InternalAWSSSOOIDC.InvalidGrant exception throw - can not access because of `package` visibility

[sebsto]

Describe the bug

I'm trying to access a Bedrock API using an expired SSO Token.
As expected, the call fails.
It throws a InternalAWSSSOOIDC.InvalidGrantException, see

aws-sdk-swift/Sources/Core/AWSSDKIdentity/InternalClients/InternalAWSSSOOIDC/Sources/InternalAWSSSOOIDC/Models.swift

Line 195 in 96c1dbb

package struct InvalidGrantException: ClientRuntime.ModeledError, AWSClientRuntime.AWSServiceError, ClientRuntime.HTTPError, Swift.Error, Swift.Sendable {

This structure is marked with package access.
It means I can not catch this exception or write a if error == test to check for this exception.

The exception should be wrapped into an exception that users can catch separately and inspect for custom behaviour.

InvalidGrantException(properties: InternalAWSSSOOIDC.InvalidGrantException.Properties(error: Optional("invalid_grant"), error_description: Optional("Invalid refresh token provided")), httpResponse: 
Status Code: HTTP status code: 400 
 x-amzn-errortype: InvalidGrantException:http://internal.amazon.com/coral/com.amazonaws.sso.oidc/, 
Date: Mon, 13 Oct 2025 07:05:51 GMT, 
Content-Length: 78, 
Content-Type: application/json, 
x-amzn-requestid: a5c498a1-060e-46ed-a796-1609cbef4b47, message: nil, requestID: nil) 

Expected Behavior

The thrown exception must be public

Current Behavior

The exception is thrown, but it's impossible to write code like

} else if let invalidGrantError = error as? InternalAWSSSOOIDCS.InvalidGrantException { // <-- Cannot find type 'InternalAWSSSOOIDCS' in scope

            throw BedrockLibraryError.authenticationFailed(
                "AWS SSO token expired: \(invalidGrantError ?? "")"
            )
        }

Reproduction Steps

Write a client app
Use SSO authentication
Wait for the SSO token to expire
Try again

Possible Solution

Wrap the error into a publicly facing error ?

Additional Information/Context

n/a

AWS SWIFT SDK version used

1.5.61

Compiler and Version used

6.2

Operating System and version

macOS 26

[jbelkins]

Thanks for the ticket.

We will have to discuss how to expose errors arising from credential resolution; as you can see, this one originated in an internal version of the public AWS SSO OIDC client that we use to obtain the needed credentials.

Once we decide how these errors should be presented to the caller, we'll update here.