convex 1.42.0 → 1.42.2-alpha.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "convex",
   "description": "Client for the Convex Cloud",
-  "version": "1.42.0",
+  "version": "1.42.2-alpha.0",
   "author": "Convex, Inc. <no-reply@convex.dev>",
   "homepage": "https://convex.dev",
   "repository": {
@@ -248,7 +248,7 @@
     "fetch-retry": "~6.0.0",
     "find-up": "^8.0.0",
     "globals": "~17.4.0",
-    "happy-dom": "~20.8.0",
+    "happy-dom": "~20.10.0",
     "jsdom": "~28.1.0",
     "json5": "~2.2.3",
     "knip": "~5.86.0",

package/src/browser/simple_client.ts

@@ -1,12 +1,4 @@
 import { validateDeploymentUrl } from "../common/index.js";
-import {
-  BaseConvexClient,
-  BaseConvexClientOptions,
-  MutationOptions,
-  PaginatedQueryToken,
-  QueryToken,
-  UserIdentityAttributes,
-} from "./index.js";
 import {
   FunctionArgs,
   FunctionReference,
@@ -15,13 +7,23 @@ import {
 } from "../server/index.js";
 import { getFunctionName } from "../server/api.js";
 import { AuthTokenFetcher } from "./sync/authentication_manager.js";
-import { ConnectionState } from "./sync/client.js";
+import {
+  BaseConvexClient,
+  BaseConvexClientOptions,
+  ConnectionState,
+  MutationOptions,
+} from "./sync/client.js";
 import {
   ExtendedTransition,
   PaginatedQueryClient,
 } from "./sync/paginated_query_client.js";
 import { PaginatedQueryResult } from "./sync/pagination.js";
-import { serializedQueryTokenIsPaginated } from "./sync/udf_path_utils.js";
+import { UserIdentityAttributes } from "./sync/protocol.js";
+import {
+  PaginatedQueryToken,
+  QueryToken,
+  serializedQueryTokenIsPaginated,
+} from "./sync/udf_path_utils.js";
 
 // In Node.js builds this points to a bundled WebSocket implementation. If no
 // WebSocket implementation is manually specified or globally available,

package/src/browser/sync/authentication_manager.ts

@@ -36,16 +36,19 @@ type AuthConfig = {
 };
 
 /**
- * In general we take 3 steps:
- *   1. Fetch a possibly cached token
+ * By default we take 3 steps:
+ *   1. Fetch a possibly cached token and send it to the server
  *   2. Immediately fetch a fresh token without using a cache
  *   3. Repeat step 2 before the end of the fresh token's lifetime
  *
- * When we fetch without using a cache we know when the token
- * will expire, and can schedule refetching it.
+ * When `initialAuthTokenReuse` is enabled, step 2 is skipped: the
+ * cached token is reused and a refetch is scheduled based on its
+ * remaining lifetime (estimated via the server's clock skew). This
+ * avoids a second Authenticate message that would cause the server
+ * to re-execute all authenticated queries.
  *
- * If we get an error before a scheduled refetch, we go back
- * to step 2.
+ * If the server rejects a token before a scheduled refetch, we
+ * immediately fetch a fresh token and retry.
  */
 type AuthState =
   | { state: "noAuth" }
@@ -97,6 +100,7 @@ export class AuthenticationManager {
   private readonly clearAuth: () => void;
   private readonly logger: Logger;
   private readonly refreshTokenLeewaySeconds: number;
+  private readonly initialAuthTokenReuse: boolean;
   // Track last value to avoid redundant calls
   private lastRefreshChange: boolean;
   // Number of times we have attempted to confirm the latest token. We retry up
@@ -115,6 +119,7 @@ export class AuthenticationManager {
     config: {
       refreshTokenLeewaySeconds: number;
       logger: Logger;
+      initialAuthTokenReuse: boolean;
     },
   ) {
     this.syncState = syncState;
@@ -126,6 +131,7 @@ export class AuthenticationManager {
     this.clearAuth = callbacks.clearAuth;
     this.logger = config.logger;
     this.refreshTokenLeewaySeconds = config.refreshTokenLeewaySeconds;
+    this.initialAuthTokenReuse = config.initialAuthTokenReuse;
     this.lastRefreshChange = false;
   }
 
@@ -206,7 +212,12 @@ export class AuthenticationManager {
 
     if (this.authState.state === "waitingForServerConfirmationOfCachedToken") {
       this._logVerbose("server confirmed auth token is valid");
-      void this.refetchToken();
+      const cachedToken = this.syncState.getAuth()?.value;
+      if (this.initialAuthTokenReuse && cachedToken) {
+        this.scheduleTokenRefetch(cachedToken, serverMessage.clientClockSkew);
+      } else {
+        void this.refetchToken();
+      }
       this.authState.config.onAuthChange(true);
       return;
     }
@@ -361,7 +372,7 @@ export class AuthenticationManager {
     this.tryRestartSocket();
   }
 
-  private scheduleTokenRefetch(token: string) {
+  private scheduleTokenRefetch(token: string, clientClockSkewMs?: number) {
     if (this.authState.state === "noAuth") {
       return;
     }
@@ -384,17 +395,34 @@ export class AuthenticationManager {
       );
       return;
     }
-    // Because the client and server clocks may be out of sync,
-    // we only know that the token will expire after `exp - iat`,
-    // and since we just fetched a fresh one we know when that
-    // will happen.
-    const tokenValiditySeconds = exp - iat;
-    if (tokenValiditySeconds <= 2) {
+    const fullLifetimeSeconds = exp - iat;
+    if (fullLifetimeSeconds <= 2) {
       this.logger.error(
         "Auth token does not live long enough, cannot refetch the token",
       );
       return;
     }
+    let tokenValiditySeconds: number;
+    if (clientClockSkewMs !== undefined) {
+      // For cached tokens we use the server's clock skew estimate to
+      // compute remaining lifetime. The server computes
+      // clientClockSkew = clientTs - serverReceiveTs, so it's positive
+      // when the client is ahead and negative when behind. To recover
+      // server time: serverNow = Date.now() - clientClockSkew.
+      // Both Date.now() and setTimeout use the same client clock, so
+      // the scheduled delay is accurate regardless of absolute offset.
+      // Connect latency inflates the skew toward "client behind," which
+      // is conservative — we schedule the refetch slightly early.
+      const estimatedServerNowSeconds = (Date.now() - clientClockSkewMs) / 1000;
+      tokenValiditySeconds = exp - estimatedServerNowSeconds;
+      if (tokenValiditySeconds <= 0) {
+        tokenValiditySeconds = 0;
+      }
+    } else {
+      // For freshly-fetched tokens, `exp - iat` is the full lifetime
+      // starting from now.
+      tokenValiditySeconds = fullLifetimeSeconds;
+    }
     // Attempt to refresh the token `refreshTokenLeewaySeconds` before it expires,
     // or immediately if the token is already expiring soon.
     let delay = Math.min(

package/src/browser/sync/client.ts

@@ -137,6 +137,22 @@ export interface BaseConvexClientOptions {
    * Defaults to false, not waiting for an auth token.
    */
   expectAuth?: boolean;
+  /**
+   * This API is experimental: it may change or disappear.
+   *
+   * When true, the client reuses the initial cached auth token instead
+   * of immediately fetching a fresh one. This avoids a second
+   * Authenticate message that causes the server to re-execute all
+   * authenticated queries.
+   *
+   * The cached token's remaining lifetime is estimated using the
+   * server's clock skew measurement, and a refresh is scheduled
+   * before it expires.
+   *
+   * Defaults to false, preserving the original behavior of immediately
+   * fetching a fresh token after the cached token is confirmed.
+   */
+  initialAuthTokenReuse?: boolean;
 }
 
 /**
@@ -358,6 +374,7 @@ export class BaseConvexClient {
       {
         logger: this.logger,
         refreshTokenLeewaySeconds: authRefreshTokenLeewaySeconds,
+        initialAuthTokenReuse: options.initialAuthTokenReuse ?? false,
       },
     );
     this.optimisticQueryResults = new OptimisticQueryResults();

package/src/cli/dev.test.ts

@@ -0,0 +1,157 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import path from "path";
+import { nodeFs } from "../bundler/fs.js";
+import { dev } from "./dev.js";
+import { deploymentCredentialsOrConfigure } from "./configure.js";
+
+// In-memory filesystem — populated in beforeEach.
+let testFiles: Map<string, string>;
+// Everything written to stderr during a test, so we can assert on error output.
+let stderr: string;
+
+vi.mock("../bundler/fs.js", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../bundler/fs.js")>();
+  return {
+    ...actual,
+    nodeFs: {
+      ...actual.nodeFs,
+      exists: vi.fn(),
+      readUtf8File: vi.fn(),
+      writeUtf8File: vi.fn(),
+      mkdir: vi.fn(),
+    },
+  };
+});
+
+// `deploymentCredentialsOrConfigure` is where the CLI prompts the user to
+// create or select a project. We stub it out so we can assert *whether* it gets
+// reached — the whole point of the fast-fail check is that it should not.
+vi.mock("./configure.js", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("./configure.js")>();
+  return {
+    ...actual,
+    deploymentCredentialsOrConfigure: vi.fn(),
+  };
+});
+
+// Avoid actually pushing if the action ever gets that far.
+vi.mock("./lib/dev.js", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("./lib/dev.js")>();
+  return {
+    ...actual,
+    devAgainstDeployment: vi.fn(),
+  };
+});
+
+vi.mock("dotenv", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("dotenv")>();
+  return {
+    ...actual,
+    config: vi.fn(),
+  };
+});
+
+vi.mock("@sentry/node", () => ({
+  captureException: vi.fn(),
+  captureMessage: vi.fn(),
+  close: vi.fn(),
+}));
+
+describe("npx convex dev", () => {
+  let savedEnv: NodeJS.ProcessEnv;
+
+  beforeEach(() => {
+    savedEnv = { ...process.env };
+    process.env = {};
+
+    testFiles = new Map();
+    stderr = "";
+
+    vi.resetAllMocks();
+
+    vi.mocked(nodeFs.exists).mockImplementation((p: string) =>
+      testFiles.has(path.resolve(p)),
+    );
+    vi.mocked(nodeFs.readUtf8File).mockImplementation((p: string) => {
+      const content = testFiles.get(path.resolve(p));
+      if (content === undefined) {
+        const err: any = new Error(
+          `ENOENT: no such file or directory, open '${p}'`,
+        );
+        err.code = "ENOENT";
+        throw err;
+      }
+      return content;
+    });
+    vi.mocked(nodeFs.writeUtf8File).mockImplementation(
+      (p: string, content: string) => {
+        testFiles.set(path.resolve(p), content);
+      },
+    );
+
+    // `crash` calls `process.exit`; make it throw so `parseAsync` rejects.
+    vi.spyOn(process, "exit").mockImplementation((() => {
+      throw new Error("the CLI tried to exit the process");
+    }) as any);
+    vi.spyOn(process.stderr, "write").mockImplementation((chunk: any) => {
+      stderr += chunk.toString();
+      return true;
+    });
+  });
+
+  afterEach(() => {
+    process.env = savedEnv;
+    vi.restoreAllMocks();
+  });
+
+  it("fails fast without prompting to create/select a project when run outside a Convex project", async () => {
+    // A package.json with no `convex` dependency: this directory is not a
+    // Convex project.
+    testFiles.set(
+      path.resolve("package.json"),
+      JSON.stringify({ name: "not-a-convex-app", dependencies: {} }),
+    );
+
+    await expect(dev.parseAsync([], { from: "user" })).rejects.toThrow(
+      "the CLI tried to exit the process",
+    );
+
+    // The error must mention how to fix it...
+    expect(stderr).toContain("add `convex` to your package.json");
+    // ...and crucially, it must happen *before* we ever ask the user to create
+    // or select a project.
+    expect(deploymentCredentialsOrConfigure).not.toHaveBeenCalled();
+  });
+
+  it("fails fast when there is no package.json at all", async () => {
+    // Empty directory: no package.json.
+    await expect(dev.parseAsync([], { from: "user" })).rejects.toThrow(
+      "the CLI tried to exit the process",
+    );
+
+    expect(deploymentCredentialsOrConfigure).not.toHaveBeenCalled();
+  });
+
+  it("proceeds to project configuration once the Convex dependency check passes", async () => {
+    testFiles.set(
+      path.resolve("package.json"),
+      JSON.stringify({
+        name: "convex-app",
+        dependencies: { convex: "^1.0.0" },
+      }),
+    );
+
+    // Short-circuit right at the project-selection step so we don't run the
+    // rest of the dev flow; reaching this proves the dependency check passed.
+    const sentinel = new Error("reached project configuration");
+    vi.mocked(deploymentCredentialsOrConfigure).mockRejectedValue(sentinel);
+
+    // `--configure` skips deployment selection and goes straight to
+    // `deploymentCredentialsOrConfigure`.
+    await expect(
+      dev.parseAsync(["--configure"], { from: "user" }),
+    ).rejects.toThrow("reached project configuration");
+
+    expect(deploymentCredentialsOrConfigure).toHaveBeenCalledTimes(1);
+  });
+});

package/src/cli/dev.ts

@@ -9,6 +9,7 @@ import { devAgainstDeployment } from "./lib/dev.js";
 import {
   CONVEX_DEPLOYMENT_ENV_VAR_NAME,
   CONVEX_SELF_HOSTED_URL_VAR_NAME,
+  ensureHasConvexDependency,
 } from "./lib/utils/utils.js";
 import {
   getDeploymentSelection,
@@ -210,6 +211,12 @@ Same format as .env.local or .env files, and overrides them.`,
 
     const devOptions = await normalizeDevOptions(ctx, cmdOptions);
 
+    // Check that we're in a Convex project (a package.json with a `convex`
+    // dependency) before doing anything else, so we fail fast with a clear
+    // error instead of prompting to create/select a project and only then
+    // crashing because there's nothing to push.
+    await ensureHasConvexDependency(ctx, "run `npx convex dev`");
+
     if (cmdOptions.configure === undefined) {
       if (cmdOptions.team || cmdOptions.project || cmdOptions.devDeployment)
         return await ctx.crash({

package/src/cli/generatedApi.ts

@@ -405,7 +405,6 @@ export interface components {
             createTime: number;
             devDeploymentName?: string | null;
             id: components["schemas"]["ProjectId"];
-            isDemo: boolean;
             name: components["schemas"]["ProjectName"];
             prodDeploymentName?: string | null;
             slug: components["schemas"]["ProjectSlug"];

package/src/cli/lib/api.ts

@@ -35,7 +35,6 @@ export type Project = {
   id: number;
   name: string;
   slug: string;
-  isDemo: boolean;
 };
 
 type AdminKey = string;

package/src/cli/lib/config.test.ts

@@ -257,10 +257,7 @@ test("parseProjectConfig - top-level validation", async () => {
     null,
     "✖ Expected `convex.json` to contain an object\n",
   );
-  await assertParseError(
-    [],
-    "✖ Expected `convex.json` to contain an object\n",
-  );
+  await assertParseError([], "✖ Expected `convex.json` to contain an object\n");
 });
 
 test("ensureConvexFunctionsDir - creates functions directory", async () => {

package/src/cli/lib/typecheck.ts

@@ -139,18 +139,34 @@ async function runTsc(
   tscArgs: string[],
   handleResult: TypecheckResultHandler,
 ): Promise<void> {
-  // Check if tsc is even installed
-  const tscPath =
-    typescriptCompiler === "tsgo"
-      ? path.join(
+  // Check if the TypeScript compiler is even installed
+  let compilerPath: string | undefined;
+  switch (typescriptCompiler) {
+    case "tsgo": {
+      // @typescript/native-preview@7.0.0-dev.20260626.1 switched to using `bin/tsgo` instead of `bin/tsgo.js`.
+      const tsgoPaths = ["tsgo", "tsgo.js"].map((filename) =>
+        path.join(
           "node_modules",
           "@typescript",
           "native-preview",
           "bin",
-          "tsgo.js",
-        )
-      : path.join("node_modules", "typescript", "bin", "tsc");
-  if (!ctx.fs.exists(tscPath)) {
+          filename,
+        ),
+      );
+      compilerPath = tsgoPaths.find((path) => ctx.fs.exists(path));
+      break;
+    }
+    case "tsc": {
+      const tscPath = path.join("node_modules", "typescript", "bin", "tsc");
+      if (ctx.fs.exists(tscPath)) {
+        compilerPath = tscPath;
+      }
+      break;
+    }
+    default:
+      typescriptCompiler satisfies never;
+  }
+  if (!compilerPath) {
     return handleResult("cantTypeCheck", () => {
       logError(
         chalkStderr.gray(
@@ -162,14 +178,14 @@ async function runTsc(
 
   // Check the TypeScript version matches the recommendation from Convex
   const versionResult = await spawnAsync(ctx, process.execPath, [
-    tscPath,
+    compilerPath,
     "--version",
   ]);
 
   const version = versionResult.stdout.match(/Version (.*)/)?.[1] ?? null;
   const hasOlderTypeScriptVersion = version && semver.lt(version, "4.8.4");
 
-  await runTscInner(ctx, tscPath, tscArgs, handleResult);
+  await runTscInner(ctx, compilerPath, tscArgs, handleResult);
 
   // Print this warning after any logs from running `tsc`
   if (hasOlderTypeScriptVersion) {

package/src/cli/lib/utils/utils.ts

@@ -602,18 +602,10 @@ export async function validateOrSelectProject(
     });
   }
   if (!projectSlug) {
-    const nonDemoProjects = projects.filter((project) => !project.isDemo);
-    if (nonDemoProjects.length === 0) {
-      return await ctx.crash({
-        exitCode: 1,
-        errorType: "fatal",
-        printedMessage: `No existing non-demo projects! Run this command again and choose "create a new project."`,
-      });
-    }
     // Prompt the user to select project.
-    switch (nonDemoProjects.length) {
+    switch (projects.length) {
       case 1: {
-        const project = nonDemoProjects[0];
+        const project = projects[0];
         const confirmed = await promptYesNo(ctx, {
           message: `${singleProjectPrompt} ${project.name} (${project.slug})?`,
         });
@@ -621,12 +613,12 @@ export async function validateOrSelectProject(
         if (!confirmed) {
           return null;
         }
-        return nonDemoProjects[0].slug;
+        return projects[0].slug;
       }
       default:
         return await promptSearch(ctx, {
           message: multiProjectPrompt,
-          choices: nonDemoProjects.map((project: Project) => ({
+          choices: projects.map((project: Project) => ({
             name: `${project.name} (${project.slug})`,
             value: project.slug,
           })),

package/src/index.ts

@@ -1 +1 @@
-export const version = "1.42.0";
+export const version = "1.42.2-alpha.0";

package/src/react/ConvexAuthState.test.tsx

@@ -198,6 +198,7 @@ test("Tokens are used to schedule refetch", async () => {
 function mockServerConfirmsAuth(
   client: ConvexReactClient,
   oldIdentityVersion: number,
+  clientClockSkew?: number,
 ) {
   act(() => {
     const querySetVersion = client.sync["remoteQuerySet"]["version"];
@@ -212,6 +213,7 @@ function mockServerConfirmsAuth(
         identity: oldIdentityVersion + 1,
       },
       modifications: [],
+      ...(clientClockSkew !== undefined ? { clientClockSkew } : {}),
     });
   });
 }
@@ -539,3 +541,146 @@ test("stop() during reauth notifies isRefreshing false", async () => {
 
   expect(onRefreshChange).toHaveBeenCalledWith(false);
 });
+
+// --- initialAuthTokenReuse tests ---
+// When enabled, the cached token is reused after server confirmation
+// (no immediate fresh-token fetch), and the refetch is scheduled using
+// the server's clientClockSkew to estimate remaining lifetime.
+// The server computes clientClockSkew = clientTs - serverReceiveTs:
+// negative means client behind, positive means ahead. Connect latency
+// makes the skew more negative (conservative).
+
+test("initialAuthTokenReuse: sends only one Authenticate", async () => {
+  const client = new ConvexReactClient("https://127.0.0.1:3001", {
+    initialAuthTokenReuse: true,
+  });
+  const tokenLifetimeSeconds = 60;
+  let tokenId = 0;
+  const tokenFetcher = vi.fn(async () =>
+    jwtEncode(
+      { iat: 1234500, exp: 1234500 + tokenLifetimeSeconds },
+      "secret" + tokenId++,
+    ),
+  );
+
+  const sendMessageSpy = vi.spyOn(
+    client.sync["webSocketManager"],
+    "sendMessage",
+  );
+
+  const onAuthChange = vi.fn();
+  void client.setAuth(tokenFetcher, onAuthChange);
+
+  await flushPromises();
+  mockServerConfirmsAuth(client, 0);
+  await flushPromises();
+
+  expect(onAuthChange).toHaveBeenCalledWith(true);
+
+  const authenticateMessages = sendMessageSpy.mock.calls.filter(
+    ([msg]) => msg.type === "Authenticate",
+  );
+  expect(authenticateMessages).toHaveLength(1);
+
+  await client.close();
+});
+
+test("initialAuthTokenReuse: clock skew adjusts schedule for partially-expired token", async () => {
+  const client = new ConvexReactClient("https://127.0.0.1:3001", {
+    initialAuthTokenReuse: true,
+  });
+  const defaultLeewaySeconds = 10;
+  const tokenLifetimeSeconds = 60;
+  const tokenAgeOnServer = 30;
+  const clientClockSkewMs = 0;
+  const clientNow = Date.now() / 1000;
+  const serverNow = clientNow;
+  const tokenFetcher = vi.fn(async () =>
+    jwtEncode(
+      {
+        iat: serverNow - tokenAgeOnServer,
+        exp: serverNow - tokenAgeOnServer + tokenLifetimeSeconds,
+      },
+      "secret",
+    ),
+  );
+  void client.setAuth(tokenFetcher, () => {});
+
+  await flushPromises();
+  mockServerConfirmsAuth(client, 0, clientClockSkewMs);
+
+  expect(tokenFetcher).toHaveBeenCalledTimes(1);
+
+  const expectedDelay =
+    (tokenLifetimeSeconds - tokenAgeOnServer - defaultLeewaySeconds) * 1000;
+
+  vi.advanceTimersByTime(expectedDelay - 1);
+  expect(tokenFetcher).toHaveBeenCalledTimes(1);
+
+  vi.advanceTimersByTime(1);
+  expect(tokenFetcher).toHaveBeenCalledTimes(2);
+});
+
+test("initialAuthTokenReuse: clock skew triggers immediate refetch for nearly-expired token", async () => {
+  const client = new ConvexReactClient("https://127.0.0.1:3001", {
+    initialAuthTokenReuse: true,
+  });
+  const tokenLifetimeSeconds = 60;
+  const clientClockSkewMs = -50_000;
+  const clientNow = Date.now() / 1000;
+  const serverNow = clientNow - clientClockSkewMs / 1000;
+  const tokenFetcher = vi.fn(async () =>
+    jwtEncode(
+      {
+        iat: serverNow - 55,
+        exp: serverNow - 55 + tokenLifetimeSeconds,
+      },
+      "secret",
+    ),
+  );
+  void client.setAuth(tokenFetcher, () => {});
+
+  await flushPromises();
+  mockServerConfirmsAuth(client, 0, clientClockSkewMs);
+
+  expect(tokenFetcher).toHaveBeenCalledTimes(1);
+
+  vi.advanceTimersByTime(1);
+  expect(tokenFetcher).toHaveBeenCalledTimes(2);
+});
+
+test("initialAuthTokenReuse: clock skew corrects for client clock behind server", async () => {
+  const client = new ConvexReactClient("https://127.0.0.1:3001", {
+    initialAuthTokenReuse: true,
+  });
+  const defaultLeewaySeconds = 10;
+  const tokenLifetimeSeconds = 60;
+  const tokenAgeOnServer = 30;
+  const clientClockSkewMs = -20_000;
+  const clientNow = Date.now() / 1000;
+  const serverNow = clientNow - clientClockSkewMs / 1000;
+  const tokenFetcher = vi.fn(async () =>
+    jwtEncode(
+      {
+        iat: serverNow - tokenAgeOnServer,
+        exp: serverNow - tokenAgeOnServer + tokenLifetimeSeconds,
+      },
+      "secret",
+    ),
+  );
+  void client.setAuth(tokenFetcher, () => {});
+
+  await flushPromises();
+  mockServerConfirmsAuth(client, 0, clientClockSkewMs);
+
+  expect(tokenFetcher).toHaveBeenCalledTimes(1);
+
+  const expectedDelay =
+    (tokenLifetimeSeconds - tokenAgeOnServer - defaultLeewaySeconds) * 1000;
+
+  vi.advanceTimersByTime(expectedDelay - 1);
+  expect(tokenFetcher).toHaveBeenCalledTimes(1);
+
+  vi.advanceTimersByTime(1);
+  expect(tokenFetcher).toHaveBeenCalledTimes(2);
+});