| 1 | // Cross-target: when the upstream rejects a token executor still believes is |
| 2 | // valid, executor re-mints it and retries — the caller never sees the 401. |
| 3 | // |
| 4 | // `expires_at` only ever holds the authorization server's ADVERTISED lifetime. |
nothing calls this directly
no test coverage detected