@indigoai-us/hq-cloud 6.14.11 → 6.14.13

package/dist/cognito-auth.d.ts

@@ -50,9 +50,33 @@ export interface CognitoTokens {
 export declare class CognitoAuthError extends Error {
     constructor(message: string);
 }
+/**
+ * A failed refresh attempt with enough classification for callers to decide
+ * whether the cached session is still worth preserving. Network/5xx/429
+ * failures remain recoverable; an invalid/expired refresh token means the
+ * stored session can no longer make progress and should be cleared.
+ */
+export declare class CognitoRefreshError extends CognitoAuthError {
+    readonly requiresReauth: boolean;
+    readonly statusCode?: number;
+    readonly sessionFingerprint?: string;
+    constructor(message: string, requiresReauth: boolean, statusCode?: number, sessionFingerprint?: string);
+}
+/** Stable, non-secret identity for one access-token generation. */
+export declare function accessTokenFingerprint(accessToken: string): string;
+/**
+ * Mark only the rejected token generation unusable. Automatic auth failures
+ * must not unlink the shared cache: another process may have completed a
+ * refresh or login after the failing request started.
+ */
+export declare function invalidateCachedTokensByFingerprint(fingerprint: string | undefined): void;
 export declare function loadCachedTokens(): CognitoTokens | null;
 export declare function saveCachedTokens(tokens: CognitoTokens): void;
 export declare function clearCachedTokens(): void;
+/** Thrown when the refresh lock can't be acquired within the deadline. */
+export declare class RefreshLockTimeoutError extends Error {
+    constructor();
+}
 /** True when the token expires within the given buffer (default 60s). */
 export declare function isExpiring(tokens: CognitoTokens, bufferSeconds?: number): boolean;
 /**
@@ -70,7 +94,7 @@ export declare function isExpiring(tokens: CognitoTokens, bufferSeconds?: number
  */
 export declare function decodeAccessTokenClientId(accessToken: string): string | null;
 export interface MachineCreds {
-    /** Cognito username (live boxes: "agt-<ulid>@agents.getindigo.ai"). */
+    /** Cognito username for the machine user. */
     username: string;
     /** Long-lived machine secret (USER_PASSWORD_AUTH password). */
     secret: string;
@@ -79,6 +103,10 @@ export interface MachineCreds {
     clientId?: string;
     /** Cognito region for the mint endpoint; falls back to config. */
     region?: string;
+    /** Expected machine kind carried in the ID token's custom:entityType claim. */
+    entityType?: "agent" | "outpost";
+    /** Exact expected machine uid carried in custom:entityUid. */
+    entityUid?: string;
 }
 /** Resolve the machine-creds file path (HQ_MACHINE_CREDS_FILE overrides). */
 export declare function machineCredsFilePath(): string;
@@ -100,14 +128,9 @@ export interface MintRetryOptions {
     maxDelayMs?: number;
 }
 /**
- * Mint a fresh session for the machine identity via USER_PASSWORD_AUTH
- * against the Cognito IDP endpoint (plain unsigned HTTP — no AWS SDK
- * dependency). Caches BOTH tokens with correct field semantics and returns
- * them.
- *
- * Retries on a `TooManyRequestsException` throttle with exponential backoff +
- * full jitter (transient, per-user rate limit); every other non-OK response
- * (bad creds, disabled flow) is a hard error surfaced immediately.
+ * Mint and persist a fresh machine session while holding the process-shared
+ * token lock. The unlocked implementation is private so public callers cannot
+ * race another process's cache write.
  */
 export declare function mintMachineTokens(config: CognitoAuthConfig, creds?: MachineCreds, retry?: MintRetryOptions): Promise<CognitoTokens>;
 /**
@@ -125,10 +148,19 @@ export declare function getValidMachineTokens(config: CognitoAuthConfig): Promis
 export declare function browserLogin(config: CognitoAuthConfig): Promise<CognitoTokens>;
 /**
  * Use the refresh token to obtain a fresh access token without user interaction.
- * The refresh token itself is NOT rotated by Cognito on the refresh grant, so
- * we preserve the existing one in the result.
+ *
+ * Concurrency-safe. Several hq processes on a box refresh the same cached
+ * session at once, so the whole read→refresh→save cycle runs under a
+ * cross-process lock, and inside the lock we (a) reuse a token another refresher
+ * just produced if it's still fresh, and (b) otherwise refresh with the FRESHEST
+ * token on disk rather than the caller's snapshot. This keeps the shared cache
+ * consistent, and stays correct if the app client uses single-use (rotated)
+ * tokens — a stale snapshot would otherwise be an already-consumed token
+ * (`invalid_grant`). NOTE: rotation is NOT how boxes stay signed in — a rotated
+ * token inherits the original's remaining lifetime, so it does not extend the
+ * session (AWS). Durable never-log-out is per-box machine identity (ADR-0009).
  */
-export declare function refreshTokens(config: CognitoAuthConfig, currentRefreshToken: string): Promise<CognitoTokens>;
+export declare function refreshTokens(config: CognitoAuthConfig, currentRefreshToken: string, currentAccessToken?: string): Promise<CognitoTokens>;
 /**
  * High-level helper: return a non-expired access token, refreshing or
  * launching browser login as needed.

package/dist/cognito-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cognito-auth.d.ts","sourceRoot":"","sources":["../src/cognito-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAaH,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,+KAA+K;IAC/K,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,QAAQ,CAAC;CACrB;AAED,qFAAqF;AACrF,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AASD,wBAAgB,gBAAgB,IAAI,aAAa,GAAG,IAAI,CAQvD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAO5D;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAiBD,yEAAyE;AACzE,wBAAgB,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,aAAa,SAAK,GAAG,OAAO,CAI7E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG5E;AAyFD,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf;4EACwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,MAAM,CAK7C;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,GAAG,IAAI,CA+BtD;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAcD;+EAC+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAkCD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,iBAAiB,EACzB,KAAK,CAAC,EAAE,YAAY,EACpB,KAAK,CAAC,EAAE,gBAAgB,GACvB,OAAO,CAAC,aAAa,CAAC,CAwExB;AAsBD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,aAAa,CAAC,CAoCxB;AAsCD;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,aAAa,CAAC,CA2GxB;AAsDD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,iBAAiB,EACzB,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC,aAAa,CAAC,CA4BxB;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GACtC,OAAO,CAAC,MAAM,CAAC,CAsDjB"}
+{"version":3,"file":"cognito-auth.d.ts","sourceRoot":"","sources":["../src/cognito-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAaH,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,+KAA+K;IAC/K,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,QAAQ,CAAC;CACrB;AAED,qFAAqF;AACrF,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,gBAAgB;IACvD,SAAgB,cAAc,EAAE,OAAO,CAAC;IACxC,SAAgB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpC,SAAgB,kBAAkB,CAAC,EAAE,MAAM,CAAC;gBAG1C,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,OAAO,EACvB,UAAU,CAAC,EAAE,MAAM,EACnB,kBAAkB,CAAC,EAAE,MAAM;CAQ9B;AAUD,mEAAmE;AACnE,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAElE;AAQD;;;;GAIG;AACH,wBAAgB,mCAAmC,CACjD,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,IAAI,CAgBN;AASD,wBAAgB,gBAAgB,IAAI,aAAa,GAAG,IAAI,CAUvD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAa5D;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CASxC;AAKD,0EAA0E;AAC1E,qBAAa,uBAAwB,SAAQ,KAAK;;CAKjD;AAyHD,yEAAyE;AACzE,wBAAgB,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,aAAa,SAAK,GAAG,OAAO,CAI7E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG5E;AAyGD,MAAM,WAAW,YAAY;IAC3B,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf;4EACwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,MAAM,CAK7C;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,GAAG,IAAI,CAsDtD;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAcD;+EAC+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA+HD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,iBAAiB,EACzB,KAAK,CAAC,EAAE,YAAY,EACpB,KAAK,CAAC,EAAE,gBAAgB,GACvB,OAAO,CAAC,aAAa,CAAC,CAExB;AAiDD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,aAAa,CAAC,CA+FxB;AAsCD;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,aAAa,CAAC,CA2GxB;AA+DD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,iBAAiB,EACzB,mBAAmB,EAAE,MAAM,EAC3B,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,aAAa,CAAC,CAiHxB;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GACtC,OAAO,CAAC,MAAM,CAAC,CAkEjB"}