| 1 | // Cloud: a refreshed OAuth credential has to be PERSISTED, and persisting it is |
| 2 | // a pair of version-checked writes into WorkOS Vault — the rotated refresh |
| 3 | // token and the new access token, one after the other, not atomically. Three |
| 4 | // production failures live in that gap. |
nothing calls this directly
no test coverage detected