Shares renewable access tokens through a file cache and refreshes them in the background.
This class combines in-memory caching, a process-shared file cache, and one renewal loop. Concurrent callers share an in-flight renewal. The wrapped bearer must have a stable name because that name selects the cache entry.
Call AsyncRenewableBearer.close at shutdown.
Returns a JSON-safe value for logs.
Creates a shared file-backed renewal layer.
cacheFilePath selects the credentials file. fileCacheThrottleMs limits
disk checks. Renewal failures use jittered exponential backoff. source
must have a stable name for its cache entry.
Optionalopts: {OptionalcacheFilePath?: stringShared YAML cache path. Defaults to ~/.nebius/credentials.yaml.
OptionalfileCacheThrottleMs?: numberMinimum interval between cache-file reads, in milliseconds. Defaults to five minutes.
OptionalinitialRetryTimeoutMs?: numberInitial retry delay, in milliseconds. Defaults to one second.
OptionalinitialSafetyMarginMs?: number | nullRequired remaining lifetime for an initially cached token, in milliseconds.
Defaults to two hours. null also selects this default. Valid cache
hits keep the margin until a fetch enters the renewal path.
OptionaljitterFraction?: numberRandom retry-delay variation from 0 to 1.
Defaults to 0.2. Values outside the range are clamped.
OptionallifetimeSafeFraction?: numberFraction of remaining lifetime to wait before renewal.
Defaults to 0.9, which renews with about 10% left.
Optionallogger?: LoggerOptional destination for diagnostic events.
OptionalmaxRetries?: numberMaximum total authentication attempts for one receiver. Defaults to 2.
OptionalmaxRetryTimeoutMs?: numberMaximum retry delay, in milliseconds. Defaults to 60 seconds.
Optionalmetrics?: AuthMetricsInputOptional authentication metrics destination.
Optionalprovider?: stringMetrics provider label. Defaults to the wrapped source provider.
OptionalrefreshRequestTimeoutMs?: numberDefault budget passed to the source for a renewal, in milliseconds.
Defaults to five seconds. It applies to foreground and background renewal when the caller does not supply a synchronous override. The source decides how it enforces the budget.
OptionalretrySafetyMarginMs?: numberAccepted for compatibility but not used by this implementation.
OptionalretryTimeoutExponent?: numberMultiplier for exponential retry delays. Defaults to 1.5.
OptionalsafetyMinRemainingMs?: numberMinimum lifetime kept before renewal, in milliseconds. Defaults to 15 seconds.
Readonly$typeContains the fully qualified runtime type name.
Extra lifetime required for the first cached token, in milliseconds.
The constructor assigns the two-hour default when the option is null or
undefined. A valid cache hit keeps this margin for later fetches. The
value becomes null only when a fetch proceeds into the renewal path.
Returns the provider name for authorization metrics.
Returns the stable credential name used by file-backed token caches.
Most bearers do not have a name. Wrappers can add one with NamedBearer.
Returns the wrapped bearer.
Returns a JSON-safe value for logs.
Stops background renewal, rejects pending waiters, and closes the source.
OptionalgraceMs: numberReturns a valid token from memory, disk, or the renewal source.
Synchronous renewal options wait and report failure. Otherwise a valid cached token can be returned while one shared renewal continues.
OptionaltimeoutMs: numberOptionaloptions: AuthorizationOptionsReturns whether the token must be renewed.
Creates a token receiver.
Schedules renewal without waiting; invalidate marks the cached value as rejected.
Shares renewable access tokens through a file cache and refreshes them in the background.
This class combines in-memory caching, a process-shared file cache, and one renewal loop. Concurrent callers share an in-flight renewal. The wrapped bearer must have a stable name because that name selects the cache entry.
Call AsyncRenewableBearer.close at shutdown.