@mitumba/sdk 1.11.0 → 1.13.0

package/dist/index.d.mts

@@ -1,3 +1,29 @@
+interface TokenStore {
+    getAccessToken(): Promise<string | null>;
+    getRefreshToken(): Promise<string | null>;
+    setTokens(access: string, refresh: string): Promise<void>;
+    clear(): Promise<void>;
+}
+declare class MemoryTokenStore implements TokenStore {
+    private accessToken;
+    private refreshToken;
+    getAccessToken(): Promise<string | null>;
+    getRefreshToken(): Promise<string | null>;
+    setTokens(access: string, refresh: string): Promise<void>;
+    clear(): Promise<void>;
+}
+declare class IDBTokenStore implements TokenStore {
+    private dbPromise;
+    private openDB;
+    private get;
+    getAccessToken(): Promise<string | null>;
+    getRefreshToken(): Promise<string | null>;
+    setTokens(access: string, refresh: string): Promise<void>;
+    clear(): Promise<void>;
+}
+/** Creates IDBTokenStore if indexedDB is available, otherwise MemoryTokenStore. */
+declare function createTokenStore(): TokenStore;
+
 interface AuthTokens {
     access_token: string;
     refresh_token: string;
@@ -628,6 +654,20 @@ interface UpdateBusinessInput {
     price_range_max?: number;
 }
 
+interface BlockedIp {
+    ip: string;
+    blocked_at: string;
+    expires_at: string;
+}
+interface SystemStats {
+    total_users: number;
+    total_sellers: number;
+    total_listings: number;
+    total_orders: number;
+    total_revenue: number;
+    active_today: number;
+}
+
 interface MitumbaClientConfig {
     baseUrl: string;
     debug?: boolean;
@@ -649,6 +689,16 @@ interface MitumbaClientConfig {
         token: string;
         refreshToken: string;
     }) => void;
+    /**
+     * Callback invoked when the refresh token is invalid/expired and the user
+     * needs to re-authenticate. Only fires when session is truly dead.
+     */
+    onAuthExpired?: () => void;
+    /**
+     * Custom token store for persisting tokens. Defaults to IndexedDB in browsers,
+     * in-memory elsewhere. Pass your own implementation for custom persistence.
+     */
+    tokenStore?: TokenStore;
 }
 interface APIErrorResponse {
     error: string;
@@ -675,13 +725,23 @@ declare class APIError extends Error {
 }
 declare class APIClient {
     private config;
+    private tokenStore;
     private isRefreshing;
     private refreshPromise;
     constructor(config: MitumbaClientConfig);
-    setToken(token: string, refreshToken?: string): void;
+    setToken(token: string, refreshToken?: string): Promise<void>;
     getToken(): string | undefined;
     getBaseUrl(): string;
-    clearToken(): void;
+    clearToken(): Promise<void>;
+    /**
+     * Check if user has a stored session (access or refresh token available).
+     */
+    isAuthenticated(): Promise<boolean>;
+    /**
+     * Hydrate tokens from the store into memory (call on app boot).
+     */
+    hydrate(): Promise<void>;
+    private ensureFreshToken;
     private request;
     private handleTokenRefresh;
     get<T>(path: string, params?: Record<string, string | number | boolean | undefined>, options?: RequestOptions): Promise<T>;
@@ -1319,6 +1379,44 @@ declare class BusinessesModule {
     }>;
 }
 
+declare class AdminModule {
+    private readonly client;
+    constructor(client: APIClient);
+    /** Block an IP address. Default duration: 24 hours. */
+    blockIp(ip: string, durationHours?: number, options?: RequestOptions): Promise<{
+        ok: true;
+        blocked: string;
+        hours: number;
+    }>;
+    /** Unblock an IP address. */
+    unblockIp(ip: string, options?: RequestOptions): Promise<{
+        ok: true;
+        unblocked: string;
+    }>;
+    /** List currently blocked IPs. */
+    getBlockedIps(options?: RequestOptions): Promise<{
+        data: BlockedIp[];
+    }>;
+    /** Get platform-wide statistics. */
+    getSystemStats(options?: RequestOptions): Promise<SystemStats>;
+    /** Suspend a user account. */
+    suspendUser(userId: string, reason: string, options?: RequestOptions): Promise<{
+        ok: true;
+    }>;
+    /** Unsuspend a user account. */
+    unsuspendUser(userId: string, options?: RequestOptions): Promise<{
+        ok: true;
+    }>;
+    /** Grant verified badge to a store. */
+    verifyStore(storeId: string, options?: RequestOptions): Promise<{
+        ok: true;
+    }>;
+    /** Revoke verified badge from a store. */
+    unverifyStore(storeId: string, options?: RequestOptions): Promise<{
+        ok: true;
+    }>;
+}
+
 declare class MitumbaClient {
     readonly api: APIClient;
     readonly auth: AuthModule;
@@ -1336,6 +1434,7 @@ declare class MitumbaClient {
     readonly settings: SettingsModule;
     readonly mailer: MailerModule;
     readonly businesses: BusinessesModule;
+    readonly admin: AdminModule;
     constructor(config: MitumbaClientConfig);
     /**
      * Set the access token for authenticated requests.
@@ -1350,6 +1449,14 @@ declare class MitumbaClient {
      * Clear the current tokens.
      */
     clearToken(): void;
+    /**
+     * Hydrate tokens from persistent store (call on app boot).
+     */
+    hydrate(): Promise<void>;
+    /**
+     * Check if user has a stored session.
+     */
+    isAuthenticated(): Promise<boolean>;
 }
 
-export { APIClient, APIError, type APIErrorResponse, type AddAddressInput, type AddPaymentMethodInput, type Address, AuthModule, type AuthTokens, type BecomeSellerInput, type Business, BusinessesModule, CONDITIONS, type CartItem, CartModule, type Category, type ChangePasswordInput, type City, type CompleteOnboardingInput, type Condition, type Conversation, type CreateListingInput, type CreateOrderInput, type CreateReviewInput, type CreateStoreInput, type DeliveryAddress, type EmailLoginInput, type EmailRegisterInput, type ForgotPasswordInput, LISTING_STATUSES, type LinkedAccount, type LinkedAccountProvider, type Listing, type ListingImage, type ListingStatus, type ListingsFeedParams, ListingsModule, type LoginInput, MailerModule, type MailerTemplate, type Message, type MessageResponse, MessagesModule, MitumbaClient, type MitumbaClientConfig, type MpesaInput, type Notification, type NotificationPref, type NotificationType, NotificationsModule, ORDER_STATUSES, type Order, type OrderEvent, type OrderHistoryParams, type OrderStatus, OrdersModule, PAYMENT_STATUSES, type PaginatedResponse, PayModule, type PaymentMethod, type PaymentMethodType, type PaymentStatus, type PaymentStatusResponse, type PaystackInitResponse, type PaystackInput, type PhoneLoginInput, type PhoneRegisterInput, type PresignImageResponse, type RegisterInput, type RequestOptions, type ResetPasswordInput, type Review, type ReviewableOrder, ReviewsModule, type SaveSearchInput, type SearchHistoryItem, SearchModule, type SearchParams, type SearchResult, type SellerProfile, type SellerStorefront, type SendEmailInput, type SendMessageInput, type SendOtpInput, type Session, SettingsModule, type SimilarListing, type StkPushInput, type StkPushResponse, type Store, type StoreAnalytics, type StoreSettings, type StoreStats, StoresModule, type SubscriptionTier, type TransitionOrderInput, type TrendingTerm, type TwoFactorRequired, type UpdateBusinessInput, type UpdateListingInput, type UpdateProfileInput, type UpdateStoreInput, type UserProfile, type VAZIOutfit, type VAZIOutfitDetail, type VAZIOutfitDetailItem, type VAZIOutfitItem, type VaziFeedParams, type VaziFeedResponse, VaziModule, type Verify2FAInput, type VerifyOtpInput, type WishlistListing, WishlistsModule };
+export { APIClient, APIError, type APIErrorResponse, type AddAddressInput, type AddPaymentMethodInput, type Address, AdminModule, AuthModule, type AuthTokens, type BecomeSellerInput, type BlockedIp, type Business, BusinessesModule, CONDITIONS, type CartItem, CartModule, type Category, type ChangePasswordInput, type City, type CompleteOnboardingInput, type Condition, type Conversation, type CreateListingInput, type CreateOrderInput, type CreateReviewInput, type CreateStoreInput, type DeliveryAddress, type EmailLoginInput, type EmailRegisterInput, type ForgotPasswordInput, IDBTokenStore, LISTING_STATUSES, type LinkedAccount, type LinkedAccountProvider, type Listing, type ListingImage, type ListingStatus, type ListingsFeedParams, ListingsModule, type LoginInput, MailerModule, type MailerTemplate, MemoryTokenStore, type Message, type MessageResponse, MessagesModule, MitumbaClient, type MitumbaClientConfig, type MpesaInput, type Notification, type NotificationPref, type NotificationType, NotificationsModule, ORDER_STATUSES, type Order, type OrderEvent, type OrderHistoryParams, type OrderStatus, OrdersModule, PAYMENT_STATUSES, type PaginatedResponse, PayModule, type PaymentMethod, type PaymentMethodType, type PaymentStatus, type PaymentStatusResponse, type PaystackInitResponse, type PaystackInput, type PhoneLoginInput, type PhoneRegisterInput, type PresignImageResponse, type RegisterInput, type RequestOptions, type ResetPasswordInput, type Review, type ReviewableOrder, ReviewsModule, type SaveSearchInput, type SearchHistoryItem, SearchModule, type SearchParams, type SearchResult, type SellerProfile, type SellerStorefront, type SendEmailInput, type SendMessageInput, type SendOtpInput, type Session, SettingsModule, type SimilarListing, type StkPushInput, type StkPushResponse, type Store, type StoreAnalytics, type StoreSettings, type StoreStats, StoresModule, type SubscriptionTier, type SystemStats, type TokenStore, type TransitionOrderInput, type TrendingTerm, type TwoFactorRequired, type UpdateBusinessInput, type UpdateListingInput, type UpdateProfileInput, type UpdateStoreInput, type UserProfile, type VAZIOutfit, type VAZIOutfitDetail, type VAZIOutfitDetailItem, type VAZIOutfitItem, type VaziFeedParams, type VaziFeedResponse, VaziModule, type Verify2FAInput, type VerifyOtpInput, type WishlistListing, WishlistsModule, createTokenStore };

package/dist/index.d.ts

@@ -1,3 +1,29 @@
+interface TokenStore {
+    getAccessToken(): Promise<string | null>;
+    getRefreshToken(): Promise<string | null>;
+    setTokens(access: string, refresh: string): Promise<void>;
+    clear(): Promise<void>;
+}
+declare class MemoryTokenStore implements TokenStore {
+    private accessToken;
+    private refreshToken;
+    getAccessToken(): Promise<string | null>;
+    getRefreshToken(): Promise<string | null>;
+    setTokens(access: string, refresh: string): Promise<void>;
+    clear(): Promise<void>;
+}
+declare class IDBTokenStore implements TokenStore {
+    private dbPromise;
+    private openDB;
+    private get;
+    getAccessToken(): Promise<string | null>;
+    getRefreshToken(): Promise<string | null>;
+    setTokens(access: string, refresh: string): Promise<void>;
+    clear(): Promise<void>;
+}
+/** Creates IDBTokenStore if indexedDB is available, otherwise MemoryTokenStore. */
+declare function createTokenStore(): TokenStore;
+
 interface AuthTokens {
     access_token: string;
     refresh_token: string;
@@ -628,6 +654,20 @@ interface UpdateBusinessInput {
     price_range_max?: number;
 }
 
+interface BlockedIp {
+    ip: string;
+    blocked_at: string;
+    expires_at: string;
+}
+interface SystemStats {
+    total_users: number;
+    total_sellers: number;
+    total_listings: number;
+    total_orders: number;
+    total_revenue: number;
+    active_today: number;
+}
+
 interface MitumbaClientConfig {
     baseUrl: string;
     debug?: boolean;
@@ -649,6 +689,16 @@ interface MitumbaClientConfig {
         token: string;
         refreshToken: string;
     }) => void;
+    /**
+     * Callback invoked when the refresh token is invalid/expired and the user
+     * needs to re-authenticate. Only fires when session is truly dead.
+     */
+    onAuthExpired?: () => void;
+    /**
+     * Custom token store for persisting tokens. Defaults to IndexedDB in browsers,
+     * in-memory elsewhere. Pass your own implementation for custom persistence.
+     */
+    tokenStore?: TokenStore;
 }
 interface APIErrorResponse {
     error: string;
@@ -675,13 +725,23 @@ declare class APIError extends Error {
 }
 declare class APIClient {
     private config;
+    private tokenStore;
     private isRefreshing;
     private refreshPromise;
     constructor(config: MitumbaClientConfig);
-    setToken(token: string, refreshToken?: string): void;
+    setToken(token: string, refreshToken?: string): Promise<void>;
     getToken(): string | undefined;
     getBaseUrl(): string;
-    clearToken(): void;
+    clearToken(): Promise<void>;
+    /**
+     * Check if user has a stored session (access or refresh token available).
+     */
+    isAuthenticated(): Promise<boolean>;
+    /**
+     * Hydrate tokens from the store into memory (call on app boot).
+     */
+    hydrate(): Promise<void>;
+    private ensureFreshToken;
     private request;
     private handleTokenRefresh;
     get<T>(path: string, params?: Record<string, string | number | boolean | undefined>, options?: RequestOptions): Promise<T>;
@@ -1319,6 +1379,44 @@ declare class BusinessesModule {
     }>;
 }
 
+declare class AdminModule {
+    private readonly client;
+    constructor(client: APIClient);
+    /** Block an IP address. Default duration: 24 hours. */
+    blockIp(ip: string, durationHours?: number, options?: RequestOptions): Promise<{
+        ok: true;
+        blocked: string;
+        hours: number;
+    }>;
+    /** Unblock an IP address. */
+    unblockIp(ip: string, options?: RequestOptions): Promise<{
+        ok: true;
+        unblocked: string;
+    }>;
+    /** List currently blocked IPs. */
+    getBlockedIps(options?: RequestOptions): Promise<{
+        data: BlockedIp[];
+    }>;
+    /** Get platform-wide statistics. */
+    getSystemStats(options?: RequestOptions): Promise<SystemStats>;
+    /** Suspend a user account. */
+    suspendUser(userId: string, reason: string, options?: RequestOptions): Promise<{
+        ok: true;
+    }>;
+    /** Unsuspend a user account. */
+    unsuspendUser(userId: string, options?: RequestOptions): Promise<{
+        ok: true;
+    }>;
+    /** Grant verified badge to a store. */
+    verifyStore(storeId: string, options?: RequestOptions): Promise<{
+        ok: true;
+    }>;
+    /** Revoke verified badge from a store. */
+    unverifyStore(storeId: string, options?: RequestOptions): Promise<{
+        ok: true;
+    }>;
+}
+
 declare class MitumbaClient {
     readonly api: APIClient;
     readonly auth: AuthModule;
@@ -1336,6 +1434,7 @@ declare class MitumbaClient {
     readonly settings: SettingsModule;
     readonly mailer: MailerModule;
     readonly businesses: BusinessesModule;
+    readonly admin: AdminModule;
     constructor(config: MitumbaClientConfig);
     /**
      * Set the access token for authenticated requests.
@@ -1350,6 +1449,14 @@ declare class MitumbaClient {
      * Clear the current tokens.
      */
     clearToken(): void;
+    /**
+     * Hydrate tokens from persistent store (call on app boot).
+     */
+    hydrate(): Promise<void>;
+    /**
+     * Check if user has a stored session.
+     */
+    isAuthenticated(): Promise<boolean>;
 }
 
-export { APIClient, APIError, type APIErrorResponse, type AddAddressInput, type AddPaymentMethodInput, type Address, AuthModule, type AuthTokens, type BecomeSellerInput, type Business, BusinessesModule, CONDITIONS, type CartItem, CartModule, type Category, type ChangePasswordInput, type City, type CompleteOnboardingInput, type Condition, type Conversation, type CreateListingInput, type CreateOrderInput, type CreateReviewInput, type CreateStoreInput, type DeliveryAddress, type EmailLoginInput, type EmailRegisterInput, type ForgotPasswordInput, LISTING_STATUSES, type LinkedAccount, type LinkedAccountProvider, type Listing, type ListingImage, type ListingStatus, type ListingsFeedParams, ListingsModule, type LoginInput, MailerModule, type MailerTemplate, type Message, type MessageResponse, MessagesModule, MitumbaClient, type MitumbaClientConfig, type MpesaInput, type Notification, type NotificationPref, type NotificationType, NotificationsModule, ORDER_STATUSES, type Order, type OrderEvent, type OrderHistoryParams, type OrderStatus, OrdersModule, PAYMENT_STATUSES, type PaginatedResponse, PayModule, type PaymentMethod, type PaymentMethodType, type PaymentStatus, type PaymentStatusResponse, type PaystackInitResponse, type PaystackInput, type PhoneLoginInput, type PhoneRegisterInput, type PresignImageResponse, type RegisterInput, type RequestOptions, type ResetPasswordInput, type Review, type ReviewableOrder, ReviewsModule, type SaveSearchInput, type SearchHistoryItem, SearchModule, type SearchParams, type SearchResult, type SellerProfile, type SellerStorefront, type SendEmailInput, type SendMessageInput, type SendOtpInput, type Session, SettingsModule, type SimilarListing, type StkPushInput, type StkPushResponse, type Store, type StoreAnalytics, type StoreSettings, type StoreStats, StoresModule, type SubscriptionTier, type TransitionOrderInput, type TrendingTerm, type TwoFactorRequired, type UpdateBusinessInput, type UpdateListingInput, type UpdateProfileInput, type UpdateStoreInput, type UserProfile, type VAZIOutfit, type VAZIOutfitDetail, type VAZIOutfitDetailItem, type VAZIOutfitItem, type VaziFeedParams, type VaziFeedResponse, VaziModule, type Verify2FAInput, type VerifyOtpInput, type WishlistListing, WishlistsModule };
+export { APIClient, APIError, type APIErrorResponse, type AddAddressInput, type AddPaymentMethodInput, type Address, AdminModule, AuthModule, type AuthTokens, type BecomeSellerInput, type BlockedIp, type Business, BusinessesModule, CONDITIONS, type CartItem, CartModule, type Category, type ChangePasswordInput, type City, type CompleteOnboardingInput, type Condition, type Conversation, type CreateListingInput, type CreateOrderInput, type CreateReviewInput, type CreateStoreInput, type DeliveryAddress, type EmailLoginInput, type EmailRegisterInput, type ForgotPasswordInput, IDBTokenStore, LISTING_STATUSES, type LinkedAccount, type LinkedAccountProvider, type Listing, type ListingImage, type ListingStatus, type ListingsFeedParams, ListingsModule, type LoginInput, MailerModule, type MailerTemplate, MemoryTokenStore, type Message, type MessageResponse, MessagesModule, MitumbaClient, type MitumbaClientConfig, type MpesaInput, type Notification, type NotificationPref, type NotificationType, NotificationsModule, ORDER_STATUSES, type Order, type OrderEvent, type OrderHistoryParams, type OrderStatus, OrdersModule, PAYMENT_STATUSES, type PaginatedResponse, PayModule, type PaymentMethod, type PaymentMethodType, type PaymentStatus, type PaymentStatusResponse, type PaystackInitResponse, type PaystackInput, type PhoneLoginInput, type PhoneRegisterInput, type PresignImageResponse, type RegisterInput, type RequestOptions, type ResetPasswordInput, type Review, type ReviewableOrder, ReviewsModule, type SaveSearchInput, type SearchHistoryItem, SearchModule, type SearchParams, type SearchResult, type SellerProfile, type SellerStorefront, type SendEmailInput, type SendMessageInput, type SendOtpInput, type Session, SettingsModule, type SimilarListing, type StkPushInput, type StkPushResponse, type Store, type StoreAnalytics, type StoreSettings, type StoreStats, StoresModule, type SubscriptionTier, type SystemStats, type TokenStore, type TransitionOrderInput, type TrendingTerm, type TwoFactorRequired, type UpdateBusinessInput, type UpdateListingInput, type UpdateProfileInput, type UpdateStoreInput, type UserProfile, type VAZIOutfit, type VAZIOutfitDetail, type VAZIOutfitDetailItem, type VAZIOutfitItem, type VaziFeedParams, type VaziFeedResponse, VaziModule, type Verify2FAInput, type VerifyOtpInput, type WishlistListing, WishlistsModule, createTokenStore };

package/dist/index.js

@@ -1,5 +1,84 @@
 'use strict';
 
+// src/token-store.ts
+var MemoryTokenStore = class {
+  accessToken = null;
+  refreshToken = null;
+  async getAccessToken() {
+    return this.accessToken;
+  }
+  async getRefreshToken() {
+    return this.refreshToken;
+  }
+  async setTokens(access, refresh) {
+    this.accessToken = access;
+    this.refreshToken = refresh;
+  }
+  async clear() {
+    this.accessToken = null;
+    this.refreshToken = null;
+  }
+};
+var DB_NAME = "mitumba_sdk";
+var STORE_NAME = "tokens";
+var KEY = "auth";
+var IDBTokenStore = class {
+  dbPromise = null;
+  openDB() {
+    if (this.dbPromise) return this.dbPromise;
+    this.dbPromise = new Promise((resolve, reject) => {
+      const request = indexedDB.open(DB_NAME, 1);
+      request.onupgradeneeded = () => {
+        request.result.createObjectStore(STORE_NAME);
+      };
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error);
+    });
+    return this.dbPromise;
+  }
+  async get() {
+    const db = await this.openDB();
+    return new Promise((resolve, reject) => {
+      const tx = db.transaction(STORE_NAME, "readonly");
+      const req = tx.objectStore(STORE_NAME).get(KEY);
+      req.onsuccess = () => resolve(req.result || null);
+      req.onerror = () => reject(req.error);
+    });
+  }
+  async getAccessToken() {
+    const data = await this.get();
+    return data?.access ?? null;
+  }
+  async getRefreshToken() {
+    const data = await this.get();
+    return data?.refresh ?? null;
+  }
+  async setTokens(access, refresh) {
+    const db = await this.openDB();
+    return new Promise((resolve, reject) => {
+      const tx = db.transaction(STORE_NAME, "readwrite");
+      const req = tx.objectStore(STORE_NAME).put({ access, refresh }, KEY);
+      req.onsuccess = () => resolve();
+      req.onerror = () => reject(req.error);
+    });
+  }
+  async clear() {
+    const db = await this.openDB();
+    return new Promise((resolve, reject) => {
+      const tx = db.transaction(STORE_NAME, "readwrite");
+      const req = tx.objectStore(STORE_NAME).delete(KEY);
+      req.onsuccess = () => resolve();
+      req.onerror = () => reject(req.error);
+    });
+  }
+};
+function createTokenStore() {
+  if (typeof indexedDB !== "undefined") {
+    return new IDBTokenStore();
+  }
+  return new MemoryTokenStore();
+}
+
 // src/client.ts
 var APIError = class extends Error {
   code;
@@ -13,18 +92,33 @@ var APIError = class extends Error {
     this.details = data.details;
   }
 };
+function isExpiringSoon(token, thresholdSeconds) {
+  try {
+    const payload = JSON.parse(atob(token.split(".")[1]));
+    const exp = payload.exp;
+    return exp - Date.now() / 1e3 < thresholdSeconds;
+  } catch {
+    return false;
+  }
+}
 var APIClient = class {
   config;
+  tokenStore;
   isRefreshing = false;
   refreshPromise = null;
   constructor(config) {
     this.config = config;
+    this.tokenStore = config.tokenStore ?? createTokenStore();
+    if (config.token) {
+      this.tokenStore.setTokens(config.token, config.refreshToken ?? "");
+    }
   }
-  setToken(token, refreshToken) {
+  async setToken(token, refreshToken) {
     this.config.token = token;
     if (refreshToken) {
       this.config.refreshToken = refreshToken;
     }
+    await this.tokenStore.setTokens(token, refreshToken ?? this.config.refreshToken ?? "");
   }
   getToken() {
     return this.config.token;
@@ -32,11 +126,44 @@ var APIClient = class {
   getBaseUrl() {
     return this.config.baseUrl;
   }
-  clearToken() {
+  async clearToken() {
     this.config.token = void 0;
     this.config.refreshToken = void 0;
+    await this.tokenStore.clear();
+  }
+  /**
+   * Check if user has a stored session (access or refresh token available).
+   */
+  async isAuthenticated() {
+    const access = this.config.token ?? await this.tokenStore.getAccessToken();
+    if (access) return true;
+    const refresh = await this.tokenStore.getRefreshToken();
+    return !!refresh;
+  }
+  /**
+   * Hydrate tokens from the store into memory (call on app boot).
+   */
+  async hydrate() {
+    const access = await this.tokenStore.getAccessToken();
+    const refresh = await this.tokenStore.getRefreshToken();
+    if (access) this.config.token = access;
+    if (refresh) this.config.refreshToken = refresh;
+  }
+  async ensureFreshToken() {
+    if (!this.config.token) {
+      const stored = await this.tokenStore.getAccessToken();
+      if (stored) this.config.token = stored;
+      const refresh = await this.tokenStore.getRefreshToken();
+      if (refresh) this.config.refreshToken = refresh;
+    }
+    if (this.config.token && isExpiringSoon(this.config.token, 60) && this.config.refreshToken) {
+      await this.handleTokenRefresh();
+    }
   }
   async request(method, path, body, params, options) {
+    if (!path.includes("/auth/refresh") && !path.includes("/auth/login") && !path.includes("/auth/register")) {
+      await this.ensureFreshToken();
+    }
     const url = new URL(path, this.config.baseUrl);
     if (params) {
       for (const [key, value] of Object.entries(params)) {
@@ -96,9 +223,16 @@ var APIClient = class {
       break;
     }
     if (response.status === 401 && this.config.refreshToken && !path.includes("/auth/refresh")) {
-      await this.handleTokenRefresh();
-      headers.set("Authorization", `Bearer ${this.config.token}`);
-      response = await fetch(url.toString(), { ...init, headers });
+      try {
+        await this.handleTokenRefresh();
+        headers.set("Authorization", `Bearer ${this.config.token}`);
+        response = await fetch(url.toString(), { ...init, headers });
+      } catch {
+        if (this.config.onAuthExpired) {
+          this.config.onAuthExpired();
+        }
+        throw new APIError(401, { error: "session_expired", message: "Session expired. Please log in again." });
+      }
     }
     if (!response.ok) {
       let errorData;
@@ -131,13 +265,15 @@ var APIClient = class {
           throw new Error("Refresh failed");
         }
         const data = await response.json();
-        this.setToken(data.access_token, data.refresh_token);
+        this.config.token = data.access_token;
+        this.config.refreshToken = data.refresh_token;
+        await this.tokenStore.setTokens(data.access_token, data.refresh_token);
         if (this.config.onTokenRefresh) {
           this.config.onTokenRefresh({ token: data.access_token, refreshToken: data.refresh_token });
         }
       } catch (err) {
-        this.clearToken();
-        throw new APIError(401, { error: "token_expired", message: "Session expired. Please log in again." });
+        await this.clearToken();
+        throw err;
       } finally {
         this.isRefreshing = false;
         this.refreshPromise = null;
@@ -933,6 +1069,46 @@ var BusinessesModule = class {
   }
 };
 
+// src/modules/admin.ts
+var AdminModule = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /** Block an IP address. Default duration: 24 hours. */
+  async blockIp(ip, durationHours, options) {
+    return this.client.post("/admin/block-ip", { ip, duration_hours: durationHours ?? 24 }, options);
+  }
+  /** Unblock an IP address. */
+  async unblockIp(ip, options) {
+    return this.client.post("/admin/unblock-ip", { ip }, options);
+  }
+  /** List currently blocked IPs. */
+  async getBlockedIps(options) {
+    return this.client.get("/admin/blocked-ips", void 0, options);
+  }
+  /** Get platform-wide statistics. */
+  async getSystemStats(options) {
+    return this.client.get("/admin/stats", void 0, options);
+  }
+  /** Suspend a user account. */
+  async suspendUser(userId, reason, options) {
+    return this.client.post(`/admin/users/${userId}/suspend`, { reason }, options);
+  }
+  /** Unsuspend a user account. */
+  async unsuspendUser(userId, options) {
+    return this.client.post(`/admin/users/${userId}/unsuspend`, void 0, options);
+  }
+  /** Grant verified badge to a store. */
+  async verifyStore(storeId, options) {
+    return this.client.post(`/admin/stores/${storeId}/verify`, void 0, options);
+  }
+  /** Revoke verified badge from a store. */
+  async unverifyStore(storeId, options) {
+    return this.client.post(`/admin/stores/${storeId}/unverify`, void 0, options);
+  }
+};
+
 // src/types/listings.ts
 var CONDITIONS = ["new", "like_new", "good", "fair"];
 var LISTING_STATUSES = ["draft", "active", "sold", "removed"];
@@ -971,6 +1147,7 @@ var MitumbaClient = class {
   settings;
   mailer;
   businesses;
+  admin;
   constructor(config) {
     this.api = new APIClient(config);
     this.auth = new AuthModule(this.api);
@@ -988,6 +1165,7 @@ var MitumbaClient = class {
     this.settings = new SettingsModule(this.api);
     this.mailer = new MailerModule(this.api);
     this.businesses = new BusinessesModule(this.api);
+    this.admin = new AdminModule(this.api);
   }
   /**
    * Set the access token for authenticated requests.
@@ -1008,17 +1186,32 @@ var MitumbaClient = class {
   clearToken() {
     this.api.clearToken();
   }
+  /**
+   * Hydrate tokens from persistent store (call on app boot).
+   */
+  hydrate() {
+    return this.api.hydrate();
+  }
+  /**
+   * Check if user has a stored session.
+   */
+  isAuthenticated() {
+    return this.api.isAuthenticated();
+  }
 };
 
 exports.APIClient = APIClient;
 exports.APIError = APIError;
+exports.AdminModule = AdminModule;
 exports.AuthModule = AuthModule;
 exports.BusinessesModule = BusinessesModule;
 exports.CONDITIONS = CONDITIONS;
 exports.CartModule = CartModule;
+exports.IDBTokenStore = IDBTokenStore;
 exports.LISTING_STATUSES = LISTING_STATUSES;
 exports.ListingsModule = ListingsModule;
 exports.MailerModule = MailerModule;
+exports.MemoryTokenStore = MemoryTokenStore;
 exports.MessagesModule = MessagesModule;
 exports.MitumbaClient = MitumbaClient;
 exports.NotificationsModule = NotificationsModule;
@@ -1032,5 +1225,6 @@ exports.SettingsModule = SettingsModule;
 exports.StoresModule = StoresModule;
 exports.VaziModule = VaziModule;
 exports.WishlistsModule = WishlistsModule;
+exports.createTokenStore = createTokenStore;
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map