@feelflow/ffid-sdk 5.19.0 → 5.22.0

package/dist/server/index.cjs

@@ -261,10 +261,12 @@ var OAUTH_INTROSPECT_ENDPOINT = "/api/v1/oauth/introspect";
 var CACHE_KEY_PREFIX = "ffid:introspect:";
 var HEX_BASE = 16;
 var HEX_BYTE_WIDTH = 2;
-var TOKEN_LOG_PREFIX_LENGTH = 8;
 function createVerifyAccessToken(deps) {
   const { authMode, baseUrl, serviceCode, serviceApiKey, verifyStrategy, logger, createError, errorCodes, cache, timeout } = deps;
   let jwtVerify2 = null;
+  let cacheReadFailureEscalated = false;
+  let cacheWriteFailureEscalated = false;
+  let missingSubtleCryptoLogged = false;
   function getJwtVerifier() {
     if (!jwtVerify2) {
       jwtVerify2 = createJwtVerifier({
@@ -324,8 +326,9 @@ function createVerifyAccessToken(deps) {
     }
     const url = `${baseUrl}${OAUTH_INTROSPECT_ENDPOINT}`;
     logger.debug("Verifying access token:", url);
-    const cacheKey = cache ? await buildCacheKey(accessToken, cacheKeySuffix) : "";
-    if (cache) {
+    const cacheKey = cache ? await buildCacheKey(accessToken, cacheKeySuffix) : null;
+    let verificationCacheDegraded = cache !== void 0 && cacheKey === null;
+    if (cache && cacheKey !== null) {
       try {
         const cached = await cache.adapter.get(cacheKey);
         if (cached && typeof cached === "object" && "sub" in cached) {
@@ -333,7 +336,16 @@ function createVerifyAccessToken(deps) {
           return { data: cached };
         }
       } catch (cacheError) {
-        logger.warn("Cache read failed, falling back to API call:", cacheError);
+        verificationCacheDegraded = true;
+        if (!cacheReadFailureEscalated) {
+          cacheReadFailureEscalated = true;
+          logger.error(
+            "Cache read failed \u2014 falling back to API call. Redis \u7B49\u306E cache adapter \u969C\u5BB3\u6642\u306F\u5168 verification \u304C introspect \u306B degrade \u3057\u307E\u3059\uFF08\u3053\u306E error \u306F instance \u3054\u3068\u306B\u521D\u56DE\u306E\u307F\u3001\u4EE5\u964D\u306F warn\uFF09:",
+            cacheError
+          );
+        } else {
+          logger.warn("Cache read failed, falling back to API call:", cacheError);
+        }
       }
     }
     const fetchOptions = {
@@ -428,31 +440,40 @@ function createVerifyAccessToken(deps) {
       }
     } : base;
     const userinfo = normalizeUserinfo(raw);
-    if (cache) {
+    if (cache && cacheKey !== null) {
       try {
         await cache.adapter.set(cacheKey, userinfo, cache.ttl);
       } catch (cacheError) {
-        logger.warn("Cache write failed (result still returned):", cacheError);
+        verificationCacheDegraded = true;
+        if (!cacheWriteFailureEscalated) {
+          cacheWriteFailureEscalated = true;
+          logger.error(
+            "Cache write failed \u2014 result still returned. cache adapter \u969C\u5BB3\u6642\u306F introspect \u7D50\u679C\u304C\u30AD\u30E3\u30C3\u30B7\u30E5\u3055\u308C\u305A\u5168 verification \u304C API \u547C\u3073\u51FA\u3057\u306B degrade \u3057\u307E\u3059\uFF08\u3053\u306E error \u306F instance \u3054\u3068\u306B\u521D\u56DE\u306E\u307F\u3001\u4EE5\u964D\u306F warn\uFF09:",
+            cacheError
+          );
+        } else {
+          logger.warn("Cache write failed (result still returned):", cacheError);
+        }
       }
     }
-    return { data: userinfo };
+    return verificationCacheDegraded ? { data: userinfo, meta: { verificationCacheDegraded: true } } : { data: userinfo };
   }
   async function buildCacheKey(token, suffix) {
-    let key;
-    if (typeof globalThis.crypto?.subtle?.digest === "function") {
-      const encoder = new TextEncoder();
-      const data = encoder.encode(token);
-      const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-      const hashArray = Array.from(new Uint8Array(hashBuffer));
-      const hashHex = hashArray.map((b) => b.toString(HEX_BASE).padStart(HEX_BYTE_WIDTH, "0")).join("");
-      key = CACHE_KEY_PREFIX + hashHex;
-    } else {
-      const tokenPrefix = token.length > TOKEN_LOG_PREFIX_LENGTH ? token.substring(0, TOKEN_LOG_PREFIX_LENGTH) + "..." : "***";
-      logger.warn(
-        `crypto.subtle \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081\u3001\u30AD\u30E3\u30C3\u30B7\u30E5\u30AD\u30FC\u306B\u30CF\u30C3\u30B7\u30E5\u5316\u3055\u308C\u3066\u3044\u306A\u3044\u30C8\u30FC\u30AF\u30F3\u3092\u4F7F\u7528\u3057\u307E\u3059 (token prefix: ${tokenPrefix})`
-      );
-      key = CACHE_KEY_PREFIX + token;
-    }
+    if (typeof globalThis.crypto?.subtle?.digest !== "function") {
+      if (!missingSubtleCryptoLogged) {
+        missingSubtleCryptoLogged = true;
+        logger.error(
+          "crypto.subtle \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081 introspect \u7D50\u679C\u306E\u30AD\u30E3\u30C3\u30B7\u30E5\u3092\u7121\u52B9\u5316\u3057\u307E\u3057\u305F\uFF08\u30CF\u30C3\u30B7\u30E5\u5316\u3055\u308C\u3066\u3044\u306A\u3044\u30C8\u30FC\u30AF\u30F3\u3092 cache key \u306B\u4F7F\u308F\u306A\u3044\u305F\u3081\u306E\u63AA\u7F6E #4119\uFF09\u3002\u5168 verification \u304C API \u547C\u3073\u51FA\u3057\u306B\u306A\u308A\u307E\u3059"
+        );
+      }
+      return null;
+    }
+    const encoder = new TextEncoder();
+    const data = encoder.encode(token);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    const hashHex = hashArray.map((b) => b.toString(HEX_BASE).padStart(HEX_BYTE_WIDTH, "0")).join("");
+    const key = CACHE_KEY_PREFIX + hashHex;
     return suffix ? `${key}:${suffix}` : key;
   }
   return verifyAccessToken;
@@ -1201,7 +1222,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.19.0";
+var SDK_VERSION = "5.22.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1443,33 +1464,48 @@ function createOAuthTokenMethods(deps) {
   async function signOutToken() {
     const tokens = tokenStore.getTokens();
     tokenStore.clearTokens();
+    const allRevoked = {
+      revoked: true,
+      accessTokenRevoked: true,
+      refreshTokenRevoked: true
+    };
     if (!tokens) {
       logger.debug("No tokens to revoke");
-      return { data: void 0 };
+      return { data: allRevoked };
     }
-    const url = `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`;
-    logger.debug("Revoking token:", url);
-    try {
-      const response = await fetch(url, {
-        method: "POST",
-        credentials: "omit",
-        headers: { "Content-Type": "application/x-www-form-urlencoded", ...sdkHeaders() },
-        body: new URLSearchParams({
-          token: tokens.accessToken,
-          client_id: clientId
-        }).toString()
-      });
-      if (!response.ok) {
-        logger.warn(
-          "\u30C8\u30FC\u30AF\u30F3\u7121\u52B9\u5316\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30B5\u30FC\u30D0\u30FC\u3067\u5931\u6557\u3057\u307E\u3057\u305F:",
-          `status=${response.status}`
-        );
+    async function revokeOAuthToken(token, tokenTypeHint) {
+      const url = `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`;
+      try {
+        const response = await fetch(url, {
+          method: "POST",
+          credentials: "omit",
+          headers: { "Content-Type": "application/x-www-form-urlencoded", ...sdkHeaders() },
+          body: new URLSearchParams({
+            token,
+            client_id: clientId,
+            token_type_hint: tokenTypeHint
+          }).toString()
+        });
+        return response.ok;
+      } catch {
+        return false;
       }
-    } catch (error) {
-      logger.warn("\u30C8\u30FC\u30AF\u30F3\u7121\u52B9\u5316\u306E\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30EA\u30AF\u30A8\u30B9\u30C8\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+    }
+    logger.debug("Revoking tokens:", `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`);
+    const accessTokenRevoked = await revokeOAuthToken(tokens.accessToken, "access_token");
+    if (!accessTokenRevoked) {
+      logger.warn("\u30A2\u30AF\u30BB\u30B9\u30C8\u30FC\u30AF\u30F3\u306E\u7121\u52B9\u5316\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30B5\u30FC\u30D0\u30FC\u3067\u5931\u6557\u3057\u307E\u3057\u305F");
+    }
+    const refreshTokenRevoked = tokens.refreshToken ? await revokeOAuthToken(tokens.refreshToken, "refresh_token") : true;
+    if (tokens.refreshToken && !refreshTokenRevoked) {
+      logger.warn("\u30EA\u30D5\u30EC\u30C3\u30B7\u30E5\u30C8\u30FC\u30AF\u30F3\u306E\u7121\u52B9\u5316\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30B5\u30FC\u30D0\u30FC\u3067\u5931\u6557\u3057\u307E\u3057\u305F");
+    }
+    const revoked = accessTokenRevoked && refreshTokenRevoked;
+    if (!revoked) {
+      logger.warn("\u30C8\u30FC\u30AF\u30F3\u7121\u52B9\u5316\u304C\u4E00\u90E8\u307E\u305F\u306F\u5168\u90E8\u5931\u6557\u3057\u307E\u3057\u305F\uFF08\u30ED\u30FC\u30AB\u30EB\u30C8\u30FC\u30AF\u30F3\u306F\u30AF\u30EA\u30A2\u6E08\u307F\uFF09");
     }
     logger.debug("Token sign-out completed");
-    return { data: void 0 };
+    return { data: { revoked, accessTokenRevoked, refreshTokenRevoked } };
   }
   return { exchangeCodeForTokens, refreshAccessToken, signOutToken };
 }
@@ -1633,7 +1669,7 @@ function createSessionMethods(deps) {
     }
     if (response.status === NO_CONTENT_STATUS) {
       logger.debug("Response: 204 No Content");
-      return { data: void 0 };
+      return { data: { revoked: true } };
     }
     if (!response.ok) {
       try {
@@ -1660,7 +1696,7 @@ function createSessionMethods(deps) {
       }
     }
     logger.debug("Response:", response.status);
-    return { data: void 0 };
+    return { data: { revoked: true } };
   }
   return { getSession, signOutCookie };
 }
@@ -1783,6 +1819,9 @@ var REDIRECT_LOOP_WINDOW_MS = 6e4;
 var REDIRECT_LOOP_THRESHOLD = 3;
 var storageReadFailureLogged = false;
 var storageWriteFailureLogged = false;
+function isLoopDetectionDegraded() {
+  return storageReadFailureLogged || storageWriteFailureLogged;
+}
 function logStorageReadFailure(logger, err) {
   if (storageReadFailureLogged) return;
   storageReadFailureLogged = true;
@@ -1927,9 +1966,16 @@ function createRedirectMethods(deps) {
     }
     const state = generateRandomState();
     if (!storeState(state, logger)) {
+      cleanupVerifierStorage(logger);
+      cleanupStateStorage(logger);
       logger.error(
-        "redirectToAuthorize: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF\u3067\u306E CSRF \u691C\u8A3C\u304C\u5931\u6557\u3057\u307E\u3059"
+        "redirectToAuthorize: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u8A8D\u53EF\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
       );
+      return {
+        success: false,
+        code: "state_persistence_failed",
+        error: "OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u8A8D\u53EF\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+      };
     }
     const redirectUri = resolvedRedirectUri ?? window.location.origin + window.location.pathname;
     const params = new URLSearchParams({
@@ -1964,7 +2010,7 @@ function createRedirectMethods(deps) {
       rollbackLastRedirectAttempt(authorizeKey, logger);
       throw err;
     }
-    return { success: true };
+    return isLoopDetectionDegraded() ? { success: true, loopDetectionDisabled: true } : { success: true };
   }
   async function redirectToLogin(options) {
     if (typeof window === "undefined") {

package/dist/server/index.d.cts

@@ -1,8 +1,8 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-BuDM5tmq.cjs';
-export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDProvisionMemberPlan, x as FFIDProvisionMemberPlanStatus, y as FFIDProvisionMemberResult, z as FFIDProvisionMemberStatus, A as FFIDProvisionOrganizationDryRun, B as FFIDProvisionOrganizationMemberInput, C as FFIDProvisionOrganizationOutcome, D as FFIDProvisionOrganizationParams, E as FFIDProvisionOrganizationResponse, G as FFIDProvisionUserDryRun, H as FFIDProvisionUserOutcome, I as FFIDProvisionUserParams, J as FFIDProvisionUserProfileInput, K as FFIDProvisionUserResponse, L as FFIDProvisionedOrganization, M as FFIDProvisionedUser, N as FFIDRemoveMemberResponse, O as FFIDResetSessionResponse, P as FFIDSubscription, Q as FFIDUpdateMemberRoleResponse, R as FFIDUpdateUserProfileRequest, S as FFIDUser, T as FFIDUserProfile, U as TokenData, V as TokenStore, W as createFFIDClient, X as createTokenStore } from '../ffid-client-BuDM5tmq.cjs';
+import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-CEJMpqRZ.cjs';
+export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDProvisionMemberPlan, x as FFIDProvisionMemberPlanStatus, y as FFIDProvisionMemberResult, z as FFIDProvisionMemberStatus, A as FFIDProvisionOrganizationDryRun, B as FFIDProvisionOrganizationMemberInput, C as FFIDProvisionOrganizationOutcome, D as FFIDProvisionOrganizationParams, E as FFIDProvisionOrganizationResponse, G as FFIDProvisionUserDryRun, H as FFIDProvisionUserOutcome, I as FFIDProvisionUserParams, J as FFIDProvisionUserProfileInput, K as FFIDProvisionUserResponse, L as FFIDProvisionedOrganization, M as FFIDProvisionedUser, N as FFIDRemoveMemberResponse, O as FFIDResetSessionResponse, P as FFIDSubscription, Q as FFIDUpdateMemberRoleResponse, R as FFIDUpdateUserProfileRequest, S as FFIDUser, T as FFIDUserProfile, U as TokenData, V as TokenStore, W as createFFIDClient, X as createTokenStore } from '../ffid-client-CEJMpqRZ.cjs';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-D61jqRIO.cjs';
 import { z } from 'zod';
-import '../types-BeVl-z12.cjs';
+import '../types-Cjb9J0rL.cjs';
 
 /**
  * FFID SDK error codes

package/dist/server/index.d.ts

@@ -1,8 +1,8 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-D0x8TBS5.js';
-export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDProvisionMemberPlan, x as FFIDProvisionMemberPlanStatus, y as FFIDProvisionMemberResult, z as FFIDProvisionMemberStatus, A as FFIDProvisionOrganizationDryRun, B as FFIDProvisionOrganizationMemberInput, C as FFIDProvisionOrganizationOutcome, D as FFIDProvisionOrganizationParams, E as FFIDProvisionOrganizationResponse, G as FFIDProvisionUserDryRun, H as FFIDProvisionUserOutcome, I as FFIDProvisionUserParams, J as FFIDProvisionUserProfileInput, K as FFIDProvisionUserResponse, L as FFIDProvisionedOrganization, M as FFIDProvisionedUser, N as FFIDRemoveMemberResponse, O as FFIDResetSessionResponse, P as FFIDSubscription, Q as FFIDUpdateMemberRoleResponse, R as FFIDUpdateUserProfileRequest, S as FFIDUser, T as FFIDUserProfile, U as TokenData, V as TokenStore, W as createFFIDClient, X as createTokenStore } from '../ffid-client-D0x8TBS5.js';
+import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-DM0ZhIDV.js';
+export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDProvisionMemberPlan, x as FFIDProvisionMemberPlanStatus, y as FFIDProvisionMemberResult, z as FFIDProvisionMemberStatus, A as FFIDProvisionOrganizationDryRun, B as FFIDProvisionOrganizationMemberInput, C as FFIDProvisionOrganizationOutcome, D as FFIDProvisionOrganizationParams, E as FFIDProvisionOrganizationResponse, G as FFIDProvisionUserDryRun, H as FFIDProvisionUserOutcome, I as FFIDProvisionUserParams, J as FFIDProvisionUserProfileInput, K as FFIDProvisionUserResponse, L as FFIDProvisionedOrganization, M as FFIDProvisionedUser, N as FFIDRemoveMemberResponse, O as FFIDResetSessionResponse, P as FFIDSubscription, Q as FFIDUpdateMemberRoleResponse, R as FFIDUpdateUserProfileRequest, S as FFIDUser, T as FFIDUserProfile, U as TokenData, V as TokenStore, W as createFFIDClient, X as createTokenStore } from '../ffid-client-DM0ZhIDV.js';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-D61jqRIO.js';
 import { z } from 'zod';
-import '../types-BeVl-z12.js';
+import '../types-Cjb9J0rL.js';
 
 /**
  * FFID SDK error codes

package/dist/server/index.js

@@ -260,10 +260,12 @@ var OAUTH_INTROSPECT_ENDPOINT = "/api/v1/oauth/introspect";
 var CACHE_KEY_PREFIX = "ffid:introspect:";
 var HEX_BASE = 16;
 var HEX_BYTE_WIDTH = 2;
-var TOKEN_LOG_PREFIX_LENGTH = 8;
 function createVerifyAccessToken(deps) {
   const { authMode, baseUrl, serviceCode, serviceApiKey, verifyStrategy, logger, createError, errorCodes, cache, timeout } = deps;
   let jwtVerify2 = null;
+  let cacheReadFailureEscalated = false;
+  let cacheWriteFailureEscalated = false;
+  let missingSubtleCryptoLogged = false;
   function getJwtVerifier() {
     if (!jwtVerify2) {
       jwtVerify2 = createJwtVerifier({
@@ -323,8 +325,9 @@ function createVerifyAccessToken(deps) {
     }
     const url = `${baseUrl}${OAUTH_INTROSPECT_ENDPOINT}`;
     logger.debug("Verifying access token:", url);
-    const cacheKey = cache ? await buildCacheKey(accessToken, cacheKeySuffix) : "";
-    if (cache) {
+    const cacheKey = cache ? await buildCacheKey(accessToken, cacheKeySuffix) : null;
+    let verificationCacheDegraded = cache !== void 0 && cacheKey === null;
+    if (cache && cacheKey !== null) {
       try {
         const cached = await cache.adapter.get(cacheKey);
         if (cached && typeof cached === "object" && "sub" in cached) {
@@ -332,7 +335,16 @@ function createVerifyAccessToken(deps) {
           return { data: cached };
         }
       } catch (cacheError) {
-        logger.warn("Cache read failed, falling back to API call:", cacheError);
+        verificationCacheDegraded = true;
+        if (!cacheReadFailureEscalated) {
+          cacheReadFailureEscalated = true;
+          logger.error(
+            "Cache read failed \u2014 falling back to API call. Redis \u7B49\u306E cache adapter \u969C\u5BB3\u6642\u306F\u5168 verification \u304C introspect \u306B degrade \u3057\u307E\u3059\uFF08\u3053\u306E error \u306F instance \u3054\u3068\u306B\u521D\u56DE\u306E\u307F\u3001\u4EE5\u964D\u306F warn\uFF09:",
+            cacheError
+          );
+        } else {
+          logger.warn("Cache read failed, falling back to API call:", cacheError);
+        }
       }
     }
     const fetchOptions = {
@@ -427,31 +439,40 @@ function createVerifyAccessToken(deps) {
       }
     } : base;
     const userinfo = normalizeUserinfo(raw);
-    if (cache) {
+    if (cache && cacheKey !== null) {
       try {
         await cache.adapter.set(cacheKey, userinfo, cache.ttl);
       } catch (cacheError) {
-        logger.warn("Cache write failed (result still returned):", cacheError);
+        verificationCacheDegraded = true;
+        if (!cacheWriteFailureEscalated) {
+          cacheWriteFailureEscalated = true;
+          logger.error(
+            "Cache write failed \u2014 result still returned. cache adapter \u969C\u5BB3\u6642\u306F introspect \u7D50\u679C\u304C\u30AD\u30E3\u30C3\u30B7\u30E5\u3055\u308C\u305A\u5168 verification \u304C API \u547C\u3073\u51FA\u3057\u306B degrade \u3057\u307E\u3059\uFF08\u3053\u306E error \u306F instance \u3054\u3068\u306B\u521D\u56DE\u306E\u307F\u3001\u4EE5\u964D\u306F warn\uFF09:",
+            cacheError
+          );
+        } else {
+          logger.warn("Cache write failed (result still returned):", cacheError);
+        }
       }
     }
-    return { data: userinfo };
+    return verificationCacheDegraded ? { data: userinfo, meta: { verificationCacheDegraded: true } } : { data: userinfo };
   }
   async function buildCacheKey(token, suffix) {
-    let key;
-    if (typeof globalThis.crypto?.subtle?.digest === "function") {
-      const encoder = new TextEncoder();
-      const data = encoder.encode(token);
-      const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-      const hashArray = Array.from(new Uint8Array(hashBuffer));
-      const hashHex = hashArray.map((b) => b.toString(HEX_BASE).padStart(HEX_BYTE_WIDTH, "0")).join("");
-      key = CACHE_KEY_PREFIX + hashHex;
-    } else {
-      const tokenPrefix = token.length > TOKEN_LOG_PREFIX_LENGTH ? token.substring(0, TOKEN_LOG_PREFIX_LENGTH) + "..." : "***";
-      logger.warn(
-        `crypto.subtle \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081\u3001\u30AD\u30E3\u30C3\u30B7\u30E5\u30AD\u30FC\u306B\u30CF\u30C3\u30B7\u30E5\u5316\u3055\u308C\u3066\u3044\u306A\u3044\u30C8\u30FC\u30AF\u30F3\u3092\u4F7F\u7528\u3057\u307E\u3059 (token prefix: ${tokenPrefix})`
-      );
-      key = CACHE_KEY_PREFIX + token;
-    }
+    if (typeof globalThis.crypto?.subtle?.digest !== "function") {
+      if (!missingSubtleCryptoLogged) {
+        missingSubtleCryptoLogged = true;
+        logger.error(
+          "crypto.subtle \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081 introspect \u7D50\u679C\u306E\u30AD\u30E3\u30C3\u30B7\u30E5\u3092\u7121\u52B9\u5316\u3057\u307E\u3057\u305F\uFF08\u30CF\u30C3\u30B7\u30E5\u5316\u3055\u308C\u3066\u3044\u306A\u3044\u30C8\u30FC\u30AF\u30F3\u3092 cache key \u306B\u4F7F\u308F\u306A\u3044\u305F\u3081\u306E\u63AA\u7F6E #4119\uFF09\u3002\u5168 verification \u304C API \u547C\u3073\u51FA\u3057\u306B\u306A\u308A\u307E\u3059"
+        );
+      }
+      return null;
+    }
+    const encoder = new TextEncoder();
+    const data = encoder.encode(token);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    const hashHex = hashArray.map((b) => b.toString(HEX_BASE).padStart(HEX_BYTE_WIDTH, "0")).join("");
+    const key = CACHE_KEY_PREFIX + hashHex;
     return suffix ? `${key}:${suffix}` : key;
   }
   return verifyAccessToken;
@@ -1200,7 +1221,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.19.0";
+var SDK_VERSION = "5.22.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1442,33 +1463,48 @@ function createOAuthTokenMethods(deps) {
   async function signOutToken() {
     const tokens = tokenStore.getTokens();
     tokenStore.clearTokens();
+    const allRevoked = {
+      revoked: true,
+      accessTokenRevoked: true,
+      refreshTokenRevoked: true
+    };
     if (!tokens) {
       logger.debug("No tokens to revoke");
-      return { data: void 0 };
+      return { data: allRevoked };
     }
-    const url = `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`;
-    logger.debug("Revoking token:", url);
-    try {
-      const response = await fetch(url, {
-        method: "POST",
-        credentials: "omit",
-        headers: { "Content-Type": "application/x-www-form-urlencoded", ...sdkHeaders() },
-        body: new URLSearchParams({
-          token: tokens.accessToken,
-          client_id: clientId
-        }).toString()
-      });
-      if (!response.ok) {
-        logger.warn(
-          "\u30C8\u30FC\u30AF\u30F3\u7121\u52B9\u5316\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30B5\u30FC\u30D0\u30FC\u3067\u5931\u6557\u3057\u307E\u3057\u305F:",
-          `status=${response.status}`
-        );
+    async function revokeOAuthToken(token, tokenTypeHint) {
+      const url = `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`;
+      try {
+        const response = await fetch(url, {
+          method: "POST",
+          credentials: "omit",
+          headers: { "Content-Type": "application/x-www-form-urlencoded", ...sdkHeaders() },
+          body: new URLSearchParams({
+            token,
+            client_id: clientId,
+            token_type_hint: tokenTypeHint
+          }).toString()
+        });
+        return response.ok;
+      } catch {
+        return false;
       }
-    } catch (error) {
-      logger.warn("\u30C8\u30FC\u30AF\u30F3\u7121\u52B9\u5316\u306E\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30EA\u30AF\u30A8\u30B9\u30C8\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+    }
+    logger.debug("Revoking tokens:", `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`);
+    const accessTokenRevoked = await revokeOAuthToken(tokens.accessToken, "access_token");
+    if (!accessTokenRevoked) {
+      logger.warn("\u30A2\u30AF\u30BB\u30B9\u30C8\u30FC\u30AF\u30F3\u306E\u7121\u52B9\u5316\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30B5\u30FC\u30D0\u30FC\u3067\u5931\u6557\u3057\u307E\u3057\u305F");
+    }
+    const refreshTokenRevoked = tokens.refreshToken ? await revokeOAuthToken(tokens.refreshToken, "refresh_token") : true;
+    if (tokens.refreshToken && !refreshTokenRevoked) {
+      logger.warn("\u30EA\u30D5\u30EC\u30C3\u30B7\u30E5\u30C8\u30FC\u30AF\u30F3\u306E\u7121\u52B9\u5316\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30B5\u30FC\u30D0\u30FC\u3067\u5931\u6557\u3057\u307E\u3057\u305F");
+    }
+    const revoked = accessTokenRevoked && refreshTokenRevoked;
+    if (!revoked) {
+      logger.warn("\u30C8\u30FC\u30AF\u30F3\u7121\u52B9\u5316\u304C\u4E00\u90E8\u307E\u305F\u306F\u5168\u90E8\u5931\u6557\u3057\u307E\u3057\u305F\uFF08\u30ED\u30FC\u30AB\u30EB\u30C8\u30FC\u30AF\u30F3\u306F\u30AF\u30EA\u30A2\u6E08\u307F\uFF09");
     }
     logger.debug("Token sign-out completed");
-    return { data: void 0 };
+    return { data: { revoked, accessTokenRevoked, refreshTokenRevoked } };
   }
   return { exchangeCodeForTokens, refreshAccessToken, signOutToken };
 }
@@ -1632,7 +1668,7 @@ function createSessionMethods(deps) {
     }
     if (response.status === NO_CONTENT_STATUS) {
       logger.debug("Response: 204 No Content");
-      return { data: void 0 };
+      return { data: { revoked: true } };
     }
     if (!response.ok) {
       try {
@@ -1659,7 +1695,7 @@ function createSessionMethods(deps) {
       }
     }
     logger.debug("Response:", response.status);
-    return { data: void 0 };
+    return { data: { revoked: true } };
   }
   return { getSession, signOutCookie };
 }
@@ -1782,6 +1818,9 @@ var REDIRECT_LOOP_WINDOW_MS = 6e4;
 var REDIRECT_LOOP_THRESHOLD = 3;
 var storageReadFailureLogged = false;
 var storageWriteFailureLogged = false;
+function isLoopDetectionDegraded() {
+  return storageReadFailureLogged || storageWriteFailureLogged;
+}
 function logStorageReadFailure(logger, err) {
   if (storageReadFailureLogged) return;
   storageReadFailureLogged = true;
@@ -1926,9 +1965,16 @@ function createRedirectMethods(deps) {
     }
     const state = generateRandomState();
     if (!storeState(state, logger)) {
+      cleanupVerifierStorage(logger);
+      cleanupStateStorage(logger);
       logger.error(
-        "redirectToAuthorize: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF\u3067\u306E CSRF \u691C\u8A3C\u304C\u5931\u6557\u3057\u307E\u3059"
+        "redirectToAuthorize: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u8A8D\u53EF\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
       );
+      return {
+        success: false,
+        code: "state_persistence_failed",
+        error: "OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u8A8D\u53EF\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+      };
     }
     const redirectUri = resolvedRedirectUri ?? window.location.origin + window.location.pathname;
     const params = new URLSearchParams({
@@ -1963,7 +2009,7 @@ function createRedirectMethods(deps) {
       rollbackLastRedirectAttempt(authorizeKey, logger);
       throw err;
     }
-    return { success: true };
+    return isLoopDetectionDegraded() ? { success: true, loopDetectionDisabled: true } : { success: true };
   }
   async function redirectToLogin(options) {
     if (typeof window === "undefined") {

package/dist/server/test/index.d.cts

@@ -1,5 +1,5 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-BuDM5tmq.cjs';
-import '../../types-BeVl-z12.cjs';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-CEJMpqRZ.cjs';
+import '../../types-Cjb9J0rL.cjs';
 
 /**
  * FFID SDK - Test mode client (E2E / integration test bypass)

package/dist/server/test/index.d.ts

@@ -1,5 +1,5 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-D0x8TBS5.js';
-import '../../types-BeVl-z12.js';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-DM0ZhIDV.js';
+import '../../types-Cjb9J0rL.js';
 
 /**
  * FFID SDK - Test mode client (E2E / integration test bypass)

package/dist/{types-BeVl-z12.d.cts → types-Cjb9J0rL.d.cts}

@@ -56,7 +56,8 @@ declare const EFFECTIVE_SUBSCRIPTION_STATUSES: readonly ["active", "active_cance
  * `src/lib/common/subscription-helpers.ts`, and a server-side unit test pins
  * element-equality between the two arrays (#3474) — convention-only sync
  * could drift silently in the server-extending direction (a new server
- * literal would fall through SDK consumers' `switch` defaults).
+ * literal would fall through SDK consumers' `switch` defaults). The PR gate also
+ * runs `npm run sdk:verify-sync` for SDK/server subscription changes.
  */
 type EffectiveSubscriptionStatus = (typeof EFFECTIVE_SUBSCRIPTION_STATUSES)[number];
 

package/dist/{types-BeVl-z12.d.ts → types-Cjb9J0rL.d.ts}

@@ -56,7 +56,8 @@ declare const EFFECTIVE_SUBSCRIPTION_STATUSES: readonly ["active", "active_cance
  * `src/lib/common/subscription-helpers.ts`, and a server-side unit test pins
  * element-equality between the two arrays (#3474) — convention-only sync
  * could drift silently in the server-extending direction (a new server
- * literal would fall through SDK consumers' `switch` defaults).
+ * literal would fall through SDK consumers' `switch` defaults). The PR gate also
+ * runs `npm run sdk:verify-sync` for SDK/server subscription changes.
  */
 type EffectiveSubscriptionStatus = (typeof EFFECTIVE_SUBSCRIPTION_STATUSES)[number];
 

package/dist/webhooks/index.cjs

@@ -89,7 +89,6 @@ function verifyWebhookSignature(rawBody, signatureHeader, secret, toleranceSecon
 }
 
 // src/webhooks/handler.ts
-var SDK_LOG_PREFIX = "[FFID Webhook SDK]";
 var HTTP_OK = 200;
 var HTTP_BAD_REQUEST = 400;
 var HTTP_INTERNAL_SERVER_ERROR = 500;
@@ -100,7 +99,8 @@ var noopLogger = {
   },
   warn: () => {
   },
-  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
+  error: () => {
+  }
 };
 function createFFIDWebhookHandler(config) {
   if (!config.secret) {

package/dist/webhooks/index.d.cts

@@ -1,4 +1,4 @@
-import { E as EffectiveSubscriptionStatus } from '../types-BeVl-z12.cjs';
+import { E as EffectiveSubscriptionStatus } from '../types-Cjb9J0rL.cjs';
 
 /**
  * FFID Webhook SDK Constants

package/dist/webhooks/index.d.ts

@@ -1,4 +1,4 @@
-import { E as EffectiveSubscriptionStatus } from '../types-BeVl-z12.js';
+import { E as EffectiveSubscriptionStatus } from '../types-Cjb9J0rL.js';
 
 /**
  * FFID Webhook SDK Constants

package/dist/webhooks/index.js

@@ -87,7 +87,6 @@ function verifyWebhookSignature(rawBody, signatureHeader, secret, toleranceSecon
 }
 
 // src/webhooks/handler.ts
-var SDK_LOG_PREFIX = "[FFID Webhook SDK]";
 var HTTP_OK = 200;
 var HTTP_BAD_REQUEST = 400;
 var HTTP_INTERNAL_SERVER_ERROR = 500;
@@ -98,7 +97,8 @@ var noopLogger = {
   },
   warn: () => {
   },
-  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
+  error: () => {
+  }
 };
 function createFFIDWebhookHandler(config) {
   if (!config.secret) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feelflow/ffid-sdk",
-  "version": "5.19.0",
+  "version": "5.22.0",
   "description": "FeelFlow ID Platform SDK for React/Next.js applications",
   "keywords": [
     "feelflow",