@naturali/sdk 0.30.0 → 0.31.0

package/dist/index.cjs

@@ -784,7 +784,7 @@ var Auth = class {
 	/**
 	* Refresh a session
 	*
-	* Exchanges a valid refresh token for a new access JWT and a rotated refresh token. Refresh tokens are single-use; presenting a previously-rotated token is treated as reuse and revokes the whole session family (createRefreshRotation reuse detection).
+	* Exchanges a valid refresh token for a new access JWT and a rotated refresh token, taken from the body or from the `refresh_token` cookie set at sign-in — a browser sends an empty body and the cookie carries the credential. Refresh tokens are single-use; presenting a previously-rotated token is treated as reuse and revokes the whole session family (createRefreshRotation reuse detection), except within a few seconds of the rotation, where it is treated as two tabs racing on one cookie and rotated again.
 	*
 	*/
 	static refreshSession(options) {
@@ -800,7 +800,7 @@ var Auth = class {
 	/**
 	* Log out
 	*
-	* Revokes the current refresh token (and its rotation family). Pass `all: true` to revoke every active session for the user.
+	* Revokes the current refresh token (and its rotation family) and clears the `refresh_token` cookie. Pass `all: true` to revoke every active session for the user.
 	*
 	*/
 	static logout(options) {

package/dist/index.d.cts

@@ -531,7 +531,7 @@ type Acknowledgement = {
   message?: string;
 };
 /**
- * A short-lived access JWT plus a rotating refresh token. Web clients may receive the refresh token as an httpOnly, Secure cookie instead of in the body.
+ * A short-lived access JWT plus a rotating refresh token. The refresh token is also set as an httpOnly, SameSite=Lax cookie scoped to `/v1/auth` (Secure whenever the connection is https), which is what carries a browser session across a reload; the body copy is for clients with no cookie jar, such as the CLI.
  *
  */
 type AuthSession = {
@@ -551,7 +551,8 @@ type AuthSession = {
   user: User;
 };
 /**
- * The refresh token may instead be presented via an httpOnly cookie.
+ * Send an empty object from a browser — the httpOnly `refresh_token` cookie is presented instead, and takes over when the body omits the field.
+ *
  */
 type RefreshRequest = {
   refresh_token?: string;
@@ -5097,14 +5098,14 @@ declare class Auth {
   /**
    * Refresh a session
    *
-   * Exchanges a valid refresh token for a new access JWT and a rotated refresh token. Refresh tokens are single-use; presenting a previously-rotated token is treated as reuse and revokes the whole session family (createRefreshRotation reuse detection).
+   * Exchanges a valid refresh token for a new access JWT and a rotated refresh token, taken from the body or from the `refresh_token` cookie set at sign-in — a browser sends an empty body and the cookie carries the credential. Refresh tokens are single-use; presenting a previously-rotated token is treated as reuse and revokes the whole session family (createRefreshRotation reuse detection), except within a few seconds of the rotation, where it is treated as two tabs racing on one cookie and rotated again.
    *
    */
   static refreshSession<ThrowOnError extends boolean = false>(options: Options<RefreshSessionData, ThrowOnError>): RequestResult<RefreshSessionResponses, RefreshSessionErrors, ThrowOnError>;
   /**
    * Log out
    *
-   * Revokes the current refresh token (and its rotation family). Pass `all: true` to revoke every active session for the user.
+   * Revokes the current refresh token (and its rotation family) and clears the `refresh_token` cookie. Pass `all: true` to revoke every active session for the user.
    *
    */
   static logout<ThrowOnError extends boolean = false>(options?: Options<LogoutData, ThrowOnError>): RequestResult<LogoutResponses, LogoutErrors, ThrowOnError>;

package/dist/index.d.mts

@@ -531,7 +531,7 @@ type Acknowledgement = {
   message?: string;
 };
 /**
- * A short-lived access JWT plus a rotating refresh token. Web clients may receive the refresh token as an httpOnly, Secure cookie instead of in the body.
+ * A short-lived access JWT plus a rotating refresh token. The refresh token is also set as an httpOnly, SameSite=Lax cookie scoped to `/v1/auth` (Secure whenever the connection is https), which is what carries a browser session across a reload; the body copy is for clients with no cookie jar, such as the CLI.
  *
  */
 type AuthSession = {
@@ -551,7 +551,8 @@ type AuthSession = {
   user: User;
 };
 /**
- * The refresh token may instead be presented via an httpOnly cookie.
+ * Send an empty object from a browser — the httpOnly `refresh_token` cookie is presented instead, and takes over when the body omits the field.
+ *
  */
 type RefreshRequest = {
   refresh_token?: string;
@@ -5097,14 +5098,14 @@ declare class Auth {
   /**
    * Refresh a session
    *
-   * Exchanges a valid refresh token for a new access JWT and a rotated refresh token. Refresh tokens are single-use; presenting a previously-rotated token is treated as reuse and revokes the whole session family (createRefreshRotation reuse detection).
+   * Exchanges a valid refresh token for a new access JWT and a rotated refresh token, taken from the body or from the `refresh_token` cookie set at sign-in — a browser sends an empty body and the cookie carries the credential. Refresh tokens are single-use; presenting a previously-rotated token is treated as reuse and revokes the whole session family (createRefreshRotation reuse detection), except within a few seconds of the rotation, where it is treated as two tabs racing on one cookie and rotated again.
    *
    */
   static refreshSession<ThrowOnError extends boolean = false>(options: Options<RefreshSessionData, ThrowOnError>): RequestResult<RefreshSessionResponses, RefreshSessionErrors, ThrowOnError>;
   /**
    * Log out
    *
-   * Revokes the current refresh token (and its rotation family). Pass `all: true` to revoke every active session for the user.
+   * Revokes the current refresh token (and its rotation family) and clears the `refresh_token` cookie. Pass `all: true` to revoke every active session for the user.
    *
    */
   static logout<ThrowOnError extends boolean = false>(options?: Options<LogoutData, ThrowOnError>): RequestResult<LogoutResponses, LogoutErrors, ThrowOnError>;

package/dist/index.mjs

@@ -783,7 +783,7 @@ var Auth = class {
 	/**
 	* Refresh a session
 	*
-	* Exchanges a valid refresh token for a new access JWT and a rotated refresh token. Refresh tokens are single-use; presenting a previously-rotated token is treated as reuse and revokes the whole session family (createRefreshRotation reuse detection).
+	* Exchanges a valid refresh token for a new access JWT and a rotated refresh token, taken from the body or from the `refresh_token` cookie set at sign-in — a browser sends an empty body and the cookie carries the credential. Refresh tokens are single-use; presenting a previously-rotated token is treated as reuse and revokes the whole session family (createRefreshRotation reuse detection), except within a few seconds of the rotation, where it is treated as two tabs racing on one cookie and rotated again.
 	*
 	*/
 	static refreshSession(options) {
@@ -799,7 +799,7 @@ var Auth = class {
 	/**
 	* Log out
 	*
-	* Revokes the current refresh token (and its rotation family). Pass `all: true` to revoke every active session for the user.
+	* Revokes the current refresh token (and its rotation family) and clears the `refresh_token` cookie. Pass `all: true` to revoke every active session for the user.
 	*
 	*/
 	static logout(options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naturali/sdk",
-  "version": "0.30.0",
+  "version": "0.31.0",
   "description": "TypeScript SDK for the naturali.ai API, generated from its OpenAPI specs",
   "type": "module",
   "sideEffects": false,
@@ -37,7 +37,7 @@
     "tsx": "^4.23.1",
     "typescript": "~6.0.3",
     "vitest": "^4.1.10",
-    "@naturali/api": "0.30.0"
+    "@naturali/api": "0.31.0"
   },
   "scripts": {
     "generate": "tsx scripts/generate.ts",