@cimplify/sdk 0.64.1 → 0.66.0

package/dist/server.js

@@ -1,8 +1,8 @@
 'use strict';
 
-var chunkDKT62WQW_js = require('./chunk-DKT62WQW.js');
-var chunkMW7ICTVK_js = require('./chunk-MW7ICTVK.js');
-require('./chunk-JGBDWEPJ.js');
+var chunkKWYI2TTA_js = require('./chunk-KWYI2TTA.js');
+var chunkJ3MGY6AU_js = require('./chunk-J3MGY6AU.js');
+require('./chunk-AVQL3TSJ.js');
 require('./chunk-7Y2O3E4D.js');
 var chunkXA3ZNR75_js = require('./chunk-XA3ZNR75.js');
 require('./chunk-OWW5GUSB.js');
@@ -27,7 +27,7 @@ function readEnv(...keys) {
 var getServerClient = react.cache((opts = {}) => {
   const baseUrl = opts.apiUrl ?? readEnv("CIMPLIFY_API_URL", "NEXT_PUBLIC_CIMPLIFY_API_URL") ?? defaultBaseUrl();
   const publicKey = opts.secretKey ?? readEnv("CIMPLIFY_SECRET_KEY", "NEXT_PUBLIC_CIMPLIFY_PUBLIC_KEY") ?? "mock-dev";
-  const client = chunkMW7ICTVK_js.createCimplifyClient({
+  const client = chunkJ3MGY6AU_js.createCimplifyClient({
     baseUrl,
     publicKey,
     suppressPublicKeyWarning: true
@@ -240,6 +240,9 @@ async function refreshPage() {
 }
 var SESSION_COOKIE = "cimplify_session";
 var ACCESS_TOKEN_COOKIE = "cimplify_access";
+var REFRESH_TOKEN_COOKIE = "cimplify_refresh";
+var REFRESH_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
+var ACCESS_REFRESH_SKEW_SECONDS = 30;
 var HEADER_LOCATION = "Location";
 var PARAM_CODE = "code";
 var PARAM_STATE = "state";
@@ -248,7 +251,7 @@ var QUERY_AUTH_ERROR = "cimplify_auth_error";
 var discoveryCache = /* @__PURE__ */ new Map();
 var jwksCache = /* @__PURE__ */ new Map();
 function issuerBase(cfg) {
-  return (cfg.issuer ?? cfg.authUrl ?? chunkDKT62WQW_js.DEFAULT_ISSUER).replace(/\/$/, "");
+  return (cfg.issuer ?? cfg.authUrl ?? chunkKWYI2TTA_js.DEFAULT_ISSUER).replace(/\/$/, "");
 }
 function cookieName(cfg) {
   return cfg.cookieName ?? SESSION_COOKIE;
@@ -256,6 +259,9 @@ function cookieName(cfg) {
 function accessTokenCookieName(cfg) {
   return cfg.accessTokenCookieName ?? ACCESS_TOKEN_COOKIE;
 }
+function refreshTokenCookieName(cfg) {
+  return cfg.refreshTokenCookieName ?? REFRESH_TOKEN_COOKIE;
+}
 async function discovery(cfg) {
   const base = issuerBase(cfg);
   let p = discoveryCache.get(base);
@@ -356,28 +362,38 @@ function buildAccessTokenCookie(cfg, accessToken, maxAgeSeconds) {
   if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
   return parts.join("; ");
 }
-function buildSignoutCookies(cfg) {
-  const idTokenParts = [
-    `${cookieName(cfg)}=`,
+function buildRefreshTokenCookie(cfg, refreshToken, maxAgeSeconds) {
+  const parts = [
+    `${refreshTokenCookieName(cfg)}=${refreshToken}`,
     "Path=/",
     "HttpOnly",
     "Secure",
     "SameSite=Lax",
-    "Max-Age=0"
+    `Max-Age=${maxAgeSeconds}`
   ];
-  const accessParts = [
-    `${accessTokenCookieName(cfg)}=`,
-    "Path=/",
-    "HttpOnly",
-    "Secure",
-    "SameSite=Lax",
-    "Max-Age=0"
+  if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
+  return parts.join("; ");
+}
+function buildSignoutCookies(cfg) {
+  const clear = (name) => {
+    const parts = [`${name}=`, "Path=/", "HttpOnly", "Secure", "SameSite=Lax", "Max-Age=0"];
+    if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
+    return parts.join("; ");
+  };
+  return [
+    clear(cookieName(cfg)),
+    clear(accessTokenCookieName(cfg)),
+    clear(refreshTokenCookieName(cfg))
   ];
-  if (cfg.cookieDomain) {
-    idTokenParts.push(`Domain=${cfg.cookieDomain}`);
-    accessParts.push(`Domain=${cfg.cookieDomain}`);
-  }
-  return [idTokenParts.join("; "), accessParts.join("; ")];
+}
+function readCookie(name, cookieHeader) {
+  if (!cookieHeader) return null;
+  const match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${name}=`));
+  if (!match) return null;
+  return match.slice(name.length + 1) || null;
+}
+function getRefreshTokenFromCookieHeader(cfg, cookieHeader) {
+  return readCookie(refreshTokenCookieName(cfg), cookieHeader);
 }
 function getAccessTokenFromCookieHeader(cfg, cookieHeader) {
   if (!cookieHeader) return null;
@@ -387,7 +403,21 @@ function getAccessTokenFromCookieHeader(cfg, cookieHeader) {
   const token = match.slice(name.length + 1);
   return token || null;
 }
+function isSameOriginCallback(req, redirectUri) {
+  const site = req.headers.get("sec-fetch-site");
+  if (site) return site === "same-origin";
+  const origin = req.headers.get("origin");
+  if (!origin) return false;
+  try {
+    return origin === new URL(redirectUri).origin;
+  } catch {
+    return false;
+  }
+}
 async function handleOidcCallback(req, opts) {
+  if (!isSameOriginCallback(req, opts.redirectUri)) {
+    return Response.json({ error: "forbidden_origin" }, { status: 403 });
+  }
   let body;
   try {
     body = await req.json();
@@ -404,30 +434,36 @@ async function handleOidcCallback(req, opts) {
       code: body.code,
       codeVerifier: body.codeVerifier
     });
-  } catch (e) {
-    return Response.json({ error: "exchange_failed", detail: String(e) }, { status: 400 });
+  } catch {
+    return Response.json({ error: "exchange_failed" }, { status: 400 });
   }
   if (!tokens.idToken) {
     return Response.json({ error: "missing_id_token" }, { status: 400 });
   }
   try {
     await verifyIdToken(opts, tokens.idToken);
-  } catch (e) {
-    return Response.json({ error: "id_token_invalid", detail: String(e) }, { status: 401 });
+  } catch {
+    return Response.json({ error: "id_token_invalid" }, { status: 401 });
   }
   const headers = new Headers({ "Content-Type": "application/json" });
   headers.append("Set-Cookie", buildSessionCookie(opts, tokens.idToken, tokens.expiresIn));
   headers.append("Set-Cookie", buildAccessTokenCookie(opts, tokens.accessToken, tokens.expiresIn));
+  if (tokens.refreshToken) {
+    headers.append(
+      "Set-Cookie",
+      buildRefreshTokenCookie(opts, tokens.refreshToken, REFRESH_COOKIE_MAX_AGE_SECONDS)
+    );
+  }
   return new Response(JSON.stringify({ ok: true }), { status: 200, headers });
 }
 function readPkceCookie(cookieHeader) {
   if (!cookieHeader) return null;
-  const match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${chunkDKT62WQW_js.PKCE_COOKIE}=`));
+  const match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${chunkKWYI2TTA_js.PKCE_COOKIE}=`));
   if (!match) return null;
-  return chunkDKT62WQW_js.decodePkceState(match.slice(chunkDKT62WQW_js.PKCE_COOKIE.length + 1));
+  return chunkKWYI2TTA_js.decodePkceState(match.slice(chunkKWYI2TTA_js.PKCE_COOKIE.length + 1));
 }
 function buildPkceClearCookie() {
-  return `${chunkDKT62WQW_js.PKCE_COOKIE}=; Path=${chunkDKT62WQW_js.PKCE_COOKIE_PATH}; Max-Age=0; Secure; SameSite=Lax`;
+  return `${chunkKWYI2TTA_js.PKCE_COOKIE}=; Path=${chunkKWYI2TTA_js.PKCE_COOKIE_PATH}; Max-Age=0; Secure; SameSite=Lax`;
 }
 function safeReturnPath(returnTo, fallback) {
   if (returnTo && returnTo.startsWith("/") && !returnTo.startsWith("//")) return returnTo;
@@ -467,6 +503,12 @@ async function handleRedirectCallback(req, opts) {
   const headers = new Headers({ [HEADER_LOCATION]: returnTo });
   headers.append("Set-Cookie", buildSessionCookie(opts, tokens.idToken, tokens.expiresIn));
   headers.append("Set-Cookie", buildAccessTokenCookie(opts, tokens.accessToken, tokens.expiresIn));
+  if (tokens.refreshToken) {
+    headers.append(
+      "Set-Cookie",
+      buildRefreshTokenCookie(opts, tokens.refreshToken, REFRESH_COOKIE_MAX_AGE_SECONDS)
+    );
+  }
   headers.append("Set-Cookie", buildPkceClearCookie());
   return new Response(null, { status: 302, headers });
 }
@@ -497,6 +539,99 @@ async function getSessionFromCookieHeader(cfg, cookieHeader) {
     return null;
   }
 }
+async function refreshTokens(cfg, refreshToken) {
+  const doc = await discovery(cfg);
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: cfg.clientId
+  });
+  const res = await fetch(doc.token_endpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`token refresh failed (${res.status}): ${text}`);
+  }
+  const payload = await res.json();
+  return {
+    accessToken: payload.access_token,
+    idToken: payload.id_token,
+    refreshToken: payload.refresh_token,
+    expiresIn: payload.expires_in,
+    scope: payload.scope
+  };
+}
+function decodeBase64Url(segment) {
+  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const pad = b64.length % 4 ? "=".repeat(4 - b64.length % 4) : "";
+  return atob(b64 + pad);
+}
+function accessTokenExpiry(token) {
+  if (!token) return null;
+  const parts = token.split(".");
+  if (parts.length < 2) return null;
+  try {
+    const payload = JSON.parse(decodeBase64Url(parts[1]));
+    return typeof payload.exp === "number" ? payload.exp : null;
+  } catch {
+    return null;
+  }
+}
+var refreshInflight = /* @__PURE__ */ new Map();
+function dedupedRefresh(cfg, refreshToken) {
+  const existing = refreshInflight.get(refreshToken);
+  if (existing) return existing;
+  const p = refreshTokens(cfg, refreshToken).finally(() => refreshInflight.delete(refreshToken));
+  refreshInflight.set(refreshToken, p);
+  return p;
+}
+function clearedResult(cfg) {
+  return {
+    outcome: "cleared",
+    setCookies: buildSignoutCookies(cfg),
+    cookies: [
+      { name: cookieName(cfg), value: "" },
+      { name: accessTokenCookieName(cfg), value: "" },
+      { name: refreshTokenCookieName(cfg), value: "" }
+    ]
+  };
+}
+async function handleTokenRefresh(req, cfg) {
+  const cookieHeader = req.headers.get("cookie");
+  const refreshToken = getRefreshTokenFromCookieHeader(cfg, cookieHeader);
+  if (!refreshToken) return { outcome: "noop", setCookies: [], cookies: [] };
+  const access = getAccessTokenFromCookieHeader(cfg, cookieHeader);
+  const exp = accessTokenExpiry(access);
+  const now = Math.floor(Date.now() / 1e3);
+  if (access && exp !== null && exp - now > ACCESS_REFRESH_SKEW_SECONDS) {
+    return { outcome: "noop", setCookies: [], cookies: [] };
+  }
+  let tokens;
+  try {
+    tokens = await dedupedRefresh(cfg, refreshToken);
+  } catch {
+    return clearedResult(cfg);
+  }
+  if (!tokens.idToken) return clearedResult(cfg);
+  const setCookies = [
+    buildSessionCookie(cfg, tokens.idToken, tokens.expiresIn),
+    buildAccessTokenCookie(cfg, tokens.accessToken, tokens.expiresIn)
+  ];
+  const cookies = [
+    { name: cookieName(cfg), value: tokens.idToken },
+    { name: accessTokenCookieName(cfg), value: tokens.accessToken }
+  ];
+  if (tokens.refreshToken) {
+    setCookies.push(
+      buildRefreshTokenCookie(cfg, tokens.refreshToken, REFRESH_COOKIE_MAX_AGE_SECONDS)
+    );
+    cookies.push({ name: refreshTokenCookieName(cfg), value: tokens.refreshToken });
+  }
+  return { outcome: "refreshed", setCookies, cookies };
+}
 
 Object.defineProperty(exports, "CimplifyError", {
   enumerable: true,
@@ -505,17 +640,21 @@ Object.defineProperty(exports, "CimplifyError", {
 exports.CACHE_LIFE_DEFAULT = CACHE_LIFE_DEFAULT;
 exports.CACHE_LIFE_PROBE = CACHE_LIFE_PROBE;
 exports.buildAccessTokenCookie = buildAccessTokenCookie;
+exports.buildRefreshTokenCookie = buildRefreshTokenCookie;
 exports.buildSessionCookie = buildSessionCookie;
 exports.buildSignoutCookie = buildSignoutCookie;
 exports.buildSignoutCookies = buildSignoutCookies;
 exports.exchangeCode = exchangeCode;
 exports.getAccessTokenFromCookieHeader = getAccessTokenFromCookieHeader;
+exports.getRefreshTokenFromCookieHeader = getRefreshTokenFromCookieHeader;
 exports.getServerClient = getServerClient;
 exports.getSessionFromCookieHeader = getSessionFromCookieHeader;
 exports.handleOidcCallback = handleOidcCallback;
 exports.handleRedirectCallback = handleRedirectCallback;
 exports.handleSessionRequest = handleSessionRequest;
+exports.handleTokenRefresh = handleTokenRefresh;
 exports.refreshPage = refreshPage;
+exports.refreshTokens = refreshTokens;
 exports.revalidateAddOn = revalidateAddOn;
 exports.revalidateAddOns = revalidateAddOns;
 exports.revalidateBrand = revalidateBrand;

package/dist/server.mjs

@@ -1,6 +1,6 @@
-import { PKCE_COOKIE, decodePkceState, PKCE_COOKIE_PATH, DEFAULT_ISSUER } from './chunk-XSOYJLMZ.mjs';
-import { createCimplifyClient } from './chunk-SQ7U3BWY.mjs';
-import './chunk-I4IXPQIX.mjs';
+import { PKCE_COOKIE, decodePkceState, PKCE_COOKIE_PATH, DEFAULT_ISSUER } from './chunk-7BKKBJQM.mjs';
+import { createCimplifyClient } from './chunk-227XTAEB.mjs';
+import './chunk-R6363CC7.mjs';
 import './chunk-TD3AY34U.mjs';
 export { CimplifyError } from './chunk-AMZXALF6.mjs';
 import './chunk-3G6RQLXK.mjs';
@@ -238,6 +238,9 @@ async function refreshPage() {
 }
 var SESSION_COOKIE = "cimplify_session";
 var ACCESS_TOKEN_COOKIE = "cimplify_access";
+var REFRESH_TOKEN_COOKIE = "cimplify_refresh";
+var REFRESH_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
+var ACCESS_REFRESH_SKEW_SECONDS = 30;
 var HEADER_LOCATION = "Location";
 var PARAM_CODE = "code";
 var PARAM_STATE = "state";
@@ -254,6 +257,9 @@ function cookieName(cfg) {
 function accessTokenCookieName(cfg) {
   return cfg.accessTokenCookieName ?? ACCESS_TOKEN_COOKIE;
 }
+function refreshTokenCookieName(cfg) {
+  return cfg.refreshTokenCookieName ?? REFRESH_TOKEN_COOKIE;
+}
 async function discovery(cfg) {
   const base = issuerBase(cfg);
   let p = discoveryCache.get(base);
@@ -354,28 +360,38 @@ function buildAccessTokenCookie(cfg, accessToken, maxAgeSeconds) {
   if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
   return parts.join("; ");
 }
-function buildSignoutCookies(cfg) {
-  const idTokenParts = [
-    `${cookieName(cfg)}=`,
+function buildRefreshTokenCookie(cfg, refreshToken, maxAgeSeconds) {
+  const parts = [
+    `${refreshTokenCookieName(cfg)}=${refreshToken}`,
     "Path=/",
     "HttpOnly",
     "Secure",
     "SameSite=Lax",
-    "Max-Age=0"
+    `Max-Age=${maxAgeSeconds}`
   ];
-  const accessParts = [
-    `${accessTokenCookieName(cfg)}=`,
-    "Path=/",
-    "HttpOnly",
-    "Secure",
-    "SameSite=Lax",
-    "Max-Age=0"
+  if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
+  return parts.join("; ");
+}
+function buildSignoutCookies(cfg) {
+  const clear = (name) => {
+    const parts = [`${name}=`, "Path=/", "HttpOnly", "Secure", "SameSite=Lax", "Max-Age=0"];
+    if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
+    return parts.join("; ");
+  };
+  return [
+    clear(cookieName(cfg)),
+    clear(accessTokenCookieName(cfg)),
+    clear(refreshTokenCookieName(cfg))
   ];
-  if (cfg.cookieDomain) {
-    idTokenParts.push(`Domain=${cfg.cookieDomain}`);
-    accessParts.push(`Domain=${cfg.cookieDomain}`);
-  }
-  return [idTokenParts.join("; "), accessParts.join("; ")];
+}
+function readCookie(name, cookieHeader) {
+  if (!cookieHeader) return null;
+  const match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${name}=`));
+  if (!match) return null;
+  return match.slice(name.length + 1) || null;
+}
+function getRefreshTokenFromCookieHeader(cfg, cookieHeader) {
+  return readCookie(refreshTokenCookieName(cfg), cookieHeader);
 }
 function getAccessTokenFromCookieHeader(cfg, cookieHeader) {
   if (!cookieHeader) return null;
@@ -385,7 +401,21 @@ function getAccessTokenFromCookieHeader(cfg, cookieHeader) {
   const token = match.slice(name.length + 1);
   return token || null;
 }
+function isSameOriginCallback(req, redirectUri) {
+  const site = req.headers.get("sec-fetch-site");
+  if (site) return site === "same-origin";
+  const origin = req.headers.get("origin");
+  if (!origin) return false;
+  try {
+    return origin === new URL(redirectUri).origin;
+  } catch {
+    return false;
+  }
+}
 async function handleOidcCallback(req, opts) {
+  if (!isSameOriginCallback(req, opts.redirectUri)) {
+    return Response.json({ error: "forbidden_origin" }, { status: 403 });
+  }
   let body;
   try {
     body = await req.json();
@@ -402,20 +432,26 @@ async function handleOidcCallback(req, opts) {
       code: body.code,
       codeVerifier: body.codeVerifier
     });
-  } catch (e) {
-    return Response.json({ error: "exchange_failed", detail: String(e) }, { status: 400 });
+  } catch {
+    return Response.json({ error: "exchange_failed" }, { status: 400 });
   }
   if (!tokens.idToken) {
     return Response.json({ error: "missing_id_token" }, { status: 400 });
   }
   try {
     await verifyIdToken(opts, tokens.idToken);
-  } catch (e) {
-    return Response.json({ error: "id_token_invalid", detail: String(e) }, { status: 401 });
+  } catch {
+    return Response.json({ error: "id_token_invalid" }, { status: 401 });
   }
   const headers = new Headers({ "Content-Type": "application/json" });
   headers.append("Set-Cookie", buildSessionCookie(opts, tokens.idToken, tokens.expiresIn));
   headers.append("Set-Cookie", buildAccessTokenCookie(opts, tokens.accessToken, tokens.expiresIn));
+  if (tokens.refreshToken) {
+    headers.append(
+      "Set-Cookie",
+      buildRefreshTokenCookie(opts, tokens.refreshToken, REFRESH_COOKIE_MAX_AGE_SECONDS)
+    );
+  }
   return new Response(JSON.stringify({ ok: true }), { status: 200, headers });
 }
 function readPkceCookie(cookieHeader) {
@@ -465,6 +501,12 @@ async function handleRedirectCallback(req, opts) {
   const headers = new Headers({ [HEADER_LOCATION]: returnTo });
   headers.append("Set-Cookie", buildSessionCookie(opts, tokens.idToken, tokens.expiresIn));
   headers.append("Set-Cookie", buildAccessTokenCookie(opts, tokens.accessToken, tokens.expiresIn));
+  if (tokens.refreshToken) {
+    headers.append(
+      "Set-Cookie",
+      buildRefreshTokenCookie(opts, tokens.refreshToken, REFRESH_COOKIE_MAX_AGE_SECONDS)
+    );
+  }
   headers.append("Set-Cookie", buildPkceClearCookie());
   return new Response(null, { status: 302, headers });
 }
@@ -495,5 +537,98 @@ async function getSessionFromCookieHeader(cfg, cookieHeader) {
     return null;
   }
 }
+async function refreshTokens(cfg, refreshToken) {
+  const doc = await discovery(cfg);
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: cfg.clientId
+  });
+  const res = await fetch(doc.token_endpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`token refresh failed (${res.status}): ${text}`);
+  }
+  const payload = await res.json();
+  return {
+    accessToken: payload.access_token,
+    idToken: payload.id_token,
+    refreshToken: payload.refresh_token,
+    expiresIn: payload.expires_in,
+    scope: payload.scope
+  };
+}
+function decodeBase64Url(segment) {
+  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const pad = b64.length % 4 ? "=".repeat(4 - b64.length % 4) : "";
+  return atob(b64 + pad);
+}
+function accessTokenExpiry(token) {
+  if (!token) return null;
+  const parts = token.split(".");
+  if (parts.length < 2) return null;
+  try {
+    const payload = JSON.parse(decodeBase64Url(parts[1]));
+    return typeof payload.exp === "number" ? payload.exp : null;
+  } catch {
+    return null;
+  }
+}
+var refreshInflight = /* @__PURE__ */ new Map();
+function dedupedRefresh(cfg, refreshToken) {
+  const existing = refreshInflight.get(refreshToken);
+  if (existing) return existing;
+  const p = refreshTokens(cfg, refreshToken).finally(() => refreshInflight.delete(refreshToken));
+  refreshInflight.set(refreshToken, p);
+  return p;
+}
+function clearedResult(cfg) {
+  return {
+    outcome: "cleared",
+    setCookies: buildSignoutCookies(cfg),
+    cookies: [
+      { name: cookieName(cfg), value: "" },
+      { name: accessTokenCookieName(cfg), value: "" },
+      { name: refreshTokenCookieName(cfg), value: "" }
+    ]
+  };
+}
+async function handleTokenRefresh(req, cfg) {
+  const cookieHeader = req.headers.get("cookie");
+  const refreshToken = getRefreshTokenFromCookieHeader(cfg, cookieHeader);
+  if (!refreshToken) return { outcome: "noop", setCookies: [], cookies: [] };
+  const access = getAccessTokenFromCookieHeader(cfg, cookieHeader);
+  const exp = accessTokenExpiry(access);
+  const now = Math.floor(Date.now() / 1e3);
+  if (access && exp !== null && exp - now > ACCESS_REFRESH_SKEW_SECONDS) {
+    return { outcome: "noop", setCookies: [], cookies: [] };
+  }
+  let tokens;
+  try {
+    tokens = await dedupedRefresh(cfg, refreshToken);
+  } catch {
+    return clearedResult(cfg);
+  }
+  if (!tokens.idToken) return clearedResult(cfg);
+  const setCookies = [
+    buildSessionCookie(cfg, tokens.idToken, tokens.expiresIn),
+    buildAccessTokenCookie(cfg, tokens.accessToken, tokens.expiresIn)
+  ];
+  const cookies = [
+    { name: cookieName(cfg), value: tokens.idToken },
+    { name: accessTokenCookieName(cfg), value: tokens.accessToken }
+  ];
+  if (tokens.refreshToken) {
+    setCookies.push(
+      buildRefreshTokenCookie(cfg, tokens.refreshToken, REFRESH_COOKIE_MAX_AGE_SECONDS)
+    );
+    cookies.push({ name: refreshTokenCookieName(cfg), value: tokens.refreshToken });
+  }
+  return { outcome: "refreshed", setCookies, cookies };
+}
 
-export { CACHE_LIFE_DEFAULT, CACHE_LIFE_PROBE, buildAccessTokenCookie, buildSessionCookie, buildSignoutCookie, buildSignoutCookies, exchangeCode, getAccessTokenFromCookieHeader, getServerClient, getSessionFromCookieHeader, handleOidcCallback, handleRedirectCallback, handleSessionRequest, refreshPage, revalidateAddOn, revalidateAddOns, revalidateBrand, revalidateBusiness, revalidateByTag, revalidateCategories, revalidateCategory, revalidateCollection, revalidateCollections, revalidateLocation, revalidateLocations, revalidatePricing, revalidateProduct, revalidateProducts, revalidateStock, revalidateSubscription, revalidateSubscriptions, tags, updateAddOn, updateAddOns, updateBrand, updateBusiness, updateByTag, updateCategories, updateCategory, updateCollection, updateCollections, updateLocation, updateLocations, updatePricing, updateProduct, updateProducts, updateStock, updateSubscription, updateSubscriptions, verifyIdToken };
+export { CACHE_LIFE_DEFAULT, CACHE_LIFE_PROBE, buildAccessTokenCookie, buildRefreshTokenCookie, buildSessionCookie, buildSignoutCookie, buildSignoutCookies, exchangeCode, getAccessTokenFromCookieHeader, getRefreshTokenFromCookieHeader, getServerClient, getSessionFromCookieHeader, handleOidcCallback, handleRedirectCallback, handleSessionRequest, handleTokenRefresh, refreshPage, refreshTokens, revalidateAddOn, revalidateAddOns, revalidateBrand, revalidateBusiness, revalidateByTag, revalidateCategories, revalidateCategory, revalidateCollection, revalidateCollections, revalidateLocation, revalidateLocations, revalidatePricing, revalidateProduct, revalidateProducts, revalidateStock, revalidateSubscription, revalidateSubscriptions, tags, updateAddOn, updateAddOns, updateBrand, updateBusiness, updateByTag, updateCategories, updateCategory, updateCollection, updateCollections, updateLocation, updateLocations, updatePricing, updateProduct, updateProducts, updateStock, updateSubscription, updateSubscriptions, verifyIdToken };