Keeps an access token in memory and renews it through another bearer.
Concurrent callers share one in-flight renewal. A successful fetch schedules background renewal before expiration. A failed background renewal uses jittered exponential backoff, while a still-valid cached token can continue to serve requests.
The timer does not keep Node.js running. Call RenewableBearer.close during orderly shutdown to reject waiters and close the wrapped source.
Returns a JSON-safe value for logs.
Creates an in-memory renewal layer around source.
lifetimeSafeFraction selects the fraction of remaining lifetime to wait
before renewal. Retry delays use exponential backoff and bounded jitter.
Optionalopts: {OptionalinitialRetryTimeoutMs?: numberInitial renewal retry delay, in milliseconds. Defaults to one second.
OptionaljitterFraction?: numberRandom retry-delay variation from 0 to 1.
Defaults to 0.2. Values outside the range are clamped.
OptionallifetimeSafeFraction?: numberFraction of remaining token lifetime to wait before renewal.
Defaults to 0.9, which renews with about 10% left.
Optionallogger?: LoggerOptional destination for diagnostic events.
OptionalmaxRetries?: numberMaximum total authentication attempts for one receiver. Defaults to 2.
OptionalmaxRetryTimeoutMs?: numberMaximum renewal retry delay, in milliseconds. Defaults to 60 seconds.
Optionalmetrics?: AuthMetricsInputOptional authentication metrics destination.
Optionalprovider?: stringProvider label for metrics. Defaults to the wrapped bearer name.
OptionalrefreshRequestTimeoutMs?: numberDefault budget for a renewal request, in milliseconds.
Defaults to five seconds. It applies to foreground and background renewal when the caller does not supply a synchronous override. The source decides how it enforces the budget.
OptionalretryTimeoutExponent?: numberMultiplier for exponential retry delays. Defaults to 1.5.
OptionalsafetyMinRemainingMs?: numberAccepted for compatibility but not used by this implementation.
Readonly$typeContains the fully qualified runtime type name.
Returns the provider name for authorization metrics.
Returns the stable credential name used by file-backed token caches.
Most bearers do not have a name. Wrappers can add one with NamedBearer.
Returns the wrapped bearer.
Returns a JSON-safe value for logs.
Stops renewal, rejects pending waiters, and closes the wrapped bearer.
OptionalgraceMs: numberReturns a valid token and starts renewal when required.
With AuthorizationOptions.renewSynchronous or AuthorizationOptions.reportError, this method waits for renewal and reports its error. Otherwise it can return a valid cached token while renewal continues. If no cached token exists, it waits for the first one.
OptionaltimeoutMs: numberOptionaloptions: AuthorizationOptionsReports whether the cached token is absent, invalidated, expired, or due for renewal.
Creates a token receiver.
Schedules renewal as soon as possible.
Set invalidate after an authentication rejection. This method does not
wait for renewal.
Keeps an access token in memory and renews it through another bearer.
Concurrent callers share one in-flight renewal. A successful fetch schedules background renewal before expiration. A failed background renewal uses jittered exponential backoff, while a still-valid cached token can continue to serve requests.
The timer does not keep Node.js running. Call RenewableBearer.close during orderly shutdown to reject waiters and close the wrapped source.