@vercel/oidc-aws-credentials-provider 3.2.0 → 3.3.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @vercel/oidc
 
+## 3.3.0
+
+### Minor Changes
+
+- d29a8f9: Cache exchanged OIDC tokens in memory, keyed by a hash of the source token, audience, and jti, so repeated exchanges reuse the result instead of calling the token-exchange endpoint every time. Cached tokens are evicted when the API-provided expiry passes, and the cache is bounded with least-recently-used eviction to avoid unbounded growth. Add a `skipCache` option (surfaced as `skipTokenCache` on `awsCredentialsProvider`) to bypass the cache. `jti` and the cache-skip flags are now only accepted alongside an `audience`, since they only take effect during a token exchange.
+
+### Patch Changes
+
+- Updated dependencies [d29a8f9]
+  - @vercel/oidc@3.8.0
+
+## 3.2.1
+
+### Patch Changes
+
+- Updated dependencies [fb93ff6]
+  - @vercel/oidc@3.7.1
+
 ## 3.2.0
 
 ### Minor Changes

package/dist/aws-credentials-provider.d.ts

@@ -6,6 +6,7 @@ import type { FromWebTokenInit } from '@aws-sdk/credential-provider-web-identity
  * @typedef {Object} AwsCredentialsProviderInit
  * @property {string} audience - Optional audience to set on the exchanged token.
  * @property {string} jti - Optional JTI to set on the exchanged token.
+ * @property {boolean} skipTokenCache - Optional flag to bypass the in-memory OIDC token cache. Does not affect STS credential caching.
  * @property {string} roleArn - ARN of the role that the caller is assuming.
  * @property {Object} [clientConfig] - Custom STS client configurations overriding the default ones.
  * @property {Array} [clientPlugins] - Custom STS client middleware plugin to modify the client default behavior.
@@ -16,18 +17,40 @@ import type { FromWebTokenInit } from '@aws-sdk/credential-provider-web-identity
  * @property {string} [policy] - An IAM policy in JSON format that you want to use as an inline session policy.
  * @property {number} [durationSeconds=3600] - The duration, in seconds, of the role session. Defaults to 3600 seconds.
  */
-export interface AwsCredentialsProviderInit extends Omit<FromWebTokenInit, 'webIdentityToken'> {
+/**
+ * The Vercel OIDC token options layered on top of the STS init.
+ *
+ * `jti` and `skipTokenCache` are only accepted when `audience` is provided,
+ * because they only take effect while exchanging the token for a custom
+ * audience — without an `audience` there is no exchange.
+ */
+export type VercelOidcExchangeInit = {
     /**
-     * Optional audience to set on the exchanged token.
-     * @default undefined
+     * Audience to set on the exchanged token.
      */
-    audience?: string;
+    audience: string;
     /**
      * Optional JTI to set on the exchanged token.
      * @default undefined
      */
     jti?: string;
-}
+    /**
+     * When `true`, bypasses the in-memory OIDC token cache so a fresh token is
+     * exchanged on each STS credential refresh. This only affects the Vercel
+     * OIDC token — it does not influence how the AWS SDK caches the STS-issued
+     * credentials (governed by `durationSeconds`).
+     * @default false
+     */
+    skipTokenCache?: boolean;
+} | {
+    /**
+     * @default undefined
+     */
+    audience?: undefined;
+    jti?: never;
+    skipTokenCache?: never;
+};
+export type AwsCredentialsProviderInit = Omit<FromWebTokenInit, 'webIdentityToken'> & VercelOidcExchangeInit;
 /**
  * Obtains the Vercel OIDC token and creates an AWS credential provider function
  * that gets AWS credentials by calling STS AssumeRoleWithWebIdentity API.
@@ -35,6 +58,7 @@ export interface AwsCredentialsProviderInit extends Omit<FromWebTokenInit, 'webI
  * @param {AwsCredentialsProviderInit} init - The initialization object.
  * @param {string} init.audience - Optional audience to set on the exchanged token.
  * @param {string} init.jti - Optional JTI to set on the exchanged token.
+ * @param {boolean} init.skipTokenCache - Optional flag to bypass the in-memory OIDC token cache. Does not affect STS credential caching.
  * @param {string} init.roleArn - ARN of the role that the caller is assuming.
  * @param {Object} [init.clientConfig] - Custom STS client configurations overriding the default ones.
  * @param {Array} [init.clientPlugins] - Custom STS client middleware plugin to modify the client default behavior.

package/dist/aws-credentials-provider.js

@@ -24,11 +24,14 @@ module.exports = __toCommonJS(aws_credentials_provider_exports);
 var import_credential_provider_web_identity = require("@aws-sdk/credential-provider-web-identity");
 var import_oidc = require("@vercel/oidc");
 function awsCredentialsProvider(init) {
-  const { audience, jti, ...initOptions } = init;
+  const { audience, jti, skipTokenCache, ...initOptions } = init;
   return async () => {
+    const webIdentityToken = await (0, import_oidc.getVercelOidcToken)(
+      audience === void 0 ? void 0 : { audience, jti, skipCache: skipTokenCache }
+    );
     return (0, import_credential_provider_web_identity.fromWebToken)({
       ...initOptions,
-      webIdentityToken: await (0, import_oidc.getVercelOidcToken)({ audience, jti })
+      webIdentityToken
     })();
   };
 }

package/dist/index.d.ts

@@ -1,2 +1,2 @@
-export type { AwsCredentialsProviderInit } from './aws-credentials-provider';
+export type { AwsCredentialsProviderInit, VercelOidcExchangeInit, } from './aws-credentials-provider';
 export { awsCredentialsProvider } from './aws-credentials-provider';

package/docs/README.md

@@ -4,9 +4,10 @@
 
 # @vercel/oidc-aws-credentials-provider
 
-## Interfaces
+## Type Aliases
 
-- [AwsCredentialsProviderInit](interfaces/AwsCredentialsProviderInit.md)
+- [AwsCredentialsProviderInit](type-aliases/AwsCredentialsProviderInit.md)
+- [VercelOidcExchangeInit](type-aliases/VercelOidcExchangeInit.md)
 
 ## Functions
 

package/docs/functions/awsCredentialsProvider.md

@@ -6,7 +6,7 @@
 
 > **awsCredentialsProvider**(`init`): `AwsCredentialIdentityProvider`
 
-Defined in: [packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts:77](https://github.com/vercel/vercel/blob/main/packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts#L77)
+Defined in: [aws-credentials-provider.ts:107](https://github.com/vercel/vercel/blob/main/packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts#L107)
 
 Obtains the Vercel OIDC token and creates an AWS credential provider function
 that gets AWS credentials by calling STS AssumeRoleWithWebIdentity API.
@@ -15,7 +15,7 @@ that gets AWS credentials by calling STS AssumeRoleWithWebIdentity API.
 
 ### init
 
-[`AwsCredentialsProviderInit`](../interfaces/AwsCredentialsProviderInit.md)
+[`AwsCredentialsProviderInit`](../type-aliases/AwsCredentialsProviderInit.md)
 
 The initialization object.
 

package/docs/type-aliases/AwsCredentialsProviderInit.md

@@ -0,0 +1,9 @@
+[**@vercel/oidc-aws-credentials-provider**](../README.md)
+
+---
+
+# Type Alias: AwsCredentialsProviderInit
+
+> **AwsCredentialsProviderInit** = [`Omit`](https://www.typescriptlang.org/docs/handbook/utility-types.html#omittype-keys)\<`FromWebTokenInit`, `"webIdentityToken"`\> & [`VercelOidcExchangeInit`](VercelOidcExchangeInit.md)
+
+Defined in: [aws-credentials-provider.ts:59](https://github.com/vercel/vercel/blob/main/packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts#L59)

package/docs/type-aliases/VercelOidcExchangeInit.md

@@ -0,0 +1,78 @@
+[**@vercel/oidc-aws-credentials-provider**](../README.md)
+
+---
+
+# Type Alias: VercelOidcExchangeInit
+
+> **VercelOidcExchangeInit** = \{ `audience`: `string`; `jti?`: `string`; `skipTokenCache?`: `boolean`; \} \| \{ `audience?`: `undefined`; `jti?`: `never`; `skipTokenCache?`: `never`; \}
+
+Defined in: [aws-credentials-provider.ts:30](https://github.com/vercel/vercel/blob/main/packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts#L30)
+
+The Vercel OIDC token options layered on top of the STS init.
+
+`jti` and `skipTokenCache` are only accepted when `audience` is provided,
+because they only take effect while exchanging the token for a custom
+audience — without an `audience` there is no exchange.
+
+## Union Members
+
+### Type Literal
+
+\{ `audience`: `string`; `jti?`: `string`; `skipTokenCache?`: `boolean`; \}
+
+#### audience
+
+> **audience**: `string`
+
+Audience to set on the exchanged token.
+
+#### jti?
+
+> `optional` **jti?**: `string`
+
+Optional JTI to set on the exchanged token.
+
+##### Default
+
+```ts
+undefined;
+```
+
+#### skipTokenCache?
+
+> `optional` **skipTokenCache?**: `boolean`
+
+When `true`, bypasses the in-memory OIDC token cache so a fresh token is
+exchanged on each STS credential refresh. This only affects the Vercel
+OIDC token — it does not influence how the AWS SDK caches the STS-issued
+credentials (governed by `durationSeconds`).
+
+##### Default
+
+```ts
+false;
+```
+
+---
+
+### Type Literal
+
+\{ `audience?`: `undefined`; `jti?`: `never`; `skipTokenCache?`: `never`; \}
+
+#### audience?
+
+> `optional` **audience?**: `undefined`
+
+##### Default
+
+```ts
+undefined;
+```
+
+#### jti?
+
+> `optional` **jti?**: `never`
+
+#### skipTokenCache?
+
+> `optional` **skipTokenCache?**: `never`

package/package.json

@@ -14,7 +14,7 @@
       "require": "./dist/index.js"
     }
   },
-  "version": "3.2.0",
+  "version": "3.3.0",
   "repository": {
     "directory": "packages/oidc-aws-credentials-provider",
     "type": "git",
@@ -42,7 +42,7 @@
   },
   "dependencies": {
     "@aws-sdk/credential-provider-web-identity": "^3.609.0",
-    "@vercel/oidc": "3.7.0"
+    "@vercel/oidc": "3.8.0"
   },
   "scripts": {
     "pretest": "pnpm run build:code",

package/docs/interfaces/AwsCredentialsProviderInit.md

@@ -1,215 +0,0 @@
-[**@vercel/oidc-aws-credentials-provider**](../README.md)
-
----
-
-# Interface: AwsCredentialsProviderInit
-
-Defined in: [packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts:22](https://github.com/vercel/vercel/blob/main/packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts#L22)
-
-The init object for the `awsCredentialsProvider` function.
-
-## Extends
-
-- [`Omit`](https://www.typescriptlang.org/docs/handbook/utility-types.html#omittype-keys)\<`FromWebTokenInit`, `"webIdentityToken"`\>
-
-## Properties
-
-### audience?
-
-> `optional` **audience?**: `string`
-
-Defined in: [packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts:28](https://github.com/vercel/vercel/blob/main/packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts#L28)
-
-Optional audience to set on the exchanged token.
-
----
-
-### clientConfig?
-
-> `optional` **clientConfig?**: `any`
-
-Defined in: node_modules/.pnpm/@aws-sdk+credential-provider-web-identity@3.609.0_@aws-sdk+client-sts@3.609.0/node_modules/@aws-sdk/credential-provider-web-identity/dist-types/fromWebToken.d.ts:135
-
-Custom STS client configurations overriding the default ones.
-
-#### Inherited from
-
-`Omit.clientConfig`
-
----
-
-### clientPlugins?
-
-> `optional` **clientPlugins?**: `Pluggable`\<`any`, `any`\>[]
-
-Defined in: node_modules/.pnpm/@aws-sdk+credential-provider-web-identity@3.609.0_@aws-sdk+client-sts@3.609.0/node_modules/@aws-sdk/credential-provider-web-identity/dist-types/fromWebToken.d.ts:139
-
-Custom STS client middleware plugin to modify the client default behavior.
-
-#### Inherited from
-
-`Omit.clientPlugins`
-
----
-
-### durationSeconds?
-
-> `optional` **durationSeconds?**: `number`
-
-The duration, in seconds, of the role session. Defaults to 3600 seconds.
-
-#### Inherited from
-
-`Omit.durationSeconds`
-
----
-
-### jti?
-
-> `optional` **jti?**: `string`
-
-Defined in: [packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts:33](https://github.com/vercel/vercel/blob/main/packages/oidc-aws-credentials-provider/src/aws-credentials-provider.ts#L33)
-
-Optional JTI to set on the exchanged token.
-
----
-
-### logger?
-
-> `optional` **logger?**: `Logger`
-
-Defined in: node_modules/.pnpm/@aws-sdk+types@3.609.0/node_modules/@aws-sdk/types/dist-types/credentials.d.ts:31
-
-This logger is only used to provide information
-on what credential providers were used during resolution.
-
-It does not log credentials.
-
-#### Inherited from
-
-`Omit.logger`
-
----
-
-### ~~parentClientConfig?~~
-
-> `optional` **parentClientConfig?**: `object`
-
-Defined in: node_modules/.pnpm/@aws-sdk+types@3.609.0/node_modules/@aws-sdk/types/dist-types/credentials.d.ts:45
-
-**`Internal`**
-
-Present if the credential provider was created by calling
-the defaultCredentialProvider in a client's middleware, having
-access to the client's config.
-
-The region of that parent or outer client is important because
-an inner client used by the credential provider may need
-to match its default partition or region with that of
-the outer client.
-
-#### Index Signature
-
-\[`key`: `string`\]: `unknown`
-
-#### ~~region?~~
-
-> `optional` **region?**: `string` \| `Provider`\<`string`\>
-
-#### Deprecated
-
-- not truly deprecated, marked as a warning to not use this.
-
-#### Inherited from
-
-`Omit.parentClientConfig`
-
----
-
-### policy?
-
-> `optional` **policy?**: `string`
-
-An IAM policy in JSON format that you want to use as an inline session policy.
-
-#### Inherited from
-
-`Omit.policy`
-
----
-
-### policyArns?
-
-> `optional` **policyArns?**: `object`[]
-
-ARNs of the IAM managed policies that you want to use as managed session policies.
-
-#### arn?
-
-> `optional` **arn?**: `string`
-
-#### Inherited from
-
-`Omit.policyArns`
-
----
-
-### providerId?
-
-> `optional` **providerId?**: `string`
-
-The fully qualified host component of the domain name of the identity provider.
-
-#### Inherited from
-
-`Omit.providerId`
-
----
-
-### roleArn
-
-> **roleArn**: `string`
-
-ARN of the role that the caller is assuming.
-
-#### Inherited from
-
-`Omit.roleArn`
-
----
-
-### roleAssumerWithWebIdentity?
-
-> `optional` **roleAssumerWithWebIdentity?**: (`params`) => [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<`AwsCredentialIdentity`\>
-
-Defined in: node_modules/.pnpm/@aws-sdk+credential-provider-web-identity@3.609.0_@aws-sdk+client-sts@3.609.0/node_modules/@aws-sdk/credential-provider-web-identity/dist-types/fromWebToken.d.ts:130
-
-A function that assumes a role with web identity and returns a promise fulfilled with credentials for the assumed role.
-
-#### Parameters
-
-##### params
-
-`AssumeRoleWithWebIdentityParams`
-
-#### Returns
-
-[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<`AwsCredentialIdentity`\>
-
-#### Inherited from
-
-`Omit.roleAssumerWithWebIdentity`
-
----
-
-### roleSessionName?
-
-> `optional` **roleSessionName?**: `string`
-
-Defined in: node_modules/.pnpm/@aws-sdk+credential-provider-web-identity@3.609.0_@aws-sdk+client-sts@3.609.0/node_modules/@aws-sdk/credential-provider-web-identity/dist-types/fromWebToken.d.ts:123
-
-An identifier for the assumed role session.
-
-#### Inherited from
-
-`Omit.roleSessionName`