createTokenStore", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.createTokenStore; }
+  get: function () { return chunkA2KK6L63_cjs.createTokenStore; }
 });
 Object.defineProperty(exports, "generateCodeChallenge", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.generateCodeChallenge; }
+  get: function () { return chunkA2KK6L63_cjs.generateCodeChallenge; }
 });
 Object.defineProperty(exports, "generateCodeVerifier", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.generateCodeVerifier; }
+  get: function () { return chunkA2KK6L63_cjs.generateCodeVerifier; }
 });
 Object.defineProperty(exports, "handleRedirectCallback", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.handleRedirectCallback; }
+  get: function () { return chunkA2KK6L63_cjs.handleRedirectCallback; }
 });
 Object.defineProperty(exports, "hasAccessFromUserinfo", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.hasAccessFromUserinfo; }
+  get: function () { return chunkA2KK6L63_cjs.hasAccessFromUserinfo; }
 });
 Object.defineProperty(exports, "isBlockedFromUserinfo", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.isBlockedFromUserinfo; }
+  get: function () { return chunkA2KK6L63_cjs.isBlockedFromUserinfo; }
 });
 Object.defineProperty(exports, "isFFIDInquiryCategorySite2026", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.isFFIDInquiryCategorySite2026; }
+  get: function () { return chunkA2KK6L63_cjs.isFFIDInquiryCategorySite2026; }
 });
 Object.defineProperty(exports, "normalizeRedirectUri", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.normalizeRedirectUri; }
+  get: function () { return chunkA2KK6L63_cjs.normalizeRedirectUri; }
 });
 Object.defineProperty(exports, "retrieveCodeVerifier", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.retrieveCodeVerifier; }
+  get: function () { return chunkA2KK6L63_cjs.retrieveCodeVerifier; }
 });
 Object.defineProperty(exports, "retrieveState", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.retrieveState; }
+  get: function () { return chunkA2KK6L63_cjs.retrieveState; }
 });
 Object.defineProperty(exports, "storeCodeVerifier", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.storeCodeVerifier; }
+  get: function () { return chunkA2KK6L63_cjs.storeCodeVerifier; }
 });
 Object.defineProperty(exports, "storeState", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.storeState; }
+  get: function () { return chunkA2KK6L63_cjs.storeState; }
 });
 Object.defineProperty(exports, "useFFID", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.useFFID; }
+  get: function () { return chunkA2KK6L63_cjs.useFFID; }
 });
 Object.defineProperty(exports, "useFFIDAnnouncements", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.useFFIDAnnouncements; }
+  get: function () { return chunkA2KK6L63_cjs.useFFIDAnnouncements; }
 });
 Object.defineProperty(exports, "useSubscription", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.useSubscription; }
+  get: function () { return chunkA2KK6L63_cjs.useSubscription; }
 });
 Object.defineProperty(exports, "withSubscription", {
   enumerable: true,
-  get: function () { return chunkFLLTPPUP_cjs.withSubscription; }
+  get: function () { return chunkA2KK6L63_cjs.withSubscription; }
 });
 Object.defineProperty(exports, "ALL_DENIED_EXCEPT_NECESSARY", {
   enumerable: true,

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { F as FFIDSubscriptionStatus, a as FFIDConfig, b as FFIDApiResponse, c as FFIDSessionResponse, d as FFIDRedirectResult, e as FFIDError, f as FFIDSubscriptionCheckResponse, g as FFIDCheckServiceAccessParams, h as FFIDServiceAccessDecision, i as FFIDAnalyticsConfig, j as FFIDVerifyAccessTokenOptions, k as FFIDOAuthUserInfo, l as FFIDInquiryCreateParams, m as FFIDInquiryCreateResponse, n as FFIDAuthMode, o as FFIDLogger, p as FFIDCacheAdapter, q as FFIDUser, r as FFIDOrganization, s as FFIDSubscription, t as FFIDSubscriptionContextValue, E as EffectiveSubscriptionStatus, u as FFIDOAuthUserInfoSubscription, v as FFIDAnnouncementsClientConfig, L as ListAnnouncementsOptions, w as FFIDAnnouncementsApiResponse, A as AnnouncementListResponse, x as FFIDAnnouncementsLogger } from './index-CsVJTuPv.cjs';
-export { y as Announcement, z as AnnouncementStatus, B as AnnouncementType, C as EFFECTIVE_SUBSCRIPTION_STATUSES, D as FFIDAnnouncementBadge, G as FFIDAnnouncementList, H as FFIDAnnouncementsError, I as FFIDAnnouncementsErrorCode, J as FFIDAnnouncementsServerResponse, K as FFIDCacheConfig, M as FFIDContextValue, N as FFIDInquiryCategory, O as FFIDInquiryCategorySite2026, P as FFIDInquiryForm, Q as FFIDInquiryFormCategoryItem, R as FFIDInquiryFormClassNames, S as FFIDInquiryFormLegalLayout, T as FFIDInquiryFormOrganization, U as FFIDInquiryFormPlaceholderContext, V as FFIDInquiryFormPrefill, W as FFIDInquiryFormProps, X as FFIDInquiryFormSubmitData, Y as FFIDInquiryFormSubmitResult, Z as FFIDJwtClaims, _ as FFIDLoginButton, $ as FFIDOAuthTokenResponse, a0 as FFIDOAuthUserInfoMemberRole, a1 as FFIDOrganizationSwitcher, a2 as FFIDRedirectErrorCode, a3 as FFIDSeatModel, a4 as FFIDServiceAccessDenialReason, a5 as FFIDServiceAccessFailPolicy, a6 as FFIDSubscriptionBadge, a7 as FFIDTokenIntrospectionResponse, a8 as FFIDUserMenu, a9 as FFID_INQUIRY_CATEGORIES, aa as FFID_INQUIRY_CATEGORIES_SITE_2026, ab as UseFFIDAnnouncementsOptions, ac as UseFFIDAnnouncementsReturn, ad as isFFIDInquiryCategorySite2026, ae as useFFIDAnnouncements } from './index-CsVJTuPv.cjs';
+import { F as FFIDSubscriptionStatus, a as FFIDPrompt, b as FFIDConfig, c as FFIDApiResponse, d as FFIDSessionResponse, e as FFIDRedirectResult, f as FFIDError, g as FFIDSubscriptionCheckResponse, h as FFIDCheckServiceAccessParams, i as FFIDServiceAccessDecision, j as FFIDAnalyticsConfig, k as FFIDVerifyAccessTokenOptions, l as FFIDOAuthUserInfo, m as FFIDInquiryCreateParams, n as FFIDInquiryCreateResponse, o as FFIDAuthMode, p as FFIDLogger, q as FFIDCacheAdapter, r as FFIDUser, s as FFIDOrganization, t as FFIDSubscription, u as FFIDSubscriptionContextValue, E as EffectiveSubscriptionStatus, v as FFIDOAuthUserInfoSubscription, w as FFIDAnnouncementsClientConfig, L as ListAnnouncementsOptions, x as FFIDAnnouncementsApiResponse, A as AnnouncementListResponse, y as FFIDAnnouncementsLogger } from './index-Bkul-fRw.cjs';
+export { z as Announcement, B as AnnouncementStatus, C as AnnouncementType, D as EFFECTIVE_SUBSCRIPTION_STATUSES, G as FFIDAnnouncementBadge, H as FFIDAnnouncementList, I as FFIDAnnouncementsError, J as FFIDAnnouncementsErrorCode, K as FFIDAnnouncementsServerResponse, M as FFIDCacheConfig, N as FFIDContextValue, O as FFIDInquiryCategory, P as FFIDInquiryCategorySite2026, Q as FFIDInquiryForm, R as FFIDInquiryFormCategoryItem, S as FFIDInquiryFormClassNames, T as FFIDInquiryFormLegalLayout, U as FFIDInquiryFormOrganization, V as FFIDInquiryFormPlaceholderContext, W as FFIDInquiryFormPrefill, X as FFIDInquiryFormProps, Y as FFIDInquiryFormSubmitData, Z as FFIDInquiryFormSubmitResult, _ as FFIDJwtClaims, $ as FFIDLoginButton, a0 as FFIDOAuthTokenResponse, a1 as FFIDOAuthUserInfoMemberRole, a2 as FFIDOrganizationSwitcher, a3 as FFIDRedirectErrorCode, a4 as FFIDSeatModel, a5 as FFIDServiceAccessDenialReason, a6 as FFIDServiceAccessFailPolicy, a7 as FFIDSubscriptionBadge, a8 as FFIDTokenIntrospectionResponse, a9 as FFIDUserMenu, aa as FFID_INQUIRY_CATEGORIES, ab as FFID_INQUIRY_CATEGORIES_SITE_2026, ac as UseFFIDAnnouncementsOptions, ad as UseFFIDAnnouncementsReturn, ae as isFFIDInquiryCategorySite2026, af as useFFIDAnnouncements } from './index-Bkul-fRw.cjs';
 export { A as ALL_DENIED_EXCEPT_NECESSARY, i as CONSENT_COOKIE_NAME, j as CONSENT_DISMISSAL_TIMESTAMP_KEY, l as COOKIE_VERSION, D as DEFAULT_CONSENT_ERROR_MESSAGES, o as FFIDAnalyticsProvider, p as FFIDAnalyticsProviderProps, c as FFIDConsentCategories, r as FFIDConsentCategoryCode, e as FFIDConsentCategoryMetadata, w as FFIDConsentError, x as FFIDConsentErrorCode, y as FFIDConsentMergeStrategy, B as FFIDConsentMergeWarning, E as FFIDConsentMergeWarningEvent, F as FFIDConsentResult, I as FFIDConsentSource, a as FFIDConsentState, d as FFIDConsentSyncResult, M as FFIDCookieBanner, N as FFIDCookieBannerClassNames, O as FFIDCookieBannerProps, Q as FFIDCookieLink, R as FFIDCookieLinkProps, f as FFIDCookiePolicy, T as FFIDCookieSettings, U as FFIDCookieSettingsClassNames, V as FFIDCookieSettingsProps, _ as FFID_CONSENT_ERROR_CODES, ae as UseFFIDConsentPreferencesReturn, af as UseFFIDConsentReturn, ag as clearConsentDismissalTimestamp, aj as decodeConsentCookie, al as encodeConsentCookie, an as readConsentCookie, ao as readConsentDismissalTimestamp, aq as useFFIDConsent, ar as useFFIDConsentPreferences, as as writeConsentCookie, at as writeConsentDismissalTimestamp } from './FFIDCookieLink-BJgVcJyw.cjs';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode, ComponentType, FC } from 'react';
@@ -1111,6 +1111,20 @@ interface RedirectToAuthorizeOptions {
      * regardless of `authMode`.
      */
     screenHint?: typeof SCREEN_HINT_SIGNUP | 'login';
+    /**
+     * OIDC `prompt` to forward to FFID `/oauth/authorize` (#4027).
+     *
+     * - `'select_account'`: forwards `prompt=select_account` so the upstream IdP
+     *   (Google) account chooser is shown — used by {@link switchAccount} to enable
+     *   RP-initiated account switching after logout (residual upstream sessions would
+     *   otherwise auto-re-authenticate the same account).
+     * - `'login'`: forces re-authentication (FFID `/login` is shown even with an
+     *   active session).
+     *
+     * Token mode: added to the `/oauth/authorize` query. Cookie mode: forwarded as
+     * `?prompt=…` on the `/login` URL (ignored for the signup screen).
+     */
+    prompt?: FFIDPrompt;
 }
 
 /** Creates an FFID API client instance */
@@ -1120,7 +1134,12 @@ declare function createFFIDClient(config: FFIDConfig): {
     redirectToLogin: (options?: RedirectToAuthorizeOptions) => Promise<FFIDRedirectResult>;
     redirectToAuthorize: (options?: RedirectToAuthorizeOptions) => Promise<FFIDRedirectResult>;
     redirectToLogout: (postLogoutRedirectUri?: string) => FFIDRedirectResult;
-    getLoginUrl: (redirectUrl?: string) => string;
+    switchAccount: (options?: {
+        organizationId?: string;
+    }) => Promise<FFIDRedirectResult>;
+    getLoginUrl: (redirectUrl?: string, options?: {
+        prompt?: FFIDPrompt;
+    }) => string;
     getLogoutUrl: (postLogoutRedirectUri?: string) => string;
     getSignupUrl: (redirectUrl?: string) => string;
     createError: (code: string, message: string) => FFIDError;
@@ -1375,12 +1394,36 @@ interface UseFFIDReturn {
      *   (forwards `screen_hint=signup` in token mode / redirects to `/signup`
      *   in cookie mode). `'login'` and `undefined` use the default login flow.
      *   See `RedirectToAuthorizeOptions` (#2908 / #2911).
+     * @param options.prompt OIDC `prompt` forwarded to FFID `/oauth/authorize`
+     *   (e.g. `'select_account'` to force the upstream account chooser). For account
+     *   switching, prefer the dedicated {@link UseFFIDReturn.switchAccount} helper (#4027).
      */
     login: (options?: {
         screenHint?: 'signup' | 'login';
+        prompt?: FFIDPrompt;
     }) => void;
-    /** Sign out */
+    /** Sign out (client-side: clears local session via the signout API) */
     logout: () => Promise<void>;
+    /**
+     * Get the FFID SSO logout URL (RP-initiated logout). Includes `client_id` for
+     * `post_logout_redirect_uri` validation. Use for cross-origin browser navigation
+     * that must clear the SSO session cookie (#4027).
+     */
+    getLogoutUrl: (postLogoutRedirectUri?: string) => string;
+    /**
+     * Redirect to the FFID SSO logout endpoint (clears the SSO session cookie via a
+     * top-level browser navigation, so SameSite=Lax cookies are sent). #4027.
+     */
+    redirectToLogout: (postLogoutRedirectUri?: string) => FFIDRedirectResult;
+    /**
+     * Switch / add account: forces the upstream Google account chooser via
+     * `prompt=select_account` so RP-initiated account switching is not silently
+     * re-authenticated against the residual upstream session. Pair with
+     * {@link UseFFIDReturn.redirectToLogout} if an explicit signed-out step is needed (#4027).
+     */
+    switchAccount: (options?: {
+        organizationId?: string;
+    }) => Promise<FFIDRedirectResult>;
     /**
      * Switch current organization.
      * Cookie mode: local state change. Token mode: OAuth re-authorization redirect.

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { F as FFIDSubscriptionStatus, a as FFIDConfig, b as FFIDApiResponse, c as FFIDSessionResponse, d as FFIDRedirectResult, e as FFIDError, f as FFIDSubscriptionCheckResponse, g as FFIDCheckServiceAccessParams, h as FFIDServiceAccessDecision, i as FFIDAnalyticsConfig, j as FFIDVerifyAccessTokenOptions, k as FFIDOAuthUserInfo, l as FFIDInquiryCreateParams, m as FFIDInquiryCreateResponse, n as FFIDAuthMode, o as FFIDLogger, p as FFIDCacheAdapter, q as FFIDUser, r as FFIDOrganization, s as FFIDSubscription, t as FFIDSubscriptionContextValue, E as EffectiveSubscriptionStatus, u as FFIDOAuthUserInfoSubscription, v as FFIDAnnouncementsClientConfig, L as ListAnnouncementsOptions, w as FFIDAnnouncementsApiResponse, A as AnnouncementListResponse, x as FFIDAnnouncementsLogger } from './index-CsVJTuPv.js';
-export { y as Announcement, z as AnnouncementStatus, B as AnnouncementType, C as EFFECTIVE_SUBSCRIPTION_STATUSES, D as FFIDAnnouncementBadge, G as FFIDAnnouncementList, H as FFIDAnnouncementsError, I as FFIDAnnouncementsErrorCode, J as FFIDAnnouncementsServerResponse, K as FFIDCacheConfig, M as FFIDContextValue, N as FFIDInquiryCategory, O as FFIDInquiryCategorySite2026, P as FFIDInquiryForm, Q as FFIDInquiryFormCategoryItem, R as FFIDInquiryFormClassNames, S as FFIDInquiryFormLegalLayout, T as FFIDInquiryFormOrganization, U as FFIDInquiryFormPlaceholderContext, V as FFIDInquiryFormPrefill, W as FFIDInquiryFormProps, X as FFIDInquiryFormSubmitData, Y as FFIDInquiryFormSubmitResult, Z as FFIDJwtClaims, _ as FFIDLoginButton, $ as FFIDOAuthTokenResponse, a0 as FFIDOAuthUserInfoMemberRole, a1 as FFIDOrganizationSwitcher, a2 as FFIDRedirectErrorCode, a3 as FFIDSeatModel, a4 as FFIDServiceAccessDenialReason, a5 as FFIDServiceAccessFailPolicy, a6 as FFIDSubscriptionBadge, a7 as FFIDTokenIntrospectionResponse, a8 as FFIDUserMenu, a9 as FFID_INQUIRY_CATEGORIES, aa as FFID_INQUIRY_CATEGORIES_SITE_2026, ab as UseFFIDAnnouncementsOptions, ac as UseFFIDAnnouncementsReturn, ad as isFFIDInquiryCategorySite2026, ae as useFFIDAnnouncements } from './index-CsVJTuPv.js';
+import { F as FFIDSubscriptionStatus, a as FFIDPrompt, b as FFIDConfig, c as FFIDApiResponse, d as FFIDSessionResponse, e as FFIDRedirectResult, f as FFIDError, g as FFIDSubscriptionCheckResponse, h as FFIDCheckServiceAccessParams, i as FFIDServiceAccessDecision, j as FFIDAnalyticsConfig, k as FFIDVerifyAccessTokenOptions, l as FFIDOAuthUserInfo, m as FFIDInquiryCreateParams, n as FFIDInquiryCreateResponse, o as FFIDAuthMode, p as FFIDLogger, q as FFIDCacheAdapter, r as FFIDUser, s as FFIDOrganization, t as FFIDSubscription, u as FFIDSubscriptionContextValue, E as EffectiveSubscriptionStatus, v as FFIDOAuthUserInfoSubscription, w as FFIDAnnouncementsClientConfig, L as ListAnnouncementsOptions, x as FFIDAnnouncementsApiResponse, A as AnnouncementListResponse, y as FFIDAnnouncementsLogger } from './index-Bkul-fRw.js';
+export { z as Announcement, B as AnnouncementStatus, C as AnnouncementType, D as EFFECTIVE_SUBSCRIPTION_STATUSES, G as FFIDAnnouncementBadge, H as FFIDAnnouncementList, I as FFIDAnnouncementsError, J as FFIDAnnouncementsErrorCode, K as FFIDAnnouncementsServerResponse, M as FFIDCacheConfig, N as FFIDContextValue, O as FFIDInquiryCategory, P as FFIDInquiryCategorySite2026, Q as FFIDInquiryForm, R as FFIDInquiryFormCategoryItem, S as FFIDInquiryFormClassNames, T as FFIDInquiryFormLegalLayout, U as FFIDInquiryFormOrganization, V as FFIDInquiryFormPlaceholderContext, W as FFIDInquiryFormPrefill, X as FFIDInquiryFormProps, Y as FFIDInquiryFormSubmitData, Z as FFIDInquiryFormSubmitResult, _ as FFIDJwtClaims, $ as FFIDLoginButton, a0 as FFIDOAuthTokenResponse, a1 as FFIDOAuthUserInfoMemberRole, a2 as FFIDOrganizationSwitcher, a3 as FFIDRedirectErrorCode, a4 as FFIDSeatModel, a5 as FFIDServiceAccessDenialReason, a6 as FFIDServiceAccessFailPolicy, a7 as FFIDSubscriptionBadge, a8 as FFIDTokenIntrospectionResponse, a9 as FFIDUserMenu, aa as FFID_INQUIRY_CATEGORIES, ab as FFID_INQUIRY_CATEGORIES_SITE_2026, ac as UseFFIDAnnouncementsOptions, ad as UseFFIDAnnouncementsReturn, ae as isFFIDInquiryCategorySite2026, af as useFFIDAnnouncements } from './index-Bkul-fRw.js';
 export { A as ALL_DENIED_EXCEPT_NECESSARY, i as CONSENT_COOKIE_NAME, j as CONSENT_DISMISSAL_TIMESTAMP_KEY, l as COOKIE_VERSION, D as DEFAULT_CONSENT_ERROR_MESSAGES, o as FFIDAnalyticsProvider, p as FFIDAnalyticsProviderProps, c as FFIDConsentCategories, r as FFIDConsentCategoryCode, e as FFIDConsentCategoryMetadata, w as FFIDConsentError, x as FFIDConsentErrorCode, y as FFIDConsentMergeStrategy, B as FFIDConsentMergeWarning, E as FFIDConsentMergeWarningEvent, F as FFIDConsentResult, I as FFIDConsentSource, a as FFIDConsentState, d as FFIDConsentSyncResult, M as FFIDCookieBanner, N as FFIDCookieBannerClassNames, O as FFIDCookieBannerProps, Q as FFIDCookieLink, R as FFIDCookieLinkProps, f as FFIDCookiePolicy, T as FFIDCookieSettings, U as FFIDCookieSettingsClassNames, V as FFIDCookieSettingsProps, _ as FFID_CONSENT_ERROR_CODES, ae as UseFFIDConsentPreferencesReturn, af as UseFFIDConsentReturn, ag as clearConsentDismissalTimestamp, aj as decodeConsentCookie, al as encodeConsentCookie, an as readConsentCookie, ao as readConsentDismissalTimestamp, aq as useFFIDConsent, ar as useFFIDConsentPreferences, as as writeConsentCookie, at as writeConsentDismissalTimestamp } from './FFIDCookieLink-BJgVcJyw.js';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode, ComponentType, FC } from 'react';
@@ -1111,6 +1111,20 @@ interface RedirectToAuthorizeOptions {
      * regardless of `authMode`.
      */
     screenHint?: typeof SCREEN_HINT_SIGNUP | 'login';
+    /**
+     * OIDC `prompt` to forward to FFID `/oauth/authorize` (#4027).
+     *
+     * - `'select_account'`: forwards `prompt=select_account` so the upstream IdP
+     *   (Google) account chooser is shown — used by {@link switchAccount} to enable
+     *   RP-initiated account switching after logout (residual upstream sessions would
+     *   otherwise auto-re-authenticate the same account).
+     * - `'login'`: forces re-authentication (FFID `/login` is shown even with an
+     *   active session).
+     *
+     * Token mode: added to the `/oauth/authorize` query. Cookie mode: forwarded as
+     * `?prompt=…` on the `/login` URL (ignored for the signup screen).
+     */
+    prompt?: FFIDPrompt;
 }
 
 /** Creates an FFID API client instance */
@@ -1120,7 +1134,12 @@ declare function createFFIDClient(config: FFIDConfig): {
     redirectToLogin: (options?: RedirectToAuthorizeOptions) => Promise<FFIDRedirectResult>;
     redirectToAuthorize: (options?: RedirectToAuthorizeOptions) => Promise<FFIDRedirectResult>;
     redirectToLogout: (postLogoutRedirectUri?: string) => FFIDRedirectResult;
-    getLoginUrl: (redirectUrl?: string) => string;
+    switchAccount: (options?: {
+        organizationId?: string;
+    }) => Promise<FFIDRedirectResult>;
+    getLoginUrl: (redirectUrl?: string, options?: {
+        prompt?: FFIDPrompt;
+    }) => string;
     getLogoutUrl: (postLogoutRedirectUri?: string) => string;
     getSignupUrl: (redirectUrl?: string) => string;
     createError: (code: string, message: string) => FFIDError;
@@ -1375,12 +1394,36 @@ interface UseFFIDReturn {
      *   (forwards `screen_hint=signup` in token mode / redirects to `/signup`
      *   in cookie mode). `'login'` and `undefined` use the default login flow.
      *   See `RedirectToAuthorizeOptions` (#2908 / #2911).
+     * @param options.prompt OIDC `prompt` forwarded to FFID `/oauth/authorize`
+     *   (e.g. `'select_account'` to force the upstream account chooser). For account
+     *   switching, prefer the dedicated {@link UseFFIDReturn.switchAccount} helper (#4027).
      */
     login: (options?: {
         screenHint?: 'signup' | 'login';
+        prompt?: FFIDPrompt;
     }) => void;
-    /** Sign out */
+    /** Sign out (client-side: clears local session via the signout API) */
     logout: () => Promise<void>;
+    /**
+     * Get the FFID SSO logout URL (RP-initiated logout). Includes `client_id` for
+     * `post_logout_redirect_uri` validation. Use for cross-origin browser navigation
+     * that must clear the SSO session cookie (#4027).
+     */
+    getLogoutUrl: (postLogoutRedirectUri?: string) => string;
+    /**
+     * Redirect to the FFID SSO logout endpoint (clears the SSO session cookie via a
+     * top-level browser navigation, so SameSite=Lax cookies are sent). #4027.
+     */
+    redirectToLogout: (postLogoutRedirectUri?: string) => FFIDRedirectResult;
+    /**
+     * Switch / add account: forces the upstream Google account chooser via
+     * `prompt=select_account` so RP-initiated account switching is not silently
+     * re-authenticated against the residual upstream session. Pair with
+     * {@link UseFFIDReturn.redirectToLogout} if an explicit signed-out step is needed (#4027).
+     */
+    switchAccount: (options?: {
+        organizationId?: string;
+    }) => Promise<FFIDRedirectResult>;
     /**
      * Switch current organization.
      * Cookie mode: local state change. Token mode: OAuth re-authorization redirect.

package/dist/index.js

@@ -1,5 +1,5 @@
-import { useFFIDContext, useSubscription } from './chunk-C7PURRNI.js';
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useSubscription, withSubscription } from './chunk-C7PURRNI.js';
+import { useFFIDContext, useSubscription } from './chunk-26X62P76.js';
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useSubscription, withSubscription } from './chunk-26X62P76.js';
 export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, CONSENT_DISMISSAL_TIMESTAMP_KEY, COOKIE_VERSION, DEFAULT_CONSENT_ERROR_MESSAGES, FFIDAnalyticsProvider, FFIDConsentError, FFIDCookieBanner, FFIDCookieLink, FFIDCookieSettings, FFID_CONSENT_ERROR_CODES, clearConsentDismissalTimestamp, decodeConsentCookie, encodeConsentCookie, readConsentCookie, readConsentDismissalTimestamp, useFFIDConsent, useFFIDConsentPreferences, writeConsentCookie, writeConsentDismissalTimestamp } from './chunk-G7VOX64X.js';
 import { useEffect, useRef } from 'react';
 import { jsx, Fragment } from 'react/jsx-runtime';

package/dist/server/index.cjs

@@ -112,10 +112,13 @@ function hasOwnKey(value, key) {
 function normalizeUserinfo(raw) {
   const hasOrganizationId = hasOwnKey(raw, "organization_id");
   const hasOrganizationName = hasOwnKey(raw, "organization_name");
-  const organizationFields = hasOrganizationId ? {
-    organizationId: raw.organization_id ?? null,
-    organizationName: hasOrganizationName ? raw.organization_name ?? null : null
-  } : hasOrganizationName ? { organizationName: raw.organization_name ?? null } : {};
+  const hasOrganizationMemberRole = hasOwnKey(raw, "organization_member_role");
+  const organizationMemberRole = hasOrganizationMemberRole ? raw.organization_member_role ?? null : raw.subscription ? raw.subscription.member_role ?? null : void 0;
+  const organizationFields = {
+    ...hasOrganizationId ? { organizationId: raw.organization_id ?? null } : {},
+    ...hasOrganizationId || hasOrganizationName ? { organizationName: raw.organization_name ?? null } : {},
+    ...organizationMemberRole !== void 0 ? { organizationMemberRole } : {}
+  };
   return {
     sub: raw.sub,
     email: raw.email,
@@ -1090,7 +1093,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.16.2";
+var SDK_VERSION = "5.17.1";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1841,6 +1844,9 @@ function createRedirectMethods(deps) {
     if (options?.screenHint === SCREEN_HINT_SIGNUP) {
       params.set(SCREEN_HINT_PARAM, SCREEN_HINT_SIGNUP);
     }
+    if (options?.prompt) {
+      params.set("prompt", options.prompt);
+    }
     const authorizeUrl = `${baseUrl}${OAUTH_AUTHORIZE_ENDPOINT}?${params.toString()}`;
     logger.debug("Redirecting to authorize:", authorizeUrl);
     recordRedirectAttempt(authorizeKey, now, logger);
@@ -1860,12 +1866,12 @@ function createRedirectMethods(deps) {
     if (authMode === "token") {
       return redirectToAuthorize(options);
     }
-    const targetUrl = options?.screenHint === SCREEN_HINT_SIGNUP ? getSignupUrl() : getLoginUrl();
+    const targetUrl = options?.screenHint === SCREEN_HINT_SIGNUP ? getSignupUrl() : getLoginUrl(void 0, options?.prompt ? { prompt: options.prompt } : void 0);
     logger.debug("Redirecting to auth page:", targetUrl);
     window.location.href = targetUrl;
     return { success: true };
   }
-  function getLoginUrl(redirectUrl) {
+  function getLoginUrl(redirectUrl, options) {
     let redirect;
     if (redirectUrl != null) {
       redirect = redirectUrl;
@@ -1875,7 +1881,8 @@ function createRedirectMethods(deps) {
       logger.warn("getLoginUrl: SSR \u74B0\u5883\u3067 redirectUrl \u304C\u672A\u6307\u5B9A\u306E\u305F\u3081\u7A7A\u6587\u5B57\u306B\u30D5\u30A9\u30FC\u30EB\u30D0\u30C3\u30AF\u3057\u307E\u3059");
       redirect = "";
     }
-    return `${baseUrl}/login?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}`;
+    const promptSuffix = options?.prompt ? `&prompt=${encodeURIComponent(options.prompt)}` : "";
+    return `${baseUrl}/login?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}${promptSuffix}`;
   }
   function getSignupUrl(redirectUrl) {
     let redirect;
@@ -1907,7 +1914,10 @@ function createRedirectMethods(deps) {
     window.location.href = logoutUrl;
     return { success: true };
   }
-  return { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout };
+  async function switchAccount(options) {
+    return redirectToLogin({ ...options, prompt: "select_account" });
+  }
+  return { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout, switchAccount };
 }
 
 // src/client/redirect-uri.ts
@@ -2806,7 +2816,7 @@ function createFFIDClient(config) {
     }
     return signOutCookie();
   }
-  const { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout } = createRedirectMethods({
+  const { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout, switchAccount } = createRedirectMethods({
     authMode,
     baseUrl,
     clientId,
@@ -3000,6 +3010,7 @@ function createFFIDClient(config) {
     redirectToLogin,
     redirectToAuthorize,
     redirectToLogout,
+    switchAccount,
     getLoginUrl,
     getLogoutUrl,
     getSignupUrl,

package/dist/server/index.d.cts

@@ -1,5 +1,5 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-CKFxY60u.cjs';
-export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDRemoveMemberResponse, x as FFIDResetSessionResponse, y as FFIDSubscription, z as FFIDUpdateMemberRoleResponse, A as FFIDUpdateUserProfileRequest, B as FFIDUser, C as FFIDUserProfile, T as TokenData, D as TokenStore, E as createFFIDClient, G as createTokenStore } from '../ffid-client-CKFxY60u.cjs';
+import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-Cwk6cG3b.cjs';
+export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDRemoveMemberResponse, x as FFIDResetSessionResponse, y as FFIDSubscription, z as FFIDUpdateMemberRoleResponse, A as FFIDUpdateUserProfileRequest, B as FFIDUser, C as FFIDUserProfile, T as TokenData, D as TokenStore, E as createFFIDClient, G as createTokenStore } from '../ffid-client-Cwk6cG3b.cjs';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-D61jqRIO.cjs';
 import { z } from 'zod';
 import '../types-BeVl-z12.cjs';

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-9-lh0G_h.js';
-export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDRemoveMemberResponse, x as FFIDResetSessionResponse, y as FFIDSubscription, z as FFIDUpdateMemberRoleResponse, A as FFIDUpdateUserProfileRequest, B as FFIDUser, C as FFIDUserProfile, T as TokenData, D as TokenStore, E as createFFIDClient, G as createTokenStore } from '../ffid-client-9-lh0G_h.js';
+import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-w8Twi5lD.js';
+export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDRemoveMemberResponse, x as FFIDResetSessionResponse, y as FFIDSubscription, z as FFIDUpdateMemberRoleResponse, A as FFIDUpdateUserProfileRequest, B as FFIDUser, C as FFIDUserProfile, T as TokenData, D as TokenStore, E as createFFIDClient, G as createTokenStore } from '../ffid-client-w8Twi5lD.js';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-D61jqRIO.js';
 import { z } from 'zod';
 import '../types-BeVl-z12.js';

package/dist/server/index.js

@@ -111,10 +111,13 @@ function hasOwnKey(value, key) {
 function normalizeUserinfo(raw) {
   const hasOrganizationId = hasOwnKey(raw, "organization_id");
   const hasOrganizationName = hasOwnKey(raw, "organization_name");
-  const organizationFields = hasOrganizationId ? {
-    organizationId: raw.organization_id ?? null,
-    organizationName: hasOrganizationName ? raw.organization_name ?? null : null
-  } : hasOrganizationName ? { organizationName: raw.organization_name ?? null } : {};
+  const hasOrganizationMemberRole = hasOwnKey(raw, "organization_member_role");
+  const organizationMemberRole = hasOrganizationMemberRole ? raw.organization_member_role ?? null : raw.subscription ? raw.subscription.member_role ?? null : void 0;
+  const organizationFields = {
+    ...hasOrganizationId ? { organizationId: raw.organization_id ?? null } : {},
+    ...hasOrganizationId || hasOrganizationName ? { organizationName: raw.organization_name ?? null } : {},
+    ...organizationMemberRole !== void 0 ? { organizationMemberRole } : {}
+  };
   return {
     sub: raw.sub,
     email: raw.email,
@@ -1089,7 +1092,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.16.2";
+var SDK_VERSION = "5.17.1";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1840,6 +1843,9 @@ function createRedirectMethods(deps) {
     if (options?.screenHint === SCREEN_HINT_SIGNUP) {
       params.set(SCREEN_HINT_PARAM, SCREEN_HINT_SIGNUP);
     }
+    if (options?.prompt) {
+      params.set("prompt", options.prompt);
+    }
     const authorizeUrl = `${baseUrl}${OAUTH_AUTHORIZE_ENDPOINT}?${params.toString()}`;
     logger.debug("Redirecting to authorize:", authorizeUrl);
     recordRedirectAttempt(authorizeKey, now, logger);
@@ -1859,12 +1865,12 @@ function createRedirectMethods(deps) {
     if (authMode === "token") {
       return redirectToAuthorize(options);
     }
-    const targetUrl = options?.screenHint === SCREEN_HINT_SIGNUP ? getSignupUrl() : getLoginUrl();
+    const targetUrl = options?.screenHint === SCREEN_HINT_SIGNUP ? getSignupUrl() : getLoginUrl(void 0, options?.prompt ? { prompt: options.prompt } : void 0);
     logger.debug("Redirecting to auth page:", targetUrl);
     window.location.href = targetUrl;
     return { success: true };
   }
-  function getLoginUrl(redirectUrl) {
+  function getLoginUrl(redirectUrl, options) {
     let redirect;
     if (redirectUrl != null) {
       redirect = redirectUrl;
@@ -1874,7 +1880,8 @@ function createRedirectMethods(deps) {
       logger.warn("getLoginUrl: SSR \u74B0\u5883\u3067 redirectUrl \u304C\u672A\u6307\u5B9A\u306E\u305F\u3081\u7A7A\u6587\u5B57\u306B\u30D5\u30A9\u30FC\u30EB\u30D0\u30C3\u30AF\u3057\u307E\u3059");
       redirect = "";
     }
-    return `${baseUrl}/login?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}`;
+    const promptSuffix = options?.prompt ? `&prompt=${encodeURIComponent(options.prompt)}` : "";
+    return `${baseUrl}/login?redirect=${encodeURIComponent(redirect)}&service=${encodeURIComponent(serviceCode)}${promptSuffix}`;
   }
   function getSignupUrl(redirectUrl) {
     let redirect;
@@ -1906,7 +1913,10 @@ function createRedirectMethods(deps) {
     window.location.href = logoutUrl;
     return { success: true };
   }
-  return { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout };
+  async function switchAccount(options) {
+    return redirectToLogin({ ...options, prompt: "select_account" });
+  }
+  return { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout, switchAccount };
 }
 
 // src/client/redirect-uri.ts
@@ -2805,7 +2815,7 @@ function createFFIDClient(config) {
     }
     return signOutCookie();
   }
-  const { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout } = createRedirectMethods({
+  const { redirectToLogin, redirectToAuthorize, getLoginUrl, getSignupUrl, getLogoutUrl, redirectToLogout, switchAccount } = createRedirectMethods({
     authMode,
     baseUrl,
     clientId,
@@ -2999,6 +3009,7 @@ function createFFIDClient(config) {
     redirectToLogin,
     redirectToAuthorize,
     redirectToLogout,
+    switchAccount,
     getLoginUrl,
     getLogoutUrl,
     getSignupUrl,

package/dist/server/test/index.d.cts

@@ -1,4 +1,4 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-CKFxY60u.cjs';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-Cwk6cG3b.cjs';
 import '../../types-BeVl-z12.cjs';
 
 /**

package/dist/server/test/index.d.ts

@@ -1,4 +1,4 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-9-lh0G_h.js';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-w8Twi5lD.js';
 import '../../types-BeVl-z12.js';
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feelflow/ffid-sdk",
-  "version": "5.16.2",
+  "version": "5.17.1",
   "description": "FeelFlow ID Platform SDK for React/Next.js applications",
   "keywords": [
     "feelflow",