@feelflow/ffid-sdk 5.19.0 → 5.22.0

package/README.md

@@ -185,6 +185,7 @@ function Header() {
   refreshInterval={300000}            // オプション: セッション更新間隔（ms）
   onAuthStateChange={(user) => {}}    // オプション: 認証状態変更時コールバック
   onError={(error) => {}}             // オプション: エラー時コールバック
+  cleanCallbackUrl={true}             // オプション: token モードの callback URL cleanup（false で consumer に委譲、v5.22.0+）
 >
   {children}
 </FFIDProvider>

package/dist/agency/index.cjs

@@ -16,8 +16,10 @@ var noopLogger = {
   },
   info: () => {
   },
-  warn: (...args) => console.warn(SDK_LOG_PREFIX, ...args),
-  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
+  warn: () => {
+  },
+  error: () => {
+  }
 };
 var consoleLogger = {
   debug: (...args) => console.debug(SDK_LOG_PREFIX, ...args),

package/dist/agency/index.js

@@ -15,8 +15,10 @@ var noopLogger = {
   },
   info: () => {
   },
-  warn: (...args) => console.warn(SDK_LOG_PREFIX, ...args),
-  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
+  warn: () => {
+  },
+  error: () => {
+  }
 };
 var consoleLogger = {
   debug: (...args) => console.debug(SDK_LOG_PREFIX, ...args),

package/dist/announcements/index.cjs

@@ -20,7 +20,8 @@ var quietLogger = {
   },
   warn: () => {
   },
-  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
+  error: () => {
+  }
 };
 var consoleLogger = {
   debug: (...args) => console.debug(SDK_LOG_PREFIX, ...args),

package/dist/announcements/index.js

@@ -18,7 +18,8 @@ var quietLogger = {
   },
   warn: () => {
   },
-  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
+  error: () => {
+  }
 };
 var consoleLogger = {
   debug: (...args) => console.debug(SDK_LOG_PREFIX, ...args),

package/dist/{chunk-D3PZ6SZB.js → chunk-7NRO2TBG.js}

@@ -264,10 +264,12 @@ var OAUTH_INTROSPECT_ENDPOINT = "/api/v1/oauth/introspect";
 var CACHE_KEY_PREFIX = "ffid:introspect:";
 var HEX_BASE = 16;
 var HEX_BYTE_WIDTH = 2;
-var TOKEN_LOG_PREFIX_LENGTH = 8;
 function createVerifyAccessToken(deps) {
   const { authMode, baseUrl, serviceCode, serviceApiKey, verifyStrategy, logger, createError, errorCodes, cache, timeout } = deps;
   let jwtVerify2 = null;
+  let cacheReadFailureEscalated = false;
+  let cacheWriteFailureEscalated = false;
+  let missingSubtleCryptoLogged = false;
   function getJwtVerifier() {
     if (!jwtVerify2) {
       jwtVerify2 = createJwtVerifier({
@@ -327,8 +329,9 @@ function createVerifyAccessToken(deps) {
     }
     const url = `${baseUrl}${OAUTH_INTROSPECT_ENDPOINT}`;
     logger.debug("Verifying access token:", url);
-    const cacheKey = cache ? await buildCacheKey(accessToken, cacheKeySuffix) : "";
-    if (cache) {
+    const cacheKey = cache ? await buildCacheKey(accessToken, cacheKeySuffix) : null;
+    let verificationCacheDegraded = cache !== void 0 && cacheKey === null;
+    if (cache && cacheKey !== null) {
       try {
         const cached = await cache.adapter.get(cacheKey);
         if (cached && typeof cached === "object" && "sub" in cached) {
@@ -336,7 +339,16 @@ function createVerifyAccessToken(deps) {
           return { data: cached };
         }
       } catch (cacheError) {
-        logger.warn("Cache read failed, falling back to API call:", cacheError);
+        verificationCacheDegraded = true;
+        if (!cacheReadFailureEscalated) {
+          cacheReadFailureEscalated = true;
+          logger.error(
+            "Cache read failed \u2014 falling back to API call. Redis \u7B49\u306E cache adapter \u969C\u5BB3\u6642\u306F\u5168 verification \u304C introspect \u306B degrade \u3057\u307E\u3059\uFF08\u3053\u306E error \u306F instance \u3054\u3068\u306B\u521D\u56DE\u306E\u307F\u3001\u4EE5\u964D\u306F warn\uFF09:",
+            cacheError
+          );
+        } else {
+          logger.warn("Cache read failed, falling back to API call:", cacheError);
+        }
       }
     }
     const fetchOptions = {
@@ -431,31 +443,40 @@ function createVerifyAccessToken(deps) {
       }
     } : base;
     const userinfo = normalizeUserinfo(raw);
-    if (cache) {
+    if (cache && cacheKey !== null) {
       try {
         await cache.adapter.set(cacheKey, userinfo, cache.ttl);
       } catch (cacheError) {
-        logger.warn("Cache write failed (result still returned):", cacheError);
+        verificationCacheDegraded = true;
+        if (!cacheWriteFailureEscalated) {
+          cacheWriteFailureEscalated = true;
+          logger.error(
+            "Cache write failed \u2014 result still returned. cache adapter \u969C\u5BB3\u6642\u306F introspect \u7D50\u679C\u304C\u30AD\u30E3\u30C3\u30B7\u30E5\u3055\u308C\u305A\u5168 verification \u304C API \u547C\u3073\u51FA\u3057\u306B degrade \u3057\u307E\u3059\uFF08\u3053\u306E error \u306F instance \u3054\u3068\u306B\u521D\u56DE\u306E\u307F\u3001\u4EE5\u964D\u306F warn\uFF09:",
+            cacheError
+          );
+        } else {
+          logger.warn("Cache write failed (result still returned):", cacheError);
+        }
       }
     }
-    return { data: userinfo };
+    return verificationCacheDegraded ? { data: userinfo, meta: { verificationCacheDegraded: true } } : { data: userinfo };
   }
   async function buildCacheKey(token, suffix) {
-    let key;
-    if (typeof globalThis.crypto?.subtle?.digest === "function") {
-      const encoder = new TextEncoder();
-      const data = encoder.encode(token);
-      const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-      const hashArray = Array.from(new Uint8Array(hashBuffer));
-      const hashHex = hashArray.map((b) => b.toString(HEX_BASE).padStart(HEX_BYTE_WIDTH, "0")).join("");
-      key = CACHE_KEY_PREFIX + hashHex;
-    } else {
-      const tokenPrefix = token.length > TOKEN_LOG_PREFIX_LENGTH ? token.substring(0, TOKEN_LOG_PREFIX_LENGTH) + "..." : "***";
-      logger.warn(
-        `crypto.subtle \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081\u3001\u30AD\u30E3\u30C3\u30B7\u30E5\u30AD\u30FC\u306B\u30CF\u30C3\u30B7\u30E5\u5316\u3055\u308C\u3066\u3044\u306A\u3044\u30C8\u30FC\u30AF\u30F3\u3092\u4F7F\u7528\u3057\u307E\u3059 (token prefix: ${tokenPrefix})`
-      );
-      key = CACHE_KEY_PREFIX + token;
-    }
+    if (typeof globalThis.crypto?.subtle?.digest !== "function") {
+      if (!missingSubtleCryptoLogged) {
+        missingSubtleCryptoLogged = true;
+        logger.error(
+          "crypto.subtle \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081 introspect \u7D50\u679C\u306E\u30AD\u30E3\u30C3\u30B7\u30E5\u3092\u7121\u52B9\u5316\u3057\u307E\u3057\u305F\uFF08\u30CF\u30C3\u30B7\u30E5\u5316\u3055\u308C\u3066\u3044\u306A\u3044\u30C8\u30FC\u30AF\u30F3\u3092 cache key \u306B\u4F7F\u308F\u306A\u3044\u305F\u3081\u306E\u63AA\u7F6E #4119\uFF09\u3002\u5168 verification \u304C API \u547C\u3073\u51FA\u3057\u306B\u306A\u308A\u307E\u3059"
+        );
+      }
+      return null;
+    }
+    const encoder = new TextEncoder();
+    const data = encoder.encode(token);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    const hashHex = hashArray.map((b) => b.toString(HEX_BASE).padStart(HEX_BYTE_WIDTH, "0")).join("");
+    const key = CACHE_KEY_PREFIX + hashHex;
     return suffix ? `${key}:${suffix}` : key;
   }
   return verifyAccessToken;
@@ -1204,7 +1225,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.19.0";
+var SDK_VERSION = "5.22.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1446,33 +1467,48 @@ function createOAuthTokenMethods(deps) {
   async function signOutToken() {
     const tokens = tokenStore.getTokens();
     tokenStore.clearTokens();
+    const allRevoked = {
+      revoked: true,
+      accessTokenRevoked: true,
+      refreshTokenRevoked: true
+    };
     if (!tokens) {
       logger.debug("No tokens to revoke");
-      return { data: void 0 };
+      return { data: allRevoked };
     }
-    const url = `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`;
-    logger.debug("Revoking token:", url);
-    try {
-      const response = await fetch(url, {
-        method: "POST",
-        credentials: "omit",
-        headers: { "Content-Type": "application/x-www-form-urlencoded", ...sdkHeaders() },
-        body: new URLSearchParams({
-          token: tokens.accessToken,
-          client_id: clientId
-        }).toString()
-      });
-      if (!response.ok) {
-        logger.warn(
-          "\u30C8\u30FC\u30AF\u30F3\u7121\u52B9\u5316\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30B5\u30FC\u30D0\u30FC\u3067\u5931\u6557\u3057\u307E\u3057\u305F:",
-          `status=${response.status}`
-        );
+    async function revokeOAuthToken(token, tokenTypeHint) {
+      const url = `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`;
+      try {
+        const response = await fetch(url, {
+          method: "POST",
+          credentials: "omit",
+          headers: { "Content-Type": "application/x-www-form-urlencoded", ...sdkHeaders() },
+          body: new URLSearchParams({
+            token,
+            client_id: clientId,
+            token_type_hint: tokenTypeHint
+          }).toString()
+        });
+        return response.ok;
+      } catch {
+        return false;
       }
-    } catch (error) {
-      logger.warn("\u30C8\u30FC\u30AF\u30F3\u7121\u52B9\u5316\u306E\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30EA\u30AF\u30A8\u30B9\u30C8\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+    }
+    logger.debug("Revoking tokens:", `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`);
+    const accessTokenRevoked = await revokeOAuthToken(tokens.accessToken, "access_token");
+    if (!accessTokenRevoked) {
+      logger.warn("\u30A2\u30AF\u30BB\u30B9\u30C8\u30FC\u30AF\u30F3\u306E\u7121\u52B9\u5316\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30B5\u30FC\u30D0\u30FC\u3067\u5931\u6557\u3057\u307E\u3057\u305F");
+    }
+    const refreshTokenRevoked = tokens.refreshToken ? await revokeOAuthToken(tokens.refreshToken, "refresh_token") : true;
+    if (tokens.refreshToken && !refreshTokenRevoked) {
+      logger.warn("\u30EA\u30D5\u30EC\u30C3\u30B7\u30E5\u30C8\u30FC\u30AF\u30F3\u306E\u7121\u52B9\u5316\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30B5\u30FC\u30D0\u30FC\u3067\u5931\u6557\u3057\u307E\u3057\u305F");
+    }
+    const revoked = accessTokenRevoked && refreshTokenRevoked;
+    if (!revoked) {
+      logger.warn("\u30C8\u30FC\u30AF\u30F3\u7121\u52B9\u5316\u304C\u4E00\u90E8\u307E\u305F\u306F\u5168\u90E8\u5931\u6557\u3057\u307E\u3057\u305F\uFF08\u30ED\u30FC\u30AB\u30EB\u30C8\u30FC\u30AF\u30F3\u306F\u30AF\u30EA\u30A2\u6E08\u307F\uFF09");
     }
     logger.debug("Token sign-out completed");
-    return { data: void 0 };
+    return { data: { revoked, accessTokenRevoked, refreshTokenRevoked } };
   }
   return { exchangeCodeForTokens, refreshAccessToken, signOutToken };
 }
@@ -1636,7 +1672,7 @@ function createSessionMethods(deps) {
     }
     if (response.status === NO_CONTENT_STATUS) {
       logger.debug("Response: 204 No Content");
-      return { data: void 0 };
+      return { data: { revoked: true } };
     }
     if (!response.ok) {
       try {
@@ -1663,7 +1699,7 @@ function createSessionMethods(deps) {
       }
     }
     logger.debug("Response:", response.status);
-    return { data: void 0 };
+    return { data: { revoked: true } };
   }
   return { getSession, signOutCookie };
 }
@@ -1881,6 +1917,9 @@ var REDIRECT_LOOP_WINDOW_MS = 6e4;
 var REDIRECT_LOOP_THRESHOLD = 3;
 var storageReadFailureLogged = false;
 var storageWriteFailureLogged = false;
+function isLoopDetectionDegraded() {
+  return storageReadFailureLogged || storageWriteFailureLogged;
+}
 function logStorageReadFailure(logger, err) {
   if (storageReadFailureLogged) return;
   storageReadFailureLogged = true;
@@ -2025,9 +2064,16 @@ function createRedirectMethods(deps) {
     }
     const state = generateRandomState();
     if (!storeState(state, logger)) {
+      cleanupVerifierStorage(logger);
+      cleanupStateStorage(logger);
       logger.error(
-        "redirectToAuthorize: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF\u3067\u306E CSRF \u691C\u8A3C\u304C\u5931\u6557\u3057\u307E\u3059"
+        "redirectToAuthorize: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u8A8D\u53EF\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
       );
+      return {
+        success: false,
+        code: "state_persistence_failed",
+        error: "OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u8A8D\u53EF\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+      };
     }
     const redirectUri = resolvedRedirectUri ?? window.location.origin + window.location.pathname;
     const params = new URLSearchParams({
@@ -2062,7 +2108,7 @@ function createRedirectMethods(deps) {
       rollbackLastRedirectAttempt(authorizeKey, logger);
       throw err;
     }
-    return { success: true };
+    return isLoopDetectionDegraded() ? { success: true, loopDetectionDisabled: true } : { success: true };
   }
   async function redirectToLogin(options) {
     if (typeof window === "undefined") {
@@ -3452,7 +3498,7 @@ async function handleRedirectCallback(client, options) {
         };
       }
       logger.error(
-        "handleRedirectCallback: OAuth state mismatch or omitted (possible CSRF) \u2014 \u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+        "handleRedirectCallback: OAuth state mismatch or omitted (possible CSRF) \u2014 \u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F\u3002\u6D88\u8CBB\u6E08\u307F callback \u30D1\u30E9\u30E1\u30FC\u30BF\u306E\u518D\u51E6\u7406\uFF08`cleanUrl: false` \u5229\u7528\u6642\u306E cleanup \u6F0F\u308C\u3084 reload \u7B49\uFF09\u3067\u3082\u767A\u751F\u3057\u307E\u3059"
       );
       return {
         error: client.createError(
@@ -3465,7 +3511,11 @@ async function handleRedirectCallback(client, options) {
   const verifier = retrieveCodeVerifier(logger);
   const result = await client.exchangeCodeForTokens(code, verifier ?? void 0);
   if (!result.error && hasWindow) {
-    cleanCallbackUrlParams(logger);
+    if (options?.cleanUrl !== false) {
+      cleanCallbackUrlParams(logger);
+    } else {
+      logger.debug("handleRedirectCallback: cleanUrl=false \u306E\u305F\u3081 URL cleanup \u3092 consumer \u306B\u59D4\u8B72\u3057\u307E\u3057\u305F");
+    }
   }
   return result;
 }
@@ -3484,7 +3534,8 @@ function FFIDProvider({
   onAuthStateChange,
   onError,
   authMode,
-  clientId
+  clientId,
+  cleanCallbackUrl = true
 }) {
   const [user, setUser] = useState(null);
   const [organizations, setOrganizations] = useState([]);
@@ -3636,14 +3687,17 @@ function FFIDProvider({
     },
     [organizations, client]
   );
+  const handledCodeRef = useRef(null);
   useEffect(() => {
     if (client.authMode !== "token") return;
     if (typeof window === "undefined") return;
     const urlParams = new URLSearchParams(window.location.search);
     const code = urlParams.get("code");
     if (!code) return;
+    if (handledCodeRef.current === code) return;
+    handledCodeRef.current = code;
     client.logger.debug("Authorization code detected, exchanging for tokens");
-    handleRedirectCallback(client).then((result) => {
+    handleRedirectCallback(client, { cleanUrl: cleanCallbackUrl }).then((result) => {
       if (result.error) {
         client.logger.error("Token exchange failed:", result.error);
         setError(result.error);
@@ -4329,7 +4383,8 @@ var quietLogger = {
   },
   warn: () => {
   },
-  error: (...args) => console.error(SDK_LOG_PREFIX2, ...args)
+  error: () => {
+  }
 };
 var consoleLogger2 = {
   debug: (...args) => console.debug(SDK_LOG_PREFIX2, ...args),

package/dist/{chunk-TW2FXASO.cjs → chunk-EM5EGNGE.cjs}

@@ -266,10 +266,12 @@ var OAUTH_INTROSPECT_ENDPOINT = "/api/v1/oauth/introspect";
 var CACHE_KEY_PREFIX = "ffid:introspect:";
 var HEX_BASE = 16;
 var HEX_BYTE_WIDTH = 2;
-var TOKEN_LOG_PREFIX_LENGTH = 8;
 function createVerifyAccessToken(deps) {
   const { authMode, baseUrl, serviceCode, serviceApiKey, verifyStrategy, logger, createError, errorCodes, cache, timeout } = deps;
   let jwtVerify2 = null;
+  let cacheReadFailureEscalated = false;
+  let cacheWriteFailureEscalated = false;
+  let missingSubtleCryptoLogged = false;
   function getJwtVerifier() {
     if (!jwtVerify2) {
       jwtVerify2 = createJwtVerifier({
@@ -329,8 +331,9 @@ function createVerifyAccessToken(deps) {
     }
     const url = `${baseUrl}${OAUTH_INTROSPECT_ENDPOINT}`;
     logger.debug("Verifying access token:", url);
-    const cacheKey = cache ? await buildCacheKey(accessToken, cacheKeySuffix) : "";
-    if (cache) {
+    const cacheKey = cache ? await buildCacheKey(accessToken, cacheKeySuffix) : null;
+    let verificationCacheDegraded = cache !== void 0 && cacheKey === null;
+    if (cache && cacheKey !== null) {
       try {
         const cached = await cache.adapter.get(cacheKey);
         if (cached && typeof cached === "object" && "sub" in cached) {
@@ -338,7 +341,16 @@ function createVerifyAccessToken(deps) {
           return { data: cached };
         }
       } catch (cacheError) {
-        logger.warn("Cache read failed, falling back to API call:", cacheError);
+        verificationCacheDegraded = true;
+        if (!cacheReadFailureEscalated) {
+          cacheReadFailureEscalated = true;
+          logger.error(
+            "Cache read failed \u2014 falling back to API call. Redis \u7B49\u306E cache adapter \u969C\u5BB3\u6642\u306F\u5168 verification \u304C introspect \u306B degrade \u3057\u307E\u3059\uFF08\u3053\u306E error \u306F instance \u3054\u3068\u306B\u521D\u56DE\u306E\u307F\u3001\u4EE5\u964D\u306F warn\uFF09:",
+            cacheError
+          );
+        } else {
+          logger.warn("Cache read failed, falling back to API call:", cacheError);
+        }
       }
     }
     const fetchOptions = {
@@ -433,31 +445,40 @@ function createVerifyAccessToken(deps) {
       }
     } : base;
     const userinfo = normalizeUserinfo(raw);
-    if (cache) {
+    if (cache && cacheKey !== null) {
       try {
         await cache.adapter.set(cacheKey, userinfo, cache.ttl);
       } catch (cacheError) {
-        logger.warn("Cache write failed (result still returned):", cacheError);
+        verificationCacheDegraded = true;
+        if (!cacheWriteFailureEscalated) {
+          cacheWriteFailureEscalated = true;
+          logger.error(
+            "Cache write failed \u2014 result still returned. cache adapter \u969C\u5BB3\u6642\u306F introspect \u7D50\u679C\u304C\u30AD\u30E3\u30C3\u30B7\u30E5\u3055\u308C\u305A\u5168 verification \u304C API \u547C\u3073\u51FA\u3057\u306B degrade \u3057\u307E\u3059\uFF08\u3053\u306E error \u306F instance \u3054\u3068\u306B\u521D\u56DE\u306E\u307F\u3001\u4EE5\u964D\u306F warn\uFF09:",
+            cacheError
+          );
+        } else {
+          logger.warn("Cache write failed (result still returned):", cacheError);
+        }
       }
     }
-    return { data: userinfo };
+    return verificationCacheDegraded ? { data: userinfo, meta: { verificationCacheDegraded: true } } : { data: userinfo };
   }
   async function buildCacheKey(token, suffix) {
-    let key;
-    if (typeof globalThis.crypto?.subtle?.digest === "function") {
-      const encoder = new TextEncoder();
-      const data = encoder.encode(token);
-      const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-      const hashArray = Array.from(new Uint8Array(hashBuffer));
-      const hashHex = hashArray.map((b) => b.toString(HEX_BASE).padStart(HEX_BYTE_WIDTH, "0")).join("");
-      key = CACHE_KEY_PREFIX + hashHex;
-    } else {
-      const tokenPrefix = token.length > TOKEN_LOG_PREFIX_LENGTH ? token.substring(0, TOKEN_LOG_PREFIX_LENGTH) + "..." : "***";
-      logger.warn(
-        `crypto.subtle \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081\u3001\u30AD\u30E3\u30C3\u30B7\u30E5\u30AD\u30FC\u306B\u30CF\u30C3\u30B7\u30E5\u5316\u3055\u308C\u3066\u3044\u306A\u3044\u30C8\u30FC\u30AF\u30F3\u3092\u4F7F\u7528\u3057\u307E\u3059 (token prefix: ${tokenPrefix})`
-      );
-      key = CACHE_KEY_PREFIX + token;
-    }
+    if (typeof globalThis.crypto?.subtle?.digest !== "function") {
+      if (!missingSubtleCryptoLogged) {
+        missingSubtleCryptoLogged = true;
+        logger.error(
+          "crypto.subtle \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081 introspect \u7D50\u679C\u306E\u30AD\u30E3\u30C3\u30B7\u30E5\u3092\u7121\u52B9\u5316\u3057\u307E\u3057\u305F\uFF08\u30CF\u30C3\u30B7\u30E5\u5316\u3055\u308C\u3066\u3044\u306A\u3044\u30C8\u30FC\u30AF\u30F3\u3092 cache key \u306B\u4F7F\u308F\u306A\u3044\u305F\u3081\u306E\u63AA\u7F6E #4119\uFF09\u3002\u5168 verification \u304C API \u547C\u3073\u51FA\u3057\u306B\u306A\u308A\u307E\u3059"
+        );
+      }
+      return null;
+    }
+    const encoder = new TextEncoder();
+    const data = encoder.encode(token);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    const hashHex = hashArray.map((b) => b.toString(HEX_BASE).padStart(HEX_BYTE_WIDTH, "0")).join("");
+    const key = CACHE_KEY_PREFIX + hashHex;
     return suffix ? `${key}:${suffix}` : key;
   }
   return verifyAccessToken;
@@ -1206,7 +1227,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.19.0";
+var SDK_VERSION = "5.22.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1448,33 +1469,48 @@ function createOAuthTokenMethods(deps) {
   async function signOutToken() {
     const tokens = tokenStore.getTokens();
     tokenStore.clearTokens();
+    const allRevoked = {
+      revoked: true,
+      accessTokenRevoked: true,
+      refreshTokenRevoked: true
+    };
     if (!tokens) {
       logger.debug("No tokens to revoke");
-      return { data: void 0 };
+      return { data: allRevoked };
     }
-    const url = `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`;
-    logger.debug("Revoking token:", url);
-    try {
-      const response = await fetch(url, {
-        method: "POST",
-        credentials: "omit",
-        headers: { "Content-Type": "application/x-www-form-urlencoded", ...sdkHeaders() },
-        body: new URLSearchParams({
-          token: tokens.accessToken,
-          client_id: clientId
-        }).toString()
-      });
-      if (!response.ok) {
-        logger.warn(
-          "\u30C8\u30FC\u30AF\u30F3\u7121\u52B9\u5316\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30B5\u30FC\u30D0\u30FC\u3067\u5931\u6557\u3057\u307E\u3057\u305F:",
-          `status=${response.status}`
-        );
+    async function revokeOAuthToken(token, tokenTypeHint) {
+      const url = `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`;
+      try {
+        const response = await fetch(url, {
+          method: "POST",
+          credentials: "omit",
+          headers: { "Content-Type": "application/x-www-form-urlencoded", ...sdkHeaders() },
+          body: new URLSearchParams({
+            token,
+            client_id: clientId,
+            token_type_hint: tokenTypeHint
+          }).toString()
+        });
+        return response.ok;
+      } catch {
+        return false;
       }
-    } catch (error) {
-      logger.warn("\u30C8\u30FC\u30AF\u30F3\u7121\u52B9\u5316\u306E\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30EA\u30AF\u30A8\u30B9\u30C8\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+    }
+    logger.debug("Revoking tokens:", `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`);
+    const accessTokenRevoked = await revokeOAuthToken(tokens.accessToken, "access_token");
+    if (!accessTokenRevoked) {
+      logger.warn("\u30A2\u30AF\u30BB\u30B9\u30C8\u30FC\u30AF\u30F3\u306E\u7121\u52B9\u5316\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30B5\u30FC\u30D0\u30FC\u3067\u5931\u6557\u3057\u307E\u3057\u305F");
+    }
+    const refreshTokenRevoked = tokens.refreshToken ? await revokeOAuthToken(tokens.refreshToken, "refresh_token") : true;
+    if (tokens.refreshToken && !refreshTokenRevoked) {
+      logger.warn("\u30EA\u30D5\u30EC\u30C3\u30B7\u30E5\u30C8\u30FC\u30AF\u30F3\u306E\u7121\u52B9\u5316\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30B5\u30FC\u30D0\u30FC\u3067\u5931\u6557\u3057\u307E\u3057\u305F");
+    }
+    const revoked = accessTokenRevoked && refreshTokenRevoked;
+    if (!revoked) {
+      logger.warn("\u30C8\u30FC\u30AF\u30F3\u7121\u52B9\u5316\u304C\u4E00\u90E8\u307E\u305F\u306F\u5168\u90E8\u5931\u6557\u3057\u307E\u3057\u305F\uFF08\u30ED\u30FC\u30AB\u30EB\u30C8\u30FC\u30AF\u30F3\u306F\u30AF\u30EA\u30A2\u6E08\u307F\uFF09");
     }
     logger.debug("Token sign-out completed");
-    return { data: void 0 };
+    return { data: { revoked, accessTokenRevoked, refreshTokenRevoked } };
   }
   return { exchangeCodeForTokens, refreshAccessToken, signOutToken };
 }
@@ -1638,7 +1674,7 @@ function createSessionMethods(deps) {
     }
     if (response.status === NO_CONTENT_STATUS) {
       logger.debug("Response: 204 No Content");
-      return { data: void 0 };
+      return { data: { revoked: true } };
     }
     if (!response.ok) {
       try {
@@ -1665,7 +1701,7 @@ function createSessionMethods(deps) {
       }
     }
     logger.debug("Response:", response.status);
-    return { data: void 0 };
+    return { data: { revoked: true } };
   }
   return { getSession, signOutCookie };
 }
@@ -1883,6 +1919,9 @@ var REDIRECT_LOOP_WINDOW_MS = 6e4;
 var REDIRECT_LOOP_THRESHOLD = 3;
 var storageReadFailureLogged = false;
 var storageWriteFailureLogged = false;
+function isLoopDetectionDegraded() {
+  return storageReadFailureLogged || storageWriteFailureLogged;
+}
 function logStorageReadFailure(logger, err) {
   if (storageReadFailureLogged) return;
   storageReadFailureLogged = true;
@@ -2027,9 +2066,16 @@ function createRedirectMethods(deps) {
     }
     const state = generateRandomState();
     if (!storeState(state, logger)) {
+      cleanupVerifierStorage(logger);
+      cleanupStateStorage(logger);
       logger.error(
-        "redirectToAuthorize: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF\u3067\u306E CSRF \u691C\u8A3C\u304C\u5931\u6557\u3057\u307E\u3059"
+        "redirectToAuthorize: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u8A8D\u53EF\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
       );
+      return {
+        success: false,
+        code: "state_persistence_failed",
+        error: "OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u8A8D\u53EF\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+      };
     }
     const redirectUri = resolvedRedirectUri ?? window.location.origin + window.location.pathname;
     const params = new URLSearchParams({
@@ -2064,7 +2110,7 @@ function createRedirectMethods(deps) {
       rollbackLastRedirectAttempt(authorizeKey, logger);
       throw err;
     }
-    return { success: true };
+    return isLoopDetectionDegraded() ? { success: true, loopDetectionDisabled: true } : { success: true };
   }
   async function redirectToLogin(options) {
     if (typeof window === "undefined") {
@@ -3454,7 +3500,7 @@ async function handleRedirectCallback(client, options) {
         };
       }
       logger.error(
-        "handleRedirectCallback: OAuth state mismatch or omitted (possible CSRF) \u2014 \u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+        "handleRedirectCallback: OAuth state mismatch or omitted (possible CSRF) \u2014 \u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F\u3002\u6D88\u8CBB\u6E08\u307F callback \u30D1\u30E9\u30E1\u30FC\u30BF\u306E\u518D\u51E6\u7406\uFF08`cleanUrl: false` \u5229\u7528\u6642\u306E cleanup \u6F0F\u308C\u3084 reload \u7B49\uFF09\u3067\u3082\u767A\u751F\u3057\u307E\u3059"
       );
       return {
         error: client.createError(
@@ -3467,7 +3513,11 @@ async function handleRedirectCallback(client, options) {
   const verifier = retrieveCodeVerifier(logger);
   const result = await client.exchangeCodeForTokens(code, verifier ?? void 0);
   if (!result.error && hasWindow) {
-    cleanCallbackUrlParams(logger);
+    if (options?.cleanUrl !== false) {
+      cleanCallbackUrlParams(logger);
+    } else {
+      logger.debug("handleRedirectCallback: cleanUrl=false \u306E\u305F\u3081 URL cleanup \u3092 consumer \u306B\u59D4\u8B72\u3057\u307E\u3057\u305F");
+    }
   }
   return result;
 }
@@ -3486,7 +3536,8 @@ function FFIDProvider({
   onAuthStateChange,
   onError,
   authMode,
-  clientId
+  clientId,
+  cleanCallbackUrl = true
 }) {
   const [user, setUser] = react.useState(null);
   const [organizations, setOrganizations] = react.useState([]);
@@ -3638,14 +3689,17 @@ function FFIDProvider({
     },
     [organizations, client]
   );
+  const handledCodeRef = react.useRef(null);
   react.useEffect(() => {
     if (client.authMode !== "token") return;
     if (typeof window === "undefined") return;
     const urlParams = new URLSearchParams(window.location.search);
     const code = urlParams.get("code");
     if (!code) return;
+    if (handledCodeRef.current === code) return;
+    handledCodeRef.current = code;
     client.logger.debug("Authorization code detected, exchanging for tokens");
-    handleRedirectCallback(client).then((result) => {
+    handleRedirectCallback(client, { cleanUrl: cleanCallbackUrl }).then((result) => {
       if (result.error) {
         client.logger.error("Token exchange failed:", result.error);
         setError(result.error);
@@ -4331,7 +4385,8 @@ var quietLogger = {
   },
   warn: () => {
   },
-  error: (...args) => console.error(SDK_LOG_PREFIX2, ...args)
+  error: () => {
+  }
 };
 var consoleLogger2 = {
   debug: (...args) => console.debug(SDK_LOG_PREFIX2, ...args),