It seems like $expiresAt can also be of type false; however, parameter $expiresAt of Spiral\Auth\Session\Token::__construct() does only seem to accept DateTimeInterface|null, maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the ignore-type annotation
91
return new Token($data['id'], $data['payload'], /** @scrutinizer ignore-type */ $expiresAt);