@scalemule/nextjs 0.1.16 → 0.1.18

package/dist/server/auth.mjs

@@ -130,23 +130,31 @@ var ScaleMuleServer = class {
       /**
        * Logout user
        */
-      logout: async (sessionToken) => {
+      logout: async (sessionToken, options) => {
         return this.request("POST", "/v1/auth/logout", {
-          body: { session_token: sessionToken }
+          sessionToken,
+          body: { session_token: sessionToken },
+          onTokenRotated: options?.onTokenRotated
         });
       },
       /**
        * Get current user from session token
        */
-      me: async (sessionToken) => {
-        return this.request("GET", "/v1/auth/me", { sessionToken });
+      me: async (sessionToken, options) => {
+        return this.request("GET", "/v1/auth/me", {
+          sessionToken,
+          onTokenRotated: options?.onTokenRotated
+        });
       },
       /**
        * Refresh session token
        */
-      refresh: async (sessionToken) => {
+      refresh: async (sessionToken, options) => {
         return this.request("POST", "/v1/auth/refresh", {
-          body: { session_token: sessionToken }
+          sessionToken,
+          clientContext: options?.clientContext,
+          isAutoRefresh: options?.isAutoRefresh,
+          onTokenRotated: options?.onTokenRotated
         });
       },
       /**
@@ -178,7 +186,8 @@ var ScaleMuleServer = class {
         if (options?.email) {
           return this.request("POST", "/v1/auth/resend-verification", {
             sessionToken: sessionTokenOrEmail,
-            body: { email: options.email }
+            body: { email: options.email },
+            onTokenRotated: options?.onTokenRotated
           });
         }
         if (sessionTokenOrEmail.includes("@")) {
@@ -187,7 +196,8 @@ var ScaleMuleServer = class {
           });
         }
         return this.request("POST", "/v1/auth/resend-verification", {
-          sessionToken: sessionTokenOrEmail
+          sessionToken: sessionTokenOrEmail,
+          onTokenRotated: options?.onTokenRotated
         });
       }
     };
@@ -198,37 +208,41 @@ var ScaleMuleServer = class {
       /**
        * Update user profile
        */
-      update: async (sessionToken, data) => {
+      update: async (sessionToken, data, options) => {
         return this.request("PATCH", "/v1/auth/profile", {
           sessionToken,
-          body: data
+          body: data,
+          onTokenRotated: options?.onTokenRotated
         });
       },
       /**
        * Change password
        */
-      changePassword: async (sessionToken, currentPassword, newPassword) => {
+      changePassword: async (sessionToken, currentPassword, newPassword, options) => {
         return this.request("POST", "/v1/auth/change-password", {
           sessionToken,
-          body: { current_password: currentPassword, new_password: newPassword }
+          body: { current_password: currentPassword, new_password: newPassword },
+          onTokenRotated: options?.onTokenRotated
         });
       },
       /**
        * Change email
        */
-      changeEmail: async (sessionToken, newEmail, password) => {
+      changeEmail: async (sessionToken, newEmail, password, options) => {
         return this.request("POST", "/v1/auth/change-email", {
           sessionToken,
-          body: { new_email: newEmail, password }
+          body: { new_email: newEmail, password },
+          onTokenRotated: options?.onTokenRotated
         });
       },
       /**
        * Delete account
        */
-      deleteAccount: async (sessionToken, password) => {
+      deleteAccount: async (sessionToken, password, options) => {
         return this.request("DELETE", "/v1/auth/me", {
           sessionToken,
-          body: { password }
+          body: { password },
+          onTokenRotated: options?.onTokenRotated
         });
       }
     };
@@ -689,6 +703,9 @@ var ScaleMuleServer = class {
     this.apiKey = config.apiKey;
     this.gatewayUrl = resolveGatewayUrl(config);
     this.debug = config.debug || false;
+    this.onRefreshStart = config.onRefreshStart;
+    this.onRefreshEnd = config.onRefreshEnd;
+    this.onAutoRefreshFailed = config.onAutoRefreshFailed;
     this.money = createMoneyClient({
       apiKey: this.apiKey,
       gatewayUrl: this.gatewayUrl,
@@ -732,6 +749,10 @@ var ScaleMuleServer = class {
         headers,
         body: options.body ? JSON.stringify(options.body) : void 0
       });
+      const rotated = response.headers.get("x-rotated-session-token");
+      if (rotated && options.onTokenRotated) {
+        options.onTokenRotated(rotated);
+      }
       const text = await response.text();
       let responseData = null;
       try {
@@ -743,6 +764,33 @@ var ScaleMuleServer = class {
           code: `HTTP_${response.status}`,
           message: responseData?.message || text || response.statusText
         };
+        if (response.status === 401 && options.sessionToken && !options.isAutoRefresh) {
+          if (this.debug) console.log("[ScaleMule Server] 401 received, attempting auto-refresh...");
+          try {
+            this.onRefreshStart?.();
+            const refreshData = await this.auth.refresh(options.sessionToken, {
+              clientContext: options.clientContext,
+              isAutoRefresh: true
+              // Prevent infinite loops
+            });
+            const newToken = refreshData.session_token;
+            if (this.debug) console.log("[ScaleMule Server] Auto-refresh succeeded, retrying original request...");
+            options.onTokenRotated?.(newToken);
+            return this.request(method, path, {
+              ...options,
+              sessionToken: newToken,
+              isAutoRefresh: true
+              // Don't refresh again on this retry
+            });
+          } catch (refreshErr) {
+            if (this.debug) console.error("[ScaleMule Server] Auto-refresh failed:", refreshErr);
+            const refreshApiError = refreshErr instanceof ScaleMuleApiError ? { code: refreshErr.code, message: refreshErr.message } : { code: "REFRESH_FAILED", message: "Auto-refresh failed" };
+            this.onAutoRefreshFailed?.(refreshApiError);
+            throw new ScaleMuleApiError(error);
+          } finally {
+            this.onRefreshEnd?.();
+          }
+        }
         throw new ScaleMuleApiError(error);
       }
       const data = responseData?.data !== void 0 ? responseData.data : responseData;
@@ -1171,8 +1219,16 @@ function createAuthRoutes(config = {}) {
         // ==================== Logout ====================
         case "logout": {
           const session = await getSession();
+          let rotated = null;
           if (session) {
-            await sm.auth.logout(session.sessionToken);
+            try {
+              await sm.auth.logout(session.sessionToken, {
+                onTokenRotated: (newToken) => {
+                  rotated = newToken;
+                }
+              });
+            } catch {
+            }
           }
           if (config.onLogout) {
             await config.onLogout();
@@ -1237,6 +1293,7 @@ function createAuthRoutes(config = {}) {
         case "resend-verification": {
           const { email } = body;
           const session = await getSession();
+          let rotated = null;
           if (email) {
             try {
               await sm.auth.resendVerification(email);
@@ -1254,7 +1311,11 @@ function createAuthRoutes(config = {}) {
             return errorResponse("UNAUTHORIZED", "Email or session required", 401);
           }
           try {
-            await sm.auth.resendVerification(session.sessionToken);
+            await sm.auth.resendVerification(session.sessionToken, {
+              onTokenRotated: (newToken) => {
+                rotated = newToken;
+              }
+            });
           } catch (err) {
             const apiErr = err instanceof ScaleMuleApiError ? err : null;
             return errorResponse(
@@ -1263,6 +1324,14 @@ function createAuthRoutes(config = {}) {
               400
             );
           }
+          if (rotated) {
+            return withRefreshedSession(
+              rotated,
+              session.userId,
+              { success: true, data: { message: "Verification email sent" } },
+              cookieOptions
+            );
+          }
           return successResponse({ message: "Verification email sent" });
         }
         // ==================== Refresh Session ====================
@@ -1297,11 +1366,17 @@ function createAuthRoutes(config = {}) {
           if (!current_password || !new_password) {
             return errorResponse("VALIDATION_ERROR", "Current and new password required", 400);
           }
+          let rotated = null;
           try {
             await sm.user.changePassword(
               session.sessionToken,
               current_password,
-              new_password
+              new_password,
+              {
+                onTokenRotated: (newToken) => {
+                  rotated = newToken;
+                }
+              }
             );
           } catch (err) {
             const apiErr = err instanceof ScaleMuleApiError ? err : null;
@@ -1311,6 +1386,14 @@ function createAuthRoutes(config = {}) {
               400
             );
           }
+          if (rotated) {
+            return withRefreshedSession(
+              rotated,
+              session.userId,
+              { success: true, data: { message: "Password changed successfully" } },
+              cookieOptions
+            );
+          }
           return successResponse({ message: "Password changed successfully" });
         }
         // ==================== Switch Account ====================
@@ -1391,14 +1474,27 @@ function createAuthRoutes(config = {}) {
             return withNorm(errorResponse("UNAUTHORIZED", "Authentication required", 401));
           }
           let userData;
+          let rotated = null;
           try {
-            userData = await sm.auth.me(session.sessionToken);
+            userData = await sm.auth.me(session.sessionToken, {
+              onTokenRotated: (newToken) => {
+                rotated = newToken;
+              }
+            });
           } catch {
             return withNorm(clearSession(
               { error: { code: "SESSION_EXPIRED", message: "Session expired" } },
               cookieOptions
             ));
           }
+          if (rotated) {
+            return withNorm(withRefreshedSession(
+              rotated,
+              session.userId,
+              { user: userData, sessionToken: rotated, userId: session.userId },
+              cookieOptions
+            ));
+          }
           return withNorm(successResponse({ user: userData, sessionToken: session.sessionToken, userId: session.userId }));
         }
         // ==================== Get Session Status ====================
@@ -1477,8 +1573,13 @@ function createAuthRoutes(config = {}) {
           const body = await request.json().catch(() => ({}));
           const { full_name, avatar_url } = body;
           let updatedUser;
+          let rotated = null;
           try {
-            updatedUser = await sm.user.update(session.sessionToken, { full_name, avatar_url });
+            updatedUser = await sm.user.update(session.sessionToken, { full_name, avatar_url }, {
+              onTokenRotated: (newToken) => {
+                rotated = newToken;
+              }
+            });
           } catch (err) {
             const apiErr = err instanceof ScaleMuleApiError ? err : null;
             return errorResponse(
@@ -1487,6 +1588,14 @@ function createAuthRoutes(config = {}) {
               400
             );
           }
+          if (rotated) {
+            return withRefreshedSession(
+              rotated,
+              session.userId,
+              { success: true, data: { user: updatedUser } },
+              cookieOptions
+            );
+          }
           return successResponse({ user: updatedUser });
         }
         default:

package/dist/server/index.d.mts

@@ -1,5 +1,5 @@
-import { S as ServerConfig } from '../webhook-handler-CUp_A0_p.mjs';
-export { a as ScaleMuleServer, V as VideoFailedEvent, b as VideoReadyEvent, c as VideoTranscodedEvent, d as VideoUploadedEvent, W as WebhookEvent, e as WebhookRoutesConfig, f as createServerClient, g as createWebhookHandler, h as createWebhookRoutes, p as parseWebhookEvent, r as registerVideoWebhook, i as resolveGatewayUrl, v as verifyWebhookSignature } from '../webhook-handler-CUp_A0_p.mjs';
+import { S as ServerConfig } from '../webhook-handler-DsxJS_He.mjs';
+export { a as ScaleMuleServer, V as VideoFailedEvent, b as VideoReadyEvent, c as VideoTranscodedEvent, d as VideoUploadedEvent, W as WebhookEvent, e as WebhookRoutesConfig, f as createServerClient, g as createWebhookHandler, h as createWebhookRoutes, p as parseWebhookEvent, r as registerVideoWebhook, i as resolveGatewayUrl, v as verifyWebhookSignature } from '../webhook-handler-DsxJS_He.mjs';
 import { p as ClientContext, A as ApiError } from '../index-DTWyUcyd.mjs';
 export { L as LedveryRoutesConfig, a as LedverySessionData, S as SM_LEDVERY_ACCESS_TOKEN_COOKIE, b as SM_LEDVERY_ID_TOKEN_COOKIE, c as SM_LEDVERY_NONCE_COOKIE, d as SM_LEDVERY_PKCE_VERIFIER_COOKIE, e as SM_LEDVERY_STATE_COOKIE, f as createLedveryRoutes, g as getLedverySession } from '../ledvery-CxPzZpxP.mjs';
 import { NextRequest, NextResponse } from 'next/server';

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
-import { S as ServerConfig } from '../webhook-handler-C07AK4QB.js';
-export { a as ScaleMuleServer, V as VideoFailedEvent, b as VideoReadyEvent, c as VideoTranscodedEvent, d as VideoUploadedEvent, W as WebhookEvent, e as WebhookRoutesConfig, f as createServerClient, g as createWebhookHandler, h as createWebhookRoutes, p as parseWebhookEvent, r as registerVideoWebhook, i as resolveGatewayUrl, v as verifyWebhookSignature } from '../webhook-handler-C07AK4QB.js';
+import { S as ServerConfig } from '../webhook-handler-CTx4Uh8u.js';
+export { a as ScaleMuleServer, V as VideoFailedEvent, b as VideoReadyEvent, c as VideoTranscodedEvent, d as VideoUploadedEvent, W as WebhookEvent, e as WebhookRoutesConfig, f as createServerClient, g as createWebhookHandler, h as createWebhookRoutes, p as parseWebhookEvent, r as registerVideoWebhook, i as resolveGatewayUrl, v as verifyWebhookSignature } from '../webhook-handler-CTx4Uh8u.js';
 import { p as ClientContext, A as ApiError } from '../index-DTWyUcyd.js';
 export { L as LedveryRoutesConfig, a as LedverySessionData, S as SM_LEDVERY_ACCESS_TOKEN_COOKIE, b as SM_LEDVERY_ID_TOKEN_COOKIE, c as SM_LEDVERY_NONCE_COOKIE, d as SM_LEDVERY_PKCE_VERIFIER_COOKIE, e as SM_LEDVERY_STATE_COOKIE, f as createLedveryRoutes, g as getLedverySession } from '../ledvery-CxPzZpxP.js';
 import { NextRequest, NextResponse } from 'next/server';

package/dist/server/index.js

@@ -2111,23 +2111,31 @@ var ScaleMuleServer = class {
       /**
        * Logout user
        */
-      logout: async (sessionToken) => {
+      logout: async (sessionToken, options) => {
         return this.request("POST", "/v1/auth/logout", {
-          body: { session_token: sessionToken }
+          sessionToken,
+          body: { session_token: sessionToken },
+          onTokenRotated: options?.onTokenRotated
         });
       },
       /**
        * Get current user from session token
        */
-      me: async (sessionToken) => {
-        return this.request("GET", "/v1/auth/me", { sessionToken });
+      me: async (sessionToken, options) => {
+        return this.request("GET", "/v1/auth/me", {
+          sessionToken,
+          onTokenRotated: options?.onTokenRotated
+        });
       },
       /**
        * Refresh session token
        */
-      refresh: async (sessionToken) => {
+      refresh: async (sessionToken, options) => {
         return this.request("POST", "/v1/auth/refresh", {
-          body: { session_token: sessionToken }
+          sessionToken,
+          clientContext: options?.clientContext,
+          isAutoRefresh: options?.isAutoRefresh,
+          onTokenRotated: options?.onTokenRotated
         });
       },
       /**
@@ -2159,7 +2167,8 @@ var ScaleMuleServer = class {
         if (options?.email) {
           return this.request("POST", "/v1/auth/resend-verification", {
             sessionToken: sessionTokenOrEmail,
-            body: { email: options.email }
+            body: { email: options.email },
+            onTokenRotated: options?.onTokenRotated
           });
         }
         if (sessionTokenOrEmail.includes("@")) {
@@ -2168,7 +2177,8 @@ var ScaleMuleServer = class {
           });
         }
         return this.request("POST", "/v1/auth/resend-verification", {
-          sessionToken: sessionTokenOrEmail
+          sessionToken: sessionTokenOrEmail,
+          onTokenRotated: options?.onTokenRotated
         });
       }
     };
@@ -2179,37 +2189,41 @@ var ScaleMuleServer = class {
       /**
        * Update user profile
        */
-      update: async (sessionToken, data) => {
+      update: async (sessionToken, data, options) => {
         return this.request("PATCH", "/v1/auth/profile", {
           sessionToken,
-          body: data
+          body: data,
+          onTokenRotated: options?.onTokenRotated
         });
       },
       /**
        * Change password
        */
-      changePassword: async (sessionToken, currentPassword, newPassword) => {
+      changePassword: async (sessionToken, currentPassword, newPassword, options) => {
         return this.request("POST", "/v1/auth/change-password", {
           sessionToken,
-          body: { current_password: currentPassword, new_password: newPassword }
+          body: { current_password: currentPassword, new_password: newPassword },
+          onTokenRotated: options?.onTokenRotated
         });
       },
       /**
        * Change email
        */
-      changeEmail: async (sessionToken, newEmail, password) => {
+      changeEmail: async (sessionToken, newEmail, password, options) => {
         return this.request("POST", "/v1/auth/change-email", {
           sessionToken,
-          body: { new_email: newEmail, password }
+          body: { new_email: newEmail, password },
+          onTokenRotated: options?.onTokenRotated
         });
       },
       /**
        * Delete account
        */
-      deleteAccount: async (sessionToken, password) => {
+      deleteAccount: async (sessionToken, password, options) => {
         return this.request("DELETE", "/v1/auth/me", {
           sessionToken,
-          body: { password }
+          body: { password },
+          onTokenRotated: options?.onTokenRotated
         });
       }
     };
@@ -2670,6 +2684,9 @@ var ScaleMuleServer = class {
     this.apiKey = config.apiKey;
     this.gatewayUrl = resolveGatewayUrl(config);
     this.debug = config.debug || false;
+    this.onRefreshStart = config.onRefreshStart;
+    this.onRefreshEnd = config.onRefreshEnd;
+    this.onAutoRefreshFailed = config.onAutoRefreshFailed;
     this.money = money.createMoneyClient({
       apiKey: this.apiKey,
       gatewayUrl: this.gatewayUrl,
@@ -2713,6 +2730,10 @@ var ScaleMuleServer = class {
         headers: headers2,
         body: options.body ? JSON.stringify(options.body) : void 0
       });
+      const rotated = response.headers.get("x-rotated-session-token");
+      if (rotated && options.onTokenRotated) {
+        options.onTokenRotated(rotated);
+      }
       const text = await response.text();
       let responseData = null;
       try {
@@ -2724,6 +2745,33 @@ var ScaleMuleServer = class {
           code: `HTTP_${response.status}`,
           message: responseData?.message || text || response.statusText
         };
+        if (response.status === 401 && options.sessionToken && !options.isAutoRefresh) {
+          if (this.debug) console.log("[ScaleMule Server] 401 received, attempting auto-refresh...");
+          try {
+            this.onRefreshStart?.();
+            const refreshData = await this.auth.refresh(options.sessionToken, {
+              clientContext: options.clientContext,
+              isAutoRefresh: true
+              // Prevent infinite loops
+            });
+            const newToken = refreshData.session_token;
+            if (this.debug) console.log("[ScaleMule Server] Auto-refresh succeeded, retrying original request...");
+            options.onTokenRotated?.(newToken);
+            return this.request(method, path, {
+              ...options,
+              sessionToken: newToken,
+              isAutoRefresh: true
+              // Don't refresh again on this retry
+            });
+          } catch (refreshErr) {
+            if (this.debug) console.error("[ScaleMule Server] Auto-refresh failed:", refreshErr);
+            const refreshApiError = refreshErr instanceof ScaleMuleApiError ? { code: refreshErr.code, message: refreshErr.message } : { code: "REFRESH_FAILED", message: "Auto-refresh failed" };
+            this.onAutoRefreshFailed?.(refreshApiError);
+            throw new ScaleMuleApiError(error);
+          } finally {
+            this.onRefreshEnd?.();
+          }
+        }
         throw new ScaleMuleApiError(error);
       }
       const data = responseData?.data !== void 0 ? responseData.data : responseData;
@@ -3245,8 +3293,16 @@ function createAuthRoutes(config = {}) {
         // ==================== Logout ====================
         case "logout": {
           const session = await getSession();
+          let rotated = null;
           if (session) {
-            await sm.auth.logout(session.sessionToken);
+            try {
+              await sm.auth.logout(session.sessionToken, {
+                onTokenRotated: (newToken) => {
+                  rotated = newToken;
+                }
+              });
+            } catch {
+            }
           }
           if (config.onLogout) {
             await config.onLogout();
@@ -3311,6 +3367,7 @@ function createAuthRoutes(config = {}) {
         case "resend-verification": {
           const { email } = body;
           const session = await getSession();
+          let rotated = null;
           if (email) {
             try {
               await sm.auth.resendVerification(email);
@@ -3328,7 +3385,11 @@ function createAuthRoutes(config = {}) {
             return errorResponse("UNAUTHORIZED", "Email or session required", 401);
           }
           try {
-            await sm.auth.resendVerification(session.sessionToken);
+            await sm.auth.resendVerification(session.sessionToken, {
+              onTokenRotated: (newToken) => {
+                rotated = newToken;
+              }
+            });
           } catch (err) {
             const apiErr = err instanceof ScaleMuleApiError ? err : null;
             return errorResponse(
@@ -3337,6 +3398,14 @@ function createAuthRoutes(config = {}) {
               400
             );
           }
+          if (rotated) {
+            return withRefreshedSession(
+              rotated,
+              session.userId,
+              { success: true, data: { message: "Verification email sent" } },
+              cookieOptions
+            );
+          }
           return successResponse({ message: "Verification email sent" });
         }
         // ==================== Refresh Session ====================
@@ -3371,11 +3440,17 @@ function createAuthRoutes(config = {}) {
           if (!current_password || !new_password) {
             return errorResponse("VALIDATION_ERROR", "Current and new password required", 400);
           }
+          let rotated = null;
           try {
             await sm.user.changePassword(
               session.sessionToken,
               current_password,
-              new_password
+              new_password,
+              {
+                onTokenRotated: (newToken) => {
+                  rotated = newToken;
+                }
+              }
             );
           } catch (err) {
             const apiErr = err instanceof ScaleMuleApiError ? err : null;
@@ -3385,6 +3460,14 @@ function createAuthRoutes(config = {}) {
               400
             );
           }
+          if (rotated) {
+            return withRefreshedSession(
+              rotated,
+              session.userId,
+              { success: true, data: { message: "Password changed successfully" } },
+              cookieOptions
+            );
+          }
           return successResponse({ message: "Password changed successfully" });
         }
         // ==================== Switch Account ====================
@@ -3465,14 +3548,27 @@ function createAuthRoutes(config = {}) {
             return withNorm(errorResponse("UNAUTHORIZED", "Authentication required", 401));
           }
           let userData;
+          let rotated = null;
           try {
-            userData = await sm.auth.me(session.sessionToken);
+            userData = await sm.auth.me(session.sessionToken, {
+              onTokenRotated: (newToken) => {
+                rotated = newToken;
+              }
+            });
           } catch {
             return withNorm(clearSession(
               { error: { code: "SESSION_EXPIRED", message: "Session expired" } },
               cookieOptions
             ));
           }
+          if (rotated) {
+            return withNorm(withRefreshedSession(
+              rotated,
+              session.userId,
+              { user: userData, sessionToken: rotated, userId: session.userId },
+              cookieOptions
+            ));
+          }
           return withNorm(successResponse({ user: userData, sessionToken: session.sessionToken, userId: session.userId }));
         }
         // ==================== Get Session Status ====================
@@ -3551,8 +3647,13 @@ function createAuthRoutes(config = {}) {
           const body = await request.json().catch(() => ({}));
           const { full_name, avatar_url } = body;
           let updatedUser;
+          let rotated = null;
           try {
-            updatedUser = await sm.user.update(session.sessionToken, { full_name, avatar_url });
+            updatedUser = await sm.user.update(session.sessionToken, { full_name, avatar_url }, {
+              onTokenRotated: (newToken) => {
+                rotated = newToken;
+              }
+            });
           } catch (err) {
             const apiErr = err instanceof ScaleMuleApiError ? err : null;
             return errorResponse(
@@ -3561,6 +3662,14 @@ function createAuthRoutes(config = {}) {
               400
             );
           }
+          if (rotated) {
+            return withRefreshedSession(
+              rotated,
+              session.userId,
+              { success: true, data: { user: updatedUser } },
+              cookieOptions
+            );
+          }
           return successResponse({ user: updatedUser });
         }
         default:
@@ -3832,6 +3941,7 @@ function setLedverySession(response, session, opts) {
   if (opts?.cookies?.sameSite) cookieOpts.sameSite = opts.cookies.sameSite;
   if (opts?.cookies?.secure !== void 0) cookieOpts.secure = opts.cookies.secure;
   const sessionPayload = JSON.stringify({
+    idToken: session.idToken,
     claims: session.claims,
     expiresAt: session.expiresAt
   });
@@ -3846,8 +3956,7 @@ function getLedverySession(request) {
   try {
     const parsed = JSON.parse(raw);
     return {
-      idToken: "",
-      // not stored in cookie for size
+      idToken: parsed.idToken || "",
       claims: parsed.claims,
       expiresAt: parsed.expiresAt
     };
@@ -4052,9 +4161,14 @@ function createLedveryRoutes(config) {
       { status: 200, headers: { "Content-Type": "application/json" } }
     );
   }
-  function handleLogout(_request) {
+  function handleLogout(request) {
+    const session = getLedverySession(request);
+    const idToken = session?.idToken;
     if (config.gatewayUrl) {
-      const rpLogoutUrl = `${config.gatewayUrl}/v1/auth/oauth/ledvery/logout?post_logout_redirect_uri=${encodeURIComponent(postLogoutRedirect)}`;
+      let rpLogoutUrl = `${config.gatewayUrl}/v1/auth/oauth/ledvery/logout?post_logout_redirect_uri=${encodeURIComponent(postLogoutRedirect)}`;
+      if (idToken) {
+        rpLogoutUrl += `&id_token_hint=${encodeURIComponent(idToken)}`;
+      }
       const response2 = new Response(null, {
         status: 302,
         headers: { Location: rpLogoutUrl }
@@ -4080,7 +4194,7 @@ function createLedveryRoutes(config) {
       case "session":
         return handleSession(request);
       case "logout":
-        return handleLogout();
+        return handleLogout(request);
       default:
         return new Response(
           JSON.stringify({ error: "not_found", message: `Unknown Ledvery route: ${action}` }),