@volr/react 0.1.13 → 0.1.15

package/dist/index.js

@@ -9009,6 +9009,7 @@ var safeStorage = {
 // ../shared/src/constants/storage.ts
 var STORAGE_KEYS = {
   accessToken: "volr:accessToken",
+  refreshToken: "volr:refreshToken",
   user: "volr:user",
   provider: "volr:provider",
   credentialId: "volr:credentialId",
@@ -9024,9 +9025,11 @@ var APIClient = class {
   constructor(config) {
     this.refreshPromise = null;
     this.accessToken = null;
+    this.refreshToken = null;
     this.apiKey = null;
     this.apiKey = config.apiKey || null;
     this.accessToken = safeStorage.getItem(STORAGE_KEYS.accessToken);
+    this.refreshToken = safeStorage.getItem(STORAGE_KEYS.refreshToken);
     this.api = axios.create({
       baseURL: config.baseUrl.replace(/\/+$/, ""),
       withCredentials: true,
@@ -9063,15 +9066,23 @@ var APIClient = class {
       (response) => response,
       async (error) => {
         const originalRequest = error.config;
+        console.log(`[APIClient] Response error:`, error.response?.status, originalRequest?.url);
+        if (originalRequest?.url?.includes("/auth/refresh")) {
+          console.log("[APIClient] Refresh endpoint failed, not retrying");
+          return Promise.reject(error);
+        }
         if (error.response?.status === 401 && !originalRequest._retry) {
+          console.log("[APIClient] 401 received, attempting token refresh...");
           originalRequest._retry = true;
           try {
             await this.refreshAccessToken();
             if (this.accessToken) {
               originalRequest.headers["Authorization"] = `Bearer ${this.accessToken}`;
             }
+            console.log("[APIClient] Token refreshed, retrying original request");
             return this.api(originalRequest);
           } catch (refreshError) {
+            console.error("[APIClient] Token refresh failed:", refreshError);
             return Promise.reject(refreshError);
           }
         }
@@ -9108,6 +9119,76 @@ var APIClient = class {
   getAccessToken() {
     return this.accessToken;
   }
+  /**
+   * Set refresh token
+   */
+  setRefreshToken(token) {
+    this.refreshToken = token;
+    if (token) {
+      safeStorage.setItem(STORAGE_KEYS.refreshToken, token);
+    } else {
+      safeStorage.removeItem(STORAGE_KEYS.refreshToken);
+    }
+  }
+  /**
+   * Get refresh token
+   */
+  getRefreshToken() {
+    return this.refreshToken;
+  }
+  /**
+   * Ensure access token is valid, refresh if missing or expired
+   * Use this before making authenticated requests that need a valid token upfront
+   * Note: Most requests don't need this as the 401 interceptor handles refresh automatically
+   */
+  async ensureAccessToken() {
+    if (this.accessToken) {
+      return;
+    }
+    if (!this.refreshToken) {
+      return;
+    }
+    try {
+      await this.refreshAccessToken();
+    } catch {
+    }
+  }
+  /**
+   * Refresh session and return user data
+   * Use this when you need fresh user data (e.g., before passkey restoration)
+   * @param timeoutMs - Timeout in milliseconds (default: 10000)
+   * @returns User data from refresh response, or null if refresh fails
+   */
+  async refreshSession(timeoutMs = 1e4) {
+    if (!this.refreshToken) {
+      throw new Error("No refresh token available. Please log in again.");
+    }
+    const timeoutPromise = new Promise(
+      (_, reject) => setTimeout(
+        () => reject(new Error("Session refresh timeout. Please check your network connection.")),
+        timeoutMs
+      )
+    );
+    const refreshPromise = this.api.post(
+      "/auth/refresh",
+      { refreshToken: this.refreshToken }
+    );
+    const response = await Promise.race([refreshPromise, timeoutPromise]);
+    const data = response.data;
+    if (isErrorResponse(data)) {
+      this.setAccessToken(null);
+      this.setRefreshToken(null);
+      throw new Error(data.error.message);
+    }
+    this.setAccessToken(data.data.accessToken);
+    if (data.data.refreshToken) {
+      this.setRefreshToken(data.data.refreshToken);
+    }
+    if (data.data.user) {
+      safeStorage.setItem(STORAGE_KEYS.user, JSON.stringify(data.data.user));
+    }
+    return data.data.user ?? null;
+  }
   /**
    * Refresh access token (single-flight)
    */
@@ -9115,19 +9196,26 @@ var APIClient = class {
     if (this.refreshPromise) {
       return this.refreshPromise;
     }
+    if (!this.refreshToken) {
+      throw new Error("No refresh token available. Please log in again.");
+    }
     this.refreshPromise = (async () => {
       try {
         const response = await this.api.post(
           "/auth/refresh",
-          {}
+          { refreshToken: this.refreshToken }
         );
         const data = response.data;
         if (isErrorResponse(data)) {
           this.setAccessToken(null);
+          this.setRefreshToken(null);
           safeStorage.removeItem(STORAGE_KEYS.user);
           throw new Error(data.error.message);
         }
         this.setAccessToken(data.data.accessToken);
+        if (data.data.refreshToken) {
+          this.setRefreshToken(data.data.refreshToken);
+        }
         if (data.data.user) {
           safeStorage.setItem(STORAGE_KEYS.user, JSON.stringify(data.data.user));
         }
@@ -9163,6 +9251,7 @@ var APIClient = class {
    */
   async post(endpoint, body, idempotencyKey) {
     const normalizedEndpoint = endpoint.startsWith("/") ? endpoint : `/${endpoint}`;
+    console.log(`[APIClient] POST ${normalizedEndpoint}`);
     const config = {
       method: "POST",
       url: normalizedEndpoint,
@@ -9173,8 +9262,14 @@ var APIClient = class {
         "Idempotency-Key": idempotencyKey
       };
     }
-    const response = await this.api.request(config);
-    return unwrapResponse(response.data);
+    try {
+      const response = await this.api.request(config);
+      console.log(`[APIClient] POST ${normalizedEndpoint} response:`, response.data);
+      return unwrapResponse(response.data);
+    } catch (error) {
+      console.error(`[APIClient] POST ${normalizedEndpoint} error:`, error);
+      throw error;
+    }
   }
   /**
    * POST request that returns raw binary (ArrayBuffer)
@@ -9508,16 +9603,12 @@ async function restorePasskey(params) {
   );
   console.log("[restorePasskey] prfInput:", prfInput);
   console.log("[restorePasskey] Step 1: Ensuring access token is fresh...");
-  const currentToken = client.getAccessToken();
-  if (!currentToken) {
-    console.log("[restorePasskey] No access token found, calling /auth/refresh...");
-    try {
-      await client.post("/auth/refresh", {});
-      console.log("[restorePasskey] Access token refreshed successfully");
-    } catch (error) {
-      console.error("[restorePasskey] Failed to refresh access token:", error);
-      throw new Error("Failed to refresh access token. Please log in again.");
-    }
+  try {
+    await client.ensureAccessToken();
+    console.log("[restorePasskey] Access token ensured");
+  } catch (error) {
+    console.error("[restorePasskey] Failed to ensure access token:", error);
+    throw new Error("Failed to refresh access token. Please log in again.");
   }
   console.log("[restorePasskey] Step 2: Downloading blob via backend proxy for blobUrl:", blobUrl);
   const apiKey = client.getApiKey();
@@ -9629,6 +9720,9 @@ function VolrProvider({ config, children }) {
   const [accessToken, setAccessTokenState] = useState(() => {
     return client.getAccessToken();
   });
+  const [refreshToken, setRefreshTokenState] = useState(() => {
+    return client.getRefreshToken();
+  });
   const syncRef = useRef(null);
   useEffect(() => {
     syncRef.current = new SessionSync();
@@ -9644,7 +9738,9 @@ function VolrProvider({ config, children }) {
         client.setApiKey(config.projectApiKey);
       } else if (event.type === "LOGOUT") {
         client.setAccessToken(null);
+        client.setRefreshToken(null);
         setAccessTokenState(null);
+        setRefreshTokenState(null);
         setUser(null);
         setProviderState(null);
         safeStorage.removeItem(STORAGE_KEYS.user);
@@ -9673,49 +9769,16 @@ function VolrProvider({ config, children }) {
         const keyStorageType = newProvider.keyStorageType;
         setProviderState(newProvider);
         try {
-          const refreshResponse = await client.post(
-            "/auth/refresh",
-            {}
-          );
-          if (refreshResponse.user) {
-            console.log(
-              "[Provider] setProvider: User data refreshed from backend:",
-              refreshResponse.user
-            );
-            setUser(refreshResponse.user);
-            safeStorage.setItem(
-              STORAGE_KEYS.user,
-              JSON.stringify(refreshResponse.user)
-            );
+          const refreshedUser = await client.refreshSession();
+          if (refreshedUser) {
+            console.log("[Provider] setProvider: User data refreshed:", refreshedUser);
+            setUser(refreshedUser);
           } else {
-            setUser((prev) => ({
-              ...prev,
-              keyStorageType
-            }));
-            safeStorage.setItem(
-              STORAGE_KEYS.user,
-              JSON.stringify({
-                ...user,
-                keyStorageType
-              })
-            );
+            setUser((prev) => ({ ...prev, keyStorageType }));
           }
         } catch (error2) {
-          console.warn(
-            "[Provider] setProvider: Failed to refresh user data, using partial update:",
-            error2
-          );
-          setUser((prev) => ({
-            ...prev,
-            keyStorageType
-          }));
-          safeStorage.setItem(
-            STORAGE_KEYS.user,
-            JSON.stringify({
-              ...user,
-              keyStorageType
-            })
-          );
+          console.warn("[Provider] setProvider: Failed to refresh user data:", error2);
+          setUser((prev) => ({ ...prev, keyStorageType }));
         }
         safeStorage.setItem(STORAGE_KEYS.provider, keyStorageType);
         syncRef.current?.broadcast({
@@ -9740,70 +9803,38 @@ function VolrProvider({ config, children }) {
       const recover = async () => {
         try {
           setIsLoading(true);
-          const response = await client.post(
-            "/auth/refresh",
-            {}
-          );
-          console.log("[Provider] /auth/refresh response:", response);
-          const refreshedToken = client.getAccessToken();
-          if (refreshedToken) {
-            if (response.user) {
-              console.log(
-                "[Provider] Setting user from response:",
-                response.user
-              );
-              console.log("[Provider] User fields:", {
-                id: response.user.id,
-                email: response.user.email,
-                accountId: response.user.accountId,
-                evmAddress: response.user.evmAddress,
-                signerType: response.user.signerType,
-                keyStorageType: response.user.keyStorageType,
-                walletConnector: response.user.walletConnector,
-                blobUrl: response.user.blobUrl,
-                prfInput: response.user.prfInput,
-                credentialId: response.user.credentialId
-              });
-              setUser(response.user);
-              safeStorage.setItem(
-                STORAGE_KEYS.user,
-                JSON.stringify(response.user)
-              );
-              if (!REQUIRE_USER_GESTURE_TO_RESTORE) ; else {
-                if (response.user.keyStorageType === "passkey") {
-                  console.log(
-                    "[Provider] TTL=0 mode: Provider restoration deferred until transaction (requires user gesture)"
-                  );
-                  if (!response.user.blobUrl || !response.user.prfInput) {
-                    console.warn(
-                      "[Provider] Passkey user detected but missing blobUrl or prfInput. User needs to re-enroll passkey."
-                    );
-                  }
-                }
+          if (!client.getRefreshToken()) {
+            console.log("[Provider] No refresh token found, skipping auto-recover");
+            setIsLoading(false);
+            return;
+          }
+          const refreshedUser = await client.refreshSession();
+          console.log("[Provider] Session refreshed, user:", refreshedUser);
+          setAccessTokenState(client.getAccessToken());
+          setRefreshTokenState(client.getRefreshToken());
+          if (refreshedUser) {
+            setUser(refreshedUser);
+            if (!REQUIRE_USER_GESTURE_TO_RESTORE) ; else if (refreshedUser.keyStorageType === "passkey") {
+              console.log("[Provider] TTL=0 mode: Provider restoration deferred");
+              if (!refreshedUser.blobUrl || !refreshedUser.prfInput) {
+                console.warn("[Provider] Passkey user missing blobUrl or prfInput");
               }
-            } else {
-              console.log(
-                "[Provider] No user in response, loading from storage"
-              );
-              const userStr = safeStorage.getItem(STORAGE_KEYS.user);
-              if (userStr) {
-                try {
-                  const storedUser = JSON.parse(userStr);
-                  console.log(
-                    "[Provider] Loaded user from storage:",
-                    storedUser
-                  );
-                  setUser(storedUser);
-                } catch {
-                  safeStorage.removeItem(STORAGE_KEYS.user);
-                }
+            }
+          } else {
+            const userStr = safeStorage.getItem(STORAGE_KEYS.user);
+            if (userStr) {
+              try {
+                setUser(JSON.parse(userStr));
+              } catch {
+                safeStorage.removeItem(STORAGE_KEYS.user);
               }
             }
-            setAccessTokenState(refreshedToken);
           }
         } catch {
           client.setAccessToken(null);
+          client.setRefreshToken(null);
           setAccessTokenState(null);
+          setRefreshTokenState(null);
           setUser(null);
           setProviderState(null);
           safeStorage.removeItem(STORAGE_KEYS.user);
@@ -9821,12 +9852,7 @@ function VolrProvider({ config, children }) {
     async (input) => {
       try {
         setError(null);
-        if (!client.getAccessToken()) {
-          try {
-            await client.post("/auth/refresh", {});
-          } catch {
-          }
-        }
+        await client.ensureAccessToken();
         const response = await client.post(
           "/wallet/precheck",
           input
@@ -9848,12 +9874,7 @@ function VolrProvider({ config, children }) {
     async (input, opts) => {
       try {
         setError(null);
-        if (!client.getAccessToken()) {
-          try {
-            await client.post("/auth/refresh", {});
-          } catch {
-          }
-        }
+        await client.ensureAccessToken();
         const idempotencyKey = opts?.idempotencyKey ?? (typeof crypto !== "undefined" && crypto.randomUUID ? crypto.randomUUID() : `${Date.now()}-${Math.random()}`);
         const serializedInput = serializeBigIntDeep(input);
         const response = await client.post(
@@ -9878,10 +9899,14 @@ function VolrProvider({ config, children }) {
     try {
       setError(null);
       client.setAccessToken(null);
+      client.setRefreshToken(null);
+      setAccessTokenState(null);
+      setRefreshTokenState(null);
       setUser(null);
       setProviderState(null);
       safeStorage.removeItem(STORAGE_KEYS.user);
       safeStorage.removeItem(STORAGE_KEYS.accessToken);
+      safeStorage.removeItem(STORAGE_KEYS.refreshToken);
       safeStorage.removeItem(STORAGE_KEYS.provider);
       syncRef.current?.broadcast({ type: "LOGOUT" });
     } catch (err) {
@@ -9966,22 +9991,25 @@ function VolrProvider({ config, children }) {
     () => ({
       session: {
         accessToken,
-        refreshToken: null
-        // Cookie-based, opaque
+        refreshToken
       },
       refreshAccessToken: async () => {
-        await client.post("/auth/refresh", {});
-        const token = client.getAccessToken();
-        setAccessTokenState(token);
+        await client.ensureAccessToken();
+        setAccessTokenState(client.getAccessToken());
+        setRefreshTokenState(client.getRefreshToken());
       },
       setAccessToken: (token) => {
         client.setAccessToken(token);
         setAccessTokenState(token);
       },
+      setRefreshToken: (token) => {
+        client.setRefreshToken(token);
+        setRefreshTokenState(token);
+      },
       client
       // Expose APIClient instance
     }),
-    [client, accessToken]
+    [client, accessToken, refreshToken]
   );
   return /* @__PURE__ */ jsx(VolrContext.Provider, { value: publicValue, children: /* @__PURE__ */ jsx(InternalAuthContext.Provider, { value: internalValue, children }) });
 }
@@ -17869,15 +17897,20 @@ var CACHE_TTL_MS = 5 * 60 * 1e3;
 function createGetRpcUrl(deps) {
   const { client, rpcOverrides } = deps;
   return async function getRpcUrl(chainId) {
+    console.log("[getRpcUrl] Getting RPC URL for chainId:", chainId);
     const overrideUrl = rpcOverrides?.[chainId.toString()];
     if (overrideUrl) {
+      console.log("[getRpcUrl] Using override URL");
       return overrideUrl;
     }
     const cached = networkCache.get(chainId);
     if (cached && cached.rpcUrl && Date.now() - cached.timestamp < CACHE_TTL_MS) {
+      console.log("[getRpcUrl] Using cached URL");
       return cached.rpcUrl;
     }
+    console.log("[getRpcUrl] Fetching from backend API...");
     const response = await client.get(`/networks/${chainId}?includeRpcUrl=true`);
+    console.log("[getRpcUrl] Backend response received");
     if (!response.rpcUrl) {
       throw new Error(
         `RPC URL not available for chainId ${chainId}. Please provide it in config.rpcOverrides[${chainId}]`
@@ -17888,6 +17921,7 @@ function createGetRpcUrl(deps) {
       name: response.name,
       timestamp: Date.now()
     });
+    console.log("[getRpcUrl] RPC URL fetched and cached");
     return response.rpcUrl;
   };
 }
@@ -18210,31 +18244,39 @@ async function pollTransactionStatus(txId, client, maxAttempts = 60, intervalMs
 
 // src/wallet/sender.ts
 async function sendCalls(args) {
+  console.log("[sendCalls] Starting sendCalls...");
   const { chainId, from: from14, calls, opts, deps } = args;
   if (chainId === 0) {
     throw new Error("chainId cannot be 0");
   }
+  console.log("[sendCalls] Normalizing calls...");
   const normalizedFrom = from14;
   const normalizedCalls = normalizeCalls(calls);
   validateCalls2(normalizedCalls);
+  console.log("[sendCalls] Calls normalized");
   let currentUser = deps.user;
   if (deps.user?.keyStorageType === "passkey" && !deps.provider) {
+    console.log("[sendCalls] Refreshing user data (provider not available)...");
     try {
-      const refreshResponse = await deps.client.post(
-        "/auth/refresh",
-        {}
-      );
-      if (refreshResponse.user) {
-        currentUser = refreshResponse.user;
+      const refreshedUser = await deps.client.refreshSession();
+      if (refreshedUser) {
+        currentUser = refreshedUser;
+        console.log("[sendCalls] User data refreshed successfully");
       }
     } catch (error) {
-      console.warn(
-        "[sendCalls] Failed to refresh user data before transaction:",
-        error
+      console.error("[sendCalls] Failed to refresh session:", error);
+      throw new Error(
+        `Failed to refresh session before transaction. ${error instanceof Error ? error.message : "Unknown error"}. Please try logging in again.`
       );
     }
+  } else {
+    console.log("[sendCalls] Skipping user refresh:", {
+      hasProvider: !!deps.provider,
+      keyStorageType: deps.user?.keyStorageType
+    });
   }
   if (opts.preflight !== false) {
+    console.log("[sendCalls] Running preflight estimate...");
     const tolerateFundingErrors = (opts.mode ?? "sponsored") !== "self";
     await preflightEstimate(
       deps.publicClient,
@@ -18242,7 +18284,11 @@ async function sendCalls(args) {
       normalizedCalls,
       { tolerateFundingErrors }
     );
+    console.log("[sendCalls] Preflight estimate done");
+  } else {
+    console.log("[sendCalls] Preflight skipped");
   }
+  console.log("[sendCalls] Building temp auth for first precheck...");
   const tempAuthForPrecheck = buildTempAuth({
     chainId,
     from: normalizedFrom,
@@ -18252,11 +18298,14 @@ async function sendCalls(args) {
   });
   let precheckQuote;
   try {
+    console.log("[sendCalls] Running first precheck...");
     precheckQuote = await deps.precheck({
       auth: tempAuthForPrecheck,
       calls: normalizedCalls
     });
+    console.log("[sendCalls] First precheck done, policyId:", precheckQuote.policyId);
   } catch (err) {
+    console.error("[sendCalls] First precheck failed:", err);
     throw err instanceof Error ? err : new Error(String(err));
   }
   const quotePolicyId = precheckQuote.policyId;
@@ -18265,6 +18314,7 @@ async function sendCalls(args) {
   }
   const projectPolicyId = quotePolicyId;
   validatePolicyId2(projectPolicyId);
+  console.log("[sendCalls] Building temp auth for second precheck...");
   const tempAuth = buildTempAuth({
     chainId,
     from: normalizedFrom,
@@ -18274,15 +18324,19 @@ async function sendCalls(args) {
   });
   let quote;
   try {
+    console.log("[sendCalls] Running second precheck...");
     quote = await deps.precheck({ auth: tempAuth, calls: normalizedCalls });
+    console.log("[sendCalls] Second precheck done");
   } catch (err) {
-    console.warn("[useVolrWallet] Precheck failed:", err);
+    console.warn("[sendCalls] Second precheck failed:", err);
   }
+  console.log("[sendCalls] Finalizing auth with nonce...");
   const auth = finalizeAuthWithNonce(tempAuth, quote);
   const idempotencyKey = opts.idempotencyKey ?? defaultIdempotencyKey();
   let signer;
   let activeProvider = null;
   try {
+    console.log("[sendCalls] Resolving signer...");
     const resolved = await resolveSigner({
       explicitSigner: void 0,
       // Always resolve internally
@@ -18294,13 +18348,16 @@ async function sendCalls(args) {
     });
     signer = resolved.signer;
     activeProvider = resolved.activeProvider;
+    console.log("[sendCalls] Signer resolved");
+    console.log("[sendCalls] Calling relay...");
     const result = await deps.relay(
       { chainId, from: normalizedFrom, auth, calls: normalizedCalls },
       { signer, rpcClient: deps.rpcClient, idempotencyKey }
     );
+    console.log("[sendCalls] Relay result:", result.status, result.txId);
     if (result.status === "QUEUED" || result.status === "PENDING") {
       console.log(
-        `[useVolrWallet] Transaction ${result.txId} is ${result.status}, starting polling...`
+        `[sendCalls] Transaction ${result.txId} is ${result.status}, starting polling...`
       );
       return pollTransactionStatus(result.txId, deps.client);
     }
@@ -18334,11 +18391,14 @@ function useVolrWallet() {
       let extendedRpcClient = null;
       const ensureRpcClient = async () => {
         if (!publicClient) {
+          console.log("[ensureRpcClient] Getting RPC URL for chainId:", chainId);
           const rpcUrl = await getRpcUrl(chainId);
+          console.log("[ensureRpcClient] Got RPC URL:", rpcUrl);
           publicClient = createPublicClient({
             transport: http(rpcUrl)
           });
           extendedRpcClient = createExtendedRPCClient(publicClient);
+          console.log("[ensureRpcClient] Public client created");
         }
         return { publicClient, extendedRpcClient };
       };
@@ -18379,8 +18439,12 @@ function useVolrWallet() {
           });
         },
         sendBatch: (async (calls, opts) => {
+          console.log("[sendBatch] Starting sendBatch...", { chainId, callsCount: calls.length });
+          console.log("[sendBatch] Ensuring RPC client...");
           const { publicClient: publicClient2, extendedRpcClient: rpcClient } = await ensureRpcClient();
+          console.log("[sendBatch] RPC client ready");
           const from14 = opts.from ?? user?.evmAddress;
+          console.log("[sendBatch] From address:", from14);
           if (!from14) {
             throw new Error(
               "from address is required. Provide it in opts.from or set user.evmAddress in VolrProvider. If you haven't set up a wallet provider yet, please complete the onboarding flow."
@@ -18389,7 +18453,10 @@ function useVolrWallet() {
           const isCallArray = (calls2) => {
             return Array.isArray(calls2) && calls2.length > 0 && "data" in calls2[0] && !("abi" in calls2[0]);
           };
+          console.log("[sendBatch] Building calls...");
           const builtCalls = isCallArray(calls) ? calls : buildCalls(calls);
+          console.log("[sendBatch] Calls built:", builtCalls.length);
+          console.log("[sendBatch] Calling sendCalls...");
           return sendCalls({
             chainId,
             from: getAddress(from14),
@@ -18452,7 +18519,7 @@ function createAxiosInstance(baseUrl, apiKey) {
 // src/hooks/useVolrLogin.ts
 function useVolrLogin() {
   const { config, setUser } = useVolr();
-  const { setAccessToken } = useInternalAuth();
+  const { setAccessToken, setRefreshToken } = useInternalAuth();
   const toVolrUser = useCallback((u) => {
     return {
       id: u.id,
@@ -18514,12 +18581,16 @@ function useVolrLogin() {
       const userFromServer = verifyData?.data?.user;
       const isNewUser = !!verifyData?.data?.isNewUser;
       const accessToken = verifyData?.data?.accessToken || "";
+      const refreshToken = verifyData?.data?.refreshToken || "";
       if (!accessToken) {
         throw new Error(
           "Access token is required but was not provided by the server"
         );
       }
       setAccessToken(accessToken);
+      if (refreshToken) {
+        setRefreshToken(refreshToken);
+      }
       if (userFromServer) {
         setUser(toVolrUser(userFromServer));
       } else {
@@ -18533,7 +18604,7 @@ function useVolrLogin() {
         accessToken
       };
     },
-    [api, setAccessToken, setUser, toVolrUser]
+    [api, setAccessToken, setRefreshToken, setUser, toVolrUser]
   );
   const handleSocialLogin = useCallback(
     async (provider) => {
@@ -18575,12 +18646,16 @@ function useVolrLogin() {
         const userFromServer = verifyData?.data?.user;
         const isNewUser = !!verifyData?.data?.isNewUser;
         const accessToken = verifyData?.data?.accessToken || "";
+        const refreshToken = verifyData?.data?.refreshToken || "";
         if (!accessToken) {
           throw new Error(
             "Access token is required but was not provided by the server"
           );
         }
         setAccessToken(accessToken);
+        if (refreshToken) {
+          setRefreshToken(refreshToken);
+        }
         if (userFromServer) {
           setUser(toVolrUser(userFromServer));
         }
@@ -18600,7 +18675,7 @@ function useVolrLogin() {
         throw error;
       }
     },
-    [api, setAccessToken, setUser, toVolrUser]
+    [api, setAccessToken, setRefreshToken, setUser, toVolrUser]
   );
   const handlePasskeyComplete = useCallback(async () => {
   }, []);
@@ -18615,7 +18690,7 @@ function useVolrLogin() {
 }
 function useVolrAuthCallback(options = {}) {
   const { config, setUser } = useVolr();
-  const { refreshAccessToken, setAccessToken } = useInternalAuth();
+  const { refreshAccessToken, setAccessToken, setRefreshToken, client } = useInternalAuth();
   const [isLoading, setIsLoading] = useState(true);
   const [error, setError] = useState(null);
   const [isNewUser, setIsNewUser] = useState(false);
@@ -18669,13 +18744,21 @@ function useVolrAuthCallback(options = {}) {
         if (!userRes.data?.ok) {
           throw new Error("Failed to fetch user details");
         }
-        const refreshRes = await api.post("/auth/refresh");
+        const currentRefreshToken = client.getRefreshToken();
+        if (!currentRefreshToken) {
+          throw new Error("No refresh token available. Please log in again.");
+        }
+        const refreshRes = await api.post("/auth/refresh", { refreshToken: currentRefreshToken });
         if (!refreshRes.data?.ok) {
           throw new Error("Failed to refresh session");
         }
         const userData = refreshRes.data.data.user;
         const accessToken = refreshRes.data.data.accessToken;
+        const newRefreshToken = refreshRes.data.data.refreshToken;
         setAccessToken(accessToken);
+        if (newRefreshToken) {
+          setRefreshToken(newRefreshToken);
+        }
         const volrUser = toVolrUser(userData);
         setUser(volrUser);
         setLocalUser(volrUser);
@@ -18690,7 +18773,7 @@ function useVolrAuthCallback(options = {}) {
       }
     };
     handleCallback();
-  }, [apiBaseUrl, config.projectApiKey, refreshAccessToken, setAccessToken, setUser, toVolrUser]);
+  }, [apiBaseUrl, config.projectApiKey, refreshAccessToken, setAccessToken, setRefreshToken, setUser, toVolrUser, client]);
   return {
     isLoading,
     error,