@cdklabs/cdk-ssm-documents 0.0.73 → 0.0.74

package/node_modules/@aws-sdk/core/dist-es/submodules/protocols/json/AwsJsonRpcProtocol.js

@@ -1,7 +1,7 @@
 import { RpcProtocol } from "@smithy/core/protocols";
 import { deref, NormalizedSchema } from "@smithy/core/schema";
 import { ProtocolLib } from "../ProtocolLib";
-import { JsonCodec } from "./codec-v1/JsonCodec";
+import { JsonCodec2 } from "./codec-v2/JsonCodec2";
 import { loadJsonRpcErrorCode } from "./parseJsonBody";
 export class AwsJsonRpcProtocol extends RpcProtocol {
     serializer;
@@ -18,7 +18,7 @@ export class AwsJsonRpcProtocol extends RpcProtocol {
         this.serviceTarget = serviceTarget;
         this.codec =
             jsonCodec ??
-                new JsonCodec({
+                new JsonCodec2({
                     timestampFormat: {
                         useTrait: true,
                         default: 7,

package/node_modules/@aws-sdk/core/dist-es/submodules/protocols/json/AwsRestJsonProtocol.js

@@ -1,14 +1,14 @@
 import { HttpBindingProtocol, HttpInterceptingShapeDeserializer, HttpInterceptingShapeSerializer, } from "@smithy/core/protocols";
 import { NormalizedSchema } from "@smithy/core/schema";
 import { ProtocolLib } from "../ProtocolLib";
-import { JsonCodec } from "./codec-v1/JsonCodec";
+import { JsonCodec2 } from "./codec-v2/JsonCodec2";
 import { loadRestJsonErrorCode } from "./parseJsonBody";
 export class AwsRestJsonProtocol extends HttpBindingProtocol {
     serializer;
     deserializer;
     codec;
     mixin = new ProtocolLib();
-    constructor({ defaultNamespace, errorTypeRegistries, }) {
+    constructor({ defaultNamespace, errorTypeRegistries, jsonCodec, }) {
         super({
             defaultNamespace,
             errorTypeRegistries,
@@ -21,7 +21,7 @@ export class AwsRestJsonProtocol extends HttpBindingProtocol {
             httpBindings: true,
             jsonName: true,
         };
-        this.codec = new JsonCodec(settings);
+        this.codec = jsonCodec ?? new JsonCodec2(settings);
         this.serializer = new HttpInterceptingShapeSerializer(this.codec.createSerializer(), settings);
         this.deserializer = new HttpInterceptingShapeDeserializer(this.codec.createDeserializer(), settings);
     }

package/node_modules/@aws-sdk/core/dist-es/submodules/protocols/json/codec-v1/JsonShapeSerializer.js

@@ -108,7 +108,7 @@ export class JsonShapeSerializer extends SerdeContextConfig {
                 }
                 return out;
             }
-            if (value instanceof Uint8Array && (ns.isBlobSchema() || ns.isDocumentSchema())) {
+            if (value instanceof Uint8Array && ns.isBlobSchema()) {
                 if (ns === this.rootSchema) {
                     return value;
                 }
@@ -148,7 +148,7 @@ export class JsonShapeSerializer extends SerdeContextConfig {
             }
             return value;
         }
-        if (typeof value === "number" && ns.isNumericSchema()) {
+        if (typeof value === "number") {
             if (Math.abs(value) === Infinity || isNaN(value)) {
                 return String(value);
             }
@@ -165,6 +165,9 @@ export class JsonShapeSerializer extends SerdeContextConfig {
         }
         if (ns.isDocumentSchema()) {
             if (isObject) {
+                if (value instanceof Uint8Array) {
+                    return (this.serdeContext?.base64Encoder ?? toBase64)(value);
+                }
                 const out = Array.isArray(value) ? [] : {};
                 for (const k in value) {
                     const v = value[k];

package/node_modules/@aws-sdk/core/dist-es/submodules/protocols/json/codec-v2/JsonShapeSerializer2.js

@@ -2,7 +2,6 @@ import { determineTimestampFormat } from "@smithy/core/protocols";
 import { NormalizedSchema } from "@smithy/core/schema";
 import { dateToUtcString, generateIdempotencyToken, LazyJsonString, NumericValue, toBase64 } from "@smithy/core/serde";
 import { SerdeContextConfig } from "../../ConfigurableSerdeContext";
-import { writeKey } from "../../writeKey";
 import { JsonBytesStringAdapter } from "./JsonBytesStringAdapter";
 const encoder = new TextEncoder();
 const OPEN_BRACE = 0x7b;
@@ -304,7 +303,7 @@ export class JsonShapeSerializer2 extends SerdeContextConfig {
             return;
         }
         if (typeof value === "number") {
-            if (ns.isNumericSchema() && (Math.abs(value) === Infinity || isNaN(value))) {
+            if (Math.abs(value) === Infinity || Number.isNaN(value)) {
                 this.writeAsciiQuoted(String(value));
                 return;
             }
@@ -396,7 +395,33 @@ export class JsonShapeSerializer2 extends SerdeContextConfig {
         const valueSchema = ns.getValueSchema();
         if (!isDocument) {
             if (valueSchema.isStringSchema() || valueSchema.isNumericSchema() || valueSchema.isBooleanSchema()) {
-                const json = sparse ? JSON.stringify(value) : JSON.stringify(value.filter((_) => _ != null));
+                let hasSpecials = false;
+                for (let i = 0; i < value.length; ++i) {
+                    const v = value[i];
+                    if (Number.isNaN(v) || v === Infinity || v === -Infinity || (v == null && !sparse)) {
+                        hasSpecials = true;
+                        break;
+                    }
+                }
+                let json;
+                if (!hasSpecials) {
+                    json = JSON.stringify(value);
+                }
+                else {
+                    const out = [];
+                    for (let i = 0; i < value.length; ++i) {
+                        const v = value[i];
+                        if (v == null && !sparse)
+                            continue;
+                        if (Number.isNaN(v) || v === Infinity || v === -Infinity) {
+                            out.push(String(v));
+                        }
+                        else {
+                            out.push(v);
+                        }
+                    }
+                    json = JSON.stringify(out);
+                }
                 this.ensure(json.length * 3);
                 this.i += encoder.encodeInto(json, this.json.subarray(this.i)).written;
                 return;
@@ -425,17 +450,22 @@ export class JsonShapeSerializer2 extends SerdeContextConfig {
         const valueSchema = ns.getValueSchema();
         if (!isDocument) {
             if (valueSchema.isStringSchema() || valueSchema.isNumericSchema() || valueSchema.isBooleanSchema()) {
-                let input = value;
-                if (sparse) {
-                    input = {};
-                    for (const k in value) {
-                        if (k === "__proto__") {
-                            writeKey(input);
-                        }
-                        input[k] = value[k] ?? null;
+                let modifications;
+                for (const k in value) {
+                    const v = value[k];
+                    if (Number.isNaN(v) || v === Infinity || v === -Infinity) {
+                        (modifications ??= {})[k] = v;
+                        value[k] = String(v);
                     }
+                    else if (v === null && !sparse) {
+                        (modifications ??= {})[k] = null;
+                        value[k] = undefined;
+                    }
+                }
+                const json = JSON.stringify(value);
+                if (modifications) {
+                    Object.assign(value, modifications);
                 }
-                const json = JSON.stringify(input);
                 this.ensure(json.length * 3);
                 this.i += encoder.encodeInto(json, this.json.subarray(this.i)).written;
                 return;

package/node_modules/@aws-sdk/core/dist-es/submodules/protocols/json/jsonReviver.js

@@ -4,25 +4,26 @@ export function jsonReviver(key, value, context) {
         const numericString = context.source;
         if (typeof value === "number") {
             const inSafeRange = value <= Number.MAX_SAFE_INTEGER && value >= Number.MIN_SAFE_INTEGER;
-            if (!inSafeRange || numericString !== String(value)) {
-                if (inSafeRange && /[eE]/.test(numericString) && String(Number(numericString)) === String(value)) {
+            if (inSafeRange) {
+                if (isRepresentable(numericString, value)) {
                     return value;
                 }
-                if (isFractionalNumeric(numericString)) {
+                return new NumericValue(numericString, "bigDecimal");
+            }
+            else {
+                if (isFractionalBigNumeric(numericString)) {
                     return new NumericValue(numericString, "bigDecimal");
                 }
-                else {
-                    if (/[eE]/.test(numericString)) {
-                        return BigInt(Number(numericString));
-                    }
-                    return BigInt(numericString);
+                if (/[eE]/.test(numericString)) {
+                    return expandExponentToBigInt(numericString);
                 }
+                return BigInt(numericString);
             }
         }
     }
     return value;
 }
-function isFractionalNumeric(s) {
+function isFractionalBigNumeric(s) {
     const dotIndex = s.indexOf(".");
     if (dotIndex === -1) {
         return false;
@@ -35,3 +36,86 @@ function isFractionalNumeric(s) {
     const exp = parseInt(s.slice(eIndex + 1), 10);
     return exp < fracDigits;
 }
+function isRepresentable(numericString, value) {
+    if (numericString === String(value)) {
+        return true;
+    }
+    if (Object.is(value, -0)) {
+        return true;
+    }
+    if (/[eE]/.test(numericString)) {
+        return expandToDecimal(numericString) === expandToDecimal(String(value));
+    }
+    const normalized = numericString.replace(/(\.\d*?)0+$/, "$1").replace(/\.$/, "");
+    const canonical = String(value);
+    if (normalized === canonical) {
+        return true;
+    }
+    if (/[eE]/.test(canonical)) {
+        return normalized === expandToDecimal(canonical);
+    }
+    return false;
+}
+function expandToDecimal(s) {
+    const negative = s.startsWith("-");
+    const abs = negative ? s.slice(1) : s;
+    const eIndex = abs.search(/[eE]/);
+    let result;
+    if (eIndex === -1) {
+        result = abs;
+    }
+    else {
+        const exp = parseInt(abs.slice(eIndex + 1), 10);
+        const mantissa = abs.slice(0, eIndex);
+        const dotIndex = mantissa.indexOf(".");
+        let digits;
+        let intLen;
+        if (dotIndex === -1) {
+            digits = mantissa;
+            intLen = mantissa.length;
+        }
+        else {
+            digits = mantissa.slice(0, dotIndex) + mantissa.slice(dotIndex + 1);
+            intLen = dotIndex;
+        }
+        digits = digits.replace(/0+$/, "") || "0";
+        const newDotPos = intLen + exp;
+        if (digits === "0") {
+            result = "0";
+        }
+        else if (newDotPos <= 0) {
+            result = "0." + "0".repeat(-newDotPos) + digits;
+        }
+        else if (newDotPos >= digits.length) {
+            result = digits + "0".repeat(newDotPos - digits.length);
+        }
+        else {
+            result = digits.slice(0, newDotPos) + "." + digits.slice(newDotPos);
+        }
+    }
+    if (result.includes(".")) {
+        result = result.replace(/(\.\d*?)0+$/, "$1").replace(/\.$/, "");
+    }
+    return (negative ? "-" : "") + result;
+}
+function expandExponentToBigInt(s) {
+    const eIndex = s.search(/[eE]/);
+    const exp = parseInt(s.slice(eIndex + 1), 10);
+    const negative = s.startsWith("-");
+    const mantissa = s.slice(negative ? 1 : 0, eIndex);
+    const dotIndex = mantissa.indexOf(".");
+    let digits;
+    let shift;
+    if (dotIndex === -1) {
+        digits = mantissa;
+        shift = exp;
+    }
+    else {
+        digits = mantissa.slice(0, dotIndex) + mantissa.slice(dotIndex + 1);
+        const fracDigits = mantissa.length - dotIndex - 1;
+        shift = exp - fracDigits;
+    }
+    digits = digits.replace(/0+$/, "") || "0";
+    const result = BigInt(digits) * 10n ** BigInt(shift + (mantissa.replace(".", "").length - digits.length));
+    return negative ? -result : result;
+}

package/node_modules/@aws-sdk/core/dist-types/submodules/protocols/json/AwsJson1_0Protocol.d.ts

@@ -1,6 +1,7 @@
 import type { TypeRegistry } from "@smithy/core/schema";
 import { AwsJsonRpcProtocol } from "./AwsJsonRpcProtocol";
 import type { JsonCodec } from "./codec-v1/JsonCodec";
+import type { JsonCodec2 } from "./codec-v2/JsonCodec2";
 /**
  * @public
  * @see https://smithy.io/2.0/aws/protocols/aws-json-1_1-protocol.html#differences-between-awsjson1-0-and-awsjson1-1
@@ -11,7 +12,7 @@ export declare class AwsJson1_0Protocol extends AwsJsonRpcProtocol {
         errorTypeRegistries?: TypeRegistry[];
         serviceTarget: string;
         awsQueryCompatible?: boolean;
-        jsonCodec?: JsonCodec;
+        jsonCodec?: JsonCodec | JsonCodec2;
     });
     getShapeId(): string;
     protected getJsonRpcVersion(): "1.0";

package/node_modules/@aws-sdk/core/dist-types/submodules/protocols/json/AwsJson1_1Protocol.d.ts

@@ -1,6 +1,7 @@
 import type { TypeRegistry } from "@smithy/core/schema";
 import { AwsJsonRpcProtocol } from "./AwsJsonRpcProtocol";
 import type { JsonCodec } from "./codec-v1/JsonCodec";
+import type { JsonCodec2 } from "./codec-v2/JsonCodec2";
 /**
  * @public
  * @see https://smithy.io/2.0/aws/protocols/aws-json-1_1-protocol.html#differences-between-awsjson1-0-and-awsjson1-1
@@ -11,7 +12,7 @@ export declare class AwsJson1_1Protocol extends AwsJsonRpcProtocol {
         errorTypeRegistries?: TypeRegistry[];
         serviceTarget: string;
         awsQueryCompatible?: boolean;
-        jsonCodec?: JsonCodec;
+        jsonCodec?: JsonCodec | JsonCodec2;
     });
     getShapeId(): string;
     protected getJsonRpcVersion(): "1.1";

package/node_modules/@aws-sdk/core/dist-types/submodules/protocols/json/AwsJsonRpcProtocol.d.ts

@@ -1,7 +1,8 @@
 import { RpcProtocol } from "@smithy/core/protocols";
 import type { TypeRegistry } from "@smithy/core/schema";
 import type { EndpointBearer, HandlerExecutionContext, HttpRequest, HttpResponse, OperationSchema, ResponseMetadata, SerdeFunctions, ShapeDeserializer, ShapeSerializer } from "@smithy/types";
-import { JsonCodec } from "./codec-v1/JsonCodec";
+import type { JsonCodec } from "./codec-v1/JsonCodec";
+import { JsonCodec2 } from "./codec-v2/JsonCodec2";
 /**
  * @public
  */
@@ -17,10 +18,10 @@ export declare abstract class AwsJsonRpcProtocol extends RpcProtocol {
         errorTypeRegistries?: TypeRegistry[];
         serviceTarget: string;
         awsQueryCompatible?: boolean;
-        jsonCodec?: JsonCodec;
+        jsonCodec?: JsonCodec | JsonCodec2;
     });
     serializeRequest<Input extends object>(operationSchema: OperationSchema, input: Input, context: HandlerExecutionContext & SerdeFunctions & EndpointBearer): Promise<HttpRequest>;
-    getPayloadCodec(): JsonCodec;
+    getPayloadCodec(): JsonCodec | JsonCodec2;
     protected abstract getJsonRpcVersion(): "1.1" | "1.0";
     /**
      * @override

package/node_modules/@aws-sdk/core/dist-types/submodules/protocols/json/AwsRestJsonProtocol.d.ts

@@ -1,7 +1,8 @@
 import { HttpBindingProtocol } from "@smithy/core/protocols";
 import type { TypeRegistry } from "@smithy/core/schema";
 import type { EndpointBearer, HandlerExecutionContext, HttpRequest, HttpResponse, MetadataBearer, OperationSchema, ResponseMetadata, SerdeFunctions, ShapeDeserializer, ShapeSerializer } from "@smithy/types";
-import { JsonCodec } from "./codec-v1/JsonCodec";
+import type { JsonCodec } from "./codec-v1/JsonCodec";
+import { JsonCodec2 } from "./codec-v2/JsonCodec2";
 /**
  * @public
  */
@@ -10,12 +11,13 @@ export declare class AwsRestJsonProtocol extends HttpBindingProtocol {
     protected deserializer: ShapeDeserializer<string | Uint8Array>;
     private readonly codec;
     private readonly mixin;
-    constructor({ defaultNamespace, errorTypeRegistries, }: {
+    constructor({ defaultNamespace, errorTypeRegistries, jsonCodec, }: {
         defaultNamespace: string;
         errorTypeRegistries?: TypeRegistry[];
+        jsonCodec?: JsonCodec | JsonCodec2;
     });
     getShapeId(): string;
-    getPayloadCodec(): JsonCodec;
+    getPayloadCodec(): JsonCodec | JsonCodec2;
     setSerdeContext(serdeContext: SerdeFunctions): void;
     /**
      * @override

package/node_modules/@aws-sdk/core/dist-types/ts3.4/submodules/protocols/json/AwsJson1_0Protocol.d.ts

@@ -1,6 +1,7 @@
 import { TypeRegistry } from "@smithy/core/schema";
 import { AwsJsonRpcProtocol } from "./AwsJsonRpcProtocol";
 import { JsonCodec } from "./codec-v1/JsonCodec";
+import { JsonCodec2 } from "./codec-v2/JsonCodec2";
 export declare class AwsJson1_0Protocol extends AwsJsonRpcProtocol {
   constructor({
     defaultNamespace,
@@ -13,7 +14,7 @@ export declare class AwsJson1_0Protocol extends AwsJsonRpcProtocol {
     errorTypeRegistries?: TypeRegistry[];
     serviceTarget: string;
     awsQueryCompatible?: boolean;
-    jsonCodec?: JsonCodec;
+    jsonCodec?: JsonCodec | JsonCodec2;
   });
   getShapeId(): string;
   protected getJsonRpcVersion(): "1.0";

package/node_modules/@aws-sdk/core/dist-types/ts3.4/submodules/protocols/json/AwsJson1_1Protocol.d.ts

@@ -1,6 +1,7 @@
 import { TypeRegistry } from "@smithy/core/schema";
 import { AwsJsonRpcProtocol } from "./AwsJsonRpcProtocol";
 import { JsonCodec } from "./codec-v1/JsonCodec";
+import { JsonCodec2 } from "./codec-v2/JsonCodec2";
 export declare class AwsJson1_1Protocol extends AwsJsonRpcProtocol {
   constructor({
     defaultNamespace,
@@ -13,7 +14,7 @@ export declare class AwsJson1_1Protocol extends AwsJsonRpcProtocol {
     errorTypeRegistries?: TypeRegistry[];
     serviceTarget: string;
     awsQueryCompatible?: boolean;
-    jsonCodec?: JsonCodec;
+    jsonCodec?: JsonCodec | JsonCodec2;
   });
   getShapeId(): string;
   protected getJsonRpcVersion(): "1.1";

package/node_modules/@aws-sdk/core/dist-types/ts3.4/submodules/protocols/json/AwsJsonRpcProtocol.d.ts

@@ -12,6 +12,7 @@ import {
   ShapeSerializer,
 } from "@smithy/types";
 import { JsonCodec } from "./codec-v1/JsonCodec";
+import { JsonCodec2 } from "./codec-v2/JsonCodec2";
 export declare abstract class AwsJsonRpcProtocol extends RpcProtocol {
   protected serializer: ShapeSerializer<string | Uint8Array>;
   protected deserializer: ShapeDeserializer<string | Uint8Array>;
@@ -30,14 +31,14 @@ export declare abstract class AwsJsonRpcProtocol extends RpcProtocol {
     errorTypeRegistries?: TypeRegistry[];
     serviceTarget: string;
     awsQueryCompatible?: boolean;
-    jsonCodec?: JsonCodec;
+    jsonCodec?: JsonCodec | JsonCodec2;
   });
   serializeRequest<Input extends object>(
     operationSchema: OperationSchema,
     input: Input,
     context: HandlerExecutionContext & SerdeFunctions & EndpointBearer,
   ): Promise<HttpRequest>;
-  getPayloadCodec(): JsonCodec;
+  getPayloadCodec(): JsonCodec | JsonCodec2;
   protected abstract getJsonRpcVersion(): "1.1" | "1.0";
   protected handleError(
     operationSchema: OperationSchema,

package/node_modules/@aws-sdk/core/dist-types/ts3.4/submodules/protocols/json/AwsRestJsonProtocol.d.ts

@@ -13,6 +13,7 @@ import {
   ShapeSerializer,
 } from "@smithy/types";
 import { JsonCodec } from "./codec-v1/JsonCodec";
+import { JsonCodec2 } from "./codec-v2/JsonCodec2";
 export declare class AwsRestJsonProtocol extends HttpBindingProtocol {
   protected serializer: ShapeSerializer<string | Uint8Array>;
   protected deserializer: ShapeDeserializer<string | Uint8Array>;
@@ -21,12 +22,14 @@ export declare class AwsRestJsonProtocol extends HttpBindingProtocol {
   constructor({
     defaultNamespace,
     errorTypeRegistries,
+    jsonCodec,
   }: {
     defaultNamespace: string;
     errorTypeRegistries?: TypeRegistry[];
+    jsonCodec?: JsonCodec | JsonCodec2;
   });
   getShapeId(): string;
-  getPayloadCodec(): JsonCodec;
+  getPayloadCodec(): JsonCodec | JsonCodec2;
   setSerdeContext(serdeContext: SerdeFunctions): void;
   serializeRequest<Input extends object>(
     operationSchema: OperationSchema,

package/node_modules/@aws-sdk/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/core",
-  "version": "3.977.4",
+  "version": "3.977.6",
   "description": "Core functions & classes shared by multiple AWS SDK clients.",
   "homepage": "https://github.com/aws/aws-sdk-js-v3/tree/main/packages-internal/core",
   "license": "Apache-2.0",

package/node_modules/@aws-sdk/credential-provider-env/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/credential-provider-env",
-  "version": "3.972.65",
+  "version": "3.972.67",
   "description": "AWS credential provider that sources credentials from known environment variables",
   "keywords": [
     "aws",
@@ -43,7 +43,7 @@
     "test:watch": "yarn g:vitest watch"
   },
   "dependencies": {
-    "@aws-sdk/core": "^3.977.4",
+    "@aws-sdk/core": "^3.977.6",
     "@aws-sdk/types": "^3.974.2",
     "@smithy/core": "^3.31.1",
     "@smithy/types": "^4.16.1",

package/node_modules/@aws-sdk/credential-provider-http/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/credential-provider-http",
-  "version": "3.972.67",
+  "version": "3.972.69",
   "description": "AWS credential provider for containers and HTTP sources",
   "keywords": [
     "aws",
@@ -53,7 +53,7 @@
     "test:integration:watch": "yarn g:vitest watch -c vitest.config.integ.mts"
   },
   "dependencies": {
-    "@aws-sdk/core": "^3.977.4",
+    "@aws-sdk/core": "^3.977.6",
     "@aws-sdk/types": "^3.974.2",
     "@smithy/core": "^3.31.1",
     "@smithy/fetch-http-handler": "^5.6.13",

package/node_modules/@aws-sdk/credential-provider-ini/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/credential-provider-ini",
-  "version": "3.973.10",
+  "version": "3.973.12",
   "description": "AWS credential provider that sources credentials from ~/.aws/credentials and ~/.aws/config",
   "keywords": [
     "aws",
@@ -45,14 +45,14 @@
     "test:integration:watch": "yarn g:vitest watch -c vitest.config.integ.mts"
   },
   "dependencies": {
-    "@aws-sdk/core": "^3.977.4",
-    "@aws-sdk/credential-provider-env": "^3.972.65",
-    "@aws-sdk/credential-provider-http": "^3.972.67",
-    "@aws-sdk/credential-provider-login": "^3.972.72",
-    "@aws-sdk/credential-provider-process": "^3.972.65",
-    "@aws-sdk/credential-provider-sso": "^3.973.9",
-    "@aws-sdk/credential-provider-web-identity": "^3.972.71",
-    "@aws-sdk/nested-clients": "^3.997.39",
+    "@aws-sdk/core": "^3.977.6",
+    "@aws-sdk/credential-provider-env": "^3.972.67",
+    "@aws-sdk/credential-provider-http": "^3.972.69",
+    "@aws-sdk/credential-provider-login": "^3.972.74",
+    "@aws-sdk/credential-provider-process": "^3.972.67",
+    "@aws-sdk/credential-provider-sso": "^3.973.11",
+    "@aws-sdk/credential-provider-web-identity": "^3.972.73",
+    "@aws-sdk/nested-clients": "^3.997.41",
     "@aws-sdk/types": "^3.974.2",
     "@smithy/core": "^3.31.1",
     "@smithy/credential-provider-imds": "^4.4.16",

package/node_modules/@aws-sdk/credential-provider-login/dist-cjs/index.js

@@ -1,5 +1,5 @@
 const { setCredentialFeature } = require("@aws-sdk/core/client");
-const { CredentialsProviderError, readFile, parseKnownFiles, getProfileName } = require("@smithy/core/config");
+const { CredentialsProviderError, parseKnownFiles, getProfileName } = require("@smithy/core/config");
 const { HttpRequest } = require("@smithy/core/protocols");
 const { createHash, createPrivateKey, createPublicKey, sign } = require("node:crypto");
 const { promises } = require("node:fs");
@@ -28,13 +28,7 @@ class LoginCredentialsFetcher {
         if (timeUntilExpiry <= LoginCredentialsFetcher.REFRESH_THRESHOLD) {
             return this.refresh(token);
         }
-        return {
-            accessKeyId: accessToken.accessKeyId,
-            secretAccessKey: accessToken.secretAccessKey,
-            sessionToken: accessToken.sessionToken,
-            accountId: accessToken.accountId,
-            expiration: new Date(accessToken.expiresAt),
-        };
+        return this.toCredentials(token.accessToken);
     }
     get logger() {
         return this.init?.logger;
@@ -42,7 +36,25 @@ class LoginCredentialsFetcher {
     get loginSession() {
         return this.profileData.login_session;
     }
+    toCredentials(token) {
+        return {
+            accessKeyId: token.accessKeyId,
+            secretAccessKey: token.secretAccessKey,
+            sessionToken: token.sessionToken,
+            accountId: token.accountId,
+            expiration: new Date(token.expiresAt),
+        };
+    }
     async refresh(token) {
+        const diskToken = await this.loadToken().catch(() => token);
+        const now = Date.now();
+        const diskExpiry = new Date(diskToken.accessToken.expiresAt).getTime();
+        const tokenExpiry = new Date(token.accessToken.expiresAt).getTime();
+        const freshToken = diskExpiry <= now && tokenExpiry > now ? token : diskToken;
+        const freshExpiry = new Date(freshToken.accessToken.expiresAt).getTime();
+        if (freshExpiry - Date.now() > LoginCredentialsFetcher.REFRESH_THRESHOLD) {
+            return this.toCredentials(freshToken.accessToken);
+        }
         const { SigninClient, CreateOAuth2TokenCommand } = require('@aws-sdk/nested-clients/signin');
         const { logger, userAgentAppId } = this.callerClientConfig ?? {};
         const isH2 = (requestHandler) => {
@@ -66,8 +78,8 @@ class LoginCredentialsFetcher {
         this.createDPoPInterceptor(client.middlewareStack);
         const commandInput = {
             tokenInput: {
-                clientId: token.clientId,
-                refreshToken: token.refreshToken,
+                clientId: freshToken.clientId,
+                refreshToken: freshToken.refreshToken,
                 grantType: "refresh_token",
             },
         };
@@ -84,9 +96,9 @@ class LoginCredentialsFetcher {
             const expiresInMs = (expiresIn ?? 900) * 1000;
             const expiration = new Date(Date.now() + expiresInMs);
             const updatedToken = {
-                ...token,
+                ...freshToken,
                 accessToken: {
-                    ...token.accessToken,
+                    ...freshToken.accessToken,
                     accessKeyId,
                     secretAccessKey,
                     sessionToken,
@@ -95,14 +107,7 @@ class LoginCredentialsFetcher {
                 refreshToken,
             };
             await this.saveToken(updatedToken);
-            const newAccessToken = updatedToken.accessToken;
-            return {
-                accessKeyId: newAccessToken.accessKeyId,
-                secretAccessKey: newAccessToken.secretAccessKey,
-                sessionToken: newAccessToken.sessionToken,
-                accountId: newAccessToken.accountId,
-                expiration,
-            };
+            return this.toCredentials(updatedToken.accessToken);
         }
         catch (error) {
             if (error.name === "AccessDeniedException") {
@@ -123,7 +128,15 @@ class LoginCredentialsFetcher {
                     default:
                         message = `Failed to refresh token: ${String(error)}. Please re-authenticate using \`aws login\``;
                 }
-                throw new CredentialsProviderError(message, { logger: this.logger, tryNextLink: false });
+                throw new CredentialsProviderError(message, {
+                    logger: this.logger,
+                    tryNextLink: false,
+                });
+            }
+            const tokenExpiry = new Date(freshToken.accessToken.expiresAt).getTime();
+            if (tokenExpiry > Date.now()) {
+                this.logger?.warn?.(`Failed to refresh token: ${String(error)}. Using existing token until expiry.`);
+                return this.toCredentials(freshToken.accessToken);
             }
             throw new CredentialsProviderError(`Failed to refresh token: ${String(error)}. Please re-authenticate using aws login`, { logger: this.logger });
         }
@@ -131,13 +144,7 @@ class LoginCredentialsFetcher {
     async loadToken() {
         const tokenFilePath = this.getTokenFilePath();
         try {
-            let tokenData;
-            try {
-                tokenData = await readFile(tokenFilePath, { ignoreCache: this.init?.ignoreCache });
-            }
-            catch {
-                tokenData = await promises.readFile(tokenFilePath, "utf8");
-            }
+            const tokenData = await promises.readFile(tokenFilePath, "utf8");
             const token = JSON.parse(tokenData);
             const missingFields = ["accessToken", "clientId", "refreshToken", "dpopKey"].filter((k) => !token[k]);
             if (!token.accessToken?.accountId) {