What
The OAuth token refresh lock now uses a named error class (OAuthRefreshLockContendedError), exposes an isCompromised() predicate and an abort signal, and raises the stale-lock timeout from 10 seconds to 60 seconds with a 5-second update heartbeat.
Details
OAuthRefreshLockContendedErroris thrown when the lock is contended after max attempts, replacing the previous untyped error.- A new
onCompromisedcallback receives a dedicatedAbortControllersignal that is aborted when compromise is detected, allowing in-flight refreshes to be cancelled. - The increased stale timeout (60 s) reduces false-positive "lock compromised" events on slow systems.
Evidence
New named error class (search for "OAuthRefreshLockContendedError")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.