Removes every token whose ExpiresAt has already passed (and its TokenUses
log along with it). Without this sweep __accessTokens grows forever — nothing
else in this module ever removes an expired token, deleteAccessToken() has no
production caller (tokens are consumed implicitly via short-lived GetData
calls, never explicitly released by the requesting system), and isTokenValid()
only checks the expiry timestamp without pruning it. Called from
registerAccessToken() — the natural "allocation" moment — so the array
self-bounds to roughly "tokens registered within one lifespan window" instead
of growing with total lifetime registrations (Memory Leak Audit Round 7,
Critical finding).
Parameters
now: Date = ...
injectable for tests; defaults to the real current time
Removes every token whose
ExpiresAthas already passed (and itsTokenUseslog along with it). Without this sweep__accessTokensgrows forever — nothing else in this module ever removes an expired token,deleteAccessToken()has no production caller (tokens are consumed implicitly via short-livedGetDatacalls, never explicitly released by the requesting system), andisTokenValid()only checks the expiry timestamp without pruning it. Called fromregisterAccessToken()— the natural "allocation" moment — so the array self-bounds to roughly "tokens registered within one lifespan window" instead of growing with total lifetime registrations (Memory Leak Audit Round 7, Critical finding).