@delopay/sdk 0.94.0 → 0.95.0

package/dist/index.d.cts

@@ -6503,6 +6503,31 @@ declare class Users {
     signUp(params: SignUpRequest | SignUpWithMerchantRequest): Promise<AuthResponse>;
     signIn(params: SignInRequest): Promise<AuthResponse>;
     signOut(): Promise<Record<string, unknown>>;
+    /**
+     * Sliding-session refresh: exchange the current (still-valid) login JWT
+     * for a fresh one with the same claims and a full lifetime. The backend
+     * keeps the session's identity (`jti`), slides `user_session.expires_at`
+     * forward and re-sets the `login_token` cookie.
+     *
+     * Requires a token backed by a revocable session (a `jti` claim). Signin
+     * and switch-merchant/-profile tokens have one; **session-less tokens do
+     * not and are rejected with 400** — team-impersonation tokens are the
+     * case in practice, and they are deliberately tab-scoped and
+     * time-bounded rather than renewable. A 400 here is not a dead session:
+     * the token remains valid for ordinary calls, it simply cannot slide.
+     *
+     * Rejected (401) for expired, blacklisted or revoked tokens — refresh can
+     * only extend a session that is still alive. Rate-limited server-side
+     * (429) to one mint per session per minute; treat a 429 as "still fresh
+     * enough", not as an error.
+     *
+     * The returned token is NOT applied to this client automatically — pass
+     * it to `setJwtToken()`, or use {@link Delopay.refreshSession} which does
+     * both.
+     *
+     * `POST /user/token/refresh`. Requires a logged-in JWT.
+     */
+    refreshToken(): Promise<TokenResponse>;
     /**
      * Paginated login history for the authenticated user -- IP, User-Agent,
      * country / city / lat-lon (when GeoIP is enabled), success and failure
@@ -7302,6 +7327,26 @@ declare class Delopay {
      * Clear the JWT token, reverting to API key authentication.
      */
     clearJwtToken(): void;
+    /**
+     * Refresh the current login JWT (see {@link Users.refreshToken}) and
+     * apply the fresh token to this client, so subsequent requests use it.
+     * Returns the fresh token for the caller to persist (e.g. session
+     * storage) — the backend has already re-set the `login_token` cookie.
+     *
+     * If the client's auth state changes while the refresh is pending —
+     * `clearJwtToken()` on sign-out, or `setJwtToken()` switching to another
+     * session — the stale completion is discarded and this rejects with a
+     * `session_changed` `DelopayError` (status 0), so the explicit change
+     * wins and the caller never persists a token for a session that is gone.
+     *
+     * Otherwise throws like any other request; in particular a 401 means the
+     * session is dead (expired/blacklisted/revoked), a 429 means a refresh
+     * was already minted for this session within the last minute, and a 400
+     * means this token has no revocable session to slide (no `jti` — team
+     * impersonation is the case in practice) and can never be refreshed,
+     * though it stays valid for ordinary calls.
+     */
+    refreshSession(): Promise<TokenResponse>;
     /**
      * Make a raw HTTP request to the Delopay API.
      *

package/dist/index.d.ts

@@ -6503,6 +6503,31 @@ declare class Users {
     signUp(params: SignUpRequest | SignUpWithMerchantRequest): Promise<AuthResponse>;
     signIn(params: SignInRequest): Promise<AuthResponse>;
     signOut(): Promise<Record<string, unknown>>;
+    /**
+     * Sliding-session refresh: exchange the current (still-valid) login JWT
+     * for a fresh one with the same claims and a full lifetime. The backend
+     * keeps the session's identity (`jti`), slides `user_session.expires_at`
+     * forward and re-sets the `login_token` cookie.
+     *
+     * Requires a token backed by a revocable session (a `jti` claim). Signin
+     * and switch-merchant/-profile tokens have one; **session-less tokens do
+     * not and are rejected with 400** — team-impersonation tokens are the
+     * case in practice, and they are deliberately tab-scoped and
+     * time-bounded rather than renewable. A 400 here is not a dead session:
+     * the token remains valid for ordinary calls, it simply cannot slide.
+     *
+     * Rejected (401) for expired, blacklisted or revoked tokens — refresh can
+     * only extend a session that is still alive. Rate-limited server-side
+     * (429) to one mint per session per minute; treat a 429 as "still fresh
+     * enough", not as an error.
+     *
+     * The returned token is NOT applied to this client automatically — pass
+     * it to `setJwtToken()`, or use {@link Delopay.refreshSession} which does
+     * both.
+     *
+     * `POST /user/token/refresh`. Requires a logged-in JWT.
+     */
+    refreshToken(): Promise<TokenResponse>;
     /**
      * Paginated login history for the authenticated user -- IP, User-Agent,
      * country / city / lat-lon (when GeoIP is enabled), success and failure
@@ -7302,6 +7327,26 @@ declare class Delopay {
      * Clear the JWT token, reverting to API key authentication.
      */
     clearJwtToken(): void;
+    /**
+     * Refresh the current login JWT (see {@link Users.refreshToken}) and
+     * apply the fresh token to this client, so subsequent requests use it.
+     * Returns the fresh token for the caller to persist (e.g. session
+     * storage) — the backend has already re-set the `login_token` cookie.
+     *
+     * If the client's auth state changes while the refresh is pending —
+     * `clearJwtToken()` on sign-out, or `setJwtToken()` switching to another
+     * session — the stale completion is discarded and this rejects with a
+     * `session_changed` `DelopayError` (status 0), so the explicit change
+     * wins and the caller never persists a token for a session that is gone.
+     *
+     * Otherwise throws like any other request; in particular a 401 means the
+     * session is dead (expired/blacklisted/revoked), a 429 means a refresh
+     * was already minted for this session within the last minute, and a 400
+     * means this token has no revocable session to slide (no `jti` — team
+     * impersonation is the case in practice) and can never be refreshed,
+     * though it stays valid for ordinary calls.
+     */
+    refreshSession(): Promise<TokenResponse>;
     /**
      * Make a raw HTTP request to the Delopay API.
      *

package/dist/index.js

@@ -88,7 +88,7 @@ import {
   surfacePadValue,
   verticalGapValue,
   visibleCustomFields
-} from "./chunk-TSYU2IQK.js";
+} from "./chunk-6BVLBNEZ.js";
 export {
   ALL_CUSTOM_FIELD_CONDITION_SOURCES,
   ALL_CUSTOM_FIELD_OPERATORS,

package/dist/internal.cjs

@@ -2803,6 +2803,33 @@ var Users = class {
   async signOut() {
     return this.request("POST", "/user/signout");
   }
+  /**
+   * Sliding-session refresh: exchange the current (still-valid) login JWT
+   * for a fresh one with the same claims and a full lifetime. The backend
+   * keeps the session's identity (`jti`), slides `user_session.expires_at`
+   * forward and re-sets the `login_token` cookie.
+   *
+   * Requires a token backed by a revocable session (a `jti` claim). Signin
+   * and switch-merchant/-profile tokens have one; **session-less tokens do
+   * not and are rejected with 400** — team-impersonation tokens are the
+   * case in practice, and they are deliberately tab-scoped and
+   * time-bounded rather than renewable. A 400 here is not a dead session:
+   * the token remains valid for ordinary calls, it simply cannot slide.
+   *
+   * Rejected (401) for expired, blacklisted or revoked tokens — refresh can
+   * only extend a session that is still alive. Rate-limited server-side
+   * (429) to one mint per session per minute; treat a 429 as "still fresh
+   * enough", not as an error.
+   *
+   * The returned token is NOT applied to this client automatically — pass
+   * it to `setJwtToken()`, or use {@link Delopay.refreshSession} which does
+   * both.
+   *
+   * `POST /user/token/refresh`. Requires a logged-in JWT.
+   */
+  async refreshToken() {
+    return this.request("POST", "/user/token/refresh");
+  }
   /**
    * Paginated login history for the authenticated user -- IP, User-Agent,
    * country / city / lat-lon (when GeoIP is enabled), success and failure
@@ -4070,6 +4097,41 @@ var Delopay = class {
   clearJwtToken() {
     this.jwtToken = void 0;
   }
+  /**
+   * Refresh the current login JWT (see {@link Users.refreshToken}) and
+   * apply the fresh token to this client, so subsequent requests use it.
+   * Returns the fresh token for the caller to persist (e.g. session
+   * storage) — the backend has already re-set the `login_token` cookie.
+   *
+   * If the client's auth state changes while the refresh is pending —
+   * `clearJwtToken()` on sign-out, or `setJwtToken()` switching to another
+   * session — the stale completion is discarded and this rejects with a
+   * `session_changed` `DelopayError` (status 0), so the explicit change
+   * wins and the caller never persists a token for a session that is gone.
+   *
+   * Otherwise throws like any other request; in particular a 401 means the
+   * session is dead (expired/blacklisted/revoked), a 429 means a refresh
+   * was already minted for this session within the last minute, and a 400
+   * means this token has no revocable session to slide (no `jti` — team
+   * impersonation is the case in practice) and can never be refreshed,
+   * though it stays valid for ordinary calls.
+   */
+  async refreshSession() {
+    const originatingToken = this.jwtToken;
+    const response = await this.users.refreshToken();
+    if (this.jwtToken !== originatingToken) {
+      throw new DelopayError(
+        "Auth state changed while the refresh was pending; refreshed token discarded",
+        {
+          status: 0,
+          code: "session_changed",
+          type: "session_changed"
+        }
+      );
+    }
+    this.setJwtToken(response.token);
+    return response;
+  }
   /**
    * Make a raw HTTP request to the Delopay API.
    *