What is the purpose of a refresh token, and why isn't the access token itself just made long-lived?

A refresh token lets a client silently obtain a new access token without forcing the user to re-enter credentials, while keeping the ACCESS token's lifetime short (minimizing the exposure window if it's stolen). Making the access token itself long-lived would mean a single stolen token remains dangerous for a long time; the refresh token is more tightly controlled/revocable and used far less frequently, reducing its exposure.