ag-awsauth 0.0.293 → 0.0.295

package/dist/config.d.ts

@@ -11,3 +11,6 @@ export declare const runConfig: () => void;
 export declare const timeoutMs = 30000;
 export declare const timeoutShortMs = 3000;
 export declare const timeoutMedMs = 6000;
+export declare const refreshWindowMs: number;
+export declare const credentialsLockTimeoutMs: number;
+export declare const credentialsLockStaleMs: number;

package/dist/config.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.timeoutMedMs = exports.timeoutShortMs = exports.timeoutMs = exports.runConfig = exports.setConfig = exports.validateConfig = exports.targetRegion = exports.ssoStartUrl = exports.identityCenterRegion = exports.setBasePath = exports.basePath = exports.stsDurationSeconds = exports.logPath = void 0;
+exports.credentialsLockStaleMs = exports.credentialsLockTimeoutMs = exports.refreshWindowMs = exports.timeoutMedMs = exports.timeoutShortMs = exports.timeoutMs = exports.runConfig = exports.setConfig = exports.validateConfig = exports.targetRegion = exports.ssoStartUrl = exports.identityCenterRegion = exports.setBasePath = exports.basePath = exports.stsDurationSeconds = exports.logPath = void 0;
 const envfile_1 = require("envfile");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
@@ -53,3 +53,10 @@ exports.runConfig = runConfig;
 exports.timeoutMs = 30000;
 exports.timeoutShortMs = 3000;
 exports.timeoutMedMs = 6000;
+// Refresh the OIDC access token this far ahead of expiry so the rotating
+// refresh-token chain stays alive instead of being used lazily after a 401.
+exports.refreshWindowMs = 5 * 60 * 1000;
+// Serialise credential file updates across processes. A refresh token is
+// single-use, so two concurrent runs must never refresh at the same time.
+exports.credentialsLockTimeoutMs = 10 * 1000;
+exports.credentialsLockStaleMs = 30 * 1000;

package/dist/helpers/awsconfig.d.ts

@@ -1,3 +1,12 @@
 import type { IAwsCreds, IAwsCredsRaw } from '../types';
 export declare const getAwsCredentials: () => Promise<Record<string, IAwsCredsRaw>>;
+export declare const readAwsCredentials: () => Promise<IAwsCreds | undefined>;
+/**
+ * Read-modify-write of the credentials file. Callers must already hold the
+ * credentials lock (use `updateAwsCredentials` unless you are inside one).
+ *
+ * OIDC refresh material is preserved unless explicitly replaced: a partial
+ * credentials object must never wipe the only token that avoids a full login.
+ */
+export declare const saveAwsCredentialsUnlocked: (p: IAwsCreds | undefined) => Promise<void>;
 export declare const updateAwsCredentials: (p: IAwsCreds | undefined) => Promise<void>;

package/dist/helpers/awsconfig.js

@@ -12,15 +12,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.updateAwsCredentials = exports.getAwsCredentials = void 0;
+exports.updateAwsCredentials = exports.saveAwsCredentialsUnlocked = exports.readAwsCredentials = exports.getAwsCredentials = void 0;
 const shared_ini_file_loader_1 = require("@aws-sdk/shared-ini-file-loader");
 const log_1 = require("ag-common/dist/common/helpers/log");
 const fs_1 = __importDefault(require("fs"));
 const ini_1 = require("ini");
 const path_1 = require("path");
+const config_1 = require("../config");
+const credentialsLock_1 = require("./credentialsLock");
 const getCredentialsFilepath_1 = require("./getCredentialsFilepath");
 const getAwsCredentials = () => __awaiter(void 0, void 0, void 0, function* () {
-    const config = yield (0, shared_ini_file_loader_1.loadSharedConfigFiles)();
+    // Read fresh from disk: the SDK caches file contents per path, which hides
+    // tokens rotated by another process (or by an earlier step of this run).
+    const config = yield (0, shared_ini_file_loader_1.loadSharedConfigFiles)({ ignoreCache: true });
     const creds = config.credentialsFile;
     // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
     if (!creds.default) {
@@ -31,7 +35,34 @@ const getAwsCredentials = () => __awaiter(void 0, void 0, void 0, function* () {
     return ret;
 });
 exports.getAwsCredentials = getAwsCredentials;
-const updateAwsCredentials = (p) => __awaiter(void 0, void 0, void 0, function* () {
+const readAwsCredentials = () => __awaiter(void 0, void 0, void 0, function* () {
+    const credraw = yield (0, exports.getAwsCredentials)();
+    if (!credraw.default.aws_access_token) {
+        return undefined;
+    }
+    return {
+        accessKeyId: credraw.default.aws_access_key_id,
+        secretAccessKey: credraw.default.aws_secret_access_key,
+        sessionToken: credraw.default.aws_session_token,
+        accessToken: credraw.default.aws_access_token,
+        ssoAuthn: credraw.default.aws_sso_authn,
+        refreshToken: credraw.default.aws_sso_refresh_token,
+        clientId: credraw.default.aws_sso_client_id,
+        clientSecret: credraw.default.aws_sso_client_secret,
+        clientSecretExpiresAt: Number(credraw.default.aws_sso_client_secret_expires_at) || undefined,
+        accessTokenExpiresAt: Number(credraw.default.aws_sso_access_token_expires_at) || undefined,
+        region: config_1.identityCenterRegion,
+    };
+});
+exports.readAwsCredentials = readAwsCredentials;
+/**
+ * Read-modify-write of the credentials file. Callers must already hold the
+ * credentials lock (use `updateAwsCredentials` unless you are inside one).
+ *
+ * OIDC refresh material is preserved unless explicitly replaced: a partial
+ * credentials object must never wipe the only token that avoids a full login.
+ */
+const saveAwsCredentialsUnlocked = (p) => __awaiter(void 0, void 0, void 0, function* () {
     const creds = yield (0, exports.getAwsCredentials)();
     if (!p) {
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -44,26 +75,23 @@ const updateAwsCredentials = (p) => __awaiter(void 0, void 0, void 0, function*
         creds.default.aws_session_token = p.sessionToken;
         creds.default.aws_access_token = p.accessToken;
         creds.default.aws_sso_authn = p.ssoAuthn;
-        if (p.refreshToken &&
-            p.clientId &&
-            p.clientSecret &&
-            p.clientSecretExpiresAt &&
-            p.accessTokenExpiresAt) {
+        if (p.refreshToken) {
             creds.default.aws_sso_refresh_token = p.refreshToken;
+        }
+        if (p.clientId) {
             creds.default.aws_sso_client_id = p.clientId;
+        }
+        if (p.clientSecret) {
             creds.default.aws_sso_client_secret = p.clientSecret;
+        }
+        if (p.clientSecretExpiresAt) {
             creds.default.aws_sso_client_secret_expires_at =
                 p.clientSecretExpiresAt.toString();
+        }
+        if (p.accessTokenExpiresAt) {
             creds.default.aws_sso_access_token_expires_at =
                 p.accessTokenExpiresAt.toString();
         }
-        else {
-            delete creds.default.aws_sso_refresh_token;
-            delete creds.default.aws_sso_client_id;
-            delete creds.default.aws_sso_client_secret;
-            delete creds.default.aws_sso_client_secret_expires_at;
-            delete creds.default.aws_sso_access_token_expires_at;
-        }
     }
     const newcreds = (0, ini_1.stringify)(creds);
     (0, log_1.info)(`saving updated default creds to .aws/credentials`);
@@ -73,6 +101,8 @@ const updateAwsCredentials = (p) => __awaiter(void 0, void 0, void 0, function*
         fs_1.default.mkdirSync(credentialsDir, { recursive: true });
         (0, log_1.info)(`created AWS credentials directory: ${credentialsDir}`);
     }
-    fs_1.default.writeFileSync(credspath, newcreds);
+    (0, credentialsLock_1.writeFileAtomic)(credspath, newcreds);
 });
+exports.saveAwsCredentialsUnlocked = saveAwsCredentialsUnlocked;
+const updateAwsCredentials = (p) => __awaiter(void 0, void 0, void 0, function* () { return (0, credentialsLock_1.withCredentialsLock)(() => (0, exports.saveAwsCredentialsUnlocked)(p)); });
 exports.updateAwsCredentials = updateAwsCredentials;

package/dist/helpers/browser.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.allowAccessIfRequested = exports.dismissAllowAccessPrompt = exports.allowAccessSelectors = exports.goToPage = exports.launchBrowser = exports.closeBrowser = void 0;
 exports.getMFA = getMFA;
 const log_1 = require("ag-common/dist/common/helpers/log");
+const sleep_1 = require("ag-common/dist/common/helpers/sleep");
 const puppeteer_1 = require("puppeteer");
 const __1 = require("..");
 const config_1 = require("../config");
@@ -103,9 +104,7 @@ const clickSelectorIfPresent = (page_1, selector_1, ...args_1) => __awaiter(void
         catch (_a) {
             // Element may detach between query and click (SPA re-render).
             // Fall back to an in-page click which re-queries the selector.
-            yield page
-                .$eval(selector, (bn) => bn.click())
-                .catch(() => undefined);
+            yield page.$eval(selector, (bn) => bn.click()).catch(() => undefined);
         }
         return true;
     }
@@ -113,24 +112,23 @@ const clickSelectorIfPresent = (page_1, selector_1, ...args_1) => __awaiter(void
         return false;
     }
 });
-const clickAllowAccessByText = (page) => __awaiter(void 0, void 0, void 0, function* () {
+const clickAllowAccessByText = (page) => {
     try {
-        return yield page.evaluate(() => {
+        const clicked = page.evaluate(() => {
             const isVisible = (el) => {
                 const rect = el.getBoundingClientRect();
-                return (rect.width > 0 &&
-                    rect.height > 0 &&
-                    getComputedStyle(el).visibility !== 'hidden');
+                return rect.width > 0 && rect.height > 0 && getComputedStyle(el).visibility !== 'hidden';
             };
             // Match button, link, or ARIA-button variants: AWS renders the
             // "Allow access" consent action differently across releases
             // (orange button vs link), so don't assume a <button>.
             const candidates = Array.from(document.querySelectorAll('button, a, [role="button"], input[type="submit"], input[type="button"]')).filter((el) => isVisible(el));
             const label = (el) => {
-                var _a, _b;
-                return ((_b = (_a = el.value) !== null && _a !== void 0 ? _a : el.textContent) !== null && _b !== void 0 ? _b : '')
-                    .trim()
-                    .toLowerCase();
+                var _a;
+                const inputValue = el.value;
+                // oxlint-disable-next-line typescript/no-unnecessary-condition -- value is undefined on non-inputs
+                const text = typeof inputValue === 'string' ? inputValue : ((_a = el.textContent) !== null && _a !== void 0 ? _a : '');
+                return text.trim().toLowerCase();
             };
             const exact = candidates.find((el) => label(el) === 'allow access');
             const target = exact !== null && exact !== void 0 ? exact : candidates.find((el) => label(el).includes('allow access'));
@@ -140,17 +138,17 @@ const clickAllowAccessByText = (page) => __awaiter(void 0, void 0, void 0, funct
             }
             return false;
         });
+        return clicked;
     }
     catch (_a) {
-        return false;
+        return Promise.resolve(false);
     }
-});
+};
 const dismissAllowAccessPrompt = (page_1, ...args_1) => __awaiter(void 0, [page_1, ...args_1], void 0, function* (page, perSelectorTimeout = 1000) {
-    for (const selector of exports.allowAccessSelectors) {
-        if (yield clickSelectorIfPresent(page, selector, perSelectorTimeout)) {
-            (0, log_1.info)(`click allow-access-button (${selector})`);
-            return true;
-        }
+    const clicked = yield Promise.all(exports.allowAccessSelectors.map((selector) => clickSelectorIfPresent(page, selector, perSelectorTimeout)));
+    if (clicked.some(Boolean)) {
+        (0, log_1.info)('click allow-access-button');
+        return true;
     }
     if (yield clickAllowAccessByText(page)) {
         (0, log_1.info)('click allow-access-button (text match "Allow access")');
@@ -159,29 +157,40 @@ const dismissAllowAccessPrompt = (page_1, ...args_1) => __awaiter(void 0, [page_
     return false;
 });
 exports.dismissAllowAccessPrompt = dismissAllowAccessPrompt;
+const pollDelayMs = 500;
+const sleepUntilDeadline = (deadline) => __awaiter(void 0, void 0, void 0, function* () {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) {
+        return;
+    }
+    yield (0, sleep_1.sleep)(Math.min(pollDelayMs, remaining));
+});
 const allowAccessIfRequested = (page_1, ...args_1) => __awaiter(void 0, [page_1, ...args_1], void 0, function* (page, timeout = config_1.timeoutMs) {
     const deadline = Date.now() + timeout;
     // Poll so a slow-rendering consent dialog is not missed, while still
     // returning quickly when the prompt appears (or never appears).
-    while (Date.now() < deadline) {
+    // oxlint-disable-next-line no-await-in-loop -- polling must stay sequential to match dialog timing
+    for (;;) {
+        // oxlint-disable-next-line no-await-in-loop -- each poll depends on the current page state
         if (yield (0, exports.dismissAllowAccessPrompt)(page)) {
             return true;
         }
-        if (Date.now() + 500 >= deadline) {
-            break;
+        if (Date.now() >= deadline) {
+            return false;
         }
-        yield new Promise((resolve) => setTimeout(resolve, 500));
+        // oxlint-disable-next-line no-await-in-loop -- delay must elapse before the next poll
+        yield sleepUntilDeadline(deadline);
     }
-    return false;
 });
 exports.allowAccessIfRequested = allowAccessIfRequested;
 const waitForSuccessDefensively = (page_1, ...args_1) => __awaiter(void 0, [page_1, ...args_1], void 0, function* (page, timeout = config_1.timeoutMs) {
-    var _a;
     const deadline = Date.now() + timeout;
     let lastError;
-    while (Date.now() < deadline) {
+    // oxlint-disable-next-line no-await-in-loop -- success and consent checks are order-dependent
+    for (;;) {
         // Success already visible?
         try {
+            // oxlint-disable-next-line no-await-in-loop -- must check before dismissing prompts
             const success = yield page.waitForSelector('[data-analytics-alert="success"]', { timeout: 2000 });
             if (success) {
                 return;
@@ -194,6 +203,7 @@ const waitForSuccessDefensively = (page_1, ...args_1) => __awaiter(void 0, [page
         // This covers the "Allow <user> to access your data? / Allow access"
         // dialog which otherwise blocks success indefinitely.
         try {
+            // oxlint-disable-next-line no-await-in-loop -- prompt check follows the success check
             if (yield (0, exports.dismissAllowAccessPrompt)(page)) {
                 (0, log_1.info)('dismissed allow-access prompt while waiting for success');
                 continue;
@@ -204,6 +214,7 @@ const waitForSuccessDefensively = (page_1, ...args_1) => __awaiter(void 0, [page
         }
         // Also re-check the other intermediate confirmations while polling.
         try {
+            // oxlint-disable-next-line no-await-in-loop -- confirmation check follows the success check
             if (yield clickSelectorIfPresent(page, '[data-analytics="accept-user-code"]', 1000)) {
                 (0, log_1.info)('click accept-user-code (while waiting for success)');
                 continue;
@@ -213,6 +224,7 @@ const waitForSuccessDefensively = (page_1, ...args_1) => __awaiter(void 0, [page
             (0, log_1.debug)('error clicking accept-user-code while waiting:', e);
         }
         try {
+            // oxlint-disable-next-line no-await-in-loop -- auth request check follows the success check
             if (yield clickSelectorIfPresent(page, '#cli_verification_btn', 1000)) {
                 (0, log_1.info)('clicking auth request button (while waiting for success)');
             }
@@ -220,6 +232,11 @@ const waitForSuccessDefensively = (page_1, ...args_1) => __awaiter(void 0, [page
         catch (e) {
             (0, log_1.debug)('error clicking auth request button while waiting:', e);
         }
+        if (Date.now() >= deadline) {
+            break;
+        }
+        // oxlint-disable-next-line no-await-in-loop -- delay must elapse before the next poll
+        yield sleepUntilDeadline(deadline);
     }
     // Final wait to surface a clear TimeoutError if success never arrived.
     try {
@@ -227,8 +244,11 @@ const waitForSuccessDefensively = (page_1, ...args_1) => __awaiter(void 0, [page
             timeout: config_1.timeoutShortMs,
         });
     }
-    catch (_b) {
-        throw ((_a = lastError) !== null && _a !== void 0 ? _a : new Error('Timed out waiting for success'));
+    catch (_a) {
+        if (lastError instanceof Error) {
+            throw lastError;
+        }
+        throw new Error('Timed out waiting for success');
     }
 });
 function getMFA(p) {

package/dist/helpers/credentialsLock.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Runs `fn` while holding an exclusive, cross-process lock next to the
+ * credentials file. Credential updates must be serialised because a rotated
+ * OIDC refresh token is single-use: two overlapping runs that refresh at the
+ * same time leave a dead token on disk.
+ */
+export declare function withCredentialsLock<T>(fn: () => Promise<T>): Promise<T>;
+/**
+ * Writes via a temp file and an atomic rename so a crash can never leave a
+ * truncated credentials file (which would lose the refresh token).
+ */
+export declare const writeFileAtomic: (filePath: string, contents: string) => void;

package/dist/helpers/credentialsLock.js

@@ -0,0 +1,102 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeFileAtomic = void 0;
+exports.withCredentialsLock = withCredentialsLock;
+/* eslint-disable no-await-in-loop */
+const sleep_1 = require("ag-common/dist/common/helpers/sleep");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = require("path");
+const config_1 = require("../config");
+const getCredentialsFilepath_1 = require("./getCredentialsFilepath");
+const getLockPath = () => `${(0, getCredentialsFilepath_1.getCredentialsFilepath)()}.lock`;
+const ensureCredentialsDir = () => {
+    const dir = (0, path_1.dirname)((0, getCredentialsFilepath_1.getCredentialsFilepath)());
+    if (!fs_1.default.existsSync(dir)) {
+        fs_1.default.mkdirSync(dir, { recursive: true });
+    }
+};
+const tryAcquire = () => {
+    try {
+        fs_1.default.mkdirSync(getLockPath());
+        return true;
+    }
+    catch (e) {
+        if (e.code === 'EEXIST') {
+            return false;
+        }
+        throw e;
+    }
+};
+const isStale = () => {
+    try {
+        return (Date.now() - fs_1.default.statSync(getLockPath()).mtimeMs > config_1.credentialsLockStaleMs);
+    }
+    catch (_a) {
+        return false;
+    }
+};
+const release = () => {
+    try {
+        fs_1.default.rmSync(getLockPath(), { recursive: true, force: true });
+    }
+    catch (_a) {
+        //
+    }
+};
+/**
+ * Runs `fn` while holding an exclusive, cross-process lock next to the
+ * credentials file. Credential updates must be serialised because a rotated
+ * OIDC refresh token is single-use: two overlapping runs that refresh at the
+ * same time leave a dead token on disk.
+ */
+function withCredentialsLock(fn) {
+    return __awaiter(this, void 0, void 0, function* () {
+        ensureCredentialsDir();
+        const deadline = Date.now() + config_1.credentialsLockTimeoutMs;
+        while (!tryAcquire()) {
+            if (isStale()) {
+                release();
+                continue;
+            }
+            if (Date.now() >= deadline) {
+                // Another process is holding the lock. Proceed best-effort rather than
+                // blocking the user forever; stale-lock handling bounds the risk.
+                return fn();
+            }
+            yield (0, sleep_1.sleep)(100);
+        }
+        try {
+            const result = yield fn();
+            return result;
+        }
+        finally {
+            release();
+        }
+    });
+}
+/**
+ * Writes via a temp file and an atomic rename so a crash can never leave a
+ * truncated credentials file (which would lose the refresh token).
+ */
+const writeFileAtomic = (filePath, contents) => {
+    const dir = (0, path_1.dirname)(filePath);
+    if (!fs_1.default.existsSync(dir)) {
+        fs_1.default.mkdirSync(dir, { recursive: true });
+    }
+    const tmp = (0, path_1.join)(dir, `.${process.pid}.${Date.now()}.tmp`);
+    fs_1.default.writeFileSync(tmp, contents);
+    fs_1.default.renameSync(tmp, filePath);
+};
+exports.writeFileAtomic = writeFileAtomic;

package/dist/helpers/oidcRefresh.d.ts

@@ -3,4 +3,18 @@ export declare class InteractiveSignInRequiredError extends Error {
     name: string;
 }
 export declare function requiresInteractiveSignIn(e: unknown): boolean;
+/**
+ * True when the access token is missing, has unknown expiry, or is within the
+ * proactive refresh window of expiring.
+ */
+export declare function needsRefresh(p: IAwsCreds): boolean;
 export declare function refreshAccessToken(p: IAwsCreds): Promise<IAwsCreds>;
+/**
+ * Refreshes the OIDC access token ahead of expiry so the rotating refresh
+ * token chain stays alive, then persists the result atomically under a lock.
+ *
+ * Terminal failures (rejected/expired refresh token) are rethrown so the
+ * caller can start an interactive sign-in. Transient failures keep the cached
+ * token and never wipe it.
+ */
+export declare function ensureFreshCredentials(p: IAwsCreds): Promise<IAwsCreds>;

package/dist/helpers/oidcRefresh.js

@@ -11,9 +11,14 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.InteractiveSignInRequiredError = void 0;
 exports.requiresInteractiveSignIn = requiresInteractiveSignIn;
+exports.needsRefresh = needsRefresh;
 exports.refreshAccessToken = refreshAccessToken;
+exports.ensureFreshCredentials = ensureFreshCredentials;
 const client_sso_oidc_1 = require("@aws-sdk/client-sso-oidc");
+const log_1 = require("ag-common/dist/common/helpers/log");
 const config_1 = require("../config");
+const awsconfig_1 = require("./awsconfig");
+const credentialsLock_1 = require("./credentialsLock");
 class InteractiveSignInRequiredError extends Error {
     constructor() {
         super(...arguments);
@@ -21,24 +26,41 @@ class InteractiveSignInRequiredError extends Error {
     }
 }
 exports.InteractiveSignInRequiredError = InteractiveSignInRequiredError;
+// Errors that mean the stored registration/token can never be reused.
+const terminalErrorNames = [
+    'InteractiveSignInRequiredError',
+    'InvalidGrantException',
+    'InvalidClientException',
+    'UnauthorizedClientException',
+];
 function requiresInteractiveSignIn(e) {
-    return (e instanceof Error &&
-        [
-            'InteractiveSignInRequiredError',
-            'InvalidGrantException',
-            'InvalidClientException',
-            'UnauthorizedClientException',
-        ].includes(e.name));
+    return e instanceof Error && terminalErrorNames.includes(e.name);
 }
+const hasRefreshMaterial = (p) => Boolean(p.refreshToken && p.clientId && p.clientSecret);
+/**
+ * True when the access token is missing, has unknown expiry, or is within the
+ * proactive refresh window of expiring.
+ */
+function needsRefresh(p) {
+    if (!p.accessToken) {
+        return true;
+    }
+    if (!p.accessTokenExpiresAt) {
+        return true;
+    }
+    return p.accessTokenExpiresAt - Date.now() <= config_1.refreshWindowMs;
+}
+const fingerprint = (t) => (t ? `${t.slice(0, 8)}...` : 'none');
 function refreshAccessToken(p) {
     return __awaiter(this, void 0, void 0, function* () {
-        if (!p.refreshToken || !p.clientId || !p.clientSecret) {
+        if (!hasRefreshMaterial(p)) {
             throw new InteractiveSignInRequiredError('OIDC refresh details are missing');
         }
         if (p.clientSecretExpiresAt &&
             p.clientSecretExpiresAt <= Math.floor(Date.now() / 1000)) {
             throw new InteractiveSignInRequiredError('OIDC client registration has expired');
         }
+        (0, log_1.info)(`refreshing OIDC token with refresh token ${fingerprint(p.refreshToken)}`);
         const response = yield new client_sso_oidc_1.SSOOIDCClient({
             region: config_1.identityCenterRegion,
         }).send(new client_sso_oidc_1.CreateTokenCommand({
@@ -50,6 +72,45 @@ function refreshAccessToken(p) {
         if (!response.accessToken || !response.expiresIn) {
             throw new Error('OIDC refresh did not return an access token');
         }
+        const rotated = Boolean(response.refreshToken && response.refreshToken !== p.refreshToken);
+        (0, log_1.info)(`OIDC refresh succeeded; refresh token ${rotated ? 'rotated' : 'reused'}`);
         return Object.assign(Object.assign({}, p), { accessToken: response.accessToken, refreshToken: response.refreshToken || p.refreshToken, accessTokenExpiresAt: Date.now() + response.expiresIn * 1000 });
     });
 }
+/**
+ * Refreshes the OIDC access token ahead of expiry so the rotating refresh
+ * token chain stays alive, then persists the result atomically under a lock.
+ *
+ * Terminal failures (rejected/expired refresh token) are rethrown so the
+ * caller can start an interactive sign-in. Transient failures keep the cached
+ * token and never wipe it.
+ */
+function ensureFreshCredentials(p) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (!hasRefreshMaterial(p) || !needsRefresh(p)) {
+            return p;
+        }
+        try {
+            const refreshed = yield (0, credentialsLock_1.withCredentialsLock)(() => __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                // Another process may have refreshed while we waited for the lock.
+                const latest = (_a = (yield (0, awsconfig_1.readAwsCredentials)())) !== null && _a !== void 0 ? _a : p;
+                if (!hasRefreshMaterial(latest) || !needsRefresh(latest)) {
+                    (0, log_1.info)('OIDC token already refreshed by another process; reusing it');
+                    return latest;
+                }
+                const rotated = yield refreshAccessToken(latest);
+                yield (0, awsconfig_1.saveAwsCredentialsUnlocked)(rotated);
+                return rotated;
+            }));
+            return refreshed;
+        }
+        catch (e) {
+            if (requiresInteractiveSignIn(e)) {
+                throw e;
+            }
+            (0, log_1.warn)(`Unable to refresh OIDC token (${e instanceof Error ? e.name : 'unknown error'}); using cached token`);
+            return p;
+        }
+    });
+}

package/dist/helpers/sso.js

@@ -114,23 +114,24 @@ function getSamlAssertion(p, instance) {
     });
 }
 const tryExistingCredentials = () => __awaiter(void 0, void 0, void 0, function* () {
-    const credraw = yield (0, awsconfig_1.getAwsCredentials)();
-    if (!credraw.default.aws_access_token) {
+    const loaded = yield (0, awsconfig_1.readAwsCredentials)();
+    if (!loaded) {
         return undefined;
     }
-    let credentials = {
-        accessKeyId: credraw.default.aws_access_key_id,
-        secretAccessKey: credraw.default.aws_secret_access_key,
-        sessionToken: credraw.default.aws_session_token,
-        accessToken: credraw.default.aws_access_token,
-        ssoAuthn: credraw.default.aws_sso_authn,
-        refreshToken: credraw.default.aws_sso_refresh_token,
-        clientId: credraw.default.aws_sso_client_id,
-        clientSecret: credraw.default.aws_sso_client_secret,
-        clientSecretExpiresAt: Number(credraw.default.aws_sso_client_secret_expires_at) || undefined,
-        accessTokenExpiresAt: Number(credraw.default.aws_sso_access_token_expires_at) || undefined,
-        region: config_1.identityCenterRegion,
-    };
+    let credentials = loaded;
+    // Refresh proactively, independent of the portal session: the portal token
+    // can still be valid while the OIDC token is stale, and letting the refresh
+    // token go unused is what eventually kills it.
+    try {
+        credentials = yield (0, oidcRefresh_1.ensureFreshCredentials)(credentials);
+    }
+    catch (e) {
+        if (!(0, oidcRefresh_1.requiresInteractiveSignIn)(e)) {
+            throw e;
+        }
+        (0, log_1.warn)(`Unable to reuse the cached SSO session (${e instanceof Error ? e.name : 'unknown error'}); interactive sign-in required.`);
+        return emptyCredentials();
+    }
     const refresh = () => __awaiter(void 0, void 0, void 0, function* () {
         credentials = yield (0, oidcRefresh_1.refreshAccessToken)(credentials);
         yield (0, awsconfig_1.updateAwsCredentials)(credentials);

package/dist/index.js

@@ -74,6 +74,9 @@ function main(args) {
                 identityCenterRegion: config_1.identityCenterRegion,
                 ssoStartUrl: config_1.ssoStartUrl,
             });
+            // Persist the fresh refresh registration before any AWS call can fail;
+            // otherwise a later error would throw away the only non-interactive token.
+            yield (0, awsconfig_1.updateAwsCredentials)(credentials);
             (0, log_1.info)('get oidc creds');
             credentials = yield (0, sso_1.getOIDCCredentialsFromAccessToken)(credentials);
         }
@@ -86,8 +89,20 @@ function main(args) {
         let debugRole = '';
         if (instance.searchMetadata) {
             (0, log_1.info)('account is native aws, directly  connecting');
+            const accountId = instance.searchMetadata.AccountId;
             try {
-                credentials = yield (0, sso_1.getOIDCCredentialsFromAccessToken)(credentials, instance.searchMetadata.AccountId);
+                credentials = yield (0, oidcRefresh_1.ensureFreshCredentials)(credentials);
+            }
+            catch (e) {
+                if (!(0, oidcRefresh_1.requiresInteractiveSignIn)(e)) {
+                    throw e;
+                }
+                (0, log_1.warn)(`Unable to reuse the cached SSO session (${e instanceof Error ? e.name : 'unknown error'}); interactive sign-in required.`);
+                credentials = yield (0, oidc_1.requestMFA)({ identityCenterRegion: config_1.identityCenterRegion, ssoStartUrl: config_1.ssoStartUrl });
+                yield (0, awsconfig_1.updateAwsCredentials)(credentials);
+            }
+            try {
+                credentials = yield (0, sso_1.getOIDCCredentialsFromAccessToken)(credentials, accountId);
             }
             catch (e) {
                 if (!(e instanceof Error) || e.name !== 'UnauthorizedException') {
@@ -95,20 +110,20 @@ function main(args) {
                 }
                 try {
                     credentials = yield (0, oidcRefresh_1.refreshAccessToken)(credentials);
+                    yield (0, awsconfig_1.updateAwsCredentials)(credentials);
                 }
-                catch (e) {
-                    if (!(0, oidcRefresh_1.requiresInteractiveSignIn)(e)) {
-                        throw e;
+                catch (refreshError) {
+                    if (!(0, oidcRefresh_1.requiresInteractiveSignIn)(refreshError)) {
+                        throw refreshError;
                     }
-                    (0, log_1.warn)(`Unable to reuse the cached SSO session (${e instanceof Error ? e.name : 'unknown error'}); interactive sign-in required.`);
+                    (0, log_1.warn)(`Unable to reuse the cached SSO session (${refreshError instanceof Error ? refreshError.name : 'unknown error'}); interactive sign-in required.`);
                     credentials = yield (0, oidc_1.requestMFA)({ identityCenterRegion: config_1.identityCenterRegion, ssoStartUrl: config_1.ssoStartUrl });
+                    yield (0, awsconfig_1.updateAwsCredentials)(credentials);
                 }
-                // Save rotated tokens before another AWS request can fail.
-                yield (0, awsconfig_1.updateAwsCredentials)(credentials);
-                credentials = yield (0, sso_1.getOIDCCredentialsFromAccessToken)(credentials, instance.searchMetadata.AccountId);
+                credentials = yield (0, sso_1.getOIDCCredentialsFromAccessToken)(credentials, accountId);
             }
             credentials.region = config_1.targetRegion;
-            debugRole = instance.searchMetadata.AccountId;
+            debugRole = accountId;
         }
         else {
             (0, log_1.info)('account is external app, getting saml');

package/package.json

@@ -1,12 +1,10 @@
 {
   "name": "ag-awsauth",
+  "version": "0.0.295",
+  "private": false,
   "description": "auth to aws sso/iamv2 easily",
-  "main": "dist/index.js",
-  "author": "andreigec@hotmail.com",
   "license": "ISC",
-  "private": false,
-  "version": "0.0.293",
-  "preferGlobal": true,
+  "author": "andreigec@hotmail.com",
   "bin": {
     "ag-awsauth": "./bin/awsauth.js"
   },
@@ -16,18 +14,21 @@
     "README.md",
     "LICENSE.md"
   ],
+  "main": "dist/index.js",
   "dependencies": {
     "@aws-sdk/client-sso": "3.972.0",
     "@aws-sdk/client-sso-oidc": "3.972.0",
     "@aws-sdk/client-sts": "3.972.0",
     "@aws-sdk/shared-ini-file-loader": "3.374.0",
-    "ag-common": "0.0.861",
+    "ag-common": "0.0.911",
     "cli-select": "1.1.2",
     "dotenv": "17.2.3",
     "envfile": "7.1.0",
-    "eslint-config-e7npm": "0.1.31",
+    "eslint-config-e7npm": "0.1.68",
     "ini": "5.0.0",
     "node-fetch": "3.3.2",
+    "oxfmt": "^0.65.0",
+    "oxlint": "^1.83.0",
     "puppeteer": "24.35.0",
     "readline-sync": "1.4.10",
     "typescript": "5.9.3",
@@ -43,12 +44,14 @@
   "resolutions": {
     "ws": ">=8.17.1"
   },
+  "preferGlobal": true,
   "engines": {
     "node": ">=20"
   },
   "scripts": {
-    "lint": "eslint src",
-    "format": "eslint src --fix",
+    "format": "e7-oxfmt --config .oxfmtrc.json --disable-nested-config .",
+    "lint": "e7-oxlint --config .oxlintrc.json --deny-warnings src && pnpm run typecheck",
+    "typecheck": "tsc --noEmit",
     "test": "tsc && node --test test/*.test.js",
     "start": "tsc && node bin/awsauth.js",
     "build": "tsc"