@scalemule/nextjs 0.1.16 → 0.1.18

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { a8 as StorageAdapter } from './index-DTWyUcyd.mjs';
+import { a8 as StorageAdapter, A as ApiError } from './index-DTWyUcyd.mjs';
 
 /**
  * ScaleMule API Client
@@ -38,6 +38,12 @@ interface ClientConfig {
     enableAccountSwitcher?: boolean;
     /** Privacy level for account switcher */
     accountSwitcherPrivacy?: 'full' | 'masked' | 'minimal';
+    /** Optional: Callback when a 401 auto-refresh starts. */
+    onRefreshStart?: () => void;
+    /** Optional: Callback when a 401 auto-refresh finishes. */
+    onRefreshEnd?: () => void;
+    /** Optional: Callback when an automatic 401 refresh fails. */
+    onAutoRefreshFailed?: (error: ApiError) => void;
 }
 interface RequestOptions extends RequestInit {
     /** Skip adding auth headers (for public endpoints) */
@@ -48,6 +54,8 @@ interface RequestOptions extends RequestInit {
     retries?: number;
     /** Skip retries */
     skipRetry?: boolean;
+    /** Internal flag to prevent infinite refresh loops */
+    isAutoRefresh?: boolean;
 }
 /**
  * ScaleMule API Client
@@ -69,6 +77,10 @@ declare class ScaleMuleClient {
     private sessionGate;
     private resolveSessionGate;
     private workspaceId;
+    private refreshPromise;
+    private onRefreshStart?;
+    private onRefreshEnd?;
+    private onAutoRefreshFailed?;
     constructor(config: ClientConfig);
     /**
      * Sync offline queue when coming back online

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import { a8 as StorageAdapter } from './index-DTWyUcyd.js';
+import { a8 as StorageAdapter, A as ApiError } from './index-DTWyUcyd.js';
 
 /**
  * ScaleMule API Client
@@ -38,6 +38,12 @@ interface ClientConfig {
     enableAccountSwitcher?: boolean;
     /** Privacy level for account switcher */
     accountSwitcherPrivacy?: 'full' | 'masked' | 'minimal';
+    /** Optional: Callback when a 401 auto-refresh starts. */
+    onRefreshStart?: () => void;
+    /** Optional: Callback when a 401 auto-refresh finishes. */
+    onRefreshEnd?: () => void;
+    /** Optional: Callback when an automatic 401 refresh fails. */
+    onAutoRefreshFailed?: (error: ApiError) => void;
 }
 interface RequestOptions extends RequestInit {
     /** Skip adding auth headers (for public endpoints) */
@@ -48,6 +54,8 @@ interface RequestOptions extends RequestInit {
     retries?: number;
     /** Skip retries */
     skipRetry?: boolean;
+    /** Internal flag to prevent infinite refresh loops */
+    isAutoRefresh?: boolean;
 }
 /**
  * ScaleMule API Client
@@ -69,6 +77,10 @@ declare class ScaleMuleClient {
     private sessionGate;
     private resolveSessionGate;
     private workspaceId;
+    private refreshPromise;
+    private onRefreshStart?;
+    private onRefreshEnd?;
+    private onAutoRefreshFailed?;
     constructor(config: ClientConfig);
     /**
      * Sync offline queue when coming back online

package/dist/client.js

@@ -278,6 +278,7 @@ var ScaleMuleClient = class {
     this.sessionGate = null;
     this.resolveSessionGate = null;
     this.workspaceId = null;
+    this.refreshPromise = null;
     this.apiKey = config.apiKey;
     this.applicationId = config.applicationId || null;
     this.gatewayUrl = resolveGatewayUrl(config);
@@ -285,6 +286,9 @@ var ScaleMuleClient = class {
     this.storage = config.storage || createDefaultStorage();
     this.enableRateLimitQueue = config.enableRateLimitQueue || false;
     this.enableOfflineQueue = config.enableOfflineQueue || false;
+    this.onRefreshStart = config.onRefreshStart;
+    this.onRefreshEnd = config.onRefreshEnd;
+    this.onAutoRefreshFailed = config.onAutoRefreshFailed;
     if (this.enableRateLimitQueue) {
       this.rateLimitQueue = new RateLimitQueue();
     }
@@ -503,6 +507,10 @@ var ScaleMuleClient = class {
           signal: controller.signal
         });
         clearTimeout(timeoutId);
+        const rotatedToken = response.headers.get("x-rotated-session-token");
+        if (rotatedToken && this.sessionToken && this.userId) {
+          this.setSession(rotatedToken, this.userId);
+        }
         const text = await response.text();
         let responseData = null;
         try {
@@ -512,6 +520,30 @@ var ScaleMuleClient = class {
         if (!response.ok) {
           const rawError = responseData?.error;
           const error = rawError && typeof rawError === "object" ? rawError : { code: `HTTP_${response.status}`, message: typeof rawError === "string" ? rawError : responseData?.message || text || response.statusText };
+          if (response.status === 401 && this.sessionToken && !options.isAutoRefresh) {
+            if (this.debug) console.log("[ScaleMule] 401 received, attempting auto-refresh...");
+            if (!this.refreshPromise) {
+              this.onRefreshStart?.();
+              this.refreshPromise = this.post("/api/auth/refresh", {}, { isAutoRefresh: true });
+            }
+            try {
+              await this.refreshPromise;
+              if (this.debug) console.log("[ScaleMule] Auto-refresh succeeded, retrying original request...");
+              attempt--;
+              if (this.sessionToken) {
+                headers.set("Authorization", `Bearer ${this.sessionToken}`);
+              }
+              continue;
+            } catch (refreshErr) {
+              if (this.debug) console.error("[ScaleMule] Auto-refresh failed:", refreshErr);
+              const refreshApiError = refreshErr instanceof ScaleMuleApiError ? { code: refreshErr.code, message: refreshErr.message, field: refreshErr.field } : { code: "REFRESH_FAILED", message: "Auto-refresh failed" };
+              this.onAutoRefreshFailed?.(refreshApiError);
+              throw new ScaleMuleApiError(error);
+            } finally {
+              this.refreshPromise = null;
+              this.onRefreshEnd?.();
+            }
+          }
           if (attempt < maxRetries && RETRYABLE_STATUS_CODES.has(response.status)) {
             lastError = error;
             const delay = getBackoffDelay(attempt);

package/dist/client.mjs

@@ -276,6 +276,7 @@ var ScaleMuleClient = class {
     this.sessionGate = null;
     this.resolveSessionGate = null;
     this.workspaceId = null;
+    this.refreshPromise = null;
     this.apiKey = config.apiKey;
     this.applicationId = config.applicationId || null;
     this.gatewayUrl = resolveGatewayUrl(config);
@@ -283,6 +284,9 @@ var ScaleMuleClient = class {
     this.storage = config.storage || createDefaultStorage();
     this.enableRateLimitQueue = config.enableRateLimitQueue || false;
     this.enableOfflineQueue = config.enableOfflineQueue || false;
+    this.onRefreshStart = config.onRefreshStart;
+    this.onRefreshEnd = config.onRefreshEnd;
+    this.onAutoRefreshFailed = config.onAutoRefreshFailed;
     if (this.enableRateLimitQueue) {
       this.rateLimitQueue = new RateLimitQueue();
     }
@@ -501,6 +505,10 @@ var ScaleMuleClient = class {
           signal: controller.signal
         });
         clearTimeout(timeoutId);
+        const rotatedToken = response.headers.get("x-rotated-session-token");
+        if (rotatedToken && this.sessionToken && this.userId) {
+          this.setSession(rotatedToken, this.userId);
+        }
         const text = await response.text();
         let responseData = null;
         try {
@@ -510,6 +518,30 @@ var ScaleMuleClient = class {
         if (!response.ok) {
           const rawError = responseData?.error;
           const error = rawError && typeof rawError === "object" ? rawError : { code: `HTTP_${response.status}`, message: typeof rawError === "string" ? rawError : responseData?.message || text || response.statusText };
+          if (response.status === 401 && this.sessionToken && !options.isAutoRefresh) {
+            if (this.debug) console.log("[ScaleMule] 401 received, attempting auto-refresh...");
+            if (!this.refreshPromise) {
+              this.onRefreshStart?.();
+              this.refreshPromise = this.post("/api/auth/refresh", {}, { isAutoRefresh: true });
+            }
+            try {
+              await this.refreshPromise;
+              if (this.debug) console.log("[ScaleMule] Auto-refresh succeeded, retrying original request...");
+              attempt--;
+              if (this.sessionToken) {
+                headers.set("Authorization", `Bearer ${this.sessionToken}`);
+              }
+              continue;
+            } catch (refreshErr) {
+              if (this.debug) console.error("[ScaleMule] Auto-refresh failed:", refreshErr);
+              const refreshApiError = refreshErr instanceof ScaleMuleApiError ? { code: refreshErr.code, message: refreshErr.message, field: refreshErr.field } : { code: "REFRESH_FAILED", message: "Auto-refresh failed" };
+              this.onAutoRefreshFailed?.(refreshApiError);
+              throw new ScaleMuleApiError(error);
+            } finally {
+              this.refreshPromise = null;
+              this.onRefreshEnd?.();
+            }
+          }
           if (attempt < maxRetries && RETRYABLE_STATUS_CODES.has(response.status)) {
             lastError = error;
             const delay = getBackoffDelay(attempt);

package/dist/index.js

@@ -7023,6 +7023,7 @@ var ScaleMuleClient2 = class {
     this.sessionGate = null;
     this.resolveSessionGate = null;
     this.workspaceId = null;
+    this.refreshPromise = null;
     this.apiKey = config.apiKey;
     this.applicationId = config.applicationId || null;
     this.gatewayUrl = resolveGatewayUrl(config);
@@ -7030,6 +7031,9 @@ var ScaleMuleClient2 = class {
     this.storage = config.storage || createDefaultStorage2();
     this.enableRateLimitQueue = config.enableRateLimitQueue || false;
     this.enableOfflineQueue = config.enableOfflineQueue || false;
+    this.onRefreshStart = config.onRefreshStart;
+    this.onRefreshEnd = config.onRefreshEnd;
+    this.onAutoRefreshFailed = config.onAutoRefreshFailed;
     if (this.enableRateLimitQueue) {
       this.rateLimitQueue = new RateLimitQueue2();
     }
@@ -7248,6 +7252,10 @@ var ScaleMuleClient2 = class {
           signal: controller.signal
         });
         clearTimeout(timeoutId);
+        const rotatedToken = response.headers.get("x-rotated-session-token");
+        if (rotatedToken && this.sessionToken && this.userId) {
+          this.setSession(rotatedToken, this.userId);
+        }
         const text = await response.text();
         let responseData = null;
         try {
@@ -7257,6 +7265,30 @@ var ScaleMuleClient2 = class {
         if (!response.ok) {
           const rawError = responseData?.error;
           const error = rawError && typeof rawError === "object" ? rawError : { code: `HTTP_${response.status}`, message: typeof rawError === "string" ? rawError : responseData?.message || text || response.statusText };
+          if (response.status === 401 && this.sessionToken && !options.isAutoRefresh) {
+            if (this.debug) console.log("[ScaleMule] 401 received, attempting auto-refresh...");
+            if (!this.refreshPromise) {
+              this.onRefreshStart?.();
+              this.refreshPromise = this.post("/api/auth/refresh", {}, { isAutoRefresh: true });
+            }
+            try {
+              await this.refreshPromise;
+              if (this.debug) console.log("[ScaleMule] Auto-refresh succeeded, retrying original request...");
+              attempt--;
+              if (this.sessionToken) {
+                headers.set("Authorization", `Bearer ${this.sessionToken}`);
+              }
+              continue;
+            } catch (refreshErr) {
+              if (this.debug) console.error("[ScaleMule] Auto-refresh failed:", refreshErr);
+              const refreshApiError = refreshErr instanceof ScaleMuleApiError ? { code: refreshErr.code, message: refreshErr.message, field: refreshErr.field } : { code: "REFRESH_FAILED", message: "Auto-refresh failed" };
+              this.onAutoRefreshFailed?.(refreshApiError);
+              throw new ScaleMuleApiError(error);
+            } finally {
+              this.refreshPromise = null;
+              this.onRefreshEnd?.();
+            }
+          }
           if (attempt < maxRetries && RETRYABLE_STATUS_CODES3.has(response.status)) {
             lastError = error;
             const delay = getBackoffDelay2(attempt);

package/dist/index.mjs

@@ -7003,6 +7003,7 @@ var ScaleMuleClient2 = class {
     this.sessionGate = null;
     this.resolveSessionGate = null;
     this.workspaceId = null;
+    this.refreshPromise = null;
     this.apiKey = config.apiKey;
     this.applicationId = config.applicationId || null;
     this.gatewayUrl = resolveGatewayUrl(config);
@@ -7010,6 +7011,9 @@ var ScaleMuleClient2 = class {
     this.storage = config.storage || createDefaultStorage2();
     this.enableRateLimitQueue = config.enableRateLimitQueue || false;
     this.enableOfflineQueue = config.enableOfflineQueue || false;
+    this.onRefreshStart = config.onRefreshStart;
+    this.onRefreshEnd = config.onRefreshEnd;
+    this.onAutoRefreshFailed = config.onAutoRefreshFailed;
     if (this.enableRateLimitQueue) {
       this.rateLimitQueue = new RateLimitQueue2();
     }
@@ -7228,6 +7232,10 @@ var ScaleMuleClient2 = class {
           signal: controller.signal
         });
         clearTimeout(timeoutId);
+        const rotatedToken = response.headers.get("x-rotated-session-token");
+        if (rotatedToken && this.sessionToken && this.userId) {
+          this.setSession(rotatedToken, this.userId);
+        }
         const text = await response.text();
         let responseData = null;
         try {
@@ -7237,6 +7245,30 @@ var ScaleMuleClient2 = class {
         if (!response.ok) {
           const rawError = responseData?.error;
           const error = rawError && typeof rawError === "object" ? rawError : { code: `HTTP_${response.status}`, message: typeof rawError === "string" ? rawError : responseData?.message || text || response.statusText };
+          if (response.status === 401 && this.sessionToken && !options.isAutoRefresh) {
+            if (this.debug) console.log("[ScaleMule] 401 received, attempting auto-refresh...");
+            if (!this.refreshPromise) {
+              this.onRefreshStart?.();
+              this.refreshPromise = this.post("/api/auth/refresh", {}, { isAutoRefresh: true });
+            }
+            try {
+              await this.refreshPromise;
+              if (this.debug) console.log("[ScaleMule] Auto-refresh succeeded, retrying original request...");
+              attempt--;
+              if (this.sessionToken) {
+                headers.set("Authorization", `Bearer ${this.sessionToken}`);
+              }
+              continue;
+            } catch (refreshErr) {
+              if (this.debug) console.error("[ScaleMule] Auto-refresh failed:", refreshErr);
+              const refreshApiError = refreshErr instanceof ScaleMuleApiError ? { code: refreshErr.code, message: refreshErr.message, field: refreshErr.field } : { code: "REFRESH_FAILED", message: "Auto-refresh failed" };
+              this.onAutoRefreshFailed?.(refreshApiError);
+              throw new ScaleMuleApiError(error);
+            } finally {
+              this.refreshPromise = null;
+              this.onRefreshEnd?.();
+            }
+          }
           if (attempt < maxRetries && RETRYABLE_STATUS_CODES3.has(response.status)) {
             lastError = error;
             const delay = getBackoffDelay2(attempt);

package/dist/server/auth.js

@@ -132,23 +132,31 @@ var ScaleMuleServer = class {
       /**
        * Logout user
        */
-      logout: async (sessionToken) => {
+      logout: async (sessionToken, options) => {
         return this.request("POST", "/v1/auth/logout", {
-          body: { session_token: sessionToken }
+          sessionToken,
+          body: { session_token: sessionToken },
+          onTokenRotated: options?.onTokenRotated
         });
       },
       /**
        * Get current user from session token
        */
-      me: async (sessionToken) => {
-        return this.request("GET", "/v1/auth/me", { sessionToken });
+      me: async (sessionToken, options) => {
+        return this.request("GET", "/v1/auth/me", {
+          sessionToken,
+          onTokenRotated: options?.onTokenRotated
+        });
       },
       /**
        * Refresh session token
        */
-      refresh: async (sessionToken) => {
+      refresh: async (sessionToken, options) => {
         return this.request("POST", "/v1/auth/refresh", {
-          body: { session_token: sessionToken }
+          sessionToken,
+          clientContext: options?.clientContext,
+          isAutoRefresh: options?.isAutoRefresh,
+          onTokenRotated: options?.onTokenRotated
         });
       },
       /**
@@ -180,7 +188,8 @@ var ScaleMuleServer = class {
         if (options?.email) {
           return this.request("POST", "/v1/auth/resend-verification", {
             sessionToken: sessionTokenOrEmail,
-            body: { email: options.email }
+            body: { email: options.email },
+            onTokenRotated: options?.onTokenRotated
           });
         }
         if (sessionTokenOrEmail.includes("@")) {
@@ -189,7 +198,8 @@ var ScaleMuleServer = class {
           });
         }
         return this.request("POST", "/v1/auth/resend-verification", {
-          sessionToken: sessionTokenOrEmail
+          sessionToken: sessionTokenOrEmail,
+          onTokenRotated: options?.onTokenRotated
         });
       }
     };
@@ -200,37 +210,41 @@ var ScaleMuleServer = class {
       /**
        * Update user profile
        */
-      update: async (sessionToken, data) => {
+      update: async (sessionToken, data, options) => {
         return this.request("PATCH", "/v1/auth/profile", {
           sessionToken,
-          body: data
+          body: data,
+          onTokenRotated: options?.onTokenRotated
         });
       },
       /**
        * Change password
        */
-      changePassword: async (sessionToken, currentPassword, newPassword) => {
+      changePassword: async (sessionToken, currentPassword, newPassword, options) => {
         return this.request("POST", "/v1/auth/change-password", {
           sessionToken,
-          body: { current_password: currentPassword, new_password: newPassword }
+          body: { current_password: currentPassword, new_password: newPassword },
+          onTokenRotated: options?.onTokenRotated
         });
       },
       /**
        * Change email
        */
-      changeEmail: async (sessionToken, newEmail, password) => {
+      changeEmail: async (sessionToken, newEmail, password, options) => {
         return this.request("POST", "/v1/auth/change-email", {
           sessionToken,
-          body: { new_email: newEmail, password }
+          body: { new_email: newEmail, password },
+          onTokenRotated: options?.onTokenRotated
         });
       },
       /**
        * Delete account
        */
-      deleteAccount: async (sessionToken, password) => {
+      deleteAccount: async (sessionToken, password, options) => {
         return this.request("DELETE", "/v1/auth/me", {
           sessionToken,
-          body: { password }
+          body: { password },
+          onTokenRotated: options?.onTokenRotated
         });
       }
     };
@@ -691,6 +705,9 @@ var ScaleMuleServer = class {
     this.apiKey = config.apiKey;
     this.gatewayUrl = resolveGatewayUrl(config);
     this.debug = config.debug || false;
+    this.onRefreshStart = config.onRefreshStart;
+    this.onRefreshEnd = config.onRefreshEnd;
+    this.onAutoRefreshFailed = config.onAutoRefreshFailed;
     this.money = money.createMoneyClient({
       apiKey: this.apiKey,
       gatewayUrl: this.gatewayUrl,
@@ -734,6 +751,10 @@ var ScaleMuleServer = class {
         headers,
         body: options.body ? JSON.stringify(options.body) : void 0
       });
+      const rotated = response.headers.get("x-rotated-session-token");
+      if (rotated && options.onTokenRotated) {
+        options.onTokenRotated(rotated);
+      }
       const text = await response.text();
       let responseData = null;
       try {
@@ -745,6 +766,33 @@ var ScaleMuleServer = class {
           code: `HTTP_${response.status}`,
           message: responseData?.message || text || response.statusText
         };
+        if (response.status === 401 && options.sessionToken && !options.isAutoRefresh) {
+          if (this.debug) console.log("[ScaleMule Server] 401 received, attempting auto-refresh...");
+          try {
+            this.onRefreshStart?.();
+            const refreshData = await this.auth.refresh(options.sessionToken, {
+              clientContext: options.clientContext,
+              isAutoRefresh: true
+              // Prevent infinite loops
+            });
+            const newToken = refreshData.session_token;
+            if (this.debug) console.log("[ScaleMule Server] Auto-refresh succeeded, retrying original request...");
+            options.onTokenRotated?.(newToken);
+            return this.request(method, path, {
+              ...options,
+              sessionToken: newToken,
+              isAutoRefresh: true
+              // Don't refresh again on this retry
+            });
+          } catch (refreshErr) {
+            if (this.debug) console.error("[ScaleMule Server] Auto-refresh failed:", refreshErr);
+            const refreshApiError = refreshErr instanceof ScaleMuleApiError ? { code: refreshErr.code, message: refreshErr.message } : { code: "REFRESH_FAILED", message: "Auto-refresh failed" };
+            this.onAutoRefreshFailed?.(refreshApiError);
+            throw new ScaleMuleApiError(error);
+          } finally {
+            this.onRefreshEnd?.();
+          }
+        }
         throw new ScaleMuleApiError(error);
       }
       const data = responseData?.data !== void 0 ? responseData.data : responseData;
@@ -1173,8 +1221,16 @@ function createAuthRoutes(config = {}) {
         // ==================== Logout ====================
         case "logout": {
           const session = await getSession();
+          let rotated = null;
           if (session) {
-            await sm.auth.logout(session.sessionToken);
+            try {
+              await sm.auth.logout(session.sessionToken, {
+                onTokenRotated: (newToken) => {
+                  rotated = newToken;
+                }
+              });
+            } catch {
+            }
           }
           if (config.onLogout) {
             await config.onLogout();
@@ -1239,6 +1295,7 @@ function createAuthRoutes(config = {}) {
         case "resend-verification": {
           const { email } = body;
           const session = await getSession();
+          let rotated = null;
           if (email) {
             try {
               await sm.auth.resendVerification(email);
@@ -1256,7 +1313,11 @@ function createAuthRoutes(config = {}) {
             return errorResponse("UNAUTHORIZED", "Email or session required", 401);
           }
           try {
-            await sm.auth.resendVerification(session.sessionToken);
+            await sm.auth.resendVerification(session.sessionToken, {
+              onTokenRotated: (newToken) => {
+                rotated = newToken;
+              }
+            });
           } catch (err) {
             const apiErr = err instanceof ScaleMuleApiError ? err : null;
             return errorResponse(
@@ -1265,6 +1326,14 @@ function createAuthRoutes(config = {}) {
               400
             );
           }
+          if (rotated) {
+            return withRefreshedSession(
+              rotated,
+              session.userId,
+              { success: true, data: { message: "Verification email sent" } },
+              cookieOptions
+            );
+          }
           return successResponse({ message: "Verification email sent" });
         }
         // ==================== Refresh Session ====================
@@ -1299,11 +1368,17 @@ function createAuthRoutes(config = {}) {
           if (!current_password || !new_password) {
             return errorResponse("VALIDATION_ERROR", "Current and new password required", 400);
           }
+          let rotated = null;
           try {
             await sm.user.changePassword(
               session.sessionToken,
               current_password,
-              new_password
+              new_password,
+              {
+                onTokenRotated: (newToken) => {
+                  rotated = newToken;
+                }
+              }
             );
           } catch (err) {
             const apiErr = err instanceof ScaleMuleApiError ? err : null;
@@ -1313,6 +1388,14 @@ function createAuthRoutes(config = {}) {
               400
             );
           }
+          if (rotated) {
+            return withRefreshedSession(
+              rotated,
+              session.userId,
+              { success: true, data: { message: "Password changed successfully" } },
+              cookieOptions
+            );
+          }
           return successResponse({ message: "Password changed successfully" });
         }
         // ==================== Switch Account ====================
@@ -1393,14 +1476,27 @@ function createAuthRoutes(config = {}) {
             return withNorm(errorResponse("UNAUTHORIZED", "Authentication required", 401));
           }
           let userData;
+          let rotated = null;
           try {
-            userData = await sm.auth.me(session.sessionToken);
+            userData = await sm.auth.me(session.sessionToken, {
+              onTokenRotated: (newToken) => {
+                rotated = newToken;
+              }
+            });
           } catch {
             return withNorm(clearSession(
               { error: { code: "SESSION_EXPIRED", message: "Session expired" } },
               cookieOptions
             ));
           }
+          if (rotated) {
+            return withNorm(withRefreshedSession(
+              rotated,
+              session.userId,
+              { user: userData, sessionToken: rotated, userId: session.userId },
+              cookieOptions
+            ));
+          }
           return withNorm(successResponse({ user: userData, sessionToken: session.sessionToken, userId: session.userId }));
         }
         // ==================== Get Session Status ====================
@@ -1479,8 +1575,13 @@ function createAuthRoutes(config = {}) {
           const body = await request.json().catch(() => ({}));
           const { full_name, avatar_url } = body;
           let updatedUser;
+          let rotated = null;
           try {
-            updatedUser = await sm.user.update(session.sessionToken, { full_name, avatar_url });
+            updatedUser = await sm.user.update(session.sessionToken, { full_name, avatar_url }, {
+              onTokenRotated: (newToken) => {
+                rotated = newToken;
+              }
+            });
           } catch (err) {
             const apiErr = err instanceof ScaleMuleApiError ? err : null;
             return errorResponse(
@@ -1489,6 +1590,14 @@ function createAuthRoutes(config = {}) {
               400
             );
           }
+          if (rotated) {
+            return withRefreshedSession(
+              rotated,
+              session.userId,
+              { success: true, data: { user: updatedUser } },
+              cookieOptions
+            );
+          }
           return successResponse({ user: updatedUser });
         }
         default: