@asgardeo/nextjs 0.3.9 → 0.3.11

package/dist/esm/utils/SessionManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"SessionManager.js","sourceRoot":"","sources":["../../../src/utils/SessionManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,oBAAoB,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAC,OAAO,EAAE,SAAS,EAAa,MAAM,MAAM,CAAC;AAoBpD;;GAEG;AACH,MAAM,cAAc;IACV,MAAM,CAAU,sBAAsB,GAAW,IAAI,CAAC;IAE9D;;;OAGG;IACK,MAAM,CAAC,SAAS;QACtB,MAAM,MAAM,GAAuB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAElE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;gBAC7C,MAAM,IAAI,oBAAoB,CAC5B,gEAAgE,EAChE,yBAAyB,EACzB,QAAQ,EACR,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YACD,oDAAoD;YACpD,sCAAsC;YACtC,OAAO,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;YAC1F,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,uCAAuC,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QAC9C,MAAM,MAAM,GAAe,IAAI,CAAC,SAAS,EAAE,CAAC;QAE5C,MAAM,GAAG,GAAW,MAAM,IAAI,OAAO,CAAC;YACpC,SAAS;YACT,IAAI,EAAE,MAAM;SACb,CAAC;aACC,kBAAkB,CAAC,EAAC,GAAG,EAAE,OAAO,EAAC,CAAC;aAClC,WAAW,EAAE;aACb,iBAAiB,CAAC,KAAK,CAAC;aACxB,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhB,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAC7B,WAAmB,EACnB,MAAc,EACd,SAAiB,EACjB,MAAc,EACd,cAAuB,EACvB,gBAAwB,IAAI,CAAC,sBAAsB;QAEnD,MAAM,MAAM,GAAe,IAAI,CAAC,SAAS,EAAE,CAAC;QAE5C,MAAM,GAAG,GAAW,MAAM,IAAI,OAAO,CAAC;YACpC,WAAW;YACX,cAAc;YACd,MAAM;YACN,SAAS;YACT,IAAI,EAAE,SAAS;SACoC,CAAC;aACnD,kBAAkB,CAAC,EAAC,GAAG,EAAE,OAAO,EAAC,CAAC;aAClC,UAAU,CAAC,MAAM,CAAC;aAClB,WAAW,EAAE;aACb,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,aAAa,CAAC;aACpD,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhB,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAa;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAe,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,EAAC,OAAO,EAAC,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAEjD,OAAO,OAA8B,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,EACpF,uBAAuB,EACvB,QAAQ,EACR,mCAAmC,CACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAa;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,GAAe,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,EAAC,OAAO,EAAC,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAEjD,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,OAAO,EAAC,SAAS,EAAE,OAAO,CAAC,WAAW,CAAW,EAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,oBAAoB,CAC5B,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,EAC9F,4BAA4B,EAC5B,QAAQ,EACR,6CAA6C,CAC9C,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,uBAAuB;QAO5B,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI,CAAC,sBAAsB;YACnC,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,KAAc;YACxB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;SACjD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,2BAA2B;QAOhC,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE,GAAG,EAAE;YACf,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,KAAc;YACxB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;SACjD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,oBAAoB;QACzB,OAAO,YAAY,CAAC,mBAAmB,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,wBAAwB;QAC7B,OAAO,YAAY,CAAC,wBAAwB,CAAC;IAC/C,CAAC;;AAGH,eAAe,cAAc,CAAC"}
+{"version":3,"file":"SessionManager.js","sourceRoot":"","sources":["../../../src/utils/SessionManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,oBAAoB,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAa,MAAM,MAAM,CAAC;AACnE,OAAO,EAAC,kCAAkC,EAAC,MAAM,+BAA+B,CAAC;AAwBjF;;GAEG;AACH,MAAM,cAAc;IAClB;;;OAGG;IACK,MAAM,CAAC,SAAS;QACtB,MAAM,MAAM,GAAuB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAElE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;gBAC7C,MAAM,IAAI,oBAAoB,CAC5B,gEAAgE,EAChE,yBAAyB,EACzB,QAAQ,EACR,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YACD,oDAAoD;YACpD,sCAAsC;YACtC,OAAO,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;YAC1F,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,uCAAuC,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QAC9C,MAAM,MAAM,GAAe,IAAI,CAAC,SAAS,EAAE,CAAC;QAE5C,MAAM,GAAG,GAAW,MAAM,IAAI,OAAO,CAAC;YACpC,SAAS;YACT,IAAI,EAAE,MAAM;SACb,CAAC;aACC,kBAAkB,CAAC,EAAC,GAAG,EAAE,OAAO,EAAC,CAAC;aAClC,WAAW,EAAE;aACb,iBAAiB,CAAC,KAAK,CAAC;aACxB,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhB,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,0BAA0B,CAAC,gBAAyB;QACzD,IAAI,gBAAgB,IAAI,IAAI,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;YACrD,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,QAAQ,GAAuB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QAExF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAW,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAE9C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,OAAO,kCAAkC,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAC7B,WAAmB,EACnB,MAAc,EACd,SAAiB,EACjB,MAAc,EACd,qBAA6B,EAC7B,YAAoB,EACpB,cAAuB;QAEvB,MAAM,MAAM,GAAe,IAAI,CAAC,SAAS,EAAE,CAAC;QAE5C,MAAM,GAAG,GAAW,MAAM,IAAI,OAAO,CAAC;YACpC,WAAW;YACX,cAAc;YACd,YAAY;YACZ,MAAM;YACN,SAAS;YACT,IAAI,EAAE,SAAS;SACoC,CAAC;aACnD,kBAAkB,CAAC,EAAC,GAAG,EAAE,OAAO,EAAC,CAAC;aAClC,UAAU,CAAC,MAAM,CAAC;aAClB,WAAW,EAAE;aACb,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,qBAAqB,CAAC;aACxE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhB,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAa;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAe,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,EAAC,OAAO,EAAC,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAEjD,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,OAAO,OAA8B,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,EACpF,uBAAuB,EACvB,QAAQ,EACR,mCAAmC,CACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,KAAa;QACrD,IAAI,CAAC;YACH,MAAM,MAAM,GAAe,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,EAAC,OAAO,EAAE,UAAU,EAAC,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACjE,MAAM,OAAO,GAAwB,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAwB,CAAC;YAE7G,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,EACpF,mCAAmC,EACnC,QAAQ,EACR,6DAA6D,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAa;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,GAAe,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,EAAC,OAAO,EAAC,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAEjD,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,OAAO,EAAC,SAAS,EAAE,OAAO,CAAC,WAAW,CAAW,EAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,oBAAoB,CAC5B,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,EAC9F,4BAA4B,EAC5B,QAAQ,EACR,6CAA6C,CAC9C,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAc;QAO3C,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,MAAM;YACN,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,KAAc;YACxB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;SACjD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,2BAA2B;QAOhC,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE,GAAG,EAAE;YACf,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,KAAc;YACxB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;SACjD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,oBAAoB;QACzB,OAAO,YAAY,CAAC,mBAAmB,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,wBAAwB;QAC7B,OAAO,YAAY,CAAC,wBAAwB,CAAC;IAC/C,CAAC;CACF;AAED,eAAe,cAAc,CAAC"}

package/dist/esm/utils/decorateConfigWithNextEnv.js

@@ -16,7 +16,7 @@
  * under the License.
  */
 const decorateConfigWithNextEnv = (config) => {
-    const { organizationHandle, scopes, applicationId, baseUrl, clientId, clientSecret, signInUrl, signUpUrl, afterSignInUrl, afterSignOutUrl, ...rest } = config;
+    const { organizationHandle, scopes, applicationId, baseUrl, clientId, clientSecret, signInUrl, signUpUrl, afterSignInUrl, afterSignOutUrl, sessionCookieExpiryTime, ...rest } = config;
     return {
         ...rest,
         afterSignInUrl: afterSignInUrl || process.env['NEXT_PUBLIC_ASGARDEO_AFTER_SIGN_IN_URL'],
@@ -27,6 +27,10 @@ const decorateConfigWithNextEnv = (config) => {
         clientSecret: clientSecret || process.env['ASGARDEO_CLIENT_SECRET'],
         organizationHandle: organizationHandle || process.env['NEXT_PUBLIC_ASGARDEO_ORGANIZATION_HANDLE'],
         scopes: scopes || process.env['NEXT_PUBLIC_ASGARDEO_SCOPES'],
+        sessionCookieExpiryTime: sessionCookieExpiryTime ||
+            (process.env['ASGARDEO_SESSION_COOKIE_EXPIRY_TIME']
+                ? parseInt(process.env['ASGARDEO_SESSION_COOKIE_EXPIRY_TIME'], 10)
+                : undefined),
         signInUrl: signInUrl || process.env['NEXT_PUBLIC_ASGARDEO_SIGN_IN_URL'],
         signUpUrl: signUpUrl || process.env['NEXT_PUBLIC_ASGARDEO_SIGN_UP_URL'],
     };

package/dist/esm/utils/decorateConfigWithNextEnv.js.map

@@ -1 +1 @@
-{"version":3,"file":"decorateConfigWithNextEnv.js","sourceRoot":"","sources":["../../../src/utils/decorateConfigWithNextEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,MAAM,yBAAyB,GAAG,CAAC,MAA0B,EAAsB,EAAE;IACnF,MAAM,EACJ,kBAAkB,EAClB,MAAM,EACN,aAAa,EACb,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,SAAS,EACT,cAAc,EACd,eAAe,EACf,GAAG,IAAI,EACR,GAAG,MAAM,CAAC;IAEX,OAAO;QACL,GAAG,IAAI;QACP,cAAc,EAAE,cAAc,IAAK,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAY;QACnG,eAAe,EAAE,eAAe,IAAK,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAY;QACtG,aAAa,EAAE,aAAa,IAAK,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAY;QAC9F,OAAO,EAAE,OAAO,IAAK,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAY;QAC5E,QAAQ,EAAE,QAAQ,IAAK,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAY;QAC/E,YAAY,EAAE,YAAY,IAAK,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAY;QAC/E,kBAAkB,EAAE,kBAAkB,IAAK,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAY;QAC7G,MAAM,EAAE,MAAM,IAAK,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAY;QACxE,SAAS,EAAE,SAAS,IAAK,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAY;QACnF,SAAS,EAAE,SAAS,IAAK,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAY;KACpF,CAAC;AACJ,CAAC,CAAC;AAEF,eAAe,yBAAyB,CAAC"}
+{"version":3,"file":"decorateConfigWithNextEnv.js","sourceRoot":"","sources":["../../../src/utils/decorateConfigWithNextEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,MAAM,yBAAyB,GAAG,CAAC,MAA0B,EAAsB,EAAE;IACnF,MAAM,EACJ,kBAAkB,EAClB,MAAM,EACN,aAAa,EACb,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,SAAS,EACT,cAAc,EACd,eAAe,EACf,uBAAuB,EACvB,GAAG,IAAI,EACR,GAAG,MAAM,CAAC;IAEX,OAAO;QACL,GAAG,IAAI;QACP,cAAc,EAAE,cAAc,IAAK,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAY;QACnG,eAAe,EAAE,eAAe,IAAK,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAY;QACtG,aAAa,EAAE,aAAa,IAAK,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAY;QAC9F,OAAO,EAAE,OAAO,IAAK,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAY;QAC5E,QAAQ,EAAE,QAAQ,IAAK,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAY;QAC/E,YAAY,EAAE,YAAY,IAAK,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAY;QAC/E,kBAAkB,EAAE,kBAAkB,IAAK,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAY;QAC7G,MAAM,EAAE,MAAM,IAAK,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAY;QACxE,uBAAuB,EACrB,uBAAuB;YACvB,CAAC,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC;gBACjD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,EAAE,EAAE,CAAC;gBAClE,CAAC,CAAC,SAAS,CAAC;QAChB,SAAS,EAAE,SAAS,IAAK,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAY;QACnF,SAAS,EAAE,SAAS,IAAK,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAY;KACpF,CAAC;AACJ,CAAC,CAAC;AAEF,eAAe,yBAAyB,CAAC"}

package/dist/esm/utils/handleRefreshToken.js

@@ -0,0 +1,82 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import SessionManager from './SessionManager';
+/**
+ * Handles the OAuth refresh_token grant and builds a new session JWT string.
+ *
+ * Intentionally decoupled from cookie APIs so it can be called from both the Edge
+ * Runtime (Next.js middleware) and the Node.js Runtime (server actions).
+ * Cookie persistence is the caller's responsibility.
+ */
+const handleRefreshToken = async (sessionPayload, config) => {
+    const { baseUrl, clientId, clientSecret, sessionCookieExpiryTime: configuredExpiry } = config;
+    const { refreshToken: storedRefreshToken, sessionId, sub, scopes, organizationId } = sessionPayload;
+    if (!storedRefreshToken) {
+        throw new Error('No refresh token found in session payload.');
+    }
+    const tokenEndpoint = `${baseUrl}/oauth2/token`;
+    const body = new URLSearchParams({
+        client_id: clientId ?? '',
+        client_secret: clientSecret ?? '',
+        grant_type: 'refresh_token',
+        refresh_token: storedRefreshToken,
+    });
+    let response;
+    try {
+        response = await fetch(tokenEndpoint, {
+            body: body.toString(),
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            method: 'POST',
+        });
+    }
+    catch (fetchError) {
+        throw new Error(`Token refresh network error: ${fetchError instanceof Error ? fetchError.message : String(fetchError)}`);
+    }
+    if (!response.ok) {
+        throw new Error(`Token endpoint rejected refresh (HTTP ${response.status}).`);
+    }
+    let tokenData;
+    try {
+        tokenData = (await response.json());
+    }
+    catch {
+        throw new Error('Failed to parse token endpoint response as JSON.');
+    }
+    const newAccessToken = tokenData['access_token'];
+    const expiresIn = tokenData['expires_in'];
+    // Use the rotated refresh token if the server provided one; otherwise keep the existing one.
+    const newRefreshToken = tokenData['refresh_token'] ?? storedRefreshToken;
+    const newScopes = tokenData['scope'] ?? (Array.isArray(scopes) ? scopes.join(' ') : scopes ?? '');
+    const resolvedSessionCookieExpiry = SessionManager.resolveSessionCookieExpiry(configuredExpiry);
+    const newSessionToken = await SessionManager.createSessionToken(newAccessToken, sub, sessionId, newScopes, expiresIn, newRefreshToken, organizationId);
+    return {
+        newSessionToken,
+        sessionCookieExpiryTime: resolvedSessionCookieExpiry,
+        tokenResponse: {
+            accessToken: newAccessToken,
+            createdAt: Math.floor(Date.now() / 1000),
+            expiresIn: String(expiresIn),
+            idToken: tokenData['id_token'] ?? '',
+            refreshToken: newRefreshToken,
+            scope: newScopes,
+            tokenType: tokenData['token_type'] ?? 'Bearer',
+        },
+    };
+};
+export default handleRefreshToken;
+//# sourceMappingURL=handleRefreshToken.js.map

package/dist/esm/utils/handleRefreshToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handleRefreshToken.js","sourceRoot":"","sources":["../../../src/utils/handleRefreshToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,cAAqC,MAAM,kBAAkB,CAAC;AAsBrE;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,KAAK,EAC9B,cAAmC,EACnC,MAAgC,EACG,EAAE;IACrC,MAAM,EAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,uBAAuB,EAAE,gBAAgB,EAAC,GAAG,MAAM,CAAC;IAC5F,MAAM,EAAC,YAAY,EAAE,kBAAkB,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAC,GAAG,cAAc,CAAC;IAElG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,aAAa,GAAW,GAAG,OAAO,eAAe,CAAC;IACxD,MAAM,IAAI,GAAoB,IAAI,eAAe,CAAC;QAChD,SAAS,EAAE,QAAQ,IAAI,EAAE;QACzB,aAAa,EAAE,YAAY,IAAI,EAAE;QACjC,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,kBAAkB;KAClC,CAAC,CAAC;IAEH,IAAI,QAAkB,CAAC;IAEvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;YACpC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,OAAO,EAAE,EAAC,cAAc,EAAE,mCAAmC,EAAC;YAC9D,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,UAAU,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,gCAAgC,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CACxG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,SAAkC,CAAC;IAEvC,IAAI,CAAC;QACH,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,cAAc,GAAW,SAAS,CAAC,cAAc,CAAW,CAAC;IACnE,MAAM,SAAS,GAAW,SAAS,CAAC,YAAY,CAAW,CAAC;IAC5D,6FAA6F;IAC7F,MAAM,eAAe,GAAY,SAAS,CAAC,eAAe,CAAwB,IAAI,kBAAkB,CAAC;IACzG,MAAM,SAAS,GACZ,SAAS,CAAC,OAAO,CAAwB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,MAAiB,IAAI,EAAE,CAAC,CAAC;IAEtH,MAAM,2BAA2B,GAAW,cAAc,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;IAExG,MAAM,eAAe,GAAW,MAAM,cAAc,CAAC,kBAAkB,CACrE,cAAc,EACd,GAAa,EACb,SAAS,EACT,SAAS,EACT,SAAS,EACT,eAAe,EACf,cAAc,CACf,CAAC;IAEF,OAAO;QACL,eAAe;QACf,uBAAuB,EAAE,2BAA2B;QACpD,aAAa,EAAE;YACb,WAAW,EAAE,cAAc;YAC3B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACxC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;YAC5B,OAAO,EAAG,SAAS,CAAC,UAAU,CAAwB,IAAI,EAAE;YAC5D,YAAY,EAAE,eAAe;YAC7B,KAAK,EAAE,SAAS;YAChB,SAAS,EAAG,SAAS,CAAC,YAAY,CAAwB,IAAI,QAAQ;SACvE;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,eAAe,kBAAkB,CAAC"}

package/dist/types/client/contexts/Asgardeo/AsgardeoContext.d.ts

@@ -17,10 +17,14 @@
  */
 import { AsgardeoContextProps as AsgardeoReactContextProps } from '@asgardeo/react';
 import { Context } from 'react';
+import { RefreshResult } from '../../../server/actions/refreshToken';
 /**
  * Props interface of {@link AsgardeoContext}
  */
-export type AsgardeoContextProps = Partial<AsgardeoReactContextProps>;
+export type AsgardeoContextProps = Partial<AsgardeoReactContextProps> & {
+    clearSession?: () => Promise<void>;
+    refreshToken?: () => Promise<RefreshResult>;
+};
 /**
  * Context object for managing the Authentication flow builder core context.
  */

package/dist/types/client/contexts/Asgardeo/AsgardeoProvider.d.ts

@@ -19,12 +19,14 @@ import { AllOrganizationsApiResponse, Organization, UpdateMeProfileConfig, User,
 import { AsgardeoProviderProps } from '@asgardeo/react';
 import { FC, PropsWithChildren } from 'react';
 import { AsgardeoContextProps } from './AsgardeoContext';
+import { RefreshResult } from '../../../server/actions/refreshToken';
 /**
  * Props interface of {@link AsgardeoClientProvider}
  */
 export type AsgardeoClientProviderProps = Partial<Omit<AsgardeoProviderProps, 'baseUrl' | 'clientId'>> & Pick<AsgardeoProviderProps, 'baseUrl' | 'clientId'> & {
     applicationId: AsgardeoContextProps['applicationId'];
     brandingPreference?: BrandingPreference | null;
+    clearSession: () => Promise<void>;
     createOrganization: (payload: CreateOrganizationPayload, sessionId: string) => Promise<Organization>;
     currentOrganization: Organization;
     getAllOrganizations: (options?: any, sessionId?: string) => Promise<AllOrganizationsApiResponse>;
@@ -36,6 +38,7 @@ export type AsgardeoClientProviderProps = Partial<Omit<AsgardeoProviderProps, 'b
     isSignedIn: boolean;
     myOrganizations: Organization[];
     organizationHandle: AsgardeoContextProps['organizationHandle'];
+    refreshToken: () => Promise<RefreshResult>;
     revalidateMyOrganizations?: (sessionId?: string) => Promise<Organization[]>;
     signIn: AsgardeoContextProps['signIn'];
     signOut: AsgardeoContextProps['signOut'];

package/dist/types/constants/sessionConstants.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * Number of seconds before access token expiry at which the SDK proactively
+ * refreshes the token. A 25-second buffer prevents races where the token is
+ * valid when a request starts but expires mid-flight.
+ */
+export declare const REFRESH_BUFFER_SECONDS: number;
+/**
+ * Default session cookie lifetime in seconds (24 hours).
+ *
+ * Used when no explicit session cookie expiry is configured. The session cookie
+ * lifetime can be overridden in two ways (evaluated in this order):
+ *
+ *   1. `sessionCookieExpiryTime` in `AsgardeoNodeConfig` — set programmatically
+ *      when initialising the SDK.
+ *   2. `ASGARDEO_SESSION_COOKIE_EXPIRY_TIME` environment variable — set in `.env`
+ *      (e.g. `ASGARDEO_SESSION_COOKIE_EXPIRY_TIME=86400`).
+ *   3. This constant — applied when neither of the above is present.
+ *
+ * Two independent expiry bounds apply to the session and they are generally
+ * NOT the same value:
+ *
+ *   - JWT `exp` claim — set by `SessionManager.createSessionToken(...)` from
+ *     the `accessTokenTtlSeconds` argument (i.e. the access token's `expires_in`
+ *     returned by the auth server, typically ~1 hour). This controls when
+ *     `verifySessionToken` rejects the token and is the trigger for a refresh.
+ *   - Browser cookie `maxAge` — set by the caller (sign-in / refresh / org-switch
+ *     actions) from `SessionManager.resolveSessionCookieExpiry(...)`, which returns
+ *     this constant by default (24 hours). This controls how long the browser
+ *     holds the cookie before discarding it.
+ */
+export declare const DEFAULT_SESSION_COOKIE_EXPIRY_TIME: number;

package/dist/types/middleware.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * Edge Runtime entry point — safe for use in Next.js middleware.ts.
+ *
+ * This file must only import modules whose full transitive dependency graph
+ * contains zero Node.js-only APIs (process.versions, fs, crypto, etc.).
+ * Permitted dependencies: jose, fetch, next/server, and local utilities
+ * that themselves satisfy the same constraint.
+ *
+ * Do NOT import from:
+ *   - AsgardeoNextClient (depends on @asgardeo/node → @asgardeo/javascript)
+ *   - server/AsgardeoProvider (depends on @asgardeo/node)
+ *   - server/actions/* (depend on @asgardeo/node)
+ *   - client/* (depend on @asgardeo/javascript via @asgardeo/react)
+ */
+export { default as asgardeoMiddleware } from './server/middleware/asgardeoMiddleware';
+export * from './server/middleware/asgardeoMiddleware';
+export { default as createRouteMatcher } from './server/middleware/createRouteMatcher';

package/dist/types/server/AsgardeoProvider.d.ts

@@ -22,6 +22,20 @@ import { FC, PropsWithChildren } from 'react';
  */
 export type AsgardeoServerProviderProps = Partial<AsgardeoProviderProps> & {
     clientSecret?: string;
+    /**
+     * Session cookie lifetime in seconds. Determines how long the session cookie
+     * remains valid in the browser after sign-in.
+     *
+     * Resolution order (first defined value wins):
+     *   1. This prop — set here when mounting the provider.
+     *   2. `ASGARDEO_SESSION_COOKIE_EXPIRY_TIME` environment variable.
+     *   3. Built-in default of 86400 seconds (24 hours).
+     *
+     * @example
+     * // 8-hour session cookie
+     * <AsgardeoServerProvider sessionCookieExpiryTime={28800} ... />
+     */
+    sessionCookieExpiryTime?: number;
 };
 /**
  * Server-side provider component for Asgardeo authentication.

package/dist/types/server/actions/clearSession.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * Deletes all Asgardeo session cookies from the browser without contacting the
+ * identity server.
+ *
+ * Use this for error-recovery scenarios where the local session must be wiped
+ * immediately: refresh token failures, corrupt sessions, or forced local sign-out
+ * when the identity server is unreachable.
+ *
+ * For a complete sign-out that also revokes the server-side session and obtains the
+ * after-sign-out redirect URL, use `signOutAction` instead.
+ *
+ * @example
+ * ```typescript
+ * import { clearSession } from '@asgardeo/nextjs/server';
+ *
+ * // Inside a Server Action or Route Handler:
+ * await clearSession();
+ * redirect('/sign-in');
+ * ```
+ */
+declare const clearSession: () => Promise<void>;
+export default clearSession;

package/dist/types/server/actions/isSignedIn.d.ts

@@ -17,10 +17,15 @@
  */
 /**
  * Check if the user is currently signed in.
- * First tries JWT session validation, then falls back to legacy session check.
  *
- * @param sessionId - Optional session ID to check (if not provided, gets from cookies)
- * @returns True if user is signed in, false otherwise
+ * For JWT-based sessions: the session JWT exp claim is now tied to the access
+ * token expiry. A successful jwtVerify (inside getSessionPayload) already proves
+ * exp > now, so no separate timestamp comparison is needed here.
+ *
+ * Falls back to the legacy SDK in-memory check when no JWT session cookie exists.
+ *
+ * @param sessionId - Optional session ID (used only for the legacy fallback path)
+ * @returns True if the user is signed in with a valid, non-expired token
  */
 declare const isSignedIn: (sessionId?: string) => Promise<boolean>;
 export default isSignedIn;

package/dist/types/server/actions/refreshToken.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * Client-safe result of a token refresh.
+ *
+ * Intentionally omits accessToken, refreshToken, idToken, and scopes — those stay
+ * server-side in the HttpOnly session cookie. Returning tokens from a Server Action
+ * serializes them into browser memory, defeating the HttpOnly boundary and exposing
+ * them to XSS, browser extensions, and error-tracking SDKs.
+ *
+ * `expiresAt` is epoch seconds for the new access token; the client uses it to
+ * schedule the next refresh.
+ */
+export interface RefreshResult {
+    expiresAt: number;
+}
+/**
+ * Server action to refresh the access token using the stored refresh token.
+ * Exchanges the refresh token for a new token set and updates the session cookie.
+ *
+ * Delegates the HTTP exchange to handleRefreshToken so the same logic is shared
+ * with the middleware token refresh path.
+ *
+ * Called from the client side (e.g. AsgardeoClientProvider refreshOnMount) where
+ * Next.js allows cookie mutation. When invoked during SSR rendering the cookie
+ * write is silently skipped and a warning is logged.
+ */
+declare const refreshToken: () => Promise<RefreshResult>;
+export default refreshToken;

package/dist/types/server/index.d.ts

@@ -18,6 +18,3 @@
 export { default as asgardeo } from './asgardeo';
 export { default as AsgardeoProvider } from './AsgardeoProvider.js';
 export * from './AsgardeoProvider.js';
-export { default as asgardeoMiddleware } from './middleware/asgardeoMiddleware';
-export * from './middleware/asgardeoMiddleware';
-export { default as createRouteMatcher } from './middleware/createRouteMatcher';

package/dist/types/server/middleware/asgardeoMiddleware.d.ts

@@ -33,7 +33,7 @@ export type AsgardeoMiddlewareContext = {
      * 2. resolvedOptions.signInUrl
      * 3. resolvedOptions.defaultRedirect
      * 4. referer (if from same origin)
-     * If none are available, throws an error.
+     * If none are available, falls back to '/'.
      */
     protectRoute: (routeOptions?: {
         redirect?: string;
@@ -44,16 +44,34 @@ type AsgardeoMiddlewareHandler = (asgardeo: AsgardeoMiddlewareContext, req: Next
  * Asgardeo middleware that integrates authentication into your Next.js application.
  * Similar to Clerk's clerkMiddleware pattern.
  *
+ * Proactively refreshes the access token when it is within REFRESH_BUFFER_SECONDS of
+ * expiry so that Server Components always receive a fresh session. The refresh also
+ * recovers expired tokens as long as a refresh token is present.
+ *
+ * The updated session cookie is written to:
+ *   - The response  → browser stores the new cookie for subsequent requests.
+ *   - The forwarded request headers → the same-request Server Component render sees
+ *     the fresh token immediately without waiting for the next navigation.
+ *
+ * Token refresh requires baseUrl, clientId, and clientSecret. These are resolved from
+ * the options argument first, then from the standard Asgardeo environment variables
+ * (NEXT_PUBLIC_ASGARDEO_BASE_URL, NEXT_PUBLIC_ASGARDEO_CLIENT_ID,
+ * ASGARDEO_CLIENT_SECRET). If none are available the refresh step is skipped silently.
+ *
  * @param handler - Optional handler function to customize middleware behavior
  * @param options - Configuration options for the middleware
  * @returns Next.js middleware function
  *
  * @example
  * ```typescript
- * // middleware.ts - Basic usage
+ * // middleware.ts - Basic usage (config read from env vars automatically)
  * import { asgardeoMiddleware } from '@asgardeo/nextjs';
  *
  * export default asgardeoMiddleware();
+ *
+ * export const config = {
+ *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+ * };
  * ```
  *
  * @example
@@ -69,32 +87,6 @@ type AsgardeoMiddlewareHandler = (asgardeo: AsgardeoMiddlewareContext, req: Next
  *   }
  * });
  * ```
- *
- * @example
- * ```typescript
- * // Advanced usage with custom logic
- * import { asgardeoMiddleware, createRouteMatcher } from '@asgardeo/nextjs';
- *
- * const isProtectedRoute = createRouteMatcher(['/dashboard(.*)']);
- * const isAuthRoute = createRouteMatcher(['/sign-in', '/sign-up']);
- *
- * export default asgardeoMiddleware(async (asgardeo, req) => {
- *   // Skip protection for auth routes
- *   if (isAuthRoute(req)) return;
- *
- *   // Protect specified routes
- *   if (isProtectedRoute(req)) {
- *     await asgardeo.protectRoute({ redirect: '/sign-in' });
- *   }
- *
- *   // Check authentication status
- *   if (asgardeo.isSignedIn()) {
- *     console.log('User is authenticated with session:', asgardeo.getSessionId());
- *   }
- * }, {
- *   defaultRedirect: '/sign-in'
- * });
- * ```
  */
 declare const asgardeoMiddleware: (handler?: AsgardeoMiddlewareHandler, options?: AsgardeoMiddlewareOptions | ((req: NextRequest) => AsgardeoMiddlewareOptions)) => ((request: NextRequest) => Promise<NextResponse>);
 export default asgardeoMiddleware;

package/dist/types/utils/SessionManager.d.ts

@@ -20,24 +20,27 @@ import { JWTPayload } from 'jose';
  * Session token payload interface
  */
 export interface SessionTokenPayload extends JWTPayload {
-    /** Expiration timestamp */
+    /** Expiration timestamp — doubles as the access token expiry (JWT exp == access token exp) */
     exp: number;
     /** Issued at timestamp */
     iat: number;
     /** Organization ID if applicable */
     organizationId?: string;
+    /** The refresh token; empty string if not provided by the auth server */
+    refreshToken: string;
     /** OAuth scopes */
     scopes: string[];
     /** Session ID */
     sessionId: string;
     /** User ID */
     sub: string;
+    /** Token type discriminant — must be 'session' for access-session JWTs */
+    type: 'session';
 }
 /**
  * Session management utility class for JWT-based session cookies
  */
 declare class SessionManager {
-    private static readonly DEFAULT_EXPIRY_SECONDS;
     /**
      * Get the signing secret from environment variable
      * Throws error in production if not set
@@ -48,13 +51,31 @@ declare class SessionManager {
      */
     static createTempSession(sessionId: string): Promise<string>;
     /**
-     * Create a session cookie with user information
+     * Resolve the session cookie expiry time in seconds.
+     *
+     * Resolution order (first defined value wins):
+     *   1. `configuredExpiry` — value from `AsgardeoNodeConfig.sessionCookieExpiryTime`
+     *   2. `ASGARDEO_SESSION_COOKIE_EXPIRY_TIME` environment variable
+     *   3. `DEFAULT_SESSION_COOKIE_EXPIRY_TIME` (24 hours)
      */
-    static createSessionToken(accessToken: string, userId: string, sessionId: string, scopes: string, organizationId?: string, expirySeconds?: number): Promise<string>;
+    static resolveSessionCookieExpiry(configuredExpiry?: number): number;
+    static createSessionToken(accessToken: string, userId: string, sessionId: string, scopes: string, accessTokenTtlSeconds: number, refreshToken: string, organizationId?: string): Promise<string>;
     /**
      * Verify and decode a session token
      */
     static verifySessionToken(token: string): Promise<SessionTokenPayload>;
+    /**
+     * Verify a session token for refresh. Validates the HMAC signature and the
+     * `type === 'session'` discriminant but intentionally skips the `exp` check
+     * so an expired access token can still be exchanged for a new one.
+     *
+     * Session lifetime is still bounded — the cookie's `maxAge` is set from
+     * `sessionCookieExpiryTime`, so the browser drops an over-age session regardless
+     * of the access-token exp embedded in the JWT.
+     *
+     * Never use the returned payload for authorization.
+     */
+    static verifySessionTokenForRefresh(token: string): Promise<SessionTokenPayload>;
     /**
      * Verify and decode a temporary session token
      */
@@ -64,7 +85,7 @@ declare class SessionManager {
     /**
      * Get session cookie options
      */
-    static getSessionCookieOptions(): {
+    static getSessionCookieOptions(maxAge: number): {
         httpOnly: boolean;
         maxAge: number;
         path: string;

package/dist/types/utils/handleRefreshToken.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import type { TokenResponse } from '@asgardeo/node';
+import { SessionTokenPayload } from './SessionManager';
+/**
+ * Config required to call the token endpoint.
+ */
+export interface HandleRefreshTokenConfig {
+    baseUrl: string;
+    clientId: string;
+    clientSecret: string;
+    sessionCookieExpiryTime?: number;
+}
+/**
+ * Result returned by handleRefreshToken.
+ * Callers are responsible for persisting newSessionToken in the appropriate cookie context.
+ */
+export interface HandleRefreshTokenResult {
+    newSessionToken: string;
+    sessionCookieExpiryTime: number;
+    tokenResponse: TokenResponse;
+}
+/**
+ * Handles the OAuth refresh_token grant and builds a new session JWT string.
+ *
+ * Intentionally decoupled from cookie APIs so it can be called from both the Edge
+ * Runtime (Next.js middleware) and the Node.js Runtime (server actions).
+ * Cookie persistence is the caller's responsibility.
+ */
+declare const handleRefreshToken: (sessionPayload: SessionTokenPayload, config: HandleRefreshTokenConfig) => Promise<HandleRefreshTokenResult>;
+export default handleRefreshToken;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@asgardeo/nextjs",
-  "version": "0.3.9",
+  "version": "0.3.11",
   "description": "Next.js implementation of Asgardeo JavaScript SDK.",
   "keywords": [
     "asgardeo",
@@ -28,6 +28,12 @@
       "types": "./dist/types/server/index.d.ts",
       "import": "./dist/esm/server/index.js",
       "require": "./dist/cjs/server/index.js"
+    },
+    "./middleware": {
+      "types": "./dist/types/middleware.d.ts",
+      "edge-light": "./dist/esm/middleware.js",
+      "import": "./dist/esm/middleware.js",
+      "require": "./dist/cjs/middleware.js"
     }
   },
   "files": [
@@ -45,8 +51,8 @@
     "@types/react": "19.2.14",
     "jose": "5.10.0",
     "tslib": "2.8.1",
-    "@asgardeo/node": "0.0.73",
-    "@asgardeo/react": "0.22.4"
+    "@asgardeo/node": "0.0.75",
+    "@asgardeo/react": "0.23.0"
   },
   "devDependencies": {
     "@types/node": "22.15.3",