Exchanges the httpOnly refresh cookie for a fresh access token via the auth endpoint,
and stores the result. Concurrent callers share one request.
The auth endpoint answers 200 in both directions, so the body is the signal:
a token means the session is alive, an empty body means the refresh cookie is
gone or expired and the user is logged out (which clears the token, and in turn
trips ClearStoreOnLogout).
A transport failure (offline, 5xx) rejects without clearing the token — a
flaky network shouldn't end a valid session.
Returns Promise<string|null>
The new access token, or null if the session has ended.
Throws
If the request fails at the transport level or the endpoint returns non-2xx.
Exchanges the httpOnly refresh cookie for a fresh access token via the auth endpoint, and stores the result. Concurrent callers share one request.
The auth endpoint answers 200 in both directions, so the body is the signal: a token means the session is alive, an empty body means the refresh cookie is gone or expired and the user is logged out (which clears the token, and in turn trips
ClearStoreOnLogout).A transport failure (offline, 5xx) rejects without clearing the token — a flaky network shouldn't end a valid session.