@delopay/sdk 0.94.0 → 0.95.0

package/dist/index.cjs

@@ -2791,6 +2791,33 @@ var Users = class {
   async signOut() {
     return this.request("POST", "/user/signout");
   }
+  /**
+   * Sliding-session refresh: exchange the current (still-valid) login JWT
+   * for a fresh one with the same claims and a full lifetime. The backend
+   * keeps the session's identity (`jti`), slides `user_session.expires_at`
+   * forward and re-sets the `login_token` cookie.
+   *
+   * Requires a token backed by a revocable session (a `jti` claim). Signin
+   * and switch-merchant/-profile tokens have one; **session-less tokens do
+   * not and are rejected with 400** — team-impersonation tokens are the
+   * case in practice, and they are deliberately tab-scoped and
+   * time-bounded rather than renewable. A 400 here is not a dead session:
+   * the token remains valid for ordinary calls, it simply cannot slide.
+   *
+   * Rejected (401) for expired, blacklisted or revoked tokens — refresh can
+   * only extend a session that is still alive. Rate-limited server-side
+   * (429) to one mint per session per minute; treat a 429 as "still fresh
+   * enough", not as an error.
+   *
+   * The returned token is NOT applied to this client automatically — pass
+   * it to `setJwtToken()`, or use {@link Delopay.refreshSession} which does
+   * both.
+   *
+   * `POST /user/token/refresh`. Requires a logged-in JWT.
+   */
+  async refreshToken() {
+    return this.request("POST", "/user/token/refresh");
+  }
   /**
    * Paginated login history for the authenticated user -- IP, User-Agent,
    * country / city / lat-lon (when GeoIP is enabled), success and failure
@@ -4058,6 +4085,41 @@ var Delopay = class {
   clearJwtToken() {
     this.jwtToken = void 0;
   }
+  /**
+   * Refresh the current login JWT (see {@link Users.refreshToken}) and
+   * apply the fresh token to this client, so subsequent requests use it.
+   * Returns the fresh token for the caller to persist (e.g. session
+   * storage) — the backend has already re-set the `login_token` cookie.
+   *
+   * If the client's auth state changes while the refresh is pending —
+   * `clearJwtToken()` on sign-out, or `setJwtToken()` switching to another
+   * session — the stale completion is discarded and this rejects with a
+   * `session_changed` `DelopayError` (status 0), so the explicit change
+   * wins and the caller never persists a token for a session that is gone.
+   *
+   * Otherwise throws like any other request; in particular a 401 means the
+   * session is dead (expired/blacklisted/revoked), a 429 means a refresh
+   * was already minted for this session within the last minute, and a 400
+   * means this token has no revocable session to slide (no `jti` — team
+   * impersonation is the case in practice) and can never be refreshed,
+   * though it stays valid for ordinary calls.
+   */
+  async refreshSession() {
+    const originatingToken = this.jwtToken;
+    const response = await this.users.refreshToken();
+    if (this.jwtToken !== originatingToken) {
+      throw new DelopayError(
+        "Auth state changed while the refresh was pending; refreshed token discarded",
+        {
+          status: 0,
+          code: "session_changed",
+          type: "session_changed"
+        }
+      );
+    }
+    this.setJwtToken(response.token);
+    return response;
+  }
   /**
    * Make a raw HTTP request to the Delopay API.
    *