alexsong-oai 3929c99a97 Refresh expired AWS credentials for Bedrock (#39410) ...

## Why

Bedrock sessions that use the AWS SDK credential chain need a way to recover when credentials expire during a request.

## What changed

- Add `aws.auth_refresh` provider configuration with an `aws` command, arguments, and a configurable timeout.
- Run the command for refreshable Bedrock authentication failures, reload the SDK credentials, re-sign the request, and retry it.
- Share refresh state across matching provider configurations so concurrent failures invoke the command only once. Bearer tokens, command auth, and static environment credentials do not use this recovery path.

## Testing

- Add coverage for configuration validation, refreshable error classification, concurrent refresh sharing, and an end-to-end retry signed with refreshed credentials.

GitOrigin-RevId: 0302fe3aabdbc1097e7bd62a74d407ba38a3cc57

2026-08-19 04:46:58 +00:00

..

src

Refresh expired AWS credentials for Bedrock (#39410)

2026-08-19 04:46:58 +00:00

BUILD.bazel

extract models manager and related ownership from core (#16508)

2026-04-02 23:00:02 -07:00

Cargo.toml

auth: move domain mode below app wire types (#29721)

2026-06-24 03:10:20 +00:00