pub fn credentials_from_token(
token: KimiTokenSet,
now_ms: u64,
) -> OAuthCredentialsExpand description
Map a granted token set onto broker credentials.
The stored expires bakes in the upstream refresh margin
(max(300, expires_in / 2) seconds, capped so a fresh token is never
instantly “expired”), so the repo-wide bare now >= expires check
refreshes on the same schedule as the official CLI.