@mitumba/sdk 1.18.0 → 1.19.0

package/dist/index.d.mts

@@ -972,6 +972,14 @@ declare class APIClient {
     private refreshPromise;
     constructor(config: MitumbaClientConfig);
     setToken(token: string, refreshToken?: string): Promise<void>;
+    /**
+     * Set both tokens explicitly. Requires a valid refresh token.
+     * Preferred over setToken() to avoid dropping the refresh token.
+     */
+    setSession(tokens: {
+        access_token: string;
+        refresh_token: string;
+    }): Promise<void>;
     getToken(): string | undefined;
     getBaseUrl(): string;
     clearToken(): Promise<void>;
@@ -998,13 +1006,13 @@ declare class AuthModule {
     constructor(client: APIClient);
     /**
      * Register a new account.
-     * If using EmailRegisterInput, returns AuthTokens.
+     * If using EmailRegisterInput, returns AuthTokens (auto-persisted).
      * If using PhoneRegisterInput, returns MessageResponse (OTP sent).
      */
     register(input: RegisterInput, options?: RequestOptions): Promise<AuthTokens | MessageResponse>;
     /**
      * Log in to an existing account.
-     * If using EmailLoginInput, returns AuthTokens (or TwoFactorRequired if 2FA enabled).
+     * If using EmailLoginInput, returns AuthTokens (auto-persisted) or TwoFactorRequired.
      * If using PhoneLoginInput, returns MessageResponse (OTP sent).
      */
     login(input: LoginInput, options?: RequestOptions): Promise<AuthTokens | MessageResponse | TwoFactorRequired>;
@@ -1013,7 +1021,7 @@ declare class AuthModule {
      */
     sendOtp(input: SendOtpInput, options?: RequestOptions): Promise<MessageResponse>;
     /**
-     * Verify an OTP code.
+     * Verify an OTP code. Tokens are auto-persisted.
      */
     verifyOtp(input: VerifyOtpInput, options?: RequestOptions): Promise<AuthTokens>;
     /**
@@ -1023,7 +1031,7 @@ declare class AuthModule {
         refresh_token: string;
     }, options?: RequestOptions): Promise<AuthTokens>;
     /**
-     * Revoke the refresh token and log out.
+     * Revoke the refresh token and log out. Clears stored session.
      */
     logout(input: {
         refresh_token: string;
@@ -1032,7 +1040,6 @@ declare class AuthModule {
     }>;
     /**
      * Request a password reset email.
-     * Sends a reset link to the provided email address.
      */
     forgotPassword(input: ForgotPasswordInput, options?: RequestOptions): Promise<MessageResponse>;
     /**
@@ -1050,26 +1057,23 @@ declare class AuthModule {
         ok: true;
     }>;
     /**
-     * Verify 2FA code during login (when login returns requires_2fa).
+     * Verify 2FA code during login. Tokens are auto-persisted.
      */
     verify2FA(input: Verify2FAInput, options?: RequestOptions): Promise<AuthTokens>;
     /**
      * Send a verification code to the user's email.
-     * If unauthenticated, pass the email address.
      */
     sendVerificationCode(email?: string, options?: RequestOptions): Promise<{
         ok: true;
     }>;
     /**
      * Verify the email with the 6-digit code.
-     * If unauthenticated, pass the email address.
      */
     verifyEmail(code: string, email?: string, options?: RequestOptions): Promise<{
         ok: true;
     }>;
     /**
      * Upgrade the current user to a seller role.
-     * Idempotent — returns success if already a seller.
      */
     becomeSeller(input: BecomeSellerInput, options?: RequestOptions): Promise<{
         ok: true;
@@ -1927,6 +1931,13 @@ declare class MitumbaClient {
      * Optionally pass a refresh token to enable automatic token rotation.
      */
     setToken(token: string, refreshToken?: string): void;
+    /**
+     * Set both tokens explicitly. Preferred — prevents dropping the refresh token.
+     */
+    setSession(tokens: {
+        access_token: string;
+        refresh_token: string;
+    }): Promise<void>;
     /**
      * Get the current access token.
      */

package/dist/index.d.ts

@@ -972,6 +972,14 @@ declare class APIClient {
     private refreshPromise;
     constructor(config: MitumbaClientConfig);
     setToken(token: string, refreshToken?: string): Promise<void>;
+    /**
+     * Set both tokens explicitly. Requires a valid refresh token.
+     * Preferred over setToken() to avoid dropping the refresh token.
+     */
+    setSession(tokens: {
+        access_token: string;
+        refresh_token: string;
+    }): Promise<void>;
     getToken(): string | undefined;
     getBaseUrl(): string;
     clearToken(): Promise<void>;
@@ -998,13 +1006,13 @@ declare class AuthModule {
     constructor(client: APIClient);
     /**
      * Register a new account.
-     * If using EmailRegisterInput, returns AuthTokens.
+     * If using EmailRegisterInput, returns AuthTokens (auto-persisted).
      * If using PhoneRegisterInput, returns MessageResponse (OTP sent).
      */
     register(input: RegisterInput, options?: RequestOptions): Promise<AuthTokens | MessageResponse>;
     /**
      * Log in to an existing account.
-     * If using EmailLoginInput, returns AuthTokens (or TwoFactorRequired if 2FA enabled).
+     * If using EmailLoginInput, returns AuthTokens (auto-persisted) or TwoFactorRequired.
      * If using PhoneLoginInput, returns MessageResponse (OTP sent).
      */
     login(input: LoginInput, options?: RequestOptions): Promise<AuthTokens | MessageResponse | TwoFactorRequired>;
@@ -1013,7 +1021,7 @@ declare class AuthModule {
      */
     sendOtp(input: SendOtpInput, options?: RequestOptions): Promise<MessageResponse>;
     /**
-     * Verify an OTP code.
+     * Verify an OTP code. Tokens are auto-persisted.
      */
     verifyOtp(input: VerifyOtpInput, options?: RequestOptions): Promise<AuthTokens>;
     /**
@@ -1023,7 +1031,7 @@ declare class AuthModule {
         refresh_token: string;
     }, options?: RequestOptions): Promise<AuthTokens>;
     /**
-     * Revoke the refresh token and log out.
+     * Revoke the refresh token and log out. Clears stored session.
      */
     logout(input: {
         refresh_token: string;
@@ -1032,7 +1040,6 @@ declare class AuthModule {
     }>;
     /**
      * Request a password reset email.
-     * Sends a reset link to the provided email address.
      */
     forgotPassword(input: ForgotPasswordInput, options?: RequestOptions): Promise<MessageResponse>;
     /**
@@ -1050,26 +1057,23 @@ declare class AuthModule {
         ok: true;
     }>;
     /**
-     * Verify 2FA code during login (when login returns requires_2fa).
+     * Verify 2FA code during login. Tokens are auto-persisted.
      */
     verify2FA(input: Verify2FAInput, options?: RequestOptions): Promise<AuthTokens>;
     /**
      * Send a verification code to the user's email.
-     * If unauthenticated, pass the email address.
      */
     sendVerificationCode(email?: string, options?: RequestOptions): Promise<{
         ok: true;
     }>;
     /**
      * Verify the email with the 6-digit code.
-     * If unauthenticated, pass the email address.
      */
     verifyEmail(code: string, email?: string, options?: RequestOptions): Promise<{
         ok: true;
     }>;
     /**
      * Upgrade the current user to a seller role.
-     * Idempotent — returns success if already a seller.
      */
     becomeSeller(input: BecomeSellerInput, options?: RequestOptions): Promise<{
         ok: true;
@@ -1927,6 +1931,13 @@ declare class MitumbaClient {
      * Optionally pass a refresh token to enable automatic token rotation.
      */
     setToken(token: string, refreshToken?: string): void;
+    /**
+     * Set both tokens explicitly. Preferred — prevents dropping the refresh token.
+     */
+    setSession(tokens: {
+        access_token: string;
+        refresh_token: string;
+    }): Promise<void>;
     /**
      * Get the current access token.
      */

package/dist/index.js

@@ -110,15 +110,25 @@ var APIClient = class {
     this.config = config;
     this.tokenStore = config.tokenStore ?? createTokenStore();
     if (config.token) {
-      this.tokenStore.setTokens(config.token, config.refreshToken ?? "");
+      this.tokenStore.setTokens(config.token, config.refreshToken || "");
     }
   }
   async setToken(token, refreshToken) {
     this.config.token = token;
-    if (refreshToken) {
+    if (refreshToken && refreshToken.length > 0) {
       this.config.refreshToken = refreshToken;
     }
-    await this.tokenStore.setTokens(token, refreshToken ?? this.config.refreshToken ?? "");
+    const effectiveRefresh = refreshToken && refreshToken.length > 0 ? refreshToken : this.config.refreshToken && this.config.refreshToken.length > 0 ? this.config.refreshToken : "";
+    await this.tokenStore.setTokens(token, effectiveRefresh);
+  }
+  /**
+   * Set both tokens explicitly. Requires a valid refresh token.
+   * Preferred over setToken() to avoid dropping the refresh token.
+   */
+  async setSession(tokens) {
+    this.config.token = tokens.access_token;
+    this.config.refreshToken = tokens.refresh_token;
+    await this.tokenStore.setTokens(tokens.access_token, tokens.refresh_token);
   }
   getToken() {
     return this.config.token;
@@ -156,7 +166,7 @@ var APIClient = class {
       const refresh = await this.tokenStore.getRefreshToken();
       if (refresh) this.config.refreshToken = refresh;
     }
-    if (this.config.token && isExpiringSoon(this.config.token, 60) && this.config.refreshToken) {
+    if (this.config.token && isExpiringSoon(this.config.token, 60) && this.config.refreshToken && this.config.refreshToken.length > 0) {
       await this.handleTokenRefresh();
     }
   }
@@ -222,12 +232,20 @@ var APIClient = class {
       }
       break;
     }
-    if (response.status === 401 && this.config.refreshToken && !path.includes("/auth/refresh")) {
-      try {
-        await this.handleTokenRefresh();
-        headers.set("Authorization", `Bearer ${this.config.token}`);
-        response = await fetch(url.toString(), { ...init, headers });
-      } catch {
+    if (response.status === 401 && !path.includes("/auth/refresh") && !path.includes("/auth/login") && !path.includes("/auth/register")) {
+      const hasRefreshToken = this.config.refreshToken && this.config.refreshToken.length > 0;
+      if (hasRefreshToken) {
+        try {
+          await this.handleTokenRefresh();
+          headers.set("Authorization", `Bearer ${this.config.token}`);
+          response = await fetch(url.toString(), { ...init, headers });
+        } catch {
+          if (this.config.onAuthExpired) {
+            this.config.onAuthExpired();
+          }
+          throw new APIError(401, { error: "session_expired", message: "Session expired. Please log in again." });
+        }
+      } else {
         if (this.config.onAuthExpired) {
           this.config.onAuthExpired();
         }
@@ -299,6 +317,9 @@ var APIClient = class {
 };
 
 // src/modules/auth.ts
+function isAuthTokens(result) {
+  return typeof result === "object" && result !== null && "access_token" in result && "refresh_token" in result;
+}
 var AuthModule = class {
   constructor(client) {
     this.client = client;
@@ -306,19 +327,27 @@ var AuthModule = class {
   client;
   /**
    * Register a new account.
-   * If using EmailRegisterInput, returns AuthTokens.
+   * If using EmailRegisterInput, returns AuthTokens (auto-persisted).
    * If using PhoneRegisterInput, returns MessageResponse (OTP sent).
    */
   async register(input, options) {
-    return this.client.post("/auth/register", input, options);
+    const result = await this.client.post("/auth/register", input, options);
+    if (isAuthTokens(result)) {
+      await this.client.setSession(result);
+    }
+    return result;
   }
   /**
    * Log in to an existing account.
-   * If using EmailLoginInput, returns AuthTokens (or TwoFactorRequired if 2FA enabled).
+   * If using EmailLoginInput, returns AuthTokens (auto-persisted) or TwoFactorRequired.
    * If using PhoneLoginInput, returns MessageResponse (OTP sent).
    */
   async login(input, options) {
-    return this.client.post("/auth/login", input, options);
+    const result = await this.client.post("/auth/login", input, options);
+    if (isAuthTokens(result)) {
+      await this.client.setSession(result);
+    }
+    return result;
   }
   /**
    * Send an OTP code to a phone number.
@@ -327,26 +356,31 @@ var AuthModule = class {
     return this.client.post("/auth/otp/send", input, options);
   }
   /**
-   * Verify an OTP code.
+   * Verify an OTP code. Tokens are auto-persisted.
    */
   async verifyOtp(input, options) {
-    return this.client.post("/auth/otp/verify", input, options);
+    const result = await this.client.post("/auth/otp/verify", input, options);
+    await this.client.setSession(result);
+    return result;
   }
   /**
    * Refresh the access token using a refresh token.
    */
   async refresh(input, options) {
-    return this.client.post("/auth/refresh", input, options);
+    const result = await this.client.post("/auth/refresh", input, options);
+    await this.client.setSession(result);
+    return result;
   }
   /**
-   * Revoke the refresh token and log out.
+   * Revoke the refresh token and log out. Clears stored session.
    */
   async logout(input, options) {
-    return this.client.post("/auth/logout", input, options);
+    const result = await this.client.post("/auth/logout", input, options);
+    await this.client.clearToken();
+    return result;
   }
   /**
    * Request a password reset email.
-   * Sends a reset link to the provided email address.
    */
   async forgotPassword(input, options) {
     return this.client.post("/auth/forgot-password", input, options);
@@ -370,28 +404,27 @@ var AuthModule = class {
     return this.client.post("/auth/onboarding/complete", input, options);
   }
   /**
-   * Verify 2FA code during login (when login returns requires_2fa).
+   * Verify 2FA code during login. Tokens are auto-persisted.
    */
   async verify2FA(input, options) {
-    return this.client.post("/auth/2fa/login", input, options);
+    const result = await this.client.post("/auth/2fa/login", input, options);
+    await this.client.setSession(result);
+    return result;
   }
   /**
    * Send a verification code to the user's email.
-   * If unauthenticated, pass the email address.
    */
   async sendVerificationCode(email, options) {
     return this.client.post("/auth/verify-email/send", email ? { email } : void 0, options);
   }
   /**
    * Verify the email with the 6-digit code.
-   * If unauthenticated, pass the email address.
    */
   async verifyEmail(code, email, options) {
     return this.client.post("/auth/verify-email/confirm", email ? { code, email } : { code }, options);
   }
   /**
    * Upgrade the current user to a seller role.
-   * Idempotent — returns success if already a seller.
    */
   async becomeSeller(input, options) {
     return this.client.post("/auth/become-seller", input, options);
@@ -1364,6 +1397,12 @@ var MitumbaClient = class {
   setToken(token, refreshToken) {
     this.api.setToken(token, refreshToken);
   }
+  /**
+   * Set both tokens explicitly. Preferred — prevents dropping the refresh token.
+   */
+  setSession(tokens) {
+    return this.api.setSession(tokens);
+  }
   /**
    * Get the current access token.
    */