@opexa/portal-sdk 0.59.75 → 0.59.76

package/dist/{chunk-ROBGEUSE.js → chunk-WVFSGB7Y.js}

@@ -39,5 +39,5 @@ function callIfFn(value, ...args) {
 }
 
 export { callIfFn, gql, statusCodeToOperationError };
-//# sourceMappingURL=chunk-ROBGEUSE.js.map
-//# sourceMappingURL=chunk-ROBGEUSE.js.map
+//# sourceMappingURL=chunk-WVFSGB7Y.js.map
+//# sourceMappingURL=chunk-WVFSGB7Y.js.map

package/dist/chunk-WVFSGB7Y.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils/gql.ts","../src/utils/status-code-to-operation-error.ts","../src/utils/call-if-fn.ts"],"names":[],"mappings":";AAAO,SAAS,GAAA,CAAI,YAAkC,MAAA,EAAmB;AACxE,EAAA,IAAI,MAAA,GAAS,EAAA;AAEb,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,MAAM,CAAA,IAAK,OAAA,CAAQ,SAAQ,EAAG;AAChD,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,EAAA,CAAG,KAAK,CAAA,IAAK,EAAA;AAElC,IAAA,MAAA,GAAS,CAAA,EAAG,MAAM,CAAA,EAAG,MAAM,GAAG,KAAK,CAAA,CAAA;AAAA,EACpC;AAEA,EAAA,OAAO,OAAO,IAAA,EAAK;AACpB;;;ACRO,SAAS,0BAAA,CACf,OACA,OAAA,EAC4B;AAC5B,EAAA,MAAM,CAAA,GAAI,UAAU,KAAK,CAAA,GAAI,UAAU,KAAK,CAAA,GAAI,UAAU,GAAG,CAAA;AAE7D,EAAA,OAAO;AAAA,IACN,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,OAAA,EAAS,WAAW,CAAA,CAAE;AAAA,GACvB;AACD;AAEA,IAAM,SAAA,GAAuD;AAAA,EAC5D,GAAA,EAAK,EAAE,IAAA,EAAM,gBAAA,EAAkB,SAAS,aAAA,EAAc;AAAA,EACtD,GAAA,EAAK,EAAE,IAAA,EAAM,kBAAA,EAAoB,SAAS,cAAA,EAAe;AAAA,EACzD,GAAA,EAAK,EAAE,IAAA,EAAM,eAAA,EAAiB,SAAS,WAAA,EAAY;AAAA,EACnD,GAAA,EAAK,EAAE,IAAA,EAAM,cAAA,EAAgB,SAAS,WAAA,EAAY;AAAA,EAClD,GAAA,EAAK,EAAE,IAAA,EAAM,oBAAA,EAAsB,SAAS,iBAAA,EAAkB;AAAA,EAC9D,GAAA,EAAK,EAAE,IAAA,EAAM,qBAAA,EAAuB,SAAS,mBAAA,EAAoB;AAAA,EACjE,GAAA,EAAK,EAAE,IAAA,EAAM,yBAAA,EAA2B,SAAS,uBAAA;AAClD,CAAA;;;ACtBA,SAAS,WACR,KAAA,EACuC;AACvC,EAAA,OAAO,OAAO,KAAA,KAAU,UAAA;AACzB;AAEO,SAAS,QAAA,CACf,UACG,IAAA,EACF;AACD,EAAA,IAAI,UAAA,CAAyB,KAAK,CAAA,EAAG;AACpC,IAAA,OAAO,KAAA,CAAM,GAAG,IAAI,CAAA;AAAA,EACrB,CAAA,MAAO;AACN,IAAA,OAAO,KAAA;AAAA,EACR;AACD","file":"chunk-WVFSGB7Y.js","sourcesContent":["export function gql(strings: TemplateStringsArray, ...values: unknown[]) {\r\n\tlet result = '';\r\n\r\n\tfor (const [index, string] of strings.entries()) {\r\n\t\tconst value = values.at(index) ?? '';\r\n\r\n\t\tresult = `${result}${string}${value}`;\r\n\t}\r\n\r\n\treturn result.trim();\r\n}\r\n","import type { HttpError, OperationError } from '../types/index.js';\r\n\r\nexport function statusCodeToOperationError(\r\n\tvalue: number,\r\n\tmessage?: string,\r\n): OperationError<HttpError> {\r\n\tconst e = ERROR_MAP[value] ? ERROR_MAP[value] : ERROR_MAP[500];\r\n\r\n\treturn {\r\n\t\tname: e.name,\r\n\t\tmessage: message ?? e.message,\r\n\t};\r\n}\r\n\r\nconst ERROR_MAP: Record<number, OperationError<HttpError>> = {\r\n\t400: { name: 'HttpBadRequest', message: 'Bad Request' },\r\n\t401: { name: 'HttpUnauthorized', message: 'Unauthorized' },\r\n\t403: { name: 'HttpForbidden', message: 'Forbidden' },\r\n\t404: { name: 'HttpNotFound', message: 'Not Found' },\r\n\t408: { name: 'HttpRequestTimeout', message: 'Request Timeout' },\r\n\t429: { name: 'HttpTooManyRequests', message: 'Too Many Requests' },\r\n\t500: { name: 'HttpInternalServerError', message: 'Internal Server Error' },\r\n};\r\n","function isFunction<Return, Args = never>(\r\n\tvalue: unknown | ((...args: Args[]) => Return),\r\n): value is (...args: Args[]) => Return {\r\n\treturn typeof value === 'function';\r\n}\r\n\r\nexport function callIfFn<Return, Args = never>(\r\n\tvalue: Return | ((...args: Args[]) => Return),\r\n\t...args: Args[]\r\n) {\r\n\tif (isFunction<Return, Args>(value)) {\r\n\t\treturn value(...args);\r\n\t} else {\r\n\t\treturn value;\r\n\t}\r\n}\r\n"]}

package/dist/index.cjs

@@ -4538,14 +4538,12 @@ var AuthService = class {
       headers.set("test-pass", input.testPass);
     }
     try {
-      const res = await fetch(
-        `${this.url}${version === 3 ? "/v3/sessions" : "/sessions"}`,
-        {
-          method: "POST",
-          headers,
-          body: JSON.stringify(input)
-        }
-      );
+      const res = await fetch(`${this.url}${version !== 1 ? `/v${version}/sessions` : "/sessions"}`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(input),
+        ...version === 4 && { credentials: "include" }
+      });
       const data = await res.json();
       if (res.ok) {
         return {
@@ -4626,14 +4624,20 @@ var AuthService = class {
     }
     throw new Error("Invalid input 'type'");
   }
-  async refreshSession(refreshToken) {
+  async refreshSession(refreshToken, version = 1) {
     const headers = new Headers(this.headers);
-    headers.append("Authorization", `Bearer ${refreshToken}`);
+    if (version !== 4) {
+      headers.append("Authorization", `Bearer ${refreshToken}`);
+    }
     try {
-      const res = await fetch(`${this.url}/session:refresh`, {
-        method: "POST",
-        headers
-      });
+      const res = await fetch(
+        `${this.url}${version === 4 ? "/v4/session/refresh" : "/session:refresh"}`,
+        {
+          method: "POST",
+          headers,
+          ...version === 4 && { credentials: "include" }
+        }
+      );
       const data = await res.json();
       if (res.ok) {
         return {
@@ -7103,6 +7107,13 @@ var SessionManagerCookie = class {
   authService;
   walletService;
   _refreshing = false;
+  /*
+   * v4 access tokens are never persisted (localStorage/cookie) so that an
+   * XSS-readable storage layer never holds a live access token. They only
+   * live in memory and get re-minted from the HttpOnly refresh cookie.
+   */
+  v4AccessToken = null;
+  v4AccessTokenExpiresAt = null;
   constructor(config) {
     this.authService = config.authService;
     this.walletService = config.walletService;
@@ -7114,6 +7125,29 @@ var SessionManagerCookie = class {
   set refreshing(value) {
     this._refreshing = value;
   }
+  persist(data, version) {
+    const now = /* @__PURE__ */ new Date();
+    if (version === 4) {
+      this.v4AccessToken = data.accessToken ?? null;
+      this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
+      cookies__default.default.set(
+        this.storageKey,
+        JSON.stringify({ version, session: data.session }),
+        { expires: subMinutes(addDays(now, 15), 2).getTime() }
+      );
+      return;
+    }
+    cookies__default.default.set(
+      this.storageKey,
+      JSON.stringify({
+        version,
+        ...data,
+        accessTokenExpiresAt: addMinutes(now, 8).getTime(),
+        refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
+      }),
+      { expires: subMinutes(addDays(now, 30), 2).getTime() }
+    );
+  }
   async create(input, version = 1) {
     if (input.type === "MAYA") {
       localStorage.setItem(this.platformStorageKey, "MAYA");
@@ -7140,16 +7174,7 @@ var SessionManagerCookie = class {
         maxAttempt: 5
       })();
       if (!r1.ok) return r1;
-      const now2 = /* @__PURE__ */ new Date();
-      cookies__default.default.set(
-        this.storageKey,
-        JSON.stringify({
-          ...r1.data,
-          accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-          refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-        }),
-        { expires: subMinutes(addDays(now2, 30), 2).getTime() }
-      );
+      this.persist(r1.data, version);
       return {
         ok: true,
         data: null
@@ -7158,18 +7183,7 @@ var SessionManagerCookie = class {
     if (input.type === "MOBILE_NUMBER") {
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        const now2 = /* @__PURE__ */ new Date();
-        cookies__default.default.set(
-          this.storageKey,
-          JSON.stringify({
-            ...res2.data,
-            accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-          }),
-          {
-            expires: subMinutes(addDays(now2, 30), 2).getTime()
-          }
-        );
+        this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -7186,16 +7200,7 @@ var SessionManagerCookie = class {
         version
       );
       if (res2.ok) {
-        const now2 = /* @__PURE__ */ new Date();
-        cookies__default.default.set(
-          this.storageKey,
-          JSON.stringify({
-            ...res2.data,
-            accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-          }),
-          { expires: subMinutes(addDays(now2, 30), 2).getTime() }
-        );
+        this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -7207,16 +7212,7 @@ var SessionManagerCookie = class {
       localStorage.setItem(this.platformStorageKey, "CABINET");
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        const now2 = /* @__PURE__ */ new Date();
-        cookies__default.default.set(
-          this.storageKey,
-          JSON.stringify({
-            ...res2.data,
-            accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-          }),
-          { expires: subMinutes(addDays(now2, 30), 2).getTime() }
-        );
+        this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -7234,16 +7230,7 @@ var SessionManagerCookie = class {
         }
       };
     }
-    const now = /* @__PURE__ */ new Date();
-    cookies__default.default.set(
-      this.storageKey,
-      JSON.stringify({
-        ...res.data,
-        accessTokenExpiresAt: addMinutes(now, 8).getTime(),
-        refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
-      }),
-      {}
-    );
+    this.persist(res.data, version);
     return {
       ok: true,
       data: null
@@ -7252,21 +7239,10 @@ var SessionManagerCookie = class {
   async createFromAuthenticator(input) {
     const res = await this.authService.authenticate(input);
     if (res.ok) {
-      const now = /* @__PURE__ */ new Date();
       if (this.isServer) {
         this.logger.warn("'client cookies' is not available on the server.");
       } else {
-        cookies__default.default.set(
-          this.storageKey,
-          JSON.stringify({
-            ...res.data,
-            accessTokenExpiresAt: addMinutes(now, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
-          }),
-          {
-            expires: subMinutes(addDays(now, 30), 2).getTime()
-          }
-        );
+        this.persist(res.data, 1);
       }
       return { ok: true };
     } else {
@@ -7293,7 +7269,11 @@ var SessionManagerCookie = class {
       };
     }
     try {
-      let obj = JSON.parse(val);
+      const stored = JSON.parse(val);
+      if (stored.version === 4) {
+        return await this.getV4(stored.session);
+      }
+      let obj = stored;
       let now = /* @__PURE__ */ new Date();
       const accessTokenExpiresAt = new Date(obj.accessTokenExpiresAt);
       const refreshTokenExpiresAt = new Date(obj.refreshTokenExpiresAt);
@@ -7311,7 +7291,10 @@ var SessionManagerCookie = class {
       if (isAfter(now, accessTokenExpiresAt)) {
         this.logger.info("Refreshing session...");
         this.refreshing = true;
-        const res = await this.authService.refreshSession(obj.refreshToken);
+        const res = await this.authService.refreshSession(
+          obj.refreshToken,
+          obj.version ?? 1
+        );
         this.refreshing = false;
         if (!res.ok) {
           this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -7333,7 +7316,8 @@ var SessionManagerCookie = class {
         now = /* @__PURE__ */ new Date();
         obj = {
           ...obj,
-          ...res.data,
+          accessToken: res.data.accessToken,
+          refreshToken: res.data.refreshToken ?? obj.refreshToken,
           accessTokenExpiresAt: addMinutes(now, 8).getTime(),
           refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
         };
@@ -7371,11 +7355,18 @@ var SessionManagerCookie = class {
       };
     }
     try {
-      let obj = JSON.parse(val);
+      const stored = JSON.parse(val);
+      if (stored.version === 4) {
+        return await this.refreshV4(stored.session);
+      }
+      let obj = stored;
       let now = /* @__PURE__ */ new Date();
       this.logger.info("Refreshing session...");
       this.refreshing = true;
-      const res = await this.authService.refreshSession(obj.refreshToken);
+      const res = await this.authService.refreshSession(
+        obj.refreshToken,
+        obj.version ?? 1
+      );
       this.refreshing = false;
       if (!res.ok) {
         this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -7397,7 +7388,8 @@ var SessionManagerCookie = class {
       now = /* @__PURE__ */ new Date();
       obj = {
         ...obj,
-        ...res.data,
+        accessToken: res.data.accessToken,
+        refreshToken: res.data.refreshToken ?? obj.refreshToken,
         accessTokenExpiresAt: addMinutes(now, 8).getTime(),
         refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
       };
@@ -7418,6 +7410,50 @@ var SessionManagerCookie = class {
       };
     }
   }
+  async getV4(session) {
+    const now = /* @__PURE__ */ new Date();
+    if (this.v4AccessToken && this.v4AccessTokenExpiresAt && !isAfter(now, new Date(this.v4AccessTokenExpiresAt))) {
+      return {
+        ok: true,
+        data: {
+          session,
+          accessToken: this.v4AccessToken,
+          accessTokenExpiresAt: this.v4AccessTokenExpiresAt
+        }
+      };
+    }
+    return await this.refreshV4(session);
+  }
+  async refreshV4(session) {
+    this.logger.info("Refreshing session...");
+    this.refreshing = true;
+    const res = await this.authService.refreshSession(void 0, 4);
+    this.refreshing = false;
+    if (!res.ok) {
+      this.logger.error(`Failed to refresh session: ${res.error.message}`);
+      if (res.error.name === "InvalidTokenError" || res.error.name === "AccountBlacklistedError" || res.error.name === "VerificationLockedError") {
+        cookies__default.default.remove(this.storageKey);
+        this.v4AccessToken = null;
+        this.v4AccessTokenExpiresAt = null;
+      }
+      return {
+        ok: false,
+        error: res.error
+      };
+    }
+    this.logger.success("Session refreshed!");
+    const now = /* @__PURE__ */ new Date();
+    this.v4AccessToken = res.data.accessToken;
+    this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
+    return {
+      ok: true,
+      data: {
+        session,
+        accessToken: this.v4AccessToken,
+        accessTokenExpiresAt: this.v4AccessTokenExpiresAt
+      }
+    };
+  }
   async destroy() {
     if (this.isServer) {
       this.logger.warn("'client cookies' is not available on the server.");
@@ -7427,6 +7463,8 @@ var SessionManagerCookie = class {
     if (res.data?.accessToken) {
       await this.authService.destroySession(res.data.accessToken);
     }
+    this.v4AccessToken = null;
+    this.v4AccessTokenExpiresAt = null;
     cookies__default.default.remove(this.storageKey);
   }
   async verify() {
@@ -7472,6 +7510,13 @@ var SessionManager = class {
   authService;
   walletService;
   _refreshing = false;
+  /*
+   * v4 access tokens are never persisted (localStorage/cookie) so that an
+   * XSS-readable storage layer never holds a live access token. They only
+   * live in memory and get re-minted from the HttpOnly refresh cookie.
+   */
+  v4AccessToken = null;
+  v4AccessTokenExpiresAt = null;
   constructor(config) {
     this.authService = config.authService;
     this.walletService = config.walletService;
@@ -7487,6 +7532,27 @@ var SessionManager = class {
   set refreshing(value) {
     this._refreshing = value;
   }
+  persist(data, version) {
+    const now = /* @__PURE__ */ new Date();
+    if (version === 4) {
+      this.v4AccessToken = data.accessToken ?? null;
+      this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
+      localStorage.setItem(
+        this.storageKey,
+        JSON.stringify({ version, session: data.session })
+      );
+      return;
+    }
+    localStorage.setItem(
+      this.storageKey,
+      JSON.stringify({
+        version,
+        ...data,
+        accessTokenExpiresAt: addMinutes(now, 8).getTime(),
+        refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
+      })
+    );
+  }
   async create(input, version = 1) {
     if (this.isServer) {
       this.logger.warn("'localStorage' is not available on the server.");
@@ -7523,15 +7589,7 @@ var SessionManager = class {
         maxAttempt: 5
       })();
       if (!r1.ok) return r1;
-      const now2 = /* @__PURE__ */ new Date();
-      localStorage.setItem(
-        this.storageKey,
-        JSON.stringify({
-          ...r1.data,
-          accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-          refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-        })
-      );
+      this.persist(r1.data, version);
       return {
         ok: true,
         data: null
@@ -7540,15 +7598,7 @@ var SessionManager = class {
     if (input.type === "MOBILE_NUMBER") {
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        const now2 = /* @__PURE__ */ new Date();
-        localStorage.setItem(
-          this.storageKey,
-          JSON.stringify({
-            ...res2.data,
-            accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-          })
-        );
+        this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -7566,15 +7616,7 @@ var SessionManager = class {
         version
       );
       if (res2.ok) {
-        const now2 = /* @__PURE__ */ new Date();
-        localStorage.setItem(
-          this.storageKey,
-          JSON.stringify({
-            ...res2.data,
-            accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-          })
-        );
+        this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -7586,15 +7628,7 @@ var SessionManager = class {
       localStorage.setItem(this.platformStorageKey, "CABINET");
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        const now2 = /* @__PURE__ */ new Date();
-        localStorage.setItem(
-          this.storageKey,
-          JSON.stringify({
-            ...res2.data,
-            accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-          })
-        );
+        this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -7612,15 +7646,7 @@ var SessionManager = class {
         }
       };
     }
-    const now = /* @__PURE__ */ new Date();
-    localStorage.setItem(
-      this.storageKey,
-      JSON.stringify({
-        ...res.data,
-        accessTokenExpiresAt: addMinutes(now, 8).getTime(),
-        refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
-      })
-    );
+    this.persist(res.data, version);
     return {
       ok: true,
       data: null
@@ -7629,18 +7655,10 @@ var SessionManager = class {
   async createFromAuthenticator(input) {
     const res = await this.authService.authenticate(input);
     if (res.ok) {
-      const now = /* @__PURE__ */ new Date();
       if (this.isServer) {
         this.logger.warn("'localStorage' is not available on the server.");
       } else {
-        localStorage.setItem(
-          this.storageKey,
-          JSON.stringify({
-            ...res.data,
-            accessTokenExpiresAt: addMinutes(now, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
-          })
-        );
+        this.persist(res.data, 1);
       }
       return { ok: true };
     } else {
@@ -7667,7 +7685,11 @@ var SessionManager = class {
       };
     }
     try {
-      let obj = JSON.parse(val);
+      const stored = JSON.parse(val);
+      if (stored.version === 4) {
+        return await this.getV4(stored.session);
+      }
+      let obj = stored;
       let now = /* @__PURE__ */ new Date();
       const accessTokenExpiresAt = new Date(obj.accessTokenExpiresAt);
       const refreshTokenExpiresAt = new Date(obj.refreshTokenExpiresAt);
@@ -7685,7 +7707,10 @@ var SessionManager = class {
       if (isAfter(now, accessTokenExpiresAt)) {
         this.logger.info("Refreshing session...");
         this.refreshing = true;
-        const res = await this.authService.refreshSession(obj.refreshToken);
+        const res = await this.authService.refreshSession(
+          obj.refreshToken,
+          obj.version ?? 1
+        );
         this.refreshing = false;
         if (!res.ok) {
           this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -7707,7 +7732,8 @@ var SessionManager = class {
         now = /* @__PURE__ */ new Date();
         obj = {
           ...obj,
-          ...res.data,
+          accessToken: res.data.accessToken,
+          refreshToken: res.data.refreshToken ?? obj.refreshToken,
           accessTokenExpiresAt: addMinutes(now, 8).getTime(),
           refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
         };
@@ -7743,11 +7769,18 @@ var SessionManager = class {
       };
     }
     try {
-      let obj = JSON.parse(val);
+      const stored = JSON.parse(val);
+      if (stored.version === 4) {
+        return await this.refreshV4(stored.session);
+      }
+      let obj = stored;
       let now = /* @__PURE__ */ new Date();
       this.logger.info("Refreshing session...");
       this.refreshing = true;
-      const res = await this.authService.refreshSession(obj.refreshToken);
+      const res = await this.authService.refreshSession(
+        obj.refreshToken,
+        obj.version ?? 1
+      );
       this.refreshing = false;
       if (!res.ok) {
         this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -7769,7 +7802,8 @@ var SessionManager = class {
       now = /* @__PURE__ */ new Date();
       obj = {
         ...obj,
-        ...res.data,
+        accessToken: res.data.accessToken,
+        refreshToken: res.data.refreshToken ?? obj.refreshToken,
         accessTokenExpiresAt: addMinutes(now, 8).getTime(),
         refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
       };
@@ -7788,6 +7822,50 @@ var SessionManager = class {
       };
     }
   }
+  async getV4(session) {
+    const now = /* @__PURE__ */ new Date();
+    if (this.v4AccessToken && this.v4AccessTokenExpiresAt && !isAfter(now, new Date(this.v4AccessTokenExpiresAt))) {
+      return {
+        ok: true,
+        data: {
+          session,
+          accessToken: this.v4AccessToken,
+          accessTokenExpiresAt: this.v4AccessTokenExpiresAt
+        }
+      };
+    }
+    return await this.refreshV4(session);
+  }
+  async refreshV4(session) {
+    this.logger.info("Refreshing session...");
+    this.refreshing = true;
+    const res = await this.authService.refreshSession(void 0, 4);
+    this.refreshing = false;
+    if (!res.ok) {
+      this.logger.error(`Failed to refresh session: ${res.error.message}`);
+      if (res.error.name === "InvalidTokenError" || res.error.name === "AccountBlacklistedError" || res.error.name === "VerificationLockedError") {
+        localStorage.removeItem(this.storageKey);
+        this.v4AccessToken = null;
+        this.v4AccessTokenExpiresAt = null;
+      }
+      return {
+        ok: false,
+        error: res.error
+      };
+    }
+    this.logger.success("Session refreshed!");
+    const now = /* @__PURE__ */ new Date();
+    this.v4AccessToken = res.data.accessToken;
+    this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
+    return {
+      ok: true,
+      data: {
+        session,
+        accessToken: this.v4AccessToken,
+        accessTokenExpiresAt: this.v4AccessTokenExpiresAt
+      }
+    };
+  }
   async destroy() {
     if (this.isServer) {
       this.logger.warn("'localStorage' is not available on the server.");
@@ -7797,6 +7875,8 @@ var SessionManager = class {
     if (res.data?.accessToken) {
       await this.authService.destroySession(res.data.accessToken);
     }
+    this.v4AccessToken = null;
+    this.v4AccessTokenExpiresAt = null;
     localStorage.removeItem(this.storageKey);
   }
   async verify() {