ag-awsauth 0.0.298 → 0.0.300

package/README.md

@@ -30,7 +30,8 @@ expired. A valid portal session can renew SAML role credentials directly;
 native AWS accounts use the OIDC access token, refreshing it when AWS rejects
 it. Rotated refresh tokens are saved immediately, even if a later request fails.
 
-When AWS rejects the refresh token (`InvalidGrantException`), another sign-in
+When AWS rejects the refresh token or cached refresh request
+(`InvalidGrantException` or `InvalidRequestException`), another sign-in
 is required. An unexpired client registration alone does not make a refresh
 token valid. The warning before the MFA prompt reports the reason. Portal
 outages and network failures are reported as errors instead of requesting login.

package/dist/helpers/oidcRefresh.js

@@ -26,11 +26,12 @@ class InteractiveSignInRequiredError extends Error {
     }
 }
 exports.InteractiveSignInRequiredError = InteractiveSignInRequiredError;
-// Errors that mean the stored registration/token can never be reused.
+// Cached refresh failures that require a new sign-in.
 const terminalErrorNames = [
     'InteractiveSignInRequiredError',
     'InvalidGrantException',
     'InvalidClientException',
+    'InvalidRequestException',
     'UnauthorizedClientException',
 ];
 function requiresInteractiveSignIn(e) {
@@ -50,7 +51,6 @@ function needsRefresh(p) {
     }
     return p.accessTokenExpiresAt - Date.now() <= config_1.refreshWindowMs;
 }
-const fingerprint = (t) => (t ? `${t.slice(0, 8)}...` : 'none');
 function refreshAccessToken(p) {
     return __awaiter(this, void 0, void 0, function* () {
         if (!hasRefreshMaterial(p)) {
@@ -60,7 +60,7 @@ function refreshAccessToken(p) {
             p.clientSecretExpiresAt <= Math.floor(Date.now() / 1000)) {
             throw new InteractiveSignInRequiredError('OIDC client registration has expired');
         }
-        (0, log_1.info)(`refreshing OIDC token with refresh token ${fingerprint(p.refreshToken)}`);
+        (0, log_1.info)('refreshing OIDC access token');
         const response = yield new client_sso_oidc_1.SSOOIDCClient({
             region: config_1.identityCenterRegion,
         }).send(new client_sso_oidc_1.CreateTokenCommand({

package/dist/helpers/sso.js

@@ -47,7 +47,8 @@ function fetchPortalJson(url, p, isValid) {
     });
 }
 const getAssumedRole = (p) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b, _c, _d;
+    var _a, _b, _c;
+    var _d;
     const sso = new client_sso_1.SSOClient({ region: config_1.identityCenterRegion });
     let accountId = p.accountId;
     if (!accountId) {

package/dist/helpers/sts.js

@@ -42,7 +42,8 @@ function validateCredentials(credentials) {
 }
 function getApplicationCreds(p) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
+        var _a;
+        var _b;
         const sts = new client_sts_1.STS({
             credentials: p.originCreds,
             region: p.targetRegion,
@@ -53,11 +54,11 @@ function getApplicationCreds(p) {
             SAMLAssertion: p.samlAssertion,
             DurationSeconds: config_1.stsDurationSeconds,
         });
-        if (((_a = ret.$metadata.httpStatusCode) !== null && _a !== void 0 ? _a : 500) >= 400) {
+        if (((_b = ret.$metadata.httpStatusCode) !== null && _b !== void 0 ? _b : 500) >= 400) {
             (0, log_1.error)('bad assume saml role', ret);
             throw new Error('bad assume saml role');
         }
-        if (!((_b = ret.Credentials) === null || _b === void 0 ? void 0 : _b.AccessKeyId) ||
+        if (!((_a = ret.Credentials) === null || _a === void 0 ? void 0 : _a.AccessKeyId) ||
             !ret.Credentials.SecretAccessKey ||
             !ret.Credentials.SessionToken) {
             throw new Error('no creds');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ag-awsauth",
-  "version": "0.0.298",
+  "version": "0.0.300",
   "private": false,
   "description": "auth to aws sso/iamv2 easily",
   "license": "ISC",
@@ -16,27 +16,27 @@
   ],
   "main": "dist/index.js",
   "dependencies": {
-    "@aws-sdk/client-sso": "3.972.0",
-    "@aws-sdk/client-sso-oidc": "3.972.0",
-    "@aws-sdk/client-sts": "3.972.0",
+    "@aws-sdk/client-sso": "3.1146.0",
+    "@aws-sdk/client-sso-oidc": "3.1146.0",
+    "@aws-sdk/client-sts": "3.1146.0",
     "@aws-sdk/shared-ini-file-loader": "3.374.0",
-    "ag-common": "0.0.912",
+    "ag-common": "0.0.914",
     "cli-select": "1.1.2",
-    "dotenv": "17.2.3",
+    "dotenv": "18.0.5",
     "envfile": "7.1.0",
-    "eslint-config-e7npm": "0.1.68",
-    "ini": "5.0.0",
+    "eslint-config-e7npm": "0.1.70",
+    "ini": "7.0.0",
     "node-fetch": "3.3.2",
-    "oxfmt": "^0.65.0",
-    "oxlint": "^1.83.0",
-    "puppeteer": "24.35.0",
+    "oxfmt": "^0.71.0",
+    "oxlint": "^1.86.0",
+    "puppeteer": "25.12.0",
     "readline-sync": "1.4.10",
-    "typescript": "5.9.3",
-    "yargs": "18.0.0"
+    "typescript": "7.0.2",
+    "yargs": "18.2.0"
   },
   "devDependencies": {
     "@types/ini": "4.1.1",
-    "@types/node": "24.10.9",
+    "@types/node": "26.6.4",
     "@types/node-fetch": "2.6.13",
     "@types/readline-sync": "1.4.8",
     "@types/yargs": "17.0.35"