@vizamodo/aws-sts-core 0.4.11 → 0.4.13

package/dist/sts/issue.js

@@ -44,24 +44,30 @@ async function getSigningMaterial(certBase64, privateKeyPkcs8Base64) {
         cachedPrivateKeyBase64 === privateKeyPkcs8Base64) {
         return cachedSigningKey;
     }
-    // FIX 2: cache vars updated inside .then() — no race condition.
-    signingKeyPromise = null;
-    cachedSigningKey = null;
-    cachedCertBase64 = null;
-    cachedPrivateKeyBase64 = null;
-    signingKeyPromise = crypto.subtle
-        .importKey("pkcs8", base64ToBytes(privateKeyPkcs8Base64), { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"])
-        .then((key) => {
-        cachedSigningKey = key;
+    // Material rotated — discard the stale resolved key so we re-import.
+    if (cachedSigningKey) {
+        signingKeyPromise = null;
+        cachedSigningKey = null;
+    }
+    if (!signingKeyPromise) {
+        try {
+            const keyBuffer = base64ToBytes(privateKeyPkcs8Base64);
+            signingKeyPromise = crypto.subtle.importKey("pkcs8", keyBuffer, { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
+        }
+        catch {
+            throw new InternalError("invalid_signing_material");
+        }
+    }
+    try {
+        cachedSigningKey = await signingKeyPromise;
         cachedCertBase64 = certBase64;
         cachedPrivateKeyBase64 = privateKeyPkcs8Base64;
-        return key;
-    })
-        .catch(() => {
+        return cachedSigningKey;
+    }
+    catch {
         signingKeyPromise = null;
         throw new InternalError("invalid_signing_material");
-    });
-    return signingKeyPromise;
+    }
 }
 // ── Session TTL ────────────────────────────────────────────────────────────
 function resolveSessionTtl(profile) {
@@ -125,19 +131,11 @@ async function fetchCredentials(input) {
         "X-Amz-X509": normalizedCert,
         "Authorization": `${ALGORITHM} Credential=${certSerialDec}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signatureHex}`,
     });
-    // FIX 4: catch network errors as aws_unreachable.
-    let res;
-    try {
-        res = await fetch(`https://${host}${PATH}`, {
-            method: "POST",
-            headers: finalHeaders,
-            body,
-        });
-    }
-    catch (err) {
-        console.warn("[aws-unreachable]", { region, err });
-        throw new InternalError("aws_unreachable");
-    }
+    const res = await fetch(`https://${host}${PATH}`, {
+        method: "POST",
+        headers: finalHeaders,
+        body,
+    });
     if (!res.ok) {
         console.warn("[aws-rejected]", { status: res.status, region });
         throw new InternalError("aws_rejected");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.4.11",
+  "version": "0.4.13",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",