@eminuckan/spine 0.3.10 → 0.3.12

package/dist/{server-BJTz5-BE.mjs → server-W3MUOcah.mjs}

@@ -1,7 +1,9 @@
 import { logger } from "./logging/index.mjs";
-import { D as OAUTH_RECOVERY_TTL_SECONDS, E as OAUTH_RECOVERY_TTL_MS, O as OAUTH_STATE_TTL_MS, T as updateAuthSession, a as createAuthSession, c as deleteOAuthRecoveryRecord, f as destroyAuthSessionsByIdentitySession, g as getAuthSession, h as destroyAuthSessionsForUser, i as consumeOAuthRecoveryRecord, k as OAUTH_STATE_TTL_SECONDS, l as deleteOAuthState, m as destroyAuthSessionsBySid, o as createOAuthRecoveryRecord, s as createOAuthState, t as AUTH_ERROR_COOKIE_PREFIX, u as destroyAuthSession, x as listAuthSessionDataForUser, y as getOAuthState } from "./redis-session-storage.server-DLJ0B7-C.mjs";
+import { A as saveRefreshedAuthSession, C as invalidateAuthSessionRefreshGeneration, F as OAUTH_STATE_TTL_MS, I as OAUTH_STATE_TTL_SECONDS, M as getTokenExpiry, N as OAUTH_RECOVERY_TTL_MS, O as releaseAuthSessionRefreshLock, P as OAUTH_RECOVERY_TTL_SECONDS, S as hasSameAuthTokenGeneration, T as listAuthSessionDataForUser, _ as destroyAuthSessionsForUser, c as createOAuthRecoveryRecord, d as deleteOAuthState, f as destroyAuthSession, g as destroyAuthSessionsBySid, i as clearAuthSessionCookie, l as createOAuthState, m as destroyAuthSessionsByIdentitySession, n as acquireAuthSessionRefreshLock, o as consumeOAuthRecoveryRecord, s as createAuthSession, t as AUTH_ERROR_COOKIE_PREFIX, u as deleteOAuthRecoveryRecord, v as getAuthSession, x as getOAuthState } from "./redis-session-storage.server--i4vhYxs.mjs";
+import { env } from "node:process";
 import * as oidc from "openid-client";
 import { createRemoteJWKSet, errors, jwtVerify } from "jose";
+import { createHash } from "node:crypto";
 //#region src/http/response.ts
 /**
 * Create a redirect response without relying on a router/framework helper.
@@ -128,7 +130,7 @@ function serializeTemporaryAuthCookie(name, value, options) {
 		"SameSite=Lax",
 		`Max-Age=${options.maxAge}`
 	];
-	if (process.env.NODE_ENV === "production") segments.push("Secure");
+	if (env.NODE_ENV === "production") segments.push("Secure");
 	return segments.join("; ");
 }
 //#endregion
@@ -201,6 +203,84 @@ function isRecoverableOAuthCallbackError(error) {
 	return isOAuthCallbackError(error) && error.code === "stale_transaction";
 }
 //#endregion
+//#region src/auth/oauth-transaction-cookies.server.ts
+const OAUTH_STATE_COOKIE_NAME = `${AUTH_ERROR_COOKIE_PREFIX}_oauth_state_id`;
+const OAUTH_RECOVERY_COOKIE_NAME = `${AUTH_ERROR_COOKIE_PREFIX}_oauth_recovery`;
+const MAX_COOKIE_HEADER_LENGTH = 32 * 1024;
+const MAX_COOKIE_PARTS = 256;
+const MAX_COOKIE_NAME_LENGTH = 256;
+const MAX_COOKIE_VALUE_LENGTH = 768;
+const MAX_CALLBACK_STATE_LENGTH = 4096;
+/** Hash the exact wire state so public context never becomes a cookie name. */
+function getScopedOAuthCookieName(baseName, state) {
+	if (!isUsableCallbackState(state) || !/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(baseName) || baseName.length + 65 > MAX_COOKIE_NAME_LENGTH) throw new Error("Invalid OAuth transaction cookie scope");
+	return `${baseName}_${createHash("sha256").update(state, "utf8").digest("hex")}`;
+}
+function isUsableCallbackState(state) {
+	return state !== null && state.trim().length > 0 && state.length <= MAX_CALLBACK_STATE_LENGTH;
+}
+function getOAuthCallbackState(request) {
+	const states = new URL(request.url).searchParams.getAll("state");
+	return states.length === 1 && isUsableCallbackState(states[0]) ? states[0] : null;
+}
+function parseCookies(request) {
+	const header = request.headers.get("Cookie") ?? "";
+	if (header.length > MAX_COOKIE_HEADER_LENGTH) return null;
+	const parts = header.split(";");
+	if (parts.length > MAX_COOKIE_PARTS) return null;
+	const cookies = /* @__PURE__ */ new Map();
+	for (const part of parts) {
+		const separator = part.indexOf("=");
+		if (separator < 0) continue;
+		const name = part.slice(0, separator).trim();
+		if (name.length > MAX_COOKIE_NAME_LENGTH) return null;
+		const values = cookies.get(name) ?? [];
+		values.push(part.slice(separator + 1).trim());
+		cookies.set(name, values);
+	}
+	return cookies;
+}
+/** A present but invalid scoped cookie must never fall back to the singleton. */
+function readOAuthTransactionCookie(request, baseName, state, allowLegacy = true) {
+	if (!isUsableCallbackState(state)) return {
+		name: null,
+		value: null,
+		present: false,
+		malformed: false,
+		scoped: false
+	};
+	const scopedName = getScopedOAuthCookieName(baseName, state);
+	const cookies = parseCookies(request);
+	if (!cookies) return {
+		name: scopedName,
+		value: null,
+		present: false,
+		malformed: true,
+		scoped: true
+	};
+	const name = cookies.has(scopedName) || !allowLegacy || !cookies.has(baseName) ? scopedName : baseName;
+	const values = cookies.get(name);
+	let value = null;
+	if (values?.length === 1 && values[0].length <= MAX_COOKIE_VALUE_LENGTH) try {
+		const decoded = decodeURIComponent(values[0]);
+		if (/^[A-Za-z0-9_-]{1,256}$/.test(decoded)) value = decoded;
+	} catch {}
+	return {
+		name,
+		value,
+		present: values !== void 0,
+		malformed: values !== void 0 && value === null,
+		scoped: name === scopedName
+	};
+}
+/** Bound browser growth without evicting another tab's pending transaction. */
+function assertOAuthTransactionCapacity(request) {
+	const cookies = parseCookies(request);
+	if (!cookies) throw new Error("Invalid OAuth cookie header");
+	const prefix = `${OAUTH_STATE_COOKIE_NAME}_`;
+	if (Array.from(cookies.keys()).filter((name) => name.startsWith(prefix) && /^[a-f0-9]{64}$/.test(name.slice(prefix.length))).length >= 8) throw new Error("Too many pending OAuth transactions");
+}
+//#endregion
 //#region src/auth/oauth-recovery.server.ts
 /**
 * Server-only recovery intent for stale OAuth callbacks.
@@ -209,30 +289,9 @@ function isRecoverableOAuthCallbackError(error) {
 * record. Consumers must atomically consume it with the typed stale callback
 * error; the client never supplies a boolean budget or a return URL.
 */
-const OAUTH_RECOVERY_COOKIE_NAME = `${AUTH_ERROR_COOKIE_PREFIX}_oauth_recovery`;
-function escapeRegExp$1(value) {
-	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function getCookieValue(request) {
-	const cookies = request.headers.get("Cookie");
-	if (!cookies) return null;
-	const cookieRegex = new RegExp(`(?:^|;\\s*)${escapeRegExp$1(OAUTH_RECOVERY_COOKIE_NAME)}=([^;]*)`);
-	const rawValue = cookies.match(cookieRegex)?.[1];
-	if (!rawValue) return null;
-	try {
-		const value = decodeURIComponent(rawValue);
-		return value.length > 0 ? value : null;
-	} catch {
-		return null;
-	}
-}
-function hasCookie(request) {
-	const cookies = request.headers.get("Cookie");
-	if (!cookies) return false;
-	return cookies.split(";").some((part) => {
-		const separator = part.indexOf("=");
-		return separator > 0 && part.slice(0, separator).trim() === OAUTH_RECOVERY_COOKIE_NAME;
-	});
+function getRecoveryCookie(request, state = getOAuthCallbackState(request)) {
+	const stateCookie = readOAuthTransactionCookie(request, OAUTH_STATE_COOKIE_NAME, state);
+	return readOAuthTransactionCookie(request, OAUTH_RECOVERY_COOKIE_NAME, state, !(stateCookie.present && stateCookie.scoped));
 }
 const SAFE_FALLBACK_COOKIE_PATH = "/";
 function normalizeCookiePath(pathname) {
@@ -256,19 +315,20 @@ function getOAuthRecoveryCookiePath(source) {
 		return SAFE_FALLBACK_COOKIE_PATH;
 	}
 }
-function serializeRecoveryCookie(ticket, maxAge, callbackPath) {
+function serializeRecoveryCookie(ticket, maxAge, callbackPath, cookieName = OAUTH_RECOVERY_COOKIE_NAME) {
 	const segments = [
-		`${OAUTH_RECOVERY_COOKIE_NAME}=${encodeURIComponent(ticket)}`,
+		`${cookieName}=${encodeURIComponent(ticket)}`,
 		`Path=${callbackPath}`,
 		"HttpOnly",
 		"SameSite=Lax",
 		`Max-Age=${maxAge}`
 	];
-	if (process.env.NODE_ENV === "production") segments.push("Secure");
+	if (env.NODE_ENV === "production") segments.push("Secure");
 	return segments.join("; ");
 }
-function appendRecoveryCookieClear(headers, callbackPath) {
-	headers.append("Set-Cookie", serializeRecoveryCookie("", 0, callbackPath));
+function appendRecoveryCookieClear(headers, callbackPath, cookieName = OAUTH_RECOVERY_COOKIE_NAME) {
+	if (!cookieName) return;
+	headers.append("Set-Cookie", serializeRecoveryCookie("", 0, callbackPath, cookieName));
 }
 function getSetCookieValues(headers) {
 	const getSetCookie = headers.getSetCookie;
@@ -279,9 +339,11 @@ function getSetCookieValues(headers) {
 * Build a lossless ticket-clear header using a callback request, URL, or
 * configured redirect URI as the cookie-path source.
 */
-function clearOAuthRecoveryIntentHeaders(source) {
+function clearOAuthRecoveryIntentHeaders(source, state) {
 	const headers = new Headers();
-	appendRecoveryCookieClear(headers, getOAuthRecoveryCookiePath(source));
+	const requestCookie = source instanceof Request ? getRecoveryCookie(source) : null;
+	const cookieName = state !== void 0 ? getScopedOAuthCookieName(OAUTH_RECOVERY_COOKIE_NAME, state) : requestCookie ? requestCookie.scoped ? requestCookie.name : null : OAUTH_RECOVERY_COOKIE_NAME;
+	appendRecoveryCookieClear(headers, getOAuthRecoveryCookiePath(source), cookieName);
 	return headers;
 }
 function hasNonEmptyParam(url, name) {
@@ -294,25 +356,23 @@ function hasNonEmptyParam(url, name) {
 */
 function isOAuthRecoveryEligibleCallback(request) {
 	const url = new URL(request.url);
-	return hasNonEmptyParam(url, "code") && hasNonEmptyParam(url, "state") && !url.searchParams.has("error") && !url.searchParams.has("kc_action") && !url.searchParams.has("kc_action_status");
+	const state = getOAuthCallbackState(request);
+	return hasNonEmptyParam(url, "code") && state !== null && !readOAuthTransactionCookie(request, OAUTH_STATE_COOKIE_NAME, state).malformed && !url.searchParams.has("error") && !url.searchParams.has("kc_action") && !url.searchParams.has("kc_action_status");
 }
 function isRecoveryRecord(value) {
 	if (value === null || typeof value !== "object") return false;
 	const record = value;
 	return typeof record.state === "string" && record.state.length > 0 && typeof record.returnUrl === "string" && typeof record.createdAt === "number" && Number.isFinite(record.createdAt);
 }
-function getCallbackState(request) {
-	const value = new URL(request.url).searchParams.get("state");
-	return value && value.trim().length > 0 ? value : null;
-}
 /**
 * Create the opaque ticket cookie for an ordinary login transaction.
 * Application-action transactions deliberately do not receive a recovery
 * ticket and therefore cannot enter the automatic recovery path.
 */
-async function createOAuthRecoveryForLogin(request, state, redirectUri) {
+async function createOAuthRecoveryForLogin(request, state, redirectUri, cookieState) {
 	const returnUrl = sanitizeOAuthReturnUrl(state.returnUrl, request) ?? "/";
 	const callbackPath = getOAuthRecoveryCookiePath(redirectUri);
+	const cookieName = cookieState === void 0 ? OAUTH_RECOVERY_COOKIE_NAME : getScopedOAuthCookieName(OAUTH_RECOVERY_COOKIE_NAME, cookieState);
 	const ticket = await createOAuthRecoveryRecord({
 		state: state.state,
 		returnUrl,
@@ -320,7 +380,7 @@ async function createOAuthRecoveryForLogin(request, state, redirectUri) {
 	});
 	return {
 		ticket,
-		cookie: serializeRecoveryCookie(ticket, OAUTH_RECOVERY_TTL_SECONDS, callbackPath)
+		cookie: serializeRecoveryCookie(ticket, OAUTH_RECOVERY_TTL_SECONDS, callbackPath, cookieName)
 	};
 }
 /**
@@ -329,11 +389,14 @@ async function createOAuthRecoveryForLogin(request, state, redirectUri) {
 * cookie if deletion fails.
 */
 async function discardOAuthRecoveryForRequest(request) {
-	const ticket = getCookieValue(request);
+	const state = getOAuthCallbackState(request);
+	const cookie = getRecoveryCookie(request, state);
 	const headers = new Headers();
-	if (!hasCookie(request)) return headers;
-	if (ticket) await deleteOAuthRecoveryRecord(ticket);
-	appendRecoveryCookieClear(headers, getOAuthRecoveryCookiePath(request));
+	if (!cookie.present || !state) return headers;
+	if (cookie.value) {
+		if (!await consumeOAuthRecoveryRecord(cookie.value, state) && !cookie.scoped) return headers;
+	}
+	appendRecoveryCookieClear(headers, getOAuthRecoveryCookiePath(request), cookie.name);
 	return headers;
 }
 /**
@@ -345,53 +408,33 @@ async function discardOAuthRecoveryForRequest(request) {
 * cannot retry.
 */
 async function consumeOAuthRecoveryIntent(request, callbackError) {
-	const cleanupHeaders = clearOAuthRecoveryIntentHeaders(request);
-	const cleanupSetCookies = getSetCookieValues(cleanupHeaders);
-	if (!isRecoverableOAuthCallbackError(callbackError) || !isOAuthRecoveryEligibleCallback(request)) return {
-		intent: null,
-		cleanupHeaders,
-		cleanupSetCookies
-	};
-	const ticket = getCookieValue(request);
-	const callbackState = getCallbackState(request);
-	if (!ticket || !callbackState) return {
-		intent: null,
-		cleanupHeaders,
-		cleanupSetCookies
+	const cookie = getRecoveryCookie(request);
+	const result = (intent = null, ownsLegacy = false) => {
+		const cleanupHeaders = new Headers();
+		appendRecoveryCookieClear(cleanupHeaders, getOAuthRecoveryCookiePath(request), cookie.scoped || ownsLegacy ? cookie.name : null);
+		return {
+			intent,
+			cleanupHeaders,
+			cleanupSetCookies: getSetCookieValues(cleanupHeaders)
+		};
 	};
+	if (!isRecoverableOAuthCallbackError(callbackError) || !isOAuthRecoveryEligibleCallback(request)) return result();
+	const ticket = cookie.value;
+	const callbackState = getOAuthCallbackState(request);
+	if (!ticket || !callbackState) return result();
 	let record;
 	try {
 		record = await consumeOAuthRecoveryRecord(ticket, callbackState);
 	} catch (error) {
 		logger.warn("OAuth recovery record could not be consumed", { errorType: error instanceof Error ? error.name : "UnknownError" });
-		return {
-			intent: null,
-			cleanupHeaders,
-			cleanupSetCookies
-		};
+		return result();
 	}
-	if (!isRecoveryRecord(record)) return {
-		intent: null,
-		cleanupHeaders,
-		cleanupSetCookies
-	};
+	if (!isRecoveryRecord(record) || record.state !== callbackState) return result();
 	const age = Date.now() - record.createdAt;
-	if (age < 0 || age > OAUTH_RECOVERY_TTL_MS) return {
-		intent: null,
-		cleanupHeaders,
-		cleanupSetCookies
-	};
+	if (age < 0 || age > OAUTH_RECOVERY_TTL_MS) return result(null, true);
 	const returnUrl = sanitizeOAuthReturnUrl(record.returnUrl, request);
-	if (!returnUrl) return {
-		intent: null,
-		cleanupHeaders,
-		cleanupSetCookies
-	};
-	return {
-		intent: { returnUrl },
-		cleanupHeaders,
-		cleanupSetCookies
-	};
+	if (!returnUrl) return result(null, true);
+	return result({ returnUrl }, true);
 }
 //#endregion
 //#region src/auth/auth.server.ts
@@ -547,7 +590,7 @@ function isLocalInsecureIssuer(authority) {
 	}
 }
 function shouldAllowInsecureOidcRequests(authority) {
-	if (process.env.NODE_ENV === "production") return false;
+	if (env.NODE_ENV === "production") return false;
 	if (process.env.OIDC_ALLOW_INSECURE_REQUESTS === "true") return true;
 	return isLocalInsecureIssuer(authority);
 }
@@ -870,7 +913,6 @@ async function createSessionData(tokenResult, claims) {
 }
 const AUTH_ERROR_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_auth_error`;
 const AUTH_ERROR_DESC_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_auth_error_desc`;
-const OAUTH_STATE_COOKIE = `${AUTH_ERROR_COOKIE_PREFIX}_oauth_state_id`;
 const LOGOUT_RETURN_URL_COOKIE = "logout_return_url";
 /**
 * Check if there's an auth error in cookies
@@ -924,22 +966,6 @@ function clearAuthErrorHeaders() {
 function hasAuthError(request) {
 	return request.headers.get("Cookie")?.includes(`${AUTH_ERROR_COOKIE}=`) ?? false;
 }
-function escapeRegExp(value) {
-	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function getOAuthStateIdFromRequest(request) {
-	const cookies = request.headers.get("Cookie");
-	if (!cookies) return null;
-	const cookieRegex = new RegExp(`(?:^|;\\s*)${escapeRegExp(OAUTH_STATE_COOKIE)}=([^;]*)`);
-	const cookieValue = cookies.match(cookieRegex)?.[1];
-	if (!cookieValue) return null;
-	try {
-		const stateId = decodeURIComponent(cookieValue);
-		return stateId.length > 0 ? stateId : null;
-	} catch {
-		return null;
-	}
-}
 function hasNonEmptyCallbackValue(value) {
 	return value !== null && value.trim().length > 0;
 }
@@ -953,8 +979,9 @@ function appendHeadersPreservingSetCookie(target, source) {
 	}
 	for (const [name, value] of sourceHeaders) if (name.toLowerCase() !== "set-cookie") target.set(name, value);
 }
-function appendOAuthStateCookieClear(headers) {
-	headers.append("Set-Cookie", serializeTemporaryAuthCookie(OAUTH_STATE_COOKIE, "", { maxAge: 0 }));
+function appendOAuthStateCookieClear(headers, cookieName) {
+	if (!cookieName) return;
+	headers.append("Set-Cookie", serializeTemporaryAuthCookie(cookieName, "", { maxAge: 0 }));
 }
 function isUsableOAuthState(state, requireNonce) {
 	return state !== null && typeof state.state === "string" && state.state.length > 0 && typeof state.codeVerifier === "string" && state.codeVerifier.length > 0 && (state.nonce === void 0 ? !requireNonce : typeof state.nonce === "string" && state.nonce.length > 0) && typeof state.createdAt === "number" && Number.isFinite(state.createdAt) && (state.returnUrl === void 0 || typeof state.returnUrl === "string") && (state.kcAction === void 0 || typeof state.kcAction === "string");
@@ -971,12 +998,12 @@ function getCallbackFailureCode(error, stage) {
 		default: return OAuthCallbackFailureCodes.StorageError;
 	}
 }
-async function createOAuthCallbackFailure(request, stateId, failureCode) {
+async function createOAuthCallbackFailure(request, stateId, failureCode, callbackState, stateCookie, canClearStateCookie) {
 	const cleanupHeaders = new Headers();
 	let cleanupError;
 	const preserveRecoveryTicket = failureCode === OAuthCallbackFailureCodes.StaleTransaction && isOAuthRecoveryEligibleCallback(request);
-	if (stateId) try {
-		await deleteOAuthState(stateId);
+	if (stateId && callbackState) try {
+		await deleteOAuthState(stateId, callbackState);
 	} catch (error) {
 		cleanupError = error;
 	}
@@ -991,7 +1018,7 @@ async function createOAuthCallbackFailure(request, stateId, failureCode) {
 		cleanupError ??= error;
 		appendHeadersPreservingSetCookie(cleanupHeaders, clearOAuthRecoveryIntentHeaders(request));
 	}
-	appendOAuthStateCookieClear(cleanupHeaders);
+	appendOAuthStateCookieClear(cleanupHeaders, canClearStateCookie ? stateCookie.name : null);
 	const effectiveFailureCode = cleanupError ? OAuthCallbackFailureCodes.StorageError : failureCode;
 	if (cleanupError) logger.warn("OAuth callback cleanup failed", {
 		failureCode: effectiveFailureCode,
@@ -1007,6 +1034,7 @@ async function createOAuthCallbackFailure(request, stateId, failureCode) {
 */
 async function login(request, returnUrlOrOptions) {
 	let oauthStateId = null;
+	let oauthStateValue = null;
 	let recoveryTicket = null;
 	let recoveryCookie = null;
 	try {
@@ -1020,11 +1048,14 @@ async function login(request, returnUrlOrOptions) {
 			const baseUrl = new URL(config.redirectUri).origin;
 			return createRedirectResponse(baseUrl, { headers });
 		}
+		assertOAuthTransactionCapacity(request);
 		const oidcConfig = await getOAuthConfig();
 		const codeVerifier = oidc.randomPKCECodeVerifier();
 		const codeChallenge = await oidc.calculatePKCECodeChallenge(codeVerifier);
 		const extraAuthParams = sanitizeExtraAuthorizationParameters(options.extraAuthParams, options);
 		const state = buildAuthorizationState(oidc.randomState(), options.publicStateContext);
+		oauthStateValue = state;
+		const stateCookieName = getScopedOAuthCookieName(OAUTH_STATE_COOKIE_NAME, state);
 		const nonce = oidc.randomNonce();
 		const oauthState = {
 			state,
@@ -1045,7 +1076,7 @@ async function login(request, returnUrlOrOptions) {
 			const recovery = await createOAuthRecoveryForLogin(request, {
 				state,
 				returnUrl
-			}, config.redirectUri);
+			}, config.redirectUri, state);
 			recoveryTicket = recovery.ticket;
 			recoveryCookie = recovery.cookie;
 		}
@@ -1062,7 +1093,7 @@ async function login(request, returnUrlOrOptions) {
 		if (options.kcAction) authorizationParameters.kc_action = options.kcAction;
 		const authorizationUrl = oidc.buildAuthorizationUrl(oidcConfig, authorizationParameters);
 		const headers = new Headers();
-		headers.append("Set-Cookie", serializeTemporaryAuthCookie(OAUTH_STATE_COOKIE, oauthStateId, { maxAge: OAUTH_STATE_TTL_SECONDS }));
+		headers.append("Set-Cookie", serializeTemporaryAuthCookie(stateCookieName, oauthStateId, { maxAge: OAUTH_STATE_TTL_SECONDS }));
 		if (recoveryCookie) headers.append("Set-Cookie", recoveryCookie);
 		logger.info("OIDC authorization flow initiated", {
 			clientId: config.clientId,
@@ -1076,7 +1107,7 @@ async function login(request, returnUrlOrOptions) {
 		return createRedirectResponse(authorizationUrl.toString(), { headers });
 	} catch (error) {
 		if (oauthStateId) try {
-			await deleteOAuthState(oauthStateId);
+			await deleteOAuthState(oauthStateId, oauthStateValue ?? void 0);
 		} catch (cleanupError) {
 			logger.warn("OAuth login state cleanup failed", { errorType: cleanupError instanceof Error ? cleanupError.name : "UnknownError" });
 		}
@@ -1104,14 +1135,27 @@ async function login(request, returnUrlOrOptions) {
 async function handleCallback(request) {
 	let stateId = null;
 	let callbackStage = "configuration";
+	let callbackState = null;
+	let canClearStateCookie = false;
+	let stateCookie = {
+		name: null,
+		value: null,
+		present: false,
+		malformed: false,
+		scoped: false
+	};
 	try {
-		stateId = getOAuthStateIdFromRequest(request);
+		callbackState = getOAuthCallbackState(request);
+		stateCookie = readOAuthTransactionCookie(request, OAUTH_STATE_COOKIE_NAME, callbackState);
+		stateId = stateCookie.value;
+		canClearStateCookie = stateCookie.scoped;
+		if (stateCookie.malformed) throw new OAuthCallbackError(OAuthCallbackFailureCodes.MalformedCallback);
 		const config = getAuthConfig();
 		const hasLandingPage = getEffectiveHasLandingPage(config);
 		const requiresNonce = config.scope.split(/\s+/).includes("openid");
 		const url = new URL(request.url);
 		const code = url.searchParams.get("code");
-		const state = url.searchParams.get("state");
+		const state = callbackState;
 		const error = url.searchParams.get("error");
 		const errorDescription = url.searchParams.get("error_description");
 		const kcAction = url.searchParams.get("kc_action");
@@ -1129,19 +1173,25 @@ async function handleCallback(request) {
 			clientId: config.clientId,
 			redirectUri: config.redirectUri
 		});
+		if (error && stateId && !stateCookie.scoped) {
+			callbackStage = "state";
+			const pendingState = await getOAuthState(stateId, { throwOnMalformed: true });
+			canClearStateCookie = !pendingState || pendingState.state === state;
+		}
 		if (error) {
 			if (kcActionStatus && hasState) {
 				callbackStage = "state";
 				if (stateId) {
 					const oauthState = await getOAuthState(stateId, { throwOnMalformed: true });
+					canClearStateCookie = stateCookie.scoped || !oauthState || oauthState.state === state;
 					const stateAge = oauthState ? Date.now() - oauthState.createdAt : Number.POSITIVE_INFINITY;
 					if (oauthState && isUsableOAuthState(oauthState, requiresNonce) && oauthState.state === state && stateAge <= OAUTH_STATE_TTL_MS) {
 						callbackStage = "storage";
-						await deleteOAuthState(stateId);
+						await deleteOAuthState(stateId, state);
 						const recoveryHeaders = await discardOAuthRecoveryForRequest(request);
 						callbackStage = "application_action";
 						const headers = new Headers();
-						appendOAuthStateCookieClear(headers);
+						appendOAuthStateCookieClear(headers, canClearStateCookie ? stateCookie.name : null);
 						appendHeadersPreservingSetCookie(headers, recoveryHeaders);
 						const redirectUrl = appendApplicationInitiatedActionResult(sanitizeOAuthReturnUrl(oauthState.returnUrl, request) ?? "/", kcAction || oauthState.kcAction, kcActionStatus);
 						logger.info("Application initiated action returned with OAuth error", {
@@ -1164,9 +1214,9 @@ async function handleCallback(request) {
 			if (error === "access_denied") {
 				logger.warn("Access denied for this application", { clientId: config.clientId });
 				callbackStage = "storage";
-				if (stateId) await deleteOAuthState(stateId);
+				if (stateId) await deleteOAuthState(stateId, state);
 				const headers = await destroyAuthSession(request);
-				appendOAuthStateCookieClear(headers);
+				appendOAuthStateCookieClear(headers, canClearStateCookie ? stateCookie.name : null);
 				appendHeadersPreservingSetCookie(headers, await discardOAuthRecoveryForRequest(request));
 				headers.append("Set-Cookie", serializeTemporaryAuthCookie(AUTH_ERROR_COOKIE, "access_denied", { maxAge: 300 }));
 				headers.append("Set-Cookie", serializeTemporaryAuthCookie(AUTH_ERROR_DESC_COOKIE, "You do not have access to this application.", { maxAge: 300 }));
@@ -1181,17 +1231,17 @@ async function handleCallback(request) {
 			if (error === "login_required") {
 				logger.info("Login required, user session may have expired");
 				callbackStage = "storage";
-				if (stateId) await deleteOAuthState(stateId);
+				if (stateId) await deleteOAuthState(stateId, state);
 				const headers = await destroyAuthSession(request);
-				appendOAuthStateCookieClear(headers);
+				appendOAuthStateCookieClear(headers, canClearStateCookie ? stateCookie.name : null);
 				appendHeadersPreservingSetCookie(headers, await discardOAuthRecoveryForRequest(request));
 				const baseUrl = new URL(config.redirectUri).origin;
 				return createRedirectResponse(baseUrl, { headers });
 			}
 			callbackStage = "storage";
-			if (stateId) await deleteOAuthState(stateId);
+			if (stateId) await deleteOAuthState(stateId, state);
 			const headers = await destroyAuthSession(request);
-			appendOAuthStateCookieClear(headers);
+			appendOAuthStateCookieClear(headers, canClearStateCookie ? stateCookie.name : null);
 			appendHeadersPreservingSetCookie(headers, await discardOAuthRecoveryForRequest(request));
 			headers.append("Set-Cookie", serializeTemporaryAuthCookie(AUTH_ERROR_COOKIE, error, { maxAge: 300 }));
 			const baseUrl = new URL(config.redirectUri).origin;
@@ -1211,6 +1261,7 @@ async function handleCallback(request) {
 		}
 		callbackStage = "state";
 		const oauthState = await getOAuthState(stateId, { throwOnMalformed: true });
+		canClearStateCookie = stateCookie.scoped || !oauthState || oauthState.state === state;
 		if (!oauthState) throw new OAuthCallbackError(hasApplicationAction ? OAuthCallbackFailureCodes.ApplicationActionFailed : OAuthCallbackFailureCodes.StaleTransaction);
 		if (!isUsableOAuthState(oauthState, requiresNonce)) throw new OAuthCallbackError(OAuthCallbackFailureCodes.StorageError);
 		if (oauthState.state !== state) throw new OAuthCallbackError(OAuthCallbackFailureCodes.StateMismatch);
@@ -1219,11 +1270,11 @@ async function handleCallback(request) {
 		if (!hasCode) {
 			if (kcActionStatus) {
 				callbackStage = "storage";
-				await deleteOAuthState(stateId);
+				await deleteOAuthState(stateId, state);
 				const recoveryHeaders = await discardOAuthRecoveryForRequest(request);
 				callbackStage = "application_action";
 				const headers = new Headers();
-				appendOAuthStateCookieClear(headers);
+				appendOAuthStateCookieClear(headers, canClearStateCookie ? stateCookie.name : null);
 				appendHeadersPreservingSetCookie(headers, recoveryHeaders);
 				const redirectUrl = appendApplicationInitiatedActionResult(sanitizeOAuthReturnUrl(oauthState.returnUrl, request) ?? "/", kcAction || oauthState.kcAction, kcActionStatus);
 				logger.info("Application initiated action returned without authorization code", {
@@ -1251,11 +1302,11 @@ async function handleCallback(request) {
 		callbackStage = "session_creation";
 		const sessionHeaders = await createAuthSession(request, newSessionData);
 		callbackStage = "storage";
-		await deleteOAuthState(stateId);
+		await deleteOAuthState(stateId, state);
 		const recoveryHeaders = await discardOAuthRecoveryForRequest(request);
 		const headers = new Headers();
 		appendHeadersPreservingSetCookie(headers, sessionHeaders);
-		appendOAuthStateCookieClear(headers);
+		appendOAuthStateCookieClear(headers, canClearStateCookie ? stateCookie.name : null);
 		appendHeadersPreservingSetCookie(headers, recoveryHeaders);
 		logger.info("OAuth callback processed successfully");
 		return createRedirectResponse(appendApplicationInitiatedActionResult(sanitizeOAuthReturnUrl(oauthState.returnUrl, request) ?? "/", kcAction || oauthState.kcAction, kcActionStatus), { headers });
@@ -1265,9 +1316,15 @@ async function handleCallback(request) {
 			failureCode,
 			errorType: error instanceof Error ? error.name : "UnknownError"
 		});
-		throw await createOAuthCallbackFailure(request, stateId, failureCode);
+		throw await createOAuthCallbackFailure(request, stateId, failureCode, callbackState, stateCookie, canClearStateCookie);
 	}
 }
+function createLocalLogoutResponse(request, headers) {
+	const returnUrl = sanitizeOAuthReturnUrl(new URL(request.url).searchParams.get("returnUrl"), request);
+	headers.append("Set-Cookie", serializeTemporaryAuthCookie(LOGOUT_RETURN_URL_COOKIE, "", { maxAge: 0 }));
+	logger.info("Local application logout completed", { hasReturnUrl: Boolean(returnUrl) });
+	return createRedirectResponse(getAbsoluteRedirectUrl(request, returnUrl || "/"), { headers });
+}
 /**
 * Logout user.
 *
@@ -1276,7 +1333,8 @@ async function handleCallback(request) {
 * `/auth/logout?logout=local` to clear only this app's Redis session without
 * bouncing the browser through the identity provider or revoking SSO tokens.
 */
-async function logout(request) {
+async function logout(request, options = {}) {
+	if (options.sessionInvalidated) return createLocalLogoutResponse(request, clearAuthSessionCookie());
 	try {
 		const config = getAuthConfig();
 		const url = new URL(request.url);
@@ -1286,15 +1344,9 @@ async function logout(request) {
 			clientId: config.clientId,
 			logoutScope
 		});
+		if (logoutScope === "local") return createLocalLogoutResponse(request, await destroyAuthSession(request));
 		const sessionData = await getAuthSession(request);
 		const idToken = sessionData.idToken;
-		if (logoutScope === "local") {
-			const headers = await destroyAuthSession(request);
-			const absoluteRedirectUrl = getAbsoluteRedirectUrl(request, returnUrl || "/");
-			headers.append("Set-Cookie", serializeTemporaryAuthCookie(LOGOUT_RETURN_URL_COOKIE, "", { maxAge: 0 }));
-			logger.info("Local application logout completed", { hasReturnUrl: Boolean(returnUrl) });
-			return createRedirectResponse(absoluteRedirectUrl, { headers });
-		}
 		const sessionHeaders = new Headers();
 		if (logoutScope === "all" && sessionData.userId) {
 			await revokeAndDestroyAllUserSessionsBestEffort(sessionData.userId);
@@ -1414,21 +1466,10 @@ async function handleFrontChannelLogout(request) {
 		return new Response(null, { status: 204 });
 	}
 }
-function getAccessTokenExpiry(accessToken) {
-	if (!accessToken) return null;
-	try {
-		const [, encodedPayload] = accessToken.split(".");
-		if (!encodedPayload) return null;
-		const payload = JSON.parse(Buffer.from(encodedPayload, "base64url").toString("utf8"));
-		return typeof payload.exp === "number" && Number.isFinite(payload.exp) ? payload.exp * 1e3 : null;
-	} catch {
-		return null;
-	}
-}
 function isSessionExpired(sessionData) {
 	const now = Date.now();
 	if (typeof sessionData.expiresAt === "number" && (!Number.isFinite(sessionData.expiresAt) || now >= sessionData.expiresAt)) return true;
-	const accessTokenExpiry = getAccessTokenExpiry(sessionData.accessToken);
+	const accessTokenExpiry = getTokenExpiry(sessionData);
 	return accessTokenExpiry !== null && now >= accessTokenExpiry;
 }
 /**
@@ -1468,75 +1509,171 @@ async function getAccessToken(request) {
 		return null;
 	}
 }
-/**
-* Refresh tokens
-*/
+const REFRESH_REQUEST_TIMEOUT_MS = 15e3;
+const REFRESH_LOCK_TTL_MS = 2e4;
+function refreshFailure(error, shouldLogout = false) {
+	return {
+		success: false,
+		error,
+		shouldLogout
+	};
+}
+function reusedRefreshResult(session) {
+	const expiry = getTokenExpiry(session);
+	return {
+		success: true,
+		tokens: {
+			access_token: session.accessToken,
+			refresh_token: session.refreshToken,
+			id_token: session.idToken,
+			expires_in: expiry === null ? void 0 : Math.max(0, Math.floor((expiry - Date.now()) / 1e3))
+		}
+	};
+}
+function hasNewUsableTokens(current, previous) {
+	return Boolean(current.accessToken) && !isSessionExpired(current) && !hasSameAuthTokenGeneration(current, previous);
+}
+async function invalidateFailedRefresh(request, expected, owner, error) {
+	const invalidated = await invalidateAuthSessionRefreshGeneration(expected, owner);
+	if (invalidated === "invalidated" || invalidated === "missing") return {
+		...refreshFailure(error, true),
+		sessionInvalidated: true
+	};
+	const latest = await getAuthSession(request, { throwOnError: true });
+	if (!latest.sessionId) return {
+		...refreshFailure("No active session", true),
+		sessionInvalidated: true
+	};
+	return hasNewUsableTokens(latest, expected) ? reusedRefreshResult(latest) : refreshFailure("Session changed while refreshing tokens");
+}
+/** Refresh only a signed, existing session, serialized across server processes. */
 async function refreshTokens(request, refreshToken) {
+	let lock;
+	let attemptedSession;
 	try {
-		const sessionData = await getAuthSession(request);
-		if (!sessionData.sessionId) {
-			logger.warn("Cannot refresh tokens without an active Redis session");
-			return {
-				success: false,
-				error: "No active session",
-				shouldLogout: true
-			};
-		}
-		const sessionRefreshToken = sessionData.refreshToken;
-		if (!sessionRefreshToken) {
-			logger.warn("No refresh token available");
-			return {
-				success: false,
-				error: "No refresh token available",
-				shouldLogout: true
+		const initial = await getAuthSession(request, { throwOnError: true });
+		if (!initial.sessionId) return {
+			...refreshFailure("No active session", true),
+			sessionInvalidated: true
+		};
+		if (refreshToken && refreshToken !== initial.refreshToken) return refreshFailure("Refresh token does not match active session", true);
+		if (!initial.refreshToken) {
+			const owner = crypto.randomUUID();
+			if (!await acquireAuthSessionRefreshLock(initial.sessionId, owner, REFRESH_LOCK_TTL_MS)) return refreshFailure("Token refresh is still in progress");
+			lock = {
+				sessionId: initial.sessionId,
+				owner
 			};
+			return await invalidateFailedRefresh(request, {
+				...initial,
+				sessionId: initial.sessionId
+			}, owner, "No refresh token available");
 		}
-		if (refreshToken && refreshToken !== sessionRefreshToken) {
-			logger.warn("Rejected refresh token that does not match the active Redis session");
-			return {
-				success: false,
-				error: "Refresh token does not match active session",
-				shouldLogout: true
+		const discovered = await getOAuthConfig();
+		const config = getAuthConfig();
+		const refreshConfig = new oidc.Configuration(discovered.serverMetadata(), config.clientId, getClientMetadata(config), getClientAuthentication(config));
+		refreshConfig.timeout = REFRESH_REQUEST_TIMEOUT_MS / 1e3;
+		if (shouldAllowInsecureOidcRequests(config.authority)) oidc.allowInsecureRequests(refreshConfig);
+		const owner = crypto.randomUUID();
+		const deadline = Date.now() + REFRESH_LOCK_TTL_MS;
+		let session;
+		while (true) {
+			if (await acquireAuthSessionRefreshLock(initial.sessionId, owner, REFRESH_LOCK_TTL_MS)) {
+				lock = {
+					sessionId: initial.sessionId,
+					owner
+				};
+				session = await getAuthSession(request, { throwOnError: true });
+				break;
+			}
+			const latest = await getAuthSession(request, { throwOnError: true });
+			if (!latest.sessionId) return {
+				...refreshFailure("No active session", true),
+				sessionInvalidated: true
 			};
+			if (!latest.refreshToken) return refreshFailure("Session changed while refreshing tokens");
+			if (hasNewUsableTokens(latest, initial)) return reusedRefreshResult(latest);
+			if (Date.now() >= deadline) return refreshFailure("Token refresh is still in progress");
+			await new Promise((resolve) => setTimeout(resolve, 50));
 		}
-		const tokenToRefresh = sessionRefreshToken;
+		if (!session.sessionId) return {
+			...refreshFailure("No active session", true),
+			sessionInvalidated: true
+		};
+		if (!session.refreshToken) return refreshFailure("Session changed while refreshing tokens");
+		if (hasNewUsableTokens(session, initial)) return reusedRefreshResult(session);
 		logger.info("Initiating token refresh");
-		const oidcConfig = await getOAuthConfig();
-		const refreshResult = await oidc.refreshTokenGrant(oidcConfig, tokenToRefresh);
-		logger.info("Token refresh successful");
-		if (!refreshResult.access_token) {
-			logger.error("Token refresh returned no access token");
-			return {
-				success: false,
-				error: "No access token in refresh response",
-				shouldLogout: true
-			};
+		attemptedSession = session;
+		let timer;
+		let result;
+		try {
+			result = await Promise.race([oidc.refreshTokenGrant(refreshConfig, session.refreshToken), new Promise((_, reject) => {
+				timer = setTimeout(() => reject(/* @__PURE__ */ new Error("Token refresh timed out")), REFRESH_REQUEST_TIMEOUT_MS);
+			})]);
+		} finally {
+			clearTimeout(timer);
 		}
-		const newRefreshToken = refreshResult.refresh_token || tokenToRefresh;
-		const expiresAt = refreshResult.expires_in ? Date.now() + refreshResult.expires_in * 1e3 : sessionData.expiresAt;
-		await updateAuthSession(request, {
-			accessToken: refreshResult.access_token,
+		if (!result.access_token) return refreshFailure("No access token in refresh response");
+		const newRefreshToken = result.refresh_token || session.refreshToken;
+		const expiresAt = getTokenExpiry({
+			accessToken: result.access_token,
+			expiresAt: typeof result.expires_in === "number" && Number.isFinite(result.expires_in) ? Date.now() + result.expires_in * 1e3 : void 0
+		}) ?? void 0;
+		if (isSessionExpired({
+			accessToken: result.access_token,
+			expiresAt
+		})) return refreshFailure("Refresh response contains an expired access token");
+		const saved = await saveRefreshedAuthSession({
+			...session,
+			sessionId: session.sessionId
+		}, owner, {
+			accessToken: result.access_token,
 			refreshToken: newRefreshToken,
-			idToken: refreshResult.id_token,
+			idToken: result.id_token ?? session.idToken,
 			expiresAt,
 			lastActivity: Date.now()
 		});
+		if (saved === "missing") return {
+			...refreshFailure("No active session", true),
+			sessionInvalidated: true
+		};
+		if (saved !== "updated") {
+			const latest = await getAuthSession(request, { throwOnError: true });
+			if (!latest.sessionId) return {
+				...refreshFailure("No active session", true),
+				sessionInvalidated: true
+			};
+			if (!latest.refreshToken) return refreshFailure("Session changed while refreshing tokens");
+			return hasNewUsableTokens(latest, session) ? reusedRefreshResult(latest) : refreshFailure("Session changed while refreshing tokens");
+		}
+		logger.info("Token refresh successful");
 		return {
 			success: true,
 			tokens: {
-				access_token: refreshResult.access_token,
+				access_token: result.access_token,
 				refresh_token: newRefreshToken,
-				id_token: refreshResult.id_token,
-				expires_in: refreshResult.expires_in
+				id_token: result.id_token ?? session.idToken,
+				expires_in: result.expires_in
 			}
 		};
 	} catch (error) {
-		logger.error("Token refresh failed with exception", error instanceof Error ? error : void 0);
-		return {
-			success: false,
-			error: getOAuthErrorMessage(error),
-			shouldLogout: true
-		};
+		logger.error("Token refresh failed", error instanceof Error ? error : void 0);
+		const terminal = error instanceof oidc.ResponseBodyError && error.error === "invalid_grant" && error.status < 500;
+		if (terminal && lock && attemptedSession) try {
+			return await invalidateFailedRefresh(request, {
+				...attemptedSession,
+				sessionId: lock.sessionId
+			}, lock.owner, getOAuthErrorMessage(error));
+		} catch {
+			return refreshFailure("Could not verify session after token refresh failure");
+		}
+		return refreshFailure(getOAuthErrorMessage(error), terminal);
+	} finally {
+		if (lock) try {
+			await releaseAuthSessionRefreshLock(lock.sessionId, lock.owner);
+		} catch (error) {
+			logger.warn("Could not release token refresh lease", { error: error instanceof Error ? error.message : "Unknown error" });
+		}
 	}
 }
 /**
@@ -1563,32 +1700,26 @@ function resolveRefreshThreshold() {
 */
 async function shouldRefreshToken(request) {
 	try {
-		const sessionData = await getAuthSession(request);
-		const now = Date.now();
-		const sessionExpired = typeof sessionData.expiresAt === "number" && now >= sessionData.expiresAt;
-		if (!sessionData.refreshToken || sessionData.refreshToken.length === 0) {
-			if (sessionExpired) {
-				logger.info("Token expired and no refresh token, forcing local application logout");
-				throw await logout(await createAutomaticLogoutRequest(request, "expired-no-refresh-token"));
-			}
-			return false;
-		}
-		if (!sessionData.expiresAt || !sessionData.accessToken) return false;
-		let jwtExpiry = null;
-		try {
-			const tokenParts = sessionData.accessToken.split(".");
-			if (tokenParts.length === 3) {
-				const payload = JSON.parse(Buffer.from(tokenParts[1], "base64").toString());
-				if (payload.exp) jwtExpiry = payload.exp * 1e3;
-			}
-		} catch {}
-		return (jwtExpiry && jwtExpiry < sessionData.expiresAt ? jwtExpiry : sessionData.expiresAt) - now <= REFRESH_THRESHOLD;
+		const sessionData = await getAuthSession(request, { throwOnError: true });
+		const expiry = getTokenExpiry(sessionData);
+		const sessionExpired = expiry !== null && Date.now() >= expiry;
+		if (!sessionData.refreshToken) return sessionExpired;
+		return Boolean(sessionData.accessToken) && expiry !== null && expiry - Date.now() <= REFRESH_THRESHOLD;
 	} catch (error) {
 		if (error instanceof Response) throw error;
 		logger.error("Error checking token refresh", error instanceof Error ? error : void 0);
-		throw error;
+		throw authUnavailableResponse();
 	}
 }
+function authUnavailableResponse() {
+	return new Response("Authentication temporarily unavailable", {
+		status: 503,
+		headers: {
+			"Cache-Control": "no-store",
+			"Retry-After": "5"
+		}
+	});
+}
 /**
 * Auto-refresh tokens if needed
 */
@@ -1600,12 +1731,12 @@ async function autoRefreshTokens(request) {
 			if (result.success && result.tokens?.access_token) logger.info("Auto-refresh completed successfully");
 			else {
 				logger.error("Auto-refresh failed", void 0, { error: result.error ?? "Refresh response did not include an access token" });
-				logger.error("Refresh token unusable, forcing local application logout");
-				throw await logout(await createAutomaticLogoutRequest(request, "refresh-failed"));
+				if (result.shouldLogout !== true) throw authUnavailableResponse();
+				throw await logout(await createAutomaticLogoutRequest(request, result.error === "No refresh token available" ? "expired-no-refresh-token" : "refresh-failed"), { sessionInvalidated: result.sessionInvalidated });
 			}
 		}
 	} catch (error) {
-		if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
+		if (error instanceof Response && (error.status >= 300 && error.status < 400 || error.status === 503)) throw error;
 		throw error;
 	}
 }
@@ -1686,7 +1817,7 @@ async function applyConfiguredRouteResolution(request, user, currentPath, protec
 		if (result) throw createRedirectFromConfig(result);
 		return true;
 	} catch (error) {
-		if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
+		if (error instanceof Response && (error.status >= 300 && error.status < 400 || error.status === 503)) throw error;
 		if (!protectionConfig.handleRouteError) throw error;
 		const recovery = await protectionConfig.handleRouteError({
 			...context,
@@ -1706,7 +1837,7 @@ async function protectRoute(request, protection, loaderFn) {
 			await autoRefreshTokens(request);
 			return loaderFn(await getUser(request) ?? void 0);
 		} catch (error) {
-			if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
+			if (error instanceof Response && (error.status >= 300 && error.status < 400 || error.status === 503)) throw error;
 			return loaderFn(void 0);
 		}
 		case "auth":
@@ -1716,7 +1847,7 @@ async function protectRoute(request, protection, loaderFn) {
 			await applyConfiguredRouteResolution(request, user, url.pathname, protection);
 			return loaderFn(user);
 		} catch (error) {
-			if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
+			if (error instanceof Response && (error.status >= 300 && error.status < 400 || error.status === 503)) throw error;
 			throw await login(request, getLoginReturnUrl(request, url.pathname, protection));
 		}
 		case "onboarding-required": try {
@@ -1725,7 +1856,7 @@ async function protectRoute(request, protection, loaderFn) {
 			await applyConfiguredRouteResolution(request, user, url.pathname, "onboarding-required");
 			return loaderFn(user);
 		} catch (error) {
-			if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
+			if (error instanceof Response && (error.status >= 300 && error.status < 400 || error.status === 503)) throw error;
 			throw await login(request, getLoginReturnUrl(request, url.pathname, "onboarding-required"));
 		}
 		case "subscription-required": try {
@@ -1737,7 +1868,7 @@ async function protectRoute(request, protection, loaderFn) {
 			}
 			return loaderFn(user);
 		} catch (error) {
-			if (error instanceof Response && error.status >= 300 && error.status < 400) throw error;
+			if (error instanceof Response && (error.status >= 300 && error.status < 400 || error.status === 503)) throw error;
 			throw await login(request, getLoginReturnUrl(request, url.pathname, "subscription-required"));
 		}
 		default: throw new Error(`Unknown protection level: ${protection}`);
@@ -1782,16 +1913,7 @@ const subscriptionRoute = (request, loaderFn) => protectRoute(request, "subscrip
 async function attemptTokenRefresh(request) {
 	try {
 		logger.info("Attempting token refresh due to 401 response");
-		const sessionData = await getAuthSession(request);
-		if (!sessionData.refreshToken) {
-			logger.warn("No refresh token available in session");
-			return {
-				success: false,
-				error: "No refresh token available",
-				shouldLogout: true
-			};
-		}
-		const refreshResult = await refreshTokens(request, sessionData.refreshToken);
+		const refreshResult = await refreshTokens(request);
 		if (!refreshResult.success) {
 			logger.error("Token refresh failed", void 0, {
 				error: refreshResult.error,
@@ -1800,7 +1922,8 @@ async function attemptTokenRefresh(request) {
 			return {
 				success: false,
 				error: refreshResult.error,
-				shouldLogout: true
+				shouldLogout: refreshResult.shouldLogout === true,
+				...refreshResult.sessionInvalidated ? { sessionInvalidated: true } : {}
 			};
 		}
 		const tokens = refreshResult.tokens;
@@ -1809,7 +1932,7 @@ async function attemptTokenRefresh(request) {
 			return {
 				success: false,
 				error: "No access token in refresh response",
-				shouldLogout: true
+				shouldLogout: false
 			};
 		}
 		logger.info("Token refresh successful");
@@ -1822,7 +1945,7 @@ async function attemptTokenRefresh(request) {
 		return {
 			success: false,
 			error: error instanceof Error ? error.message : "Unknown error",
-			shouldLogout: true
+			shouldLogout: false
 		};
 	}
 }
@@ -1839,6 +1962,6 @@ function shouldAttemptTokenRefresh(response, hasAuth) {
 	return hasAuth && isTokenExpiredResponse(response);
 }
 //#endregion
-export { resetAuthClaimMapping as A, handleCallback as C, logout as D, login as E, OAuthCallbackError as F, OAuthCallbackFailureCodes as I, isOAuthCallbackError as L, clearOAuthRecoveryIntentHeaders as M, consumeOAuthRecoveryIntent as N, refreshTokens as O, getOAuthRecoveryCookiePath as P, isRecoverableOAuthCallbackError as R, handleBackChannelLogout as S, hasAuthError as T, createAuthorizationResponseUrl as _, configureRouteProtection as a, getAuthError as b, protectRoute as c, resetRouteProtectionConfig as d, shouldRefreshToken as f, configureAuthClaimMapping as g, clearAuthServerCache as h, authRoute as i, OAUTH_RECOVERY_COOKIE_NAME as j, requireAuth as k, protectedRoute as l, clearAuthErrorHeaders as m, isTokenExpiredResponse as n, onboardingRoute as o, subscriptionRoute as p, shouldAttemptTokenRefresh as r, policyRoute as s, attemptTokenRefresh as t, publicRoute as u, extractUserInfo as v, handleFrontChannelLogout as w, getUser as x, getAccessToken as y };
+export { resetAuthClaimMapping as A, handleCallback as C, logout as D, login as E, OAUTH_RECOVERY_COOKIE_NAME as F, OAuthCallbackError as I, OAuthCallbackFailureCodes as L, consumeOAuthRecoveryIntent as M, getOAuthRecoveryCookiePath as N, refreshTokens as O, isOAuthRecoveryEligibleCallback as P, isOAuthCallbackError as R, handleBackChannelLogout as S, hasAuthError as T, createAuthorizationResponseUrl as _, configureRouteProtection as a, getAuthError as b, protectRoute as c, resetRouteProtectionConfig as d, shouldRefreshToken as f, configureAuthClaimMapping as g, clearAuthServerCache as h, authRoute as i, clearOAuthRecoveryIntentHeaders as j, requireAuth as k, protectedRoute as l, clearAuthErrorHeaders as m, isTokenExpiredResponse as n, onboardingRoute as o, subscriptionRoute as p, shouldAttemptTokenRefresh as r, policyRoute as s, attemptTokenRefresh as t, publicRoute as u, extractUserInfo as v, handleFrontChannelLogout as w, getUser as x, getAccessToken as y, isRecoverableOAuthCallbackError as z };
 
-//# sourceMappingURL=server-BJTz5-BE.mjs.map
+//# sourceMappingURL=server-W3MUOcah.mjs.map