@feelflow/ffid-sdk 5.21.0 → 5.22.0

package/README.md

@@ -185,6 +185,7 @@ function Header() {
   refreshInterval={300000}            // オプション: セッション更新間隔（ms）
   onAuthStateChange={(user) => {}}    // オプション: 認証状態変更時コールバック
   onError={(error) => {}}             // オプション: エラー時コールバック
+  cleanCallbackUrl={true}             // オプション: token モードの callback URL cleanup（false で consumer に委譲、v5.22.0+）
 >
   {children}
 </FFIDProvider>

package/dist/{chunk-U57ZDFEN.js → chunk-7NRO2TBG.js}

@@ -1225,7 +1225,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.21.0";
+var SDK_VERSION = "5.22.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -3498,7 +3498,7 @@ async function handleRedirectCallback(client, options) {
         };
       }
       logger.error(
-        "handleRedirectCallback: OAuth state mismatch or omitted (possible CSRF) \u2014 \u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+        "handleRedirectCallback: OAuth state mismatch or omitted (possible CSRF) \u2014 \u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F\u3002\u6D88\u8CBB\u6E08\u307F callback \u30D1\u30E9\u30E1\u30FC\u30BF\u306E\u518D\u51E6\u7406\uFF08`cleanUrl: false` \u5229\u7528\u6642\u306E cleanup \u6F0F\u308C\u3084 reload \u7B49\uFF09\u3067\u3082\u767A\u751F\u3057\u307E\u3059"
       );
       return {
         error: client.createError(
@@ -3511,7 +3511,11 @@ async function handleRedirectCallback(client, options) {
   const verifier = retrieveCodeVerifier(logger);
   const result = await client.exchangeCodeForTokens(code, verifier ?? void 0);
   if (!result.error && hasWindow) {
-    cleanCallbackUrlParams(logger);
+    if (options?.cleanUrl !== false) {
+      cleanCallbackUrlParams(logger);
+    } else {
+      logger.debug("handleRedirectCallback: cleanUrl=false \u306E\u305F\u3081 URL cleanup \u3092 consumer \u306B\u59D4\u8B72\u3057\u307E\u3057\u305F");
+    }
   }
   return result;
 }
@@ -3530,7 +3534,8 @@ function FFIDProvider({
   onAuthStateChange,
   onError,
   authMode,
-  clientId
+  clientId,
+  cleanCallbackUrl = true
 }) {
   const [user, setUser] = useState(null);
   const [organizations, setOrganizations] = useState([]);
@@ -3682,14 +3687,17 @@ function FFIDProvider({
     },
     [organizations, client]
   );
+  const handledCodeRef = useRef(null);
   useEffect(() => {
     if (client.authMode !== "token") return;
     if (typeof window === "undefined") return;
     const urlParams = new URLSearchParams(window.location.search);
     const code = urlParams.get("code");
     if (!code) return;
+    if (handledCodeRef.current === code) return;
+    handledCodeRef.current = code;
     client.logger.debug("Authorization code detected, exchanging for tokens");
-    handleRedirectCallback(client).then((result) => {
+    handleRedirectCallback(client, { cleanUrl: cleanCallbackUrl }).then((result) => {
       if (result.error) {
         client.logger.error("Token exchange failed:", result.error);
         setError(result.error);

package/dist/{chunk-RDQ4R3XC.cjs → chunk-EM5EGNGE.cjs}

@@ -1227,7 +1227,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.21.0";
+var SDK_VERSION = "5.22.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -3500,7 +3500,7 @@ async function handleRedirectCallback(client, options) {
         };
       }
       logger.error(
-        "handleRedirectCallback: OAuth state mismatch or omitted (possible CSRF) \u2014 \u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+        "handleRedirectCallback: OAuth state mismatch or omitted (possible CSRF) \u2014 \u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F\u3002\u6D88\u8CBB\u6E08\u307F callback \u30D1\u30E9\u30E1\u30FC\u30BF\u306E\u518D\u51E6\u7406\uFF08`cleanUrl: false` \u5229\u7528\u6642\u306E cleanup \u6F0F\u308C\u3084 reload \u7B49\uFF09\u3067\u3082\u767A\u751F\u3057\u307E\u3059"
       );
       return {
         error: client.createError(
@@ -3513,7 +3513,11 @@ async function handleRedirectCallback(client, options) {
   const verifier = retrieveCodeVerifier(logger);
   const result = await client.exchangeCodeForTokens(code, verifier ?? void 0);
   if (!result.error && hasWindow) {
-    cleanCallbackUrlParams(logger);
+    if (options?.cleanUrl !== false) {
+      cleanCallbackUrlParams(logger);
+    } else {
+      logger.debug("handleRedirectCallback: cleanUrl=false \u306E\u305F\u3081 URL cleanup \u3092 consumer \u306B\u59D4\u8B72\u3057\u307E\u3057\u305F");
+    }
   }
   return result;
 }
@@ -3532,7 +3536,8 @@ function FFIDProvider({
   onAuthStateChange,
   onError,
   authMode,
-  clientId
+  clientId,
+  cleanCallbackUrl = true
 }) {
   const [user, setUser] = react.useState(null);
   const [organizations, setOrganizations] = react.useState([]);
@@ -3684,14 +3689,17 @@ function FFIDProvider({
     },
     [organizations, client]
   );
+  const handledCodeRef = react.useRef(null);
   react.useEffect(() => {
     if (client.authMode !== "token") return;
     if (typeof window === "undefined") return;
     const urlParams = new URLSearchParams(window.location.search);
     const code = urlParams.get("code");
     if (!code) return;
+    if (handledCodeRef.current === code) return;
+    handledCodeRef.current = code;
     client.logger.debug("Authorization code detected, exchanging for tokens");
-    handleRedirectCallback(client).then((result) => {
+    handleRedirectCallback(client, { cleanUrl: cleanCallbackUrl }).then((result) => {
       if (result.error) {
         client.logger.error("Token exchange failed:", result.error);
         setError(result.error);

package/dist/components/index.cjs

@@ -1,34 +1,34 @@
 'use strict';
 
-var chunkRDQ4R3XC_cjs = require('../chunk-RDQ4R3XC.cjs');
+var chunkEM5EGNGE_cjs = require('../chunk-EM5EGNGE.cjs');
 
 
 
 Object.defineProperty(exports, "FFIDAnnouncementBadge", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFIDAnnouncementBadge; }
+  get: function () { return chunkEM5EGNGE_cjs.FFIDAnnouncementBadge; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementList", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFIDAnnouncementList; }
+  get: function () { return chunkEM5EGNGE_cjs.FFIDAnnouncementList; }
 });
 Object.defineProperty(exports, "FFIDInquiryForm", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFIDInquiryForm; }
+  get: function () { return chunkEM5EGNGE_cjs.FFIDInquiryForm; }
 });
 Object.defineProperty(exports, "FFIDLoginButton", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFIDLoginButton; }
+  get: function () { return chunkEM5EGNGE_cjs.FFIDLoginButton; }
 });
 Object.defineProperty(exports, "FFIDOrganizationSwitcher", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFIDOrganizationSwitcher; }
+  get: function () { return chunkEM5EGNGE_cjs.FFIDOrganizationSwitcher; }
 });
 Object.defineProperty(exports, "FFIDSubscriptionBadge", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFIDSubscriptionBadge; }
+  get: function () { return chunkEM5EGNGE_cjs.FFIDSubscriptionBadge; }
 });
 Object.defineProperty(exports, "FFIDUserMenu", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFIDUserMenu; }
+  get: function () { return chunkEM5EGNGE_cjs.FFIDUserMenu; }
 });

package/dist/components/index.d.cts

@@ -1,3 +1,3 @@
-export { H as FFIDAnnouncementBadge, ai as FFIDAnnouncementBadgeClassNames, aj as FFIDAnnouncementBadgeProps, I as FFIDAnnouncementList, ak as FFIDAnnouncementListClassNames, al as FFIDAnnouncementListProps, S as FFIDInquiryForm, T as FFIDInquiryFormCategoryItem, U as FFIDInquiryFormClassNames, V as FFIDInquiryFormLegalLayout, W as FFIDInquiryFormOrganization, X as FFIDInquiryFormPlaceholderContext, Y as FFIDInquiryFormPrefill, Z as FFIDInquiryFormProps, _ as FFIDInquiryFormSubmitData, $ as FFIDInquiryFormSubmitResult, a1 as FFIDLoginButton, am as FFIDLoginButtonProps, a4 as FFIDOrganizationSwitcher, an as FFIDOrganizationSwitcherClassNames, ao as FFIDOrganizationSwitcherProps, a9 as FFIDSubscriptionBadge, ap as FFIDSubscriptionBadgeClassNames, aq as FFIDSubscriptionBadgeProps, ab as FFIDUserMenu, ar as FFIDUserMenuClassNames, as as FFIDUserMenuProps } from '../index--wRiPlpi.cjs';
+export { H as FFIDAnnouncementBadge, ai as FFIDAnnouncementBadgeClassNames, aj as FFIDAnnouncementBadgeProps, I as FFIDAnnouncementList, ak as FFIDAnnouncementListClassNames, al as FFIDAnnouncementListProps, S as FFIDInquiryForm, T as FFIDInquiryFormCategoryItem, U as FFIDInquiryFormClassNames, V as FFIDInquiryFormLegalLayout, W as FFIDInquiryFormOrganization, X as FFIDInquiryFormPlaceholderContext, Y as FFIDInquiryFormPrefill, Z as FFIDInquiryFormProps, _ as FFIDInquiryFormSubmitData, $ as FFIDInquiryFormSubmitResult, a1 as FFIDLoginButton, am as FFIDLoginButtonProps, a4 as FFIDOrganizationSwitcher, an as FFIDOrganizationSwitcherClassNames, ao as FFIDOrganizationSwitcherProps, a9 as FFIDSubscriptionBadge, ap as FFIDSubscriptionBadgeClassNames, aq as FFIDSubscriptionBadgeProps, ab as FFIDUserMenu, ar as FFIDUserMenuClassNames, as as FFIDUserMenuProps } from '../index-btouGGKr.cjs';
 import 'react/jsx-runtime';
 import 'react';

package/dist/components/index.d.ts

@@ -1,3 +1,3 @@
-export { H as FFIDAnnouncementBadge, ai as FFIDAnnouncementBadgeClassNames, aj as FFIDAnnouncementBadgeProps, I as FFIDAnnouncementList, ak as FFIDAnnouncementListClassNames, al as FFIDAnnouncementListProps, S as FFIDInquiryForm, T as FFIDInquiryFormCategoryItem, U as FFIDInquiryFormClassNames, V as FFIDInquiryFormLegalLayout, W as FFIDInquiryFormOrganization, X as FFIDInquiryFormPlaceholderContext, Y as FFIDInquiryFormPrefill, Z as FFIDInquiryFormProps, _ as FFIDInquiryFormSubmitData, $ as FFIDInquiryFormSubmitResult, a1 as FFIDLoginButton, am as FFIDLoginButtonProps, a4 as FFIDOrganizationSwitcher, an as FFIDOrganizationSwitcherClassNames, ao as FFIDOrganizationSwitcherProps, a9 as FFIDSubscriptionBadge, ap as FFIDSubscriptionBadgeClassNames, aq as FFIDSubscriptionBadgeProps, ab as FFIDUserMenu, ar as FFIDUserMenuClassNames, as as FFIDUserMenuProps } from '../index--wRiPlpi.js';
+export { H as FFIDAnnouncementBadge, ai as FFIDAnnouncementBadgeClassNames, aj as FFIDAnnouncementBadgeProps, I as FFIDAnnouncementList, ak as FFIDAnnouncementListClassNames, al as FFIDAnnouncementListProps, S as FFIDInquiryForm, T as FFIDInquiryFormCategoryItem, U as FFIDInquiryFormClassNames, V as FFIDInquiryFormLegalLayout, W as FFIDInquiryFormOrganization, X as FFIDInquiryFormPlaceholderContext, Y as FFIDInquiryFormPrefill, Z as FFIDInquiryFormProps, _ as FFIDInquiryFormSubmitData, $ as FFIDInquiryFormSubmitResult, a1 as FFIDLoginButton, am as FFIDLoginButtonProps, a4 as FFIDOrganizationSwitcher, an as FFIDOrganizationSwitcherClassNames, ao as FFIDOrganizationSwitcherProps, a9 as FFIDSubscriptionBadge, ap as FFIDSubscriptionBadgeClassNames, aq as FFIDSubscriptionBadgeProps, ab as FFIDUserMenu, ar as FFIDUserMenuClassNames, as as FFIDUserMenuProps } from '../index-btouGGKr.js';
 import 'react/jsx-runtime';
 import 'react';

package/dist/components/index.js

@@ -1 +1 @@
-export { FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDSubscriptionBadge, FFIDUserMenu } from '../chunk-U57ZDFEN.js';
+export { FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDSubscriptionBadge, FFIDUserMenu } from '../chunk-7NRO2TBG.js';

package/dist/{ffid-client-BQPhm-XL.d.cts → ffid-client-CEJMpqRZ.d.cts}

@@ -1,4 +1,4 @@
-import { E as EffectiveSubscriptionStatus } from './types-BeVl-z12.cjs';
+import { E as EffectiveSubscriptionStatus } from './types-Cjb9J0rL.cjs';
 
 /**
  * Inquiry types exposed by the FFID SDK.

package/dist/{ffid-client-Bx8y4SwC.d.ts → ffid-client-DM0ZhIDV.d.ts}

@@ -1,4 +1,4 @@
-import { E as EffectiveSubscriptionStatus } from './types-BeVl-z12.js';
+import { E as EffectiveSubscriptionStatus } from './types-Cjb9J0rL.js';
 
 /**
  * Inquiry types exposed by the FFID SDK.

package/dist/{index--wRiPlpi.d.cts → index-btouGGKr.d.cts}

@@ -80,7 +80,8 @@ declare const EFFECTIVE_SUBSCRIPTION_STATUSES: readonly ["active", "active_cance
  * `src/lib/common/subscription-helpers.ts`, and a server-side unit test pins
  * element-equality between the two arrays (#3474) — convention-only sync
  * could drift silently in the server-extending direction (a new server
- * literal would fall through SDK consumers' `switch` defaults).
+ * literal would fall through SDK consumers' `switch` defaults). The PR gate also
+ * runs `npm run sdk:verify-sync` for SDK/server subscription changes.
  */
 type EffectiveSubscriptionStatus = (typeof EFFECTIVE_SUBSCRIPTION_STATUSES)[number];
 

package/dist/{index--wRiPlpi.d.ts → index-btouGGKr.d.ts}

@@ -80,7 +80,8 @@ declare const EFFECTIVE_SUBSCRIPTION_STATUSES: readonly ["active", "active_cance
  * `src/lib/common/subscription-helpers.ts`, and a server-side unit test pins
  * element-equality between the two arrays (#3474) — convention-only sync
  * could drift silently in the server-extending direction (a new server
- * literal would fall through SDK consumers' `switch` defaults).
+ * literal would fall through SDK consumers' `switch` defaults). The PR gate also
+ * runs `npm run sdk:verify-sync` for SDK/server subscription changes.
  */
 type EffectiveSubscriptionStatus = (typeof EFFECTIVE_SUBSCRIPTION_STATUSES)[number];
 

package/dist/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkRDQ4R3XC_cjs = require('./chunk-RDQ4R3XC.cjs');
+var chunkEM5EGNGE_cjs = require('./chunk-EM5EGNGE.cjs');
 var chunkH5O2CCAY_cjs = require('./chunk-H5O2CCAY.cjs');
 var react = require('react');
 var jsxRuntime = require('react/jsx-runtime');
@@ -54,8 +54,8 @@ function defaultRedirect(url) {
 }
 function useRequireActiveSubscription(options) {
   const { redirectTo, allowGrace = true, onRedirect } = options;
-  const { isLoading, error } = chunkRDQ4R3XC_cjs.useFFIDContext();
-  const { effectiveStatus, isBlocked, isGrace } = chunkRDQ4R3XC_cjs.useSubscription();
+  const { isLoading, error } = chunkEM5EGNGE_cjs.useFFIDContext();
+  const { effectiveStatus, isBlocked, isGrace } = chunkEM5EGNGE_cjs.useSubscription();
   const hasFetchError = error !== null && effectiveStatus === null;
   const shouldRedirect = !isLoading && !hasFetchError && (isBlocked || !allowGrace && isGrace || effectiveStatus === null);
   react.useEffect(() => {
@@ -76,7 +76,7 @@ function useRequireActiveSubscription(options) {
 }
 function withFFIDAuth(Component, options = {}) {
   const WrappedComponent = (props) => {
-    const { isLoading, isAuthenticated, login } = chunkRDQ4R3XC_cjs.useFFIDContext();
+    const { isLoading, isAuthenticated, login } = chunkEM5EGNGE_cjs.useFFIDContext();
     const hasRedirected = react.useRef(false);
     react.useEffect(() => {
       if (!isLoading && !isAuthenticated && options.redirectToLogin && !hasRedirected.current) {
@@ -105,155 +105,155 @@ var FFID_NEWSLETTER_DISPATCH_MAX_RECIPIENTS = 1e3;
 
 Object.defineProperty(exports, "ACCESS_GRANTING_EFFECTIVE_STATUSES", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.ACCESS_GRANTING_EFFECTIVE_STATUSES; }
+  get: function () { return chunkEM5EGNGE_cjs.ACCESS_GRANTING_EFFECTIVE_STATUSES; }
 });
 Object.defineProperty(exports, "BLOCKING_EFFECTIVE_STATUSES", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.BLOCKING_EFFECTIVE_STATUSES; }
+  get: function () { return chunkEM5EGNGE_cjs.BLOCKING_EFFECTIVE_STATUSES; }
 });
 Object.defineProperty(exports, "DEFAULT_API_BASE_URL", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.DEFAULT_API_BASE_URL; }
+  get: function () { return chunkEM5EGNGE_cjs.DEFAULT_API_BASE_URL; }
 });
 Object.defineProperty(exports, "DEFAULT_OAUTH_SCOPES", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.DEFAULT_OAUTH_SCOPES; }
+  get: function () { return chunkEM5EGNGE_cjs.DEFAULT_OAUTH_SCOPES; }
 });
 Object.defineProperty(exports, "EFFECTIVE_SUBSCRIPTION_STATUSES", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.EFFECTIVE_SUBSCRIPTION_STATUSES; }
+  get: function () { return chunkEM5EGNGE_cjs.EFFECTIVE_SUBSCRIPTION_STATUSES; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementBadge", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFIDAnnouncementBadge; }
+  get: function () { return chunkEM5EGNGE_cjs.FFIDAnnouncementBadge; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementList", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFIDAnnouncementList; }
+  get: function () { return chunkEM5EGNGE_cjs.FFIDAnnouncementList; }
 });
 Object.defineProperty(exports, "FFIDInquiryForm", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFIDInquiryForm; }
+  get: function () { return chunkEM5EGNGE_cjs.FFIDInquiryForm; }
 });
 Object.defineProperty(exports, "FFIDLoginButton", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFIDLoginButton; }
+  get: function () { return chunkEM5EGNGE_cjs.FFIDLoginButton; }
 });
 Object.defineProperty(exports, "FFIDOrganizationSwitcher", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFIDOrganizationSwitcher; }
+  get: function () { return chunkEM5EGNGE_cjs.FFIDOrganizationSwitcher; }
 });
 Object.defineProperty(exports, "FFIDProvider", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFIDProvider; }
+  get: function () { return chunkEM5EGNGE_cjs.FFIDProvider; }
 });
 Object.defineProperty(exports, "FFIDSDKError", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFIDSDKError; }
+  get: function () { return chunkEM5EGNGE_cjs.FFIDSDKError; }
 });
 Object.defineProperty(exports, "FFIDSubscriptionBadge", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFIDSubscriptionBadge; }
+  get: function () { return chunkEM5EGNGE_cjs.FFIDSubscriptionBadge; }
 });
 Object.defineProperty(exports, "FFIDUserMenu", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFIDUserMenu; }
+  get: function () { return chunkEM5EGNGE_cjs.FFIDUserMenu; }
 });
 Object.defineProperty(exports, "FFID_ANNOUNCEMENTS_ERROR_CODES", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFID_ANNOUNCEMENTS_ERROR_CODES; }
+  get: function () { return chunkEM5EGNGE_cjs.FFID_ANNOUNCEMENTS_ERROR_CODES; }
 });
 Object.defineProperty(exports, "FFID_ERROR_CODES", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFID_ERROR_CODES; }
+  get: function () { return chunkEM5EGNGE_cjs.FFID_ERROR_CODES; }
 });
 Object.defineProperty(exports, "FFID_INQUIRY_CATEGORIES", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFID_INQUIRY_CATEGORIES; }
+  get: function () { return chunkEM5EGNGE_cjs.FFID_INQUIRY_CATEGORIES; }
 });
 Object.defineProperty(exports, "FFID_INQUIRY_CATEGORIES_SITE_2026", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.FFID_INQUIRY_CATEGORIES_SITE_2026; }
+  get: function () { return chunkEM5EGNGE_cjs.FFID_INQUIRY_CATEGORIES_SITE_2026; }
 });
 Object.defineProperty(exports, "clearState", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.cleanupStateStorage; }
+  get: function () { return chunkEM5EGNGE_cjs.cleanupStateStorage; }
 });
 Object.defineProperty(exports, "computeEffectiveStatusFromSession", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.computeEffectiveStatusFromSession; }
+  get: function () { return chunkEM5EGNGE_cjs.computeEffectiveStatusFromSession; }
 });
 Object.defineProperty(exports, "createFFIDAnnouncementsClient", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.createFFIDAnnouncementsClient; }
+  get: function () { return chunkEM5EGNGE_cjs.createFFIDAnnouncementsClient; }
 });
 Object.defineProperty(exports, "createFFIDClient", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.createFFIDClient; }
+  get: function () { return chunkEM5EGNGE_cjs.createFFIDClient; }
 });
 Object.defineProperty(exports, "createTokenStore", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.createTokenStore; }
+  get: function () { return chunkEM5EGNGE_cjs.createTokenStore; }
 });
 Object.defineProperty(exports, "generateCodeChallenge", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.generateCodeChallenge; }
+  get: function () { return chunkEM5EGNGE_cjs.generateCodeChallenge; }
 });
 Object.defineProperty(exports, "generateCodeVerifier", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.generateCodeVerifier; }
+  get: function () { return chunkEM5EGNGE_cjs.generateCodeVerifier; }
 });
 Object.defineProperty(exports, "handleRedirectCallback", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.handleRedirectCallback; }
+  get: function () { return chunkEM5EGNGE_cjs.handleRedirectCallback; }
 });
 Object.defineProperty(exports, "hasAccessFromUserinfo", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.hasAccessFromUserinfo; }
+  get: function () { return chunkEM5EGNGE_cjs.hasAccessFromUserinfo; }
 });
 Object.defineProperty(exports, "isBlockedFromUserinfo", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.isBlockedFromUserinfo; }
+  get: function () { return chunkEM5EGNGE_cjs.isBlockedFromUserinfo; }
 });
 Object.defineProperty(exports, "isFFIDInquiryCategorySite2026", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.isFFIDInquiryCategorySite2026; }
+  get: function () { return chunkEM5EGNGE_cjs.isFFIDInquiryCategorySite2026; }
 });
 Object.defineProperty(exports, "normalizeRedirectUri", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.normalizeRedirectUri; }
+  get: function () { return chunkEM5EGNGE_cjs.normalizeRedirectUri; }
 });
 Object.defineProperty(exports, "retrieveCodeVerifier", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.retrieveCodeVerifier; }
+  get: function () { return chunkEM5EGNGE_cjs.retrieveCodeVerifier; }
 });
 Object.defineProperty(exports, "retrieveState", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.retrieveState; }
+  get: function () { return chunkEM5EGNGE_cjs.retrieveState; }
 });
 Object.defineProperty(exports, "storeCodeVerifier", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.storeCodeVerifier; }
+  get: function () { return chunkEM5EGNGE_cjs.storeCodeVerifier; }
 });
 Object.defineProperty(exports, "storeState", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.storeState; }
+  get: function () { return chunkEM5EGNGE_cjs.storeState; }
 });
 Object.defineProperty(exports, "useFFID", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.useFFID; }
+  get: function () { return chunkEM5EGNGE_cjs.useFFID; }
 });
 Object.defineProperty(exports, "useFFIDAnnouncements", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.useFFIDAnnouncements; }
+  get: function () { return chunkEM5EGNGE_cjs.useFFIDAnnouncements; }
 });
 Object.defineProperty(exports, "useSubscription", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.useSubscription; }
+  get: function () { return chunkEM5EGNGE_cjs.useSubscription; }
 });
 Object.defineProperty(exports, "withSubscription", {
   enumerable: true,
-  get: function () { return chunkRDQ4R3XC_cjs.withSubscription; }
+  get: function () { return chunkEM5EGNGE_cjs.withSubscription; }
 });
 Object.defineProperty(exports, "ALL_DENIED_EXCEPT_NECESSARY", {
   enumerable: true,

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { F as FFIDSubscriptionStatus, a as FFIDPrompt, b as FFIDConfig, c as FFIDApiResponse, d as FFIDSessionResponse, e as FFIDSignOutResult, f as FFIDRedirectResult, g as FFIDError, h as FFIDSubscriptionCheckResponse, i as FFIDCheckServiceAccessParams, j as FFIDServiceAccessDecision, k as FFIDAnalyticsConfig, l as FFIDVerifyAccessTokenOptions, m as FFIDOAuthUserInfo, n as FFIDInquiryCreateParams, o as FFIDInquiryCreateResponse, p as FFIDAuthMode, q as FFIDLogger, r as FFIDCacheAdapter, s as FFIDUser, t as FFIDOrganization, u as FFIDSubscription, v as FFIDSubscriptionContextValue, E as EffectiveSubscriptionStatus, w as FFIDOAuthUserInfoSubscription, x as FFIDAnnouncementsClientConfig, L as ListAnnouncementsOptions, y as FFIDAnnouncementsApiResponse, A as AnnouncementListResponse, z as FFIDAnnouncementsLogger } from './index--wRiPlpi.cjs';
-export { B as Announcement, C as AnnouncementStatus, D as AnnouncementType, G as EFFECTIVE_SUBSCRIPTION_STATUSES, H as FFIDAnnouncementBadge, I as FFIDAnnouncementList, J as FFIDAnnouncementsError, K as FFIDAnnouncementsErrorCode, M as FFIDAnnouncementsServerResponse, N as FFIDApiResponseMeta, O as FFIDCacheConfig, P as FFIDContextValue, Q as FFIDInquiryCategory, R as FFIDInquiryCategorySite2026, S as FFIDInquiryForm, T as FFIDInquiryFormCategoryItem, U as FFIDInquiryFormClassNames, V as FFIDInquiryFormLegalLayout, W as FFIDInquiryFormOrganization, X as FFIDInquiryFormPlaceholderContext, Y as FFIDInquiryFormPrefill, Z as FFIDInquiryFormProps, _ as FFIDInquiryFormSubmitData, $ as FFIDInquiryFormSubmitResult, a0 as FFIDJwtClaims, a1 as FFIDLoginButton, a2 as FFIDOAuthTokenResponse, a3 as FFIDOAuthUserInfoMemberRole, a4 as FFIDOrganizationSwitcher, a5 as FFIDRedirectErrorCode, a6 as FFIDSeatModel, a7 as FFIDServiceAccessDenialReason, a8 as FFIDServiceAccessFailPolicy, a9 as FFIDSubscriptionBadge, aa as FFIDTokenIntrospectionResponse, ab as FFIDUserMenu, ac as FFID_INQUIRY_CATEGORIES, ad as FFID_INQUIRY_CATEGORIES_SITE_2026, ae as UseFFIDAnnouncementsOptions, af as UseFFIDAnnouncementsReturn, ag as isFFIDInquiryCategorySite2026, ah as useFFIDAnnouncements } from './index--wRiPlpi.cjs';
+import { F as FFIDSubscriptionStatus, a as FFIDPrompt, b as FFIDConfig, c as FFIDApiResponse, d as FFIDSessionResponse, e as FFIDSignOutResult, f as FFIDRedirectResult, g as FFIDError, h as FFIDSubscriptionCheckResponse, i as FFIDCheckServiceAccessParams, j as FFIDServiceAccessDecision, k as FFIDAnalyticsConfig, l as FFIDVerifyAccessTokenOptions, m as FFIDOAuthUserInfo, n as FFIDInquiryCreateParams, o as FFIDInquiryCreateResponse, p as FFIDAuthMode, q as FFIDLogger, r as FFIDCacheAdapter, s as FFIDUser, t as FFIDOrganization, u as FFIDSubscription, v as FFIDSubscriptionContextValue, E as EffectiveSubscriptionStatus, w as FFIDOAuthUserInfoSubscription, x as FFIDAnnouncementsClientConfig, L as ListAnnouncementsOptions, y as FFIDAnnouncementsApiResponse, A as AnnouncementListResponse, z as FFIDAnnouncementsLogger } from './index-btouGGKr.cjs';
+export { B as Announcement, C as AnnouncementStatus, D as AnnouncementType, G as EFFECTIVE_SUBSCRIPTION_STATUSES, H as FFIDAnnouncementBadge, I as FFIDAnnouncementList, J as FFIDAnnouncementsError, K as FFIDAnnouncementsErrorCode, M as FFIDAnnouncementsServerResponse, N as FFIDApiResponseMeta, O as FFIDCacheConfig, P as FFIDContextValue, Q as FFIDInquiryCategory, R as FFIDInquiryCategorySite2026, S as FFIDInquiryForm, T as FFIDInquiryFormCategoryItem, U as FFIDInquiryFormClassNames, V as FFIDInquiryFormLegalLayout, W as FFIDInquiryFormOrganization, X as FFIDInquiryFormPlaceholderContext, Y as FFIDInquiryFormPrefill, Z as FFIDInquiryFormProps, _ as FFIDInquiryFormSubmitData, $ as FFIDInquiryFormSubmitResult, a0 as FFIDJwtClaims, a1 as FFIDLoginButton, a2 as FFIDOAuthTokenResponse, a3 as FFIDOAuthUserInfoMemberRole, a4 as FFIDOrganizationSwitcher, a5 as FFIDRedirectErrorCode, a6 as FFIDSeatModel, a7 as FFIDServiceAccessDenialReason, a8 as FFIDServiceAccessFailPolicy, a9 as FFIDSubscriptionBadge, aa as FFIDTokenIntrospectionResponse, ab as FFIDUserMenu, ac as FFID_INQUIRY_CATEGORIES, ad as FFID_INQUIRY_CATEGORIES_SITE_2026, ae as UseFFIDAnnouncementsOptions, af as UseFFIDAnnouncementsReturn, ag as isFFIDInquiryCategorySite2026, ah as useFFIDAnnouncements } from './index-btouGGKr.cjs';
 export { A as ALL_DENIED_EXCEPT_NECESSARY, i as CONSENT_COOKIE_NAME, j as CONSENT_DISMISSAL_TIMESTAMP_KEY, l as COOKIE_VERSION, D as DEFAULT_CONSENT_ERROR_MESSAGES, o as FFIDAnalyticsProvider, p as FFIDAnalyticsProviderProps, c as FFIDConsentCategories, r as FFIDConsentCategoryCode, e as FFIDConsentCategoryMetadata, w as FFIDConsentError, x as FFIDConsentErrorCode, y as FFIDConsentMergeStrategy, B as FFIDConsentMergeWarning, E as FFIDConsentMergeWarningEvent, F as FFIDConsentResult, I as FFIDConsentSource, a as FFIDConsentState, d as FFIDConsentSyncResult, M as FFIDCookieBanner, N as FFIDCookieBannerClassNames, O as FFIDCookieBannerProps, Q as FFIDCookieLink, R as FFIDCookieLinkProps, f as FFIDCookiePolicy, T as FFIDCookieSettings, U as FFIDCookieSettingsClassNames, V as FFIDCookieSettingsProps, _ as FFID_CONSENT_ERROR_CODES, ae as UseFFIDConsentPreferencesReturn, af as UseFFIDConsentReturn, ag as clearConsentDismissalTimestamp, aj as decodeConsentCookie, al as encodeConsentCookie, an as readConsentCookie, ao as readConsentDismissalTimestamp, aq as useFFIDConsent, ar as useFFIDConsentPreferences, as as writeConsentCookie, at as writeConsentDismissalTimestamp } from './FFIDCookieLink-BJgVcJyw.cjs';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode, ComponentType, FC } from 'react';
@@ -1524,7 +1524,25 @@ interface HandleRedirectCallbackOptions {
      * absolute URL, a relative URL, or a bare query string. Defaults to
      * `window.location.search` in the browser.
      */
-    url?: string;
+    url?: string | undefined;
+    /**
+     * Whether to remove `code` / `state` from the browser URL via
+     * `window.history.replaceState` after a successful exchange. Defaults to
+     * `true`.
+     *
+     * Set to `false` to take over URL cleanup on the consumer side. This matters
+     * on Next.js App Router: the App Router patches `history.replaceState`, so
+     * the SDK's cleanup re-evaluates `useSearchParams()` and re-runs any effect
+     * that depends on it. A callback effect that treats "no `code` in the URL"
+     * as "start a new login" then fires `login()` again, causing repeated
+     * authorize redirects (#4254). With `cleanUrl: false`, remove `code` /
+     * `state` yourself once callback handling is done — keep the other query
+     * params, mirroring the SDK's own cleanup. Consumed callback params left in
+     * the URL fail on reload with `STATE_MISMATCH_ERROR`: the one-time OAuth
+     * `state` stored at authorize time was already consumed, so re-processing
+     * fails state validation before any exchange is attempted.
+     */
+    cleanUrl?: boolean | undefined;
 }
 /**
  * Complete an OAuth authorization-code redirect.
@@ -1538,13 +1556,14 @@ interface HandleRedirectCallbackOptions {
  *    neither side has any state (a genuine no-state flow). Omitting the callback
  *    `state` does NOT bypass the check (#3841).
  * 3. Retrieves the PKCE verifier and exchanges the code for tokens.
- * 4. On success, removes `code` + `state` from the browser URL.
+ * 4. On success, removes `code` + `state` from the browser URL (skipped when
+ *    `options.cleanUrl` is `false` — the consumer then owns URL cleanup).
  *
  * SSR-safe: when there is no `window` and no `options.url`, no exchange is
  * attempted and an error result is returned.
  *
  * @param client - FFID client (or any object exposing exchangeCodeForTokens / createError / logger)
- * @param options - Optional callback URL override
+ * @param options - Optional callback URL override and URL cleanup control (see {@link HandleRedirectCallbackOptions})
  */
 declare function handleRedirectCallback(client: HandleRedirectCallbackClient, options?: HandleRedirectCallbackOptions): Promise<FFIDApiResponse<void>>;
 
@@ -1596,6 +1615,23 @@ declare function createKVCacheAdapter(kv: KVNamespaceLike): FFIDCacheAdapter;
 interface FFIDProviderProps extends FFIDConfig {
     /** Child components */
     children: ReactNode;
+    /**
+     * Token mode only: whether the provider removes `code` / `state` from the
+     * browser URL (`history.replaceState`) after a successful code exchange.
+     * Defaults to `true`. Forwarded to
+     * {@link HandleRedirectCallbackOptions.cleanUrl} — see its JSDoc for the
+     * Next.js App Router background (#4254). Read once when the mount-time code
+     * exchange runs; toggling it afterwards has no effect.
+     *
+     * Set to `false` on Next.js App Router when the patched history API
+     * re-evaluating `useSearchParams()` (and re-running effects that depend on
+     * it) is a problem — then remove `code` / `state` yourself (keeping other
+     * query params) after authentication completes. Consumed callback params
+     * left in the URL fail on reload with `STATE_MISMATCH_ERROR` (the one-time
+     * OAuth `state` was already consumed), which also leaves an authenticated
+     * user rendered as signed-out until the URL is cleaned.
+     */
+    cleanCallbackUrl?: boolean | undefined;
 }
 /**
  * FFIDProvider - Wrap your app to enable FFID authentication
@@ -1607,7 +1643,7 @@ interface FFIDProviderProps extends FFIDConfig {
  * - Automatic session refresh
  * - Token mode: automatic code exchange and token refresh
  */
-declare function FFIDProvider({ children, serviceCode, scope, apiBaseUrl, debug, logger, refreshInterval, onAuthStateChange, onError, authMode, clientId, }: FFIDProviderProps): react_jsx_runtime.JSX.Element;
+declare function FFIDProvider({ children, serviceCode, scope, apiBaseUrl, debug, logger, refreshInterval, onAuthStateChange, onError, authMode, clientId, cleanCallbackUrl, }: FFIDProviderProps): react_jsx_runtime.JSX.Element;
 
 /**
  * Return type for useFFID hook

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { F as FFIDSubscriptionStatus, a as FFIDPrompt, b as FFIDConfig, c as FFIDApiResponse, d as FFIDSessionResponse, e as FFIDSignOutResult, f as FFIDRedirectResult, g as FFIDError, h as FFIDSubscriptionCheckResponse, i as FFIDCheckServiceAccessParams, j as FFIDServiceAccessDecision, k as FFIDAnalyticsConfig, l as FFIDVerifyAccessTokenOptions, m as FFIDOAuthUserInfo, n as FFIDInquiryCreateParams, o as FFIDInquiryCreateResponse, p as FFIDAuthMode, q as FFIDLogger, r as FFIDCacheAdapter, s as FFIDUser, t as FFIDOrganization, u as FFIDSubscription, v as FFIDSubscriptionContextValue, E as EffectiveSubscriptionStatus, w as FFIDOAuthUserInfoSubscription, x as FFIDAnnouncementsClientConfig, L as ListAnnouncementsOptions, y as FFIDAnnouncementsApiResponse, A as AnnouncementListResponse, z as FFIDAnnouncementsLogger } from './index--wRiPlpi.js';
-export { B as Announcement, C as AnnouncementStatus, D as AnnouncementType, G as EFFECTIVE_SUBSCRIPTION_STATUSES, H as FFIDAnnouncementBadge, I as FFIDAnnouncementList, J as FFIDAnnouncementsError, K as FFIDAnnouncementsErrorCode, M as FFIDAnnouncementsServerResponse, N as FFIDApiResponseMeta, O as FFIDCacheConfig, P as FFIDContextValue, Q as FFIDInquiryCategory, R as FFIDInquiryCategorySite2026, S as FFIDInquiryForm, T as FFIDInquiryFormCategoryItem, U as FFIDInquiryFormClassNames, V as FFIDInquiryFormLegalLayout, W as FFIDInquiryFormOrganization, X as FFIDInquiryFormPlaceholderContext, Y as FFIDInquiryFormPrefill, Z as FFIDInquiryFormProps, _ as FFIDInquiryFormSubmitData, $ as FFIDInquiryFormSubmitResult, a0 as FFIDJwtClaims, a1 as FFIDLoginButton, a2 as FFIDOAuthTokenResponse, a3 as FFIDOAuthUserInfoMemberRole, a4 as FFIDOrganizationSwitcher, a5 as FFIDRedirectErrorCode, a6 as FFIDSeatModel, a7 as FFIDServiceAccessDenialReason, a8 as FFIDServiceAccessFailPolicy, a9 as FFIDSubscriptionBadge, aa as FFIDTokenIntrospectionResponse, ab as FFIDUserMenu, ac as FFID_INQUIRY_CATEGORIES, ad as FFID_INQUIRY_CATEGORIES_SITE_2026, ae as UseFFIDAnnouncementsOptions, af as UseFFIDAnnouncementsReturn, ag as isFFIDInquiryCategorySite2026, ah as useFFIDAnnouncements } from './index--wRiPlpi.js';
+import { F as FFIDSubscriptionStatus, a as FFIDPrompt, b as FFIDConfig, c as FFIDApiResponse, d as FFIDSessionResponse, e as FFIDSignOutResult, f as FFIDRedirectResult, g as FFIDError, h as FFIDSubscriptionCheckResponse, i as FFIDCheckServiceAccessParams, j as FFIDServiceAccessDecision, k as FFIDAnalyticsConfig, l as FFIDVerifyAccessTokenOptions, m as FFIDOAuthUserInfo, n as FFIDInquiryCreateParams, o as FFIDInquiryCreateResponse, p as FFIDAuthMode, q as FFIDLogger, r as FFIDCacheAdapter, s as FFIDUser, t as FFIDOrganization, u as FFIDSubscription, v as FFIDSubscriptionContextValue, E as EffectiveSubscriptionStatus, w as FFIDOAuthUserInfoSubscription, x as FFIDAnnouncementsClientConfig, L as ListAnnouncementsOptions, y as FFIDAnnouncementsApiResponse, A as AnnouncementListResponse, z as FFIDAnnouncementsLogger } from './index-btouGGKr.js';
+export { B as Announcement, C as AnnouncementStatus, D as AnnouncementType, G as EFFECTIVE_SUBSCRIPTION_STATUSES, H as FFIDAnnouncementBadge, I as FFIDAnnouncementList, J as FFIDAnnouncementsError, K as FFIDAnnouncementsErrorCode, M as FFIDAnnouncementsServerResponse, N as FFIDApiResponseMeta, O as FFIDCacheConfig, P as FFIDContextValue, Q as FFIDInquiryCategory, R as FFIDInquiryCategorySite2026, S as FFIDInquiryForm, T as FFIDInquiryFormCategoryItem, U as FFIDInquiryFormClassNames, V as FFIDInquiryFormLegalLayout, W as FFIDInquiryFormOrganization, X as FFIDInquiryFormPlaceholderContext, Y as FFIDInquiryFormPrefill, Z as FFIDInquiryFormProps, _ as FFIDInquiryFormSubmitData, $ as FFIDInquiryFormSubmitResult, a0 as FFIDJwtClaims, a1 as FFIDLoginButton, a2 as FFIDOAuthTokenResponse, a3 as FFIDOAuthUserInfoMemberRole, a4 as FFIDOrganizationSwitcher, a5 as FFIDRedirectErrorCode, a6 as FFIDSeatModel, a7 as FFIDServiceAccessDenialReason, a8 as FFIDServiceAccessFailPolicy, a9 as FFIDSubscriptionBadge, aa as FFIDTokenIntrospectionResponse, ab as FFIDUserMenu, ac as FFID_INQUIRY_CATEGORIES, ad as FFID_INQUIRY_CATEGORIES_SITE_2026, ae as UseFFIDAnnouncementsOptions, af as UseFFIDAnnouncementsReturn, ag as isFFIDInquiryCategorySite2026, ah as useFFIDAnnouncements } from './index-btouGGKr.js';
 export { A as ALL_DENIED_EXCEPT_NECESSARY, i as CONSENT_COOKIE_NAME, j as CONSENT_DISMISSAL_TIMESTAMP_KEY, l as COOKIE_VERSION, D as DEFAULT_CONSENT_ERROR_MESSAGES, o as FFIDAnalyticsProvider, p as FFIDAnalyticsProviderProps, c as FFIDConsentCategories, r as FFIDConsentCategoryCode, e as FFIDConsentCategoryMetadata, w as FFIDConsentError, x as FFIDConsentErrorCode, y as FFIDConsentMergeStrategy, B as FFIDConsentMergeWarning, E as FFIDConsentMergeWarningEvent, F as FFIDConsentResult, I as FFIDConsentSource, a as FFIDConsentState, d as FFIDConsentSyncResult, M as FFIDCookieBanner, N as FFIDCookieBannerClassNames, O as FFIDCookieBannerProps, Q as FFIDCookieLink, R as FFIDCookieLinkProps, f as FFIDCookiePolicy, T as FFIDCookieSettings, U as FFIDCookieSettingsClassNames, V as FFIDCookieSettingsProps, _ as FFID_CONSENT_ERROR_CODES, ae as UseFFIDConsentPreferencesReturn, af as UseFFIDConsentReturn, ag as clearConsentDismissalTimestamp, aj as decodeConsentCookie, al as encodeConsentCookie, an as readConsentCookie, ao as readConsentDismissalTimestamp, aq as useFFIDConsent, ar as useFFIDConsentPreferences, as as writeConsentCookie, at as writeConsentDismissalTimestamp } from './FFIDCookieLink-BJgVcJyw.js';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode, ComponentType, FC } from 'react';
@@ -1524,7 +1524,25 @@ interface HandleRedirectCallbackOptions {
      * absolute URL, a relative URL, or a bare query string. Defaults to
      * `window.location.search` in the browser.
      */
-    url?: string;
+    url?: string | undefined;
+    /**
+     * Whether to remove `code` / `state` from the browser URL via
+     * `window.history.replaceState` after a successful exchange. Defaults to
+     * `true`.
+     *
+     * Set to `false` to take over URL cleanup on the consumer side. This matters
+     * on Next.js App Router: the App Router patches `history.replaceState`, so
+     * the SDK's cleanup re-evaluates `useSearchParams()` and re-runs any effect
+     * that depends on it. A callback effect that treats "no `code` in the URL"
+     * as "start a new login" then fires `login()` again, causing repeated
+     * authorize redirects (#4254). With `cleanUrl: false`, remove `code` /
+     * `state` yourself once callback handling is done — keep the other query
+     * params, mirroring the SDK's own cleanup. Consumed callback params left in
+     * the URL fail on reload with `STATE_MISMATCH_ERROR`: the one-time OAuth
+     * `state` stored at authorize time was already consumed, so re-processing
+     * fails state validation before any exchange is attempted.
+     */
+    cleanUrl?: boolean | undefined;
 }
 /**
  * Complete an OAuth authorization-code redirect.
@@ -1538,13 +1556,14 @@ interface HandleRedirectCallbackOptions {
  *    neither side has any state (a genuine no-state flow). Omitting the callback
  *    `state` does NOT bypass the check (#3841).
  * 3. Retrieves the PKCE verifier and exchanges the code for tokens.
- * 4. On success, removes `code` + `state` from the browser URL.
+ * 4. On success, removes `code` + `state` from the browser URL (skipped when
+ *    `options.cleanUrl` is `false` — the consumer then owns URL cleanup).
  *
  * SSR-safe: when there is no `window` and no `options.url`, no exchange is
  * attempted and an error result is returned.
  *
  * @param client - FFID client (or any object exposing exchangeCodeForTokens / createError / logger)
- * @param options - Optional callback URL override
+ * @param options - Optional callback URL override and URL cleanup control (see {@link HandleRedirectCallbackOptions})
  */
 declare function handleRedirectCallback(client: HandleRedirectCallbackClient, options?: HandleRedirectCallbackOptions): Promise<FFIDApiResponse<void>>;
 
@@ -1596,6 +1615,23 @@ declare function createKVCacheAdapter(kv: KVNamespaceLike): FFIDCacheAdapter;
 interface FFIDProviderProps extends FFIDConfig {
     /** Child components */
     children: ReactNode;
+    /**
+     * Token mode only: whether the provider removes `code` / `state` from the
+     * browser URL (`history.replaceState`) after a successful code exchange.
+     * Defaults to `true`. Forwarded to
+     * {@link HandleRedirectCallbackOptions.cleanUrl} — see its JSDoc for the
+     * Next.js App Router background (#4254). Read once when the mount-time code
+     * exchange runs; toggling it afterwards has no effect.
+     *
+     * Set to `false` on Next.js App Router when the patched history API
+     * re-evaluating `useSearchParams()` (and re-running effects that depend on
+     * it) is a problem — then remove `code` / `state` yourself (keeping other
+     * query params) after authentication completes. Consumed callback params
+     * left in the URL fail on reload with `STATE_MISMATCH_ERROR` (the one-time
+     * OAuth `state` was already consumed), which also leaves an authenticated
+     * user rendered as signed-out until the URL is cleaned.
+     */
+    cleanCallbackUrl?: boolean | undefined;
 }
 /**
  * FFIDProvider - Wrap your app to enable FFID authentication
@@ -1607,7 +1643,7 @@ interface FFIDProviderProps extends FFIDConfig {
  * - Automatic session refresh
  * - Token mode: automatic code exchange and token refresh
  */
-declare function FFIDProvider({ children, serviceCode, scope, apiBaseUrl, debug, logger, refreshInterval, onAuthStateChange, onError, authMode, clientId, }: FFIDProviderProps): react_jsx_runtime.JSX.Element;
+declare function FFIDProvider({ children, serviceCode, scope, apiBaseUrl, debug, logger, refreshInterval, onAuthStateChange, onError, authMode, clientId, cleanCallbackUrl, }: FFIDProviderProps): react_jsx_runtime.JSX.Element;
 
 /**
  * Return type for useFFID hook

package/dist/index.js

@@ -1,5 +1,5 @@
-import { useFFIDContext, useSubscription } from './chunk-U57ZDFEN.js';
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useSubscription, withSubscription } from './chunk-U57ZDFEN.js';
+import { useFFIDContext, useSubscription } from './chunk-7NRO2TBG.js';
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, cleanupStateStorage as clearState, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useSubscription, withSubscription } from './chunk-7NRO2TBG.js';
 export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, CONSENT_DISMISSAL_TIMESTAMP_KEY, COOKIE_VERSION, DEFAULT_CONSENT_ERROR_MESSAGES, FFIDAnalyticsProvider, FFIDConsentError, FFIDCookieBanner, FFIDCookieLink, FFIDCookieSettings, FFID_CONSENT_ERROR_CODES, clearConsentDismissalTimestamp, decodeConsentCookie, encodeConsentCookie, readConsentCookie, readConsentDismissalTimestamp, useFFIDConsent, useFFIDConsentPreferences, writeConsentCookie, writeConsentDismissalTimestamp } from './chunk-G7VOX64X.js';
 import { useEffect, useRef } from 'react';
 import { jsx, Fragment } from 'react/jsx-runtime';

package/dist/server/index.cjs

@@ -1222,7 +1222,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.21.0";
+var SDK_VERSION = "5.22.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {

package/dist/server/index.d.cts

@@ -1,8 +1,8 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-BQPhm-XL.cjs';
-export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDProvisionMemberPlan, x as FFIDProvisionMemberPlanStatus, y as FFIDProvisionMemberResult, z as FFIDProvisionMemberStatus, A as FFIDProvisionOrganizationDryRun, B as FFIDProvisionOrganizationMemberInput, C as FFIDProvisionOrganizationOutcome, D as FFIDProvisionOrganizationParams, E as FFIDProvisionOrganizationResponse, G as FFIDProvisionUserDryRun, H as FFIDProvisionUserOutcome, I as FFIDProvisionUserParams, J as FFIDProvisionUserProfileInput, K as FFIDProvisionUserResponse, L as FFIDProvisionedOrganization, M as FFIDProvisionedUser, N as FFIDRemoveMemberResponse, O as FFIDResetSessionResponse, P as FFIDSubscription, Q as FFIDUpdateMemberRoleResponse, R as FFIDUpdateUserProfileRequest, S as FFIDUser, T as FFIDUserProfile, U as TokenData, V as TokenStore, W as createFFIDClient, X as createTokenStore } from '../ffid-client-BQPhm-XL.cjs';
+import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-CEJMpqRZ.cjs';
+export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDProvisionMemberPlan, x as FFIDProvisionMemberPlanStatus, y as FFIDProvisionMemberResult, z as FFIDProvisionMemberStatus, A as FFIDProvisionOrganizationDryRun, B as FFIDProvisionOrganizationMemberInput, C as FFIDProvisionOrganizationOutcome, D as FFIDProvisionOrganizationParams, E as FFIDProvisionOrganizationResponse, G as FFIDProvisionUserDryRun, H as FFIDProvisionUserOutcome, I as FFIDProvisionUserParams, J as FFIDProvisionUserProfileInput, K as FFIDProvisionUserResponse, L as FFIDProvisionedOrganization, M as FFIDProvisionedUser, N as FFIDRemoveMemberResponse, O as FFIDResetSessionResponse, P as FFIDSubscription, Q as FFIDUpdateMemberRoleResponse, R as FFIDUpdateUserProfileRequest, S as FFIDUser, T as FFIDUserProfile, U as TokenData, V as TokenStore, W as createFFIDClient, X as createTokenStore } from '../ffid-client-CEJMpqRZ.cjs';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-D61jqRIO.cjs';
 import { z } from 'zod';
-import '../types-BeVl-z12.cjs';
+import '../types-Cjb9J0rL.cjs';
 
 /**
  * FFID SDK error codes

package/dist/server/index.d.ts

@@ -1,8 +1,8 @@
-import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-Bx8y4SwC.js';
-export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDProvisionMemberPlan, x as FFIDProvisionMemberPlanStatus, y as FFIDProvisionMemberResult, z as FFIDProvisionMemberStatus, A as FFIDProvisionOrganizationDryRun, B as FFIDProvisionOrganizationMemberInput, C as FFIDProvisionOrganizationOutcome, D as FFIDProvisionOrganizationParams, E as FFIDProvisionOrganizationResponse, G as FFIDProvisionUserDryRun, H as FFIDProvisionUserOutcome, I as FFIDProvisionUserParams, J as FFIDProvisionUserProfileInput, K as FFIDProvisionUserResponse, L as FFIDProvisionedOrganization, M as FFIDProvisionedUser, N as FFIDRemoveMemberResponse, O as FFIDResetSessionResponse, P as FFIDSubscription, Q as FFIDUpdateMemberRoleResponse, R as FFIDUpdateUserProfileRequest, S as FFIDUser, T as FFIDUserProfile, U as TokenData, V as TokenStore, W as createFFIDClient, X as createTokenStore } from '../ffid-client-Bx8y4SwC.js';
+import { F as FFIDLogger, a as FFIDError, b as FFIDCacheAdapter, c as FFIDVerifyAccessTokenOptions, d as FFIDApiResponse, e as FFIDOAuthUserInfo } from '../ffid-client-DM0ZhIDV.js';
+export { f as FFIDAddMemberParams, g as FFIDAddMemberRequest, h as FFIDAddMemberResponse, i as FFIDAssignableMemberRole, j as FFIDCacheConfig, k as FFIDClient, l as FFIDConfig, m as FFIDListMembersResponse, n as FFIDMemberRole, o as FFIDOrganization, p as FFIDOrganizationMember, q as FFIDOtpSendResponse, r as FFIDOtpVerifyResponse, s as FFIDPasswordResetConfirmResponse, t as FFIDPasswordResetResponse, u as FFIDPasswordResetVerifyResponse, v as FFIDProfileCallOptions, w as FFIDProvisionMemberPlan, x as FFIDProvisionMemberPlanStatus, y as FFIDProvisionMemberResult, z as FFIDProvisionMemberStatus, A as FFIDProvisionOrganizationDryRun, B as FFIDProvisionOrganizationMemberInput, C as FFIDProvisionOrganizationOutcome, D as FFIDProvisionOrganizationParams, E as FFIDProvisionOrganizationResponse, G as FFIDProvisionUserDryRun, H as FFIDProvisionUserOutcome, I as FFIDProvisionUserParams, J as FFIDProvisionUserProfileInput, K as FFIDProvisionUserResponse, L as FFIDProvisionedOrganization, M as FFIDProvisionedUser, N as FFIDRemoveMemberResponse, O as FFIDResetSessionResponse, P as FFIDSubscription, Q as FFIDUpdateMemberRoleResponse, R as FFIDUpdateUserProfileRequest, S as FFIDUser, T as FFIDUserProfile, U as TokenData, V as TokenStore, W as createFFIDClient, X as createTokenStore } from '../ffid-client-DM0ZhIDV.js';
 export { D as DEFAULT_API_BASE_URL, a as DEFAULT_OAUTH_SCOPES } from '../constants-D61jqRIO.js';
 import { z } from 'zod';
-import '../types-BeVl-z12.js';
+import '../types-Cjb9J0rL.js';
 
 /**
  * FFID SDK error codes

package/dist/server/index.js

@@ -1221,7 +1221,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.21.0";
+var SDK_VERSION = "5.22.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {

package/dist/server/test/index.d.cts

@@ -1,5 +1,5 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-BQPhm-XL.cjs';
-import '../../types-BeVl-z12.cjs';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-CEJMpqRZ.cjs';
+import '../../types-Cjb9J0rL.cjs';
 
 /**
  * FFID SDK - Test mode client (E2E / integration test bypass)

package/dist/server/test/index.d.ts

@@ -1,5 +1,5 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-Bx8y4SwC.js';
-import '../../types-BeVl-z12.js';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-DM0ZhIDV.js';
+import '../../types-Cjb9J0rL.js';
 
 /**
  * FFID SDK - Test mode client (E2E / integration test bypass)

package/dist/{types-BeVl-z12.d.cts → types-Cjb9J0rL.d.cts}

@@ -56,7 +56,8 @@ declare const EFFECTIVE_SUBSCRIPTION_STATUSES: readonly ["active", "active_cance
  * `src/lib/common/subscription-helpers.ts`, and a server-side unit test pins
  * element-equality between the two arrays (#3474) — convention-only sync
  * could drift silently in the server-extending direction (a new server
- * literal would fall through SDK consumers' `switch` defaults).
+ * literal would fall through SDK consumers' `switch` defaults). The PR gate also
+ * runs `npm run sdk:verify-sync` for SDK/server subscription changes.
  */
 type EffectiveSubscriptionStatus = (typeof EFFECTIVE_SUBSCRIPTION_STATUSES)[number];
 

package/dist/{types-BeVl-z12.d.ts → types-Cjb9J0rL.d.ts}

@@ -56,7 +56,8 @@ declare const EFFECTIVE_SUBSCRIPTION_STATUSES: readonly ["active", "active_cance
  * `src/lib/common/subscription-helpers.ts`, and a server-side unit test pins
  * element-equality between the two arrays (#3474) — convention-only sync
  * could drift silently in the server-extending direction (a new server
- * literal would fall through SDK consumers' `switch` defaults).
+ * literal would fall through SDK consumers' `switch` defaults). The PR gate also
+ * runs `npm run sdk:verify-sync` for SDK/server subscription changes.
  */
 type EffectiveSubscriptionStatus = (typeof EFFECTIVE_SUBSCRIPTION_STATUSES)[number];
 

package/dist/webhooks/index.d.cts

@@ -1,4 +1,4 @@
-import { E as EffectiveSubscriptionStatus } from '../types-BeVl-z12.cjs';
+import { E as EffectiveSubscriptionStatus } from '../types-Cjb9J0rL.cjs';
 
 /**
  * FFID Webhook SDK Constants

package/dist/webhooks/index.d.ts

@@ -1,4 +1,4 @@
-import { E as EffectiveSubscriptionStatus } from '../types-BeVl-z12.js';
+import { E as EffectiveSubscriptionStatus } from '../types-Cjb9J0rL.js';
 
 /**
  * FFID Webhook SDK Constants

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feelflow/ffid-sdk",
-  "version": "5.21.0",
+  "version": "5.22.0",
   "description": "FeelFlow ID Platform SDK for React/Next.js applications",
   "keywords": [
     "feelflow",