feat: add SSO auth support

.oxlintrc.json

@@ -11,6 +11,7 @@
     "no-array-callback-reference": "off",
     "no-inline-comments": "off",
     "no-unsafe-assignment": "off",
-    "strict-boolean-expressions": "off"
+    "strict-boolean-expressions": "off",
+    "prefer-readonly-parameter-types": "off"
   }
 }

README.md

@@ -66,7 +66,11 @@ Run `ssm-secrets --help` or `ssm-secrets <command> --help` for details.
 
 ### 🔐 Authenticate
 
-Store AWS credentials in your system keyring.
+Store AWS authentication data in your system keyring.
+
+#### Static credentials
+
+Store long-lived AWS credentials:
 
 ```bash
 ssm-secrets auth
@@ -80,11 +84,34 @@ AWS Access Key ID:
 AWS Secret Access Key:
 ```
 
-These are securely saved using your OS’s secret store:
+#### AWS SSO
+
+Store AWS SSO authentication state:
+
+```bash
+ssm-secrets auth --sso-start-url https://d-zzzzzz.awsapps.com/start
+```
+
+Options:
+
+* `--region <region>`
+  AWS region for SSM and AWS SSO/OIDC endpoints. Defaults to `eu-central-1`.
 
-* Linux: Secret Service / GNOME Keyring / KWallet
-* macOS: Keychain Access
-* Windows: Credential Manager
+* `--account-id <id>`
+  Use a specific AWS SSO account instead of selecting interactively.
+
+* `--role-name <name>`
+  Use a specific AWS SSO role instead of selecting interactively.
+
+During SSO authentication, the CLI opens the AWS login URL in your browser and also prints the URL and device code as a fallback. Temporary AWS credentials, SSO tokens, client registration, account ID, role name, region, and start URL are stored in the system keyring. Later commands silently refresh credentials when possible. If silent refresh is no longer possible and browser refresh was allowed during auth, the command opens the browser again and continues after login.
+
+#### Wipe credentials
+
+Delete all stored credentials:
+
+```bash
+ssm-secrets wipe-credentials
+```
 
 ### 📜 List parameters
 
@@ -251,7 +278,11 @@ Credentials are stored securely in the system keyring via [`keyring-node`](https
 | macOS    | macOS Keychain                                                       |
 | Windows  | Credential Manager                                                   |
 
-Nothing sensitive is stored in plaintext.
+Nothing sensitive is stored in plaintext. Static AWS credentials and AWS SSO tokens are stored in the OS keyring.
+
+Current versions store credentials using keyring user with `/v2` suffix. For compatibility with older `ssm-secrets` versions, static auth also writes legacy static credentials to the default keyring target. Current versions prefer `v2` credentials and fall back to legacy static credentials when `v2` credentials are missing.
+
+SSO auth is stored only under the `/v2` suffix because older versions do not support SSO. If legacy static credentials exist, older versions can keep using them. `ssm-secrets wipe-credentials` deletes both `v2` and legacy credentials.
 
 ## 🧠 Example workflow
 

package.json

@@ -39,20 +39,24 @@
   "license": "MIT",
   "packageManager": "pnpm@10.18.1+sha512.77a884a165cbba2d8d1c19e3b4880eee6d2fcabd0d879121e282196b80042351d5eb3ca0935fa599da1dc51265cc68816ad2bddd2a2de5ea9fdf92adbec7cd34",
   "dependencies": {
-    "@aws-sdk/client-ssm": "^3.990.0",
-    "@inquirer/input": "^5.0.6",
-    "@inquirer/password": "^5.0.6",
-    "@napi-rs/keyring": "^1.2.0",
+    "@aws-sdk/client-ssm": "^3.1056.0",
+    "@aws-sdk/client-sso": "^3.1056.0",
+    "@aws-sdk/client-sso-oidc": "^3.1056.0",
+    "@inquirer/confirm": "^6.1.1",
+    "@inquirer/input": "^5.1.2",
+    "@inquirer/password": "^5.1.1",
+    "@inquirer/select": "^5.2.1",
+    "@napi-rs/keyring": "^1.3.0",
     "commander": "^14.0.3",
-    "dotenv": "^17.3.1",
-    "zod": "^4.3.6"
+    "dotenv": "^17.4.2",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@stylistic/eslint-plugin": "^5.8.0",
-    "@types/node": "^24.10.13",
-    "@typescript-eslint/parser": "^8.55.0",
-    "eslint": "^9.39.2",
-    "oxlint": "^1.48.0",
+    "@stylistic/eslint-plugin": "^5.10.0",
+    "@types/node": "^24.13.2",
+    "@typescript-eslint/parser": "^8.61.0",
+    "eslint": "^9.39.4",
+    "oxlint": "^1.69.0",
     "oxlint-tsgolint": "^0.13.0",
     "typescript": "^5.9.3"
   }