@manta-eu/auth 0.1.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Manta AI AS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,63 @@
+# @manta-eu/auth
+
+Keycloak login for the SDK CLIs (`@manta-eu/codegen`, `@manta-eu/upload`): browser and device-code
+login, silent token renewal, and credential storage. It knows nothing about either CLI's own
+purpose — it only mints and renews tokens, and gives each CLI `login`/`logout`/`status` commands to
+register on its own `commander` program.
+
+## Log in
+
+`MANTA_CLIENT_SECRET` decides the path.
+
+**No secret — a person.** `userTokenSource()` builds a token source that logs in once and renews
+silently after that:
+
+```ts
+import { publicClientFrom, userTokenSource } from "@manta-eu/auth";
+
+const token = userTokenSource(publicClientFrom({ keycloakUrl, keycloakRealm }), { label: "my-cli" });
+```
+
+It opens the browser and listens on `127.0.0.1` for Keycloak to hand the login back (the
+authorization code flow with PKCE). Over SSH, or on Linux without a display, it prints a link and a
+code for a browser on another machine instead; `useDeviceCode: true` asks for that anywhere. The
+token is the person's, so a caller reads only what that person can open.
+
+The login is kept, so later runs renew it silently. It asks for `offline_access`, so it lasts until
+it goes unused for the realm's offline idle limit (30 days by default) or the person logs out.
+`userTokenSource` logs in by itself when nothing is stored and a terminal is attached; without one it
+throws and names the `login` command instead of waiting for a browser.
+
+`registerAuthCommands(program, { label })` wires `login`, `status` and `logout` into a `commander`
+program, all reading and writing the same store:
+
+| Command  | What it does                                                        |
+| -------- | ------------------------------------------------------------------- |
+| `login`  | Logs in and stores the login.                                       |
+| `status` | Says whether a login is stored, and for whom. Exits 1 when none is. |
+| `logout` | Revokes the login at Keycloak and deletes the stored copy.          |
+
+Each takes the same `--keycloak-url` and `--keycloak-realm`, because a login belongs to one
+Keycloak, realm and client. The client defaults to the realm's `<realm>-cli`, a public client made
+for this; `--client-id` is only needed for another one. Every CLI that registers these commands
+reads and writes the same store, so logging in with one serves all of them.
+
+The login lives in the macOS Keychain (service `manta-cli`), or in `~/.manta/credentials.json` with
+mode `0600` on Linux, on Windows, and on a Mac whose Keychain refuses it: while locked, e.g. over
+SSH, or for a refresh token over about 2.9 KB, the most `security` takes in one line. The CLI says
+on stderr when the file takes over. Only the refresh token is kept. `MANTA_CONFIG_DIR` moves the file.
+
+**A secret — a machine.** `mintWithClientCredentials()` asks for a service account token directly,
+with no stored login involved:
+
+```ts
+import { mintWithClientCredentials } from "@manta-eu/auth";
+
+const accessToken = await mintWithClientCredentials({ baseUrl, realm, clientId, clientSecret, scope });
+```
+
+## Renewing on refusal
+
+`withRenewal(token, call)` calls `call` with a fresh access token, and on a 401 specifically calls
+the token source's `renew()` and retries once — the same pattern Claude Code uses for MCP OAuth. Wrap
+any authenticated request with it instead of minting a token by hand.

package/dist/auth-commands.d.ts

@@ -0,0 +1,56 @@
+import type { Command } from "commander";
+import { type CredentialStore } from "./credential-store.js";
+import { type DeviceTokens, type PublicClient } from "./device-login.js";
+import { type FetchLike } from "./http.js";
+import { type RenewableTokenSource } from "./token.js";
+export type ClientOptions = {
+    keycloakUrl: string;
+    keycloakRealm: string;
+    clientId?: string;
+};
+export declare function cliClientId(realm: string): string;
+export declare const ciClientId = "manta-codegen";
+export declare const clientIdHelp = "Keycloak client id (default: <realm>-cli, or manta-codegen with MANTA_CLIENT_SECRET)";
+export type LoginOptions = {
+    useDeviceCode?: boolean;
+};
+export declare function publicClientFrom({ keycloakUrl, keycloakRealm, clientId }: ClientOptions): PublicClient;
+export declare function interactiveLogin(client: PublicClient, { label, useDeviceCode, fetchImpl, }: {
+    label: string;
+    useDeviceCode?: boolean;
+    fetchImpl?: FetchLike;
+}): Promise<DeviceTokens>;
+export declare function reportLogin(label: string, client: PublicClient, tokens: DeviceTokens, saved: boolean): void;
+export declare function notLoggedIn(label: string, client: PublicClient): Error;
+export declare function userTokenSource(client: PublicClient, { label, useDeviceCode, store, interactive, fetchImpl, }: {
+    label: string;
+    useDeviceCode?: boolean;
+    store?: CredentialStore;
+    interactive?: boolean;
+    fetchImpl?: FetchLike;
+}): RenewableTokenSource;
+export declare function revocationEndpoint(baseUrl: string, realm: string): string;
+export declare function revokeRefreshToken(client: PublicClient, refreshToken: string, fetchImpl?: FetchLike): Promise<boolean>;
+export declare function logIn(client: PublicClient, { label, useDeviceCode, store, fetchImpl, }: {
+    label: string;
+    useDeviceCode?: boolean;
+    store: CredentialStore;
+    fetchImpl?: FetchLike;
+}): Promise<void>;
+export declare function logOut(client: PublicClient, { label, store, fetchImpl }: {
+    label: string;
+    store: CredentialStore;
+    fetchImpl?: FetchLike;
+}): Promise<void>;
+export declare function loginStatus(client: PublicClient, { store }: {
+    store: CredentialStore;
+}): Promise<{
+    loggedIn: boolean;
+    line: string;
+}>;
+export declare function registerAuthCommands(program: Command, { label, store, fetchImpl, }: {
+    label: string;
+    store?: CredentialStore;
+    fetchImpl?: FetchLike;
+}): void;
+//# sourceMappingURL=auth-commands.d.ts.map

package/dist/auth-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-commands.d.ts","sourceRoot":"","sources":["../src/auth-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzC,OAAO,EAAE,KAAK,eAAe,EAA0B,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAEL,KAAK,YAAY,EAEjB,KAAK,YAAY,EAElB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAiB,KAAK,SAAS,EAAuB,MAAM,WAAW,CAAC;AAE/E,OAAO,EAAuB,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAE5E,MAAM,MAAM,aAAa,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9F,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAGD,eAAO,MAAM,UAAU,kBAAkB,CAAC;AAE1C,eAAO,MAAM,YAAY,yFAAyF,CAAC;AAEnH,MAAM,MAAM,YAAY,GAAG;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEvD,wBAAgB,gBAAgB,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,aAAa,GAAG,YAAY,CAMtG;AAUD,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,YAAY,EACpB,EACE,KAAK,EACL,aAAqB,EACrB,SAAiB,GAClB,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GACnE,OAAO,CAAC,YAAY,CAAC,CAmBvB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAK3G;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,KAAK,CAOtE;AAGD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,YAAY,EACpB,EACE,KAAK,EACL,aAAa,EACb,KAAuD,EACvD,WAA0C,EAC1C,SAAiB,GAClB,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,GACA,oBAAoB,CAetB;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE;AAGD,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,EACpB,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED,wBAAsB,KAAK,CACzB,MAAM,EAAE,YAAY,EACpB,EACE,KAAK,EACL,aAAa,EACb,KAAK,EACL,SAAiB,GAClB,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC3F,OAAO,CAAC,IAAI,CAAC,CAIf;AAGD,wBAAsB,MAAM,CAC1B,MAAM,EAAE,YAAY,EACpB,EAAE,KAAK,EAAE,KAAK,EAAE,SAAiB,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GACpG,OAAO,CAAC,IAAI,CAAC,CAgBf;AAGD,wBAAsB,WAAW,CAC/B,MAAM,EAAE,YAAY,EACpB,EAAE,KAAK,EAAE,EAAE;IAAE,KAAK,EAAE,eAAe,CAAA;CAAE,GACpC,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAM9C;AAqBD,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,EACE,KAAK,EACL,KAAuD,EACvD,SAAiB,GAClB,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GACnE,IAAI,CAsBN"}

package/dist/auth-commands.js

@@ -0,0 +1,137 @@
+import { browserLogin, loginScope } from "./browser-login.js";
+import { hasLocalBrowser, openInBrowser } from "./browser.js";
+import { defaultCredentialStore } from "./credential-store.js";
+import { createPkcePair, pollForDeviceTokens, startDeviceLogin, } from "./device-login.js";
+import { describeError, formRequest, postTo } from "./http.js";
+import { saveLogin, storedLoginTokenSource } from "./stored-login.js";
+import { accessTokenUsername } from "./token.js";
+export function cliClientId(realm) {
+    return `${realm}-cli`;
+}
+// The confidential client a CI job authenticates with through MANTA_CLIENT_SECRET.
+export const ciClientId = "manta-codegen";
+export const clientIdHelp = `Keycloak client id (default: <realm>-cli, or ${ciClientId} with MANTA_CLIENT_SECRET)`;
+export function publicClientFrom({ keycloakUrl, keycloakRealm, clientId }) {
+    return {
+        baseUrl: keycloakUrl.replace(/\/+$/, ""),
+        realm: keycloakRealm,
+        clientId: clientId ?? cliClientId(keycloakRealm),
+    };
+}
+function warnAs(label) {
+    return (message) => console.error(`${label}: ${message}`);
+}
+function where(client) {
+    return `${client.realm} at ${client.baseUrl}`;
+}
+export async function interactiveLogin(client, { label, useDeviceCode = false, fetchImpl = fetch, }) {
+    const localBrowser = hasLocalBrowser();
+    if (useDeviceCode || !localBrowser) {
+        const login = await startDeviceLogin(client, fetchImpl, createPkcePair(), loginScope);
+        console.error(`${label}: open ${login.verificationUri} and enter the code ${login.userCode}`);
+        if (localBrowser)
+            openInBrowser(login.verificationUri);
+        return pollForDeviceTokens(client, login, { fetchImpl });
+    }
+    return browserLogin(client, {
+        fetchImpl,
+        openUrl: (url) => {
+            console.error(`${label}: log in with the browser that opened. If none did, open ${url}`);
+            openInBrowser(url);
+        },
+    });
+}
+export function reportLogin(label, client, tokens, saved) {
+    const username = accessTokenUsername(tokens.accessToken);
+    console.error(`${label}: logged in to ${where(client)}${username ? ` as ${username}` : ""}`);
+    if (!saved)
+        console.error(`${label}: Keycloak sent no refresh token, so the next run logs in again.`);
+}
+export function notLoggedIn(label, client) {
+    const clientFlag = client.clientId === cliClientId(client.realm) ? "" : ` --client-id ${client.clientId}`;
+    return new Error(`not logged in to ${where(client)}. ` +
+        `Run: ${label} login --keycloak-url ${client.baseUrl} --keycloak-realm ${client.realm}${clientFlag}`);
+}
+// A run without a terminal cannot answer a browser, so it names the command to run instead of waiting.
+export function userTokenSource(client, { label, useDeviceCode, store = defaultCredentialStore({ warn: warnAs(label) }), interactive = Boolean(process.stdin.isTTY), fetchImpl = fetch, }) {
+    return storedLoginTokenSource({
+        client,
+        store,
+        fetchImpl,
+        warn: warnAs(label),
+        login: async () => {
+            if (!interactive)
+                throw notLoggedIn(label, client);
+            const tokens = await interactiveLogin(client, { label, useDeviceCode, fetchImpl });
+            reportLogin(label, client, tokens, Boolean(tokens.refreshToken));
+            return tokens;
+        },
+    });
+}
+export function revocationEndpoint(baseUrl, realm) {
+    return `${baseUrl}/realms/${realm}/protocol/openid-connect/revoke`;
+}
+// Revoking the refresh token ends its offline session in Keycloak, not just this machine's copy.
+export async function revokeRefreshToken(client, refreshToken, fetchImpl = fetch) {
+    const request = formRequest({ token: refreshToken, token_type_hint: "refresh_token", client_id: client.clientId });
+    try {
+        return (await postTo(revocationEndpoint(client.baseUrl, client.realm), request, fetchImpl)).ok;
+    }
+    catch {
+        return false;
+    }
+}
+export async function logIn(client, { label, useDeviceCode, store, fetchImpl = fetch, }) {
+    const tokens = await interactiveLogin(client, { label, useDeviceCode, fetchImpl });
+    reportLogin(label, client, tokens, await saveLogin(store, client, tokens));
+}
+// The local copy goes even when Keycloak is unreachable, since a login the user asked to end must not linger here.
+export async function logOut(client, { label, store, fetchImpl = fetch }) {
+    const stored = await store.read(client);
+    if (!stored) {
+        console.error(`${label}: not logged in to ${where(client)}`);
+        return;
+    }
+    const revoked = await revokeRefreshToken(client, stored.refreshToken, fetchImpl);
+    await store.remove(client);
+    console.error(revoked
+        ? `${label}: logged out of ${where(client)}`
+        : `${label}: deleted the stored login for ${where(client)}, but Keycloak did not confirm the revocation.`);
+}
+// Reads the store only, so it answers offline; the next run finds out whether Keycloak still accepts the login.
+export async function loginStatus(client, { store }) {
+    const stored = await store.read(client);
+    if (!stored)
+        return { loggedIn: false, line: `not logged in to ${where(client)}` };
+    return { loggedIn: true, line: `logged in to ${where(client)}${stored.username ? ` as ${stored.username}` : ""}` };
+}
+function clientCommand(program, name, description) {
+    return program
+        .command(name)
+        .description(description)
+        .requiredOption("--keycloak-url <url>", "Keycloak base URL")
+        .requiredOption("--keycloak-realm <realm>", "Keycloak realm")
+        .option("--client-id <id>", "Keycloak client id (default: <realm>-cli)");
+}
+async function reportingFailure(label, action) {
+    try {
+        await action();
+    }
+    catch (error) {
+        console.error(`${label}: ${describeError(error)}`);
+        process.exitCode = 1;
+    }
+}
+// Both CLIs register the same commands over the same store, so one login serves both.
+export function registerAuthCommands(program, { label, store = defaultCredentialStore({ warn: warnAs(label) }), fetchImpl = fetch, }) {
+    clientCommand(program, "login", "log in once; later runs renew the stored login without a browser")
+        .option("--use-device-code", "log in with a one-time code instead of a browser redirect, e.g. over SSH")
+        .action((options) => reportingFailure(label, () => logIn(publicClientFrom(options), { label, useDeviceCode: options.useDeviceCode, store, fetchImpl })));
+    clientCommand(program, "logout", "revoke the stored login at Keycloak and delete it").action((options) => reportingFailure(label, () => logOut(publicClientFrom(options), { label, store, fetchImpl })));
+    clientCommand(program, "status", "show whether a login is stored").action((options) => reportingFailure(label, async () => {
+        const { loggedIn, line } = await loginStatus(publicClientFrom(options), { store });
+        console.log(line);
+        if (!loggedIn)
+            process.exitCode = 1;
+    }));
+}

package/dist/browser-login.d.ts

@@ -0,0 +1,32 @@
+import { type DeviceTokens, type PkcePair, type PublicClient } from "./device-login.js";
+import { type FetchLike } from "./http.js";
+export declare const loginScope = "openid offline_access";
+export declare function authorizationEndpoint(baseUrl: string, realm: string): string;
+export declare function authorizationUrl(client: PublicClient, { redirectUri, state, challenge, scope }: {
+    redirectUri: string;
+    state: string;
+    challenge: string;
+    scope: string;
+}): string;
+type PendingCallback = {
+    redirectUri: string;
+    code: Promise<string>;
+    close: () => void;
+};
+export declare function listenForCallback(state: string, timeoutMs?: number): Promise<PendingCallback>;
+export declare function exchangeCode(client: PublicClient, { code, redirectUri, verifier }: {
+    code: string;
+    redirectUri: string;
+    verifier: string;
+}, fetchImpl?: FetchLike): Promise<DeviceTokens>;
+export declare function checkAuthorizationRequest(client: PublicClient, url: string, fetchImpl?: FetchLike): Promise<void>;
+export declare function browserLogin(client: PublicClient, { openUrl, fetchImpl, scope, timeoutMs, pkce, state, }: {
+    openUrl: (url: string) => void;
+    fetchImpl?: FetchLike;
+    scope?: string;
+    timeoutMs?: number;
+    pkce?: PkcePair;
+    state?: string;
+}): Promise<DeviceTokens>;
+export {};
+//# sourceMappingURL=browser-login.d.ts.map

package/dist/browser-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-login.d.ts","sourceRoot":"","sources":["../src/browser-login.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkB,KAAK,YAAY,EAAE,KAAK,QAAQ,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACxG,OAAO,EAAE,KAAK,SAAS,EAAiC,MAAM,WAAW,CAAC;AAI1E,eAAO,MAAM,UAAU,0BAA0B,CAAC;AAMlD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,YAAY,EACpB,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjH,MAAM,CAcR;AAgBD,KAAK,eAAe,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,IAAI,CAAA;CAAE,CAAC;AAGzF,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,GAAE,MAAyB,GAAG,OAAO,CAAC,eAAe,CAAC,CA+DrH;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EACxF,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAsBvB;AAGD,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAUf;AAGD,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,EACE,OAAO,EACP,SAAiB,EACjB,KAAkB,EAClB,SAA4B,EAC5B,IAAuB,EACvB,KAA6C,GAC9C,EAAE;IACD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GACA,OAAO,CAAC,YAAY,CAAC,CAoBvB"}

package/dist/browser-login.js

@@ -0,0 +1,129 @@
+import { randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { createPkcePair } from "./device-login.js";
+import { formRequest, postTo, readJson } from "./http.js";
+import { tokenEndpoint } from "./token.js";
+// offline_access makes the refresh token outlive the browser session: it lasts while it is used.
+export const loginScope = "openid offline_access";
+const callbackPath = "/callback";
+const defaultTimeoutMs = 300_000;
+export function authorizationEndpoint(baseUrl, realm) {
+    return `${baseUrl}/realms/${realm}/protocol/openid-connect/auth`;
+}
+export function authorizationUrl(client, { redirectUri, state, challenge, scope }) {
+    const url = new URL(authorizationEndpoint(client.baseUrl, client.realm));
+    url.search = new URLSearchParams({
+        client_id: client.clientId,
+        response_type: "code",
+        redirect_uri: redirectUri,
+        scope,
+        state,
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+    }).toString();
+    return url.toString();
+}
+function page(title, message) {
+    return (`<!doctype html><html lang="en"><head><meta charset="utf-8"><title>${title}</title></head>` +
+        `<body style="font-family: system-ui, sans-serif; max-width: 32rem; margin: 20vh auto; text-align: center">` +
+        `<h1 style="font-size: 1.25rem">${title}</h1><p>${message}</p></body></html>`);
+}
+function callbackFailure(error, description) {
+    return error === "access_denied"
+        ? new Error("the login was refused in the browser.")
+        : new Error(`the browser login failed with "${description ?? error}".`);
+}
+// Keycloak matches a 127.0.0.1 redirect URI whatever its port, so the OS picks a free one.
+export async function listenForCallback(state, timeoutMs = defaultTimeoutMs) {
+    let settle;
+    const code = new Promise((resolve, reject) => (settle = { resolve, reject }));
+    // A timeout can fire after the caller stopped waiting; that must not surface as an unhandled rejection.
+    code.catch(() => undefined);
+    const server = createServer((request, response) => {
+        const url = new URL(request.url ?? "/", "http://127.0.0.1");
+        if (url.pathname !== callbackPath) {
+            response.writeHead(404).end();
+            return;
+        }
+        const answer = (status, title, message) => response.writeHead(status, { "content-type": "text/html; charset=utf-8" }).end(page(title, message));
+        // A page on another origin can load this URL too; only the state this process sent proves the answer.
+        if (url.searchParams.get("state") !== state) {
+            answer(400, "Login failed", "This login link does not belong to the command that is waiting. Run it again.");
+            return;
+        }
+        const error = url.searchParams.get("error");
+        const received = url.searchParams.get("code");
+        if (error || !received) {
+            answer(400, "Login failed", "Return to your terminal for the details.");
+            settle?.reject(callbackFailure(error ?? "missing_code", url.searchParams.get("error_description")));
+            return;
+        }
+        answer(200, "Logged in to Manta", "You can close this tab and return to your terminal.");
+        settle?.resolve(received);
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            server.off("error", reject);
+            resolve();
+        });
+    }).catch((cause) => {
+        throw new Error("cannot listen on 127.0.0.1 for the browser login. Use --use-device-code.", {
+            cause,
+        });
+    });
+    const timer = setTimeout(() => settle?.reject(new Error("nobody finished the login in time. Run it again.")), timeoutMs);
+    const { port } = server.address();
+    return {
+        redirectUri: `http://127.0.0.1:${port}${callbackPath}`,
+        code,
+        close: () => {
+            clearTimeout(timer);
+            server.close();
+        },
+    };
+}
+export async function exchangeCode(client, { code, redirectUri, verifier }, fetchImpl = fetch) {
+    const endpoint = tokenEndpoint(client.baseUrl, client.realm);
+    const request = formRequest({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: redirectUri,
+        client_id: client.clientId,
+        code_verifier: verifier,
+    });
+    const response = await postTo(endpoint, request, fetchImpl);
+    const body = await readJson(response, endpoint);
+    if (!response.ok || !body.access_token) {
+        throw new Error(`${endpoint} refused the login with status ${response.status}. ${body.error_description ?? ""}`.trim());
+    }
+    return { accessToken: body.access_token, ...(body.refresh_token ? { refreshToken: body.refresh_token } : {}) };
+}
+// Keycloak answers an unknown client or redirect URI with its own error page, never with a redirect back here.
+export async function checkAuthorizationRequest(client, url, fetchImpl = fetch) {
+    const response = await postTo(url, { method: "GET", redirect: "manual" }, fetchImpl);
+    await response.body?.cancel().catch(() => undefined);
+    if (response.status >= 400) {
+        throw new Error(`Keycloak refused to start the login with status ${response.status}. ` +
+            `Check that realm ${client.realm} at ${client.baseUrl} has the client ${client.clientId}.`);
+    }
+}
+// The authorization code flow with PKCE and a loopback redirect (RFC 8252), as Claude Code and the AWS CLI log in.
+export async function browserLogin(client, { openUrl, fetchImpl = fetch, scope = loginScope, timeoutMs = defaultTimeoutMs, pkce = createPkcePair(), state = randomBytes(16).toString("base64url"), }) {
+    const callback = await listenForCallback(state, timeoutMs);
+    try {
+        const url = authorizationUrl(client, {
+            redirectUri: callback.redirectUri,
+            state,
+            challenge: pkce.challenge,
+            scope,
+        });
+        await checkAuthorizationRequest(client, url, fetchImpl);
+        openUrl(url);
+        const code = await callback.code;
+        return await exchangeCode(client, { code, redirectUri: callback.redirectUri, verifier: pkce.verifier }, fetchImpl);
+    }
+    finally {
+        callback.close();
+    }
+}

package/dist/browser.d.ts

@@ -0,0 +1,4 @@
+export declare function hasLocalBrowser(env?: Record<string, string | undefined>, platform?: string): boolean;
+export declare function browserCommand(url: string, platform?: string): [string, string[]];
+export declare function openInBrowser(url: string, platform?: string): void;
+//# sourceMappingURL=browser.d.ts.map

package/dist/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAEA,wBAAgB,eAAe,CAC7B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,QAAQ,GAAE,MAAyB,GAClC,OAAO,CAKT;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAyB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAKnG;AAGD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAyB,GAAG,IAAI,CAWpF"}

package/dist/browser.js

@@ -0,0 +1,27 @@
+import { spawn } from "node:child_process";
+export function hasLocalBrowser(env = process.env, platform = process.platform) {
+    if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY)
+        return false;
+    if (platform === "linux")
+        return Boolean(env.DISPLAY || env.WAYLAND_DISPLAY);
+    return true;
+}
+export function browserCommand(url, platform = process.platform) {
+    if (platform === "darwin")
+        return ["open", [url]];
+    if (platform === "win32")
+        return ["rundll32", ["url.dll,FileProtocolHandler", url]];
+    return ["xdg-open", [url]];
+}
+// Best effort: the URL is always printed too, so a browser that fails to open costs nothing.
+export function openInBrowser(url, platform = process.platform) {
+    const [command, args] = browserCommand(url, platform);
+    try {
+        const child = spawn(command, args, { stdio: "ignore", detached: true });
+        child.on("error", () => undefined);
+        child.unref();
+    }
+    catch {
+        return;
+    }
+}

package/dist/credential-store.d.ts

@@ -0,0 +1,32 @@
+import type { PublicClient } from "./device-login.js";
+export type StoredLogin = {
+    refreshToken: string;
+    username?: string;
+    savedAt?: number;
+};
+export type CredentialStore = {
+    read: (client: PublicClient) => Promise<StoredLogin | undefined>;
+    write: (client: PublicClient, login: StoredLogin) => Promise<void>;
+    remove: (client: PublicClient) => Promise<void>;
+};
+export declare function loginKeyId({ baseUrl, realm, clientId }: PublicClient): string;
+export declare function configDir(env?: Record<string, string | undefined>): string;
+export declare function credentialsFilePath(env?: Record<string, string | undefined>): string;
+export declare function fileCredentialStore(path?: string): CredentialStore;
+export type SecurityResult = {
+    code: number;
+    stdout: string;
+};
+export type RunSecurity = (args: string[], stdin?: string) => Promise<SecurityResult>;
+export declare const keychainService = "manta-cli";
+export declare const runSecurity: RunSecurity;
+export declare function keychainCredentialStore(run?: RunSecurity): CredentialStore;
+export declare function keychainWithFileFallback(keychain: CredentialStore, file: CredentialStore, { clock, warn }?: {
+    clock?: () => number;
+    warn?: (reason: string) => void;
+}): CredentialStore;
+export declare function defaultCredentialStore({ platform, warn, }?: {
+    platform?: string;
+    warn?: (message: string) => void;
+}): CredentialStore;
+//# sourceMappingURL=credential-store.d.ts.map

package/dist/credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAItD,MAAM,MAAM,WAAW,GAAG;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IACjE,KAAK,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD,CAAC;AAGF,wBAAgB,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,YAAY,GAAG,MAAM,CAE7E;AAED,wBAAgB,SAAS,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,CAEvF;AAED,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,CAEjG;AA6DD,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,MAA8B,GAAG,eAAe,CAoBzF;AAED,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AAEtF,eAAO,MAAM,eAAe,cAAc,CAAC;AAE3C,eAAO,MAAM,WAAW,EAAE,WAStB,CAAC;AAsBL,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,WAAyB,GAAG,eAAe,CAwBvF;AAGD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,eAAe,EACrB,EAAE,KAAgB,EAAE,IAAsB,EAAE,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GAC3G,eAAe,CA+BjB;AAED,wBAAgB,sBAAsB,CAAC,EACrC,QAA2B,EAC3B,IAAoB,GACrB,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GAAG,eAAe,CAShF"}

package/dist/credential-store.js

@@ -0,0 +1,167 @@
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { describeError } from "./http.js";
+// One entry per Keycloak, realm and client, so staging, production and another realm never share a login.
+export function loginKeyId({ baseUrl, realm, clientId }) {
+    return `${baseUrl.replace(/\/+$/, "")} ${realm} ${clientId}`;
+}
+export function configDir(env = process.env) {
+    return env.MANTA_CONFIG_DIR || join(homedir(), ".manta");
+}
+export function credentialsFilePath(env = process.env) {
+    return join(configDir(env), "credentials.json");
+}
+function isStoredLogin(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const { refreshToken, username, savedAt } = value;
+    return (typeof refreshToken === "string" &&
+        (username === undefined || typeof username === "string") &&
+        (savedAt === undefined || typeof savedAt === "number"));
+}
+function isMissingFile(error) {
+    return error?.code === "ENOENT";
+}
+async function readCredentialsFile(path) {
+    let text;
+    try {
+        text = await readFile(path, "utf8");
+    }
+    catch (error) {
+        if (isMissingFile(error))
+            return { logins: {} };
+        throw error;
+    }
+    // Rewriting a file it could not read would drop every other login in it.
+    const unreadable = new Error(`${path} is not a credentials file. Delete it and log in again.`);
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw unreadable;
+    }
+    const logins = parsed?.logins;
+    if (typeof logins !== "object" || logins === null)
+        throw unreadable;
+    return {
+        logins: Object.fromEntries(Object.entries(logins).filter((entry) => isStoredLogin(entry[1]))),
+    };
+}
+// Written to a sibling and renamed, so a crash never leaves half a file behind.
+async function writeCredentialsFile(path, file) {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const sibling = `${path}.${randomBytes(6).toString("hex")}.tmp`;
+    await writeFile(sibling, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
+    await rename(sibling, path);
+}
+// Mode 0600 on macOS and Linux; on Windows the user profile's own permissions restrict it.
+export function fileCredentialStore(path = credentialsFilePath()) {
+    return {
+        async read(client) {
+            return (await readCredentialsFile(path)).logins[loginKeyId(client)];
+        },
+        async write(client, login) {
+            const file = await readCredentialsFile(path);
+            await writeCredentialsFile(path, { logins: { ...file.logins, [loginKeyId(client)]: login } });
+        },
+        async remove(client) {
+            const file = await readCredentialsFile(path);
+            const id = loginKeyId(client);
+            if (!(id in file.logins))
+                return;
+            const { [id]: _removed, ...rest } = file.logins;
+            await writeCredentialsFile(path, { logins: rest });
+        },
+    };
+}
+export const keychainService = "manta-cli";
+export const runSecurity = (args, stdin) => new Promise((resolve) => {
+    const child = spawn("security", args, { stdio: ["pipe", "pipe", "ignore"] });
+    let stdout = "";
+    child.stdout.on("data", (chunk) => (stdout += chunk.toString("utf8")));
+    child.on("error", () => resolve({ code: -1, stdout: "" }));
+    child.on("close", (code) => resolve({ code: code ?? -1, stdout }));
+    child.stdin.end(stdin ?? "");
+});
+function keychainAccount(client) {
+    const account = loginKeyId(client);
+    // `security -i` splits its input like a shell, so a quote would end the account early.
+    if (/["\\\n]/.test(account))
+        throw new Error(`cannot store a login for ${account} in the Keychain.`);
+    return account;
+}
+function decodeKeychainSecret(stdout) {
+    try {
+        const parsed = JSON.parse(Buffer.from(stdout.trim(), "base64").toString("utf8"));
+        return isStoredLogin(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+// The secret goes in on stdin through `security -i`, never as an argument other processes can list.
+export function keychainCredentialStore(run = runSecurity) {
+    async function read(client) {
+        const found = await run(["find-generic-password", "-s", keychainService, "-a", keychainAccount(client), "-w"]);
+        return found.code === 0 ? decodeKeychainSecret(found.stdout) : undefined;
+    }
+    return {
+        read,
+        async write(client, login) {
+            const secret = Buffer.from(JSON.stringify(login)).toString("base64");
+            const command = `add-generic-password -U -s ${keychainService} -a "${keychainAccount(client)}" -w ${secret}\n`;
+            await run(["-i"], command);
+            // `security -i` does not report a failed inner command in its exit code, so the write is read back.
+            if ((await read(client))?.refreshToken !== login.refreshToken) {
+                throw new Error("the Keychain refused the login.");
+            }
+        },
+        async remove(client) {
+            await run(["delete-generic-password", "-s", keychainService, "-a", keychainAccount(client)]);
+        },
+    };
+}
+// The Keychain refuses a write while locked, e.g. over SSH, or past `security -i`'s ~4 KB line, so the file takes over.
+export function keychainWithFileFallback(keychain, file, { clock = Date.now, warn = () => undefined } = {}) {
+    return {
+        async read(client) {
+            const [fromFile, fromKeychain] = await Promise.all([
+                file.read(client).catch(() => undefined),
+                keychain.read(client).catch(() => undefined),
+            ]);
+            // Either copy can be stale: the Keychain's after it refused a write, the file's after a failed remove.
+            return (fromKeychain?.savedAt ?? 0) > (fromFile?.savedAt ?? 0) ? fromKeychain : (fromFile ?? fromKeychain);
+        },
+        async write(client, login) {
+            const stamped = { ...login, savedAt: clock() };
+            try {
+                await keychain.write(client, stamped);
+            }
+            catch (error) {
+                const movesToFile = !(await file.read(client).catch(() => undefined));
+                await file.write(client, stamped);
+                if (movesToFile)
+                    warn(describeError(error));
+                return;
+            }
+            await file.remove(client).catch(() => undefined);
+        },
+        async remove(client) {
+            await keychain.remove(client).catch(() => undefined);
+            await file.remove(client);
+        },
+    };
+}
+export function defaultCredentialStore({ platform = process.platform, warn = console.error, } = {}) {
+    const path = credentialsFilePath();
+    const file = fileCredentialStore(path);
+    if (platform !== "darwin")
+        return file;
+    return keychainWithFileFallback(keychainCredentialStore(), file, {
+        warn: (reason) => warn(`${reason} Stored it in ${path} instead.`),
+    });
+}

package/dist/device-login.d.ts

@@ -0,0 +1,36 @@
+import { type FetchLike } from "./http.js";
+export type PublicClient = {
+    baseUrl: string;
+    realm: string;
+    clientId: string;
+};
+export type DeviceLogin = {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    intervalMs: number;
+    expiresInMs: number;
+    codeVerifier: string;
+};
+export type PkcePair = {
+    verifier: string;
+    challenge: string;
+};
+export type Sleep = (ms: number) => Promise<void>;
+export declare function deviceAuthEndpoint(baseUrl: string, realm: string): string;
+export declare function createPkcePair(): PkcePair;
+export declare function startDeviceLogin(client: PublicClient, fetchImpl?: FetchLike, pkce?: PkcePair, scope?: string): Promise<DeviceLogin>;
+export type DeviceTokens = {
+    accessToken: string;
+    refreshToken?: string;
+};
+export declare function pollForDeviceTokens(client: PublicClient, { deviceCode, codeVerifier, intervalMs, expiresInMs, }: Pick<DeviceLogin, "deviceCode" | "codeVerifier"> & {
+    intervalMs?: number;
+    expiresInMs?: number;
+}, { fetchImpl, sleep, clock, }?: {
+    fetchImpl?: FetchLike;
+    sleep?: Sleep;
+    clock?: () => number;
+}): Promise<DeviceTokens>;
+export declare function refreshAccessToken(client: PublicClient, refreshToken: string, fetchImpl?: FetchLike): Promise<DeviceTokens | undefined>;
+//# sourceMappingURL=device-login.d.ts.map

package/dist/device-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-login.d.ts","sourceRoot":"","sources":["../src/device-login.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,SAAS,EAAoD,MAAM,WAAW,CAAC;AAG7F,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,MAAM,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAclD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE;AAGD,wBAAgB,cAAc,IAAI,QAAQ,CAIzC;AA+BD,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,YAAY,EACpB,SAAS,GAAE,SAAiB,EAC5B,IAAI,GAAE,QAA2B,EACjC,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,WAAW,CAAC,CAkBtB;AAyBD,MAAM,MAAM,YAAY,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,YAAY,EACpB,EACE,UAAU,EACV,YAAY,EACZ,UAA8B,EAC9B,WAAgC,GACjC,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,GAAG,cAAc,CAAC,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EACnG,EACE,SAAiB,EACjB,KAAgB,EAChB,KAAgB,GACjB,GAAE;IAAE,SAAS,CAAC,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CAAO,GACrE,OAAO,CAAC,YAAY,CAAC,CAwBvB;AAGD,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,EACpB,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAiBnC"}

package/dist/device-login.js

@@ -0,0 +1,109 @@
+import { createHash, randomBytes } from "node:crypto";
+import { formRequest, isTransientStatus, postTo, readJson } from "./http.js";
+import { tokenEndpoint } from "./token.js";
+const deviceCodeGrant = "urn:ietf:params:oauth:grant-type:device_code";
+// RFC 8628 says to add this much whenever the server answers slow_down.
+const slowDownStepMs = 5_000;
+const defaultIntervalMs = 5_000;
+// RFC 8628 makes expires_in optional, and Keycloak sends ten minutes.
+const defaultExpiresInMs = 600_000;
+const sleepFor = (ms) => new Promise((done) => setTimeout(done, ms));
+export function deviceAuthEndpoint(baseUrl, realm) {
+    return `${baseUrl}/realms/${realm}/protocol/openid-connect/auth/device`;
+}
+// A public client holds no secret, so PKCE is what ties the token request back to this process.
+export function createPkcePair() {
+    const verifier = randomBytes(32).toString("base64url");
+    return { verifier, challenge: createHash("sha256").update(verifier).digest("base64url") };
+}
+function readDeviceLogin(body, endpoint, codeVerifier) {
+    const deviceCode = body.device_code;
+    const userCode = body.user_code;
+    const verificationUri = body.verification_uri_complete ?? body.verification_uri;
+    if (!deviceCode || !userCode || !verificationUri) {
+        throw new Error(`the device login response from ${endpoint} is incomplete.`);
+    }
+    return {
+        deviceCode,
+        userCode,
+        verificationUri,
+        intervalMs: body.interval ? body.interval * 1000 : defaultIntervalMs,
+        expiresInMs: body.expires_in ? body.expires_in * 1000 : defaultExpiresInMs,
+        codeVerifier,
+    };
+}
+// No secret lives on the machine: a developer needs nothing beyond a browser login.
+export async function startDeviceLogin(client, fetchImpl = fetch, pkce = createPkcePair(), scope) {
+    const endpoint = deviceAuthEndpoint(client.baseUrl, client.realm);
+    const request = formRequest({
+        client_id: client.clientId,
+        code_challenge: pkce.challenge,
+        code_challenge_method: "S256",
+        ...(scope ? { scope } : {}),
+    });
+    const response = await postTo(endpoint, request, fetchImpl);
+    if (!response.ok) {
+        throw new Error(`${endpoint} refused the device login with status ${response.status}. ` +
+            `Check that the client ${client.clientId} is public and allows the OAuth device flow.`);
+    }
+    return readDeviceLogin(await readJson(response, endpoint), endpoint, pkce.verifier);
+}
+function deviceLoginFailure(error, status) {
+    switch (error) {
+        case "access_denied":
+            return new Error("the login was refused in the browser.");
+        case "expired_token":
+            return new Error("the login code expired. Run the command again.");
+        case "authorization_pending":
+        case "slow_down":
+            return undefined;
+        default:
+            return new Error(`the device login failed with "${error ?? status}".`);
+    }
+}
+function deviceTokenRequest(client, deviceCode, codeVerifier) {
+    return formRequest({
+        grant_type: deviceCodeGrant,
+        device_code: deviceCode,
+        client_id: client.clientId,
+        code_verifier: codeVerifier,
+    });
+}
+export async function pollForDeviceTokens(client, { deviceCode, codeVerifier, intervalMs = defaultIntervalMs, expiresInMs = defaultExpiresInMs, }, { fetchImpl = fetch, sleep = sleepFor, clock = Date.now, } = {}) {
+    const endpoint = tokenEndpoint(client.baseUrl, client.realm);
+    const request = deviceTokenRequest(client, deviceCode, codeVerifier);
+    const deadline = clock() + expiresInMs;
+    let wait = intervalMs;
+    for (;;) {
+        // Keycloak answers authorization_pending for ever if nobody opens the link.
+        if (clock() >= deadline)
+            throw new Error("nobody approved the login in time. Run it again.");
+        const response = await postTo(endpoint, request, fetchImpl);
+        const body = await readJson(response, endpoint);
+        if (response.ok && body.access_token) {
+            return { accessToken: body.access_token, ...(body.refresh_token ? { refreshToken: body.refresh_token } : {}) };
+        }
+        const failure = deviceLoginFailure(body.error, response.status);
+        if (failure)
+            throw failure;
+        if (body.error === "slow_down")
+            wait += slowDownStepMs;
+        await sleep(wait);
+    }
+}
+// A refresh token outlives many access tokens, so a long run renews without a second browser login.
+export async function refreshAccessToken(client, refreshToken, fetchImpl = fetch) {
+    const endpoint = tokenEndpoint(client.baseUrl, client.realm);
+    const request = formRequest({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: client.clientId });
+    const response = await postTo(endpoint, request, fetchImpl);
+    // A refused refresh token is terminal and earns a new login; an overloaded Keycloak must not cost one.
+    if (isTransientStatus(response.status)) {
+        throw new Error(`${endpoint} could not renew the token (status ${response.status}).`);
+    }
+    if (!response.ok)
+        return undefined;
+    const body = await readJson(response, endpoint);
+    if (!body.access_token)
+        return undefined;
+    return { accessToken: body.access_token, refreshToken: body.refresh_token ?? refreshToken };
+}

package/dist/http.d.ts

@@ -0,0 +1,11 @@
+export type FetchLike = (url: string, init: RequestInit) => Promise<Response>;
+export declare function formRequest(fields: Record<string, string>): RequestInit;
+export declare class RefusedRequestError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+export declare function isTransientStatus(status: number): boolean;
+export declare function readJson<T>(response: Response, endpoint: string): Promise<T>;
+export declare function postTo(endpoint: string, init: RequestInit, fetchImpl?: FetchLike): Promise<Response>;
+export declare function describeError(error: unknown): string;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE9E,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,WAAW,CAMvE;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAG1C,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADvB,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;CAI1B;AAGD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAQlF;AAED,wBAAsB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,GAAE,SAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAMjH;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIpD"}

package/dist/http.js

@@ -0,0 +1,40 @@
+export function formRequest(fields) {
+    return {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams(fields).toString(),
+    };
+}
+export class RefusedRequestError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
+}
+// Overload and timeout, which are worth repeating; every other refusal is the server's final word.
+export function isTransientStatus(status) {
+    return status >= 500 || status === 429 || status === 408;
+}
+export async function readJson(response, endpoint) {
+    const body = await response.text();
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        throw new Error(`${endpoint} answered status ${response.status} with text, not JSON: ${body}`);
+    }
+}
+export async function postTo(endpoint, init, fetchImpl = fetch) {
+    try {
+        return await fetchImpl(endpoint, init);
+    }
+    catch (cause) {
+        throw new Error(`cannot reach ${endpoint}.`, { cause });
+    }
+}
+export function describeError(error) {
+    if (!(error instanceof Error))
+        return String(error);
+    return error.cause instanceof Error ? `${error.message}\n  caused by: ${error.cause.message}` : error.message;
+}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { ciClientId, cliClientId, clientIdHelp, interactiveLogin, logIn, loginStatus, logOut, publicClientFrom, registerAuthCommands, revokeRefreshToken, userTokenSource, type ClientOptions, type LoginOptions, } from "./auth-commands.js";
+export { browserLogin, loginScope } from "./browser-login.js";
+export { defaultCredentialStore, fileCredentialStore, keychainCredentialStore, keychainWithFileFallback, type CredentialStore, type RunSecurity, type SecurityResult, type StoredLogin, } from "./credential-store.js";
+export { pollForDeviceTokens, refreshAccessToken, startDeviceLogin, type DeviceLogin, type DeviceTokens, type PkcePair, type PublicClient, type Sleep, } from "./device-login.js";
+export { describeError, isTransientStatus, postTo, readJson, RefusedRequestError, type FetchLike } from "./http.js";
+export { saveLogin, storedLoginTokenSource } from "./stored-login.js";
+export { cachedToken, mintWithClientCredentials, withRenewal, type ClientCredentials, type RenewableTokenSource, type TokenSource, } from "./token.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,KAAK,EACL,WAAW,EACX,MAAM,EACN,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,KAAK,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACpH,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+export { ciClientId, cliClientId, clientIdHelp, interactiveLogin, logIn, loginStatus, logOut, publicClientFrom, registerAuthCommands, revokeRefreshToken, userTokenSource, } from "./auth-commands.js";
+export { browserLogin, loginScope } from "./browser-login.js";
+export { defaultCredentialStore, fileCredentialStore, keychainCredentialStore, keychainWithFileFallback, } from "./credential-store.js";
+export { pollForDeviceTokens, refreshAccessToken, startDeviceLogin, } from "./device-login.js";
+export { describeError, isTransientStatus, postTo, readJson, RefusedRequestError } from "./http.js";
+export { saveLogin, storedLoginTokenSource } from "./stored-login.js";
+export { cachedToken, mintWithClientCredentials, withRenewal, } from "./token.js";

package/dist/stored-login.d.ts

@@ -0,0 +1,14 @@
+import type { CredentialStore } from "./credential-store.js";
+import { type DeviceTokens, type PublicClient } from "./device-login.js";
+import { type FetchLike } from "./http.js";
+import { type RenewableTokenSource } from "./token.js";
+export declare function saveLogin(store: CredentialStore, client: PublicClient, tokens: DeviceTokens): Promise<boolean>;
+export declare function storedLoginTokenSource({ client, store, login, warn, fetchImpl, clock, }: {
+    client: PublicClient;
+    store: CredentialStore;
+    login: () => Promise<DeviceTokens>;
+    warn?: (message: string) => void;
+    fetchImpl?: FetchLike;
+    clock?: () => number;
+}): RenewableTokenSource;
+//# sourceMappingURL=stored-login.d.ts.map

package/dist/stored-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stored-login.d.ts","sourceRoot":"","sources":["../src/stored-login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,YAAY,EAAsB,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAoC,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGzF,wBAAsB,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAQpH;AAGD,wBAAgB,sBAAsB,CAAC,EACrC,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAoB,EACpB,SAAiB,EACjB,KAAgB,GACjB,EAAE;IACD,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB,GAAG,oBAAoB,CA+BvB"}

package/dist/stored-login.js

@@ -0,0 +1,35 @@
+import { refreshAccessToken } from "./device-login.js";
+import { describeError } from "./http.js";
+import { accessTokenUsername, cachedToken } from "./token.js";
+// Keycloak may rotate the refresh token on every renewal, so each new one replaces the stored one.
+export async function saveLogin(store, client, tokens) {
+    if (!tokens.refreshToken)
+        return false;
+    const username = accessTokenUsername(tokens.accessToken);
+    await store.write(client, { refreshToken: tokens.refreshToken, ...(username ? { username } : {}) });
+    return true;
+}
+// Renews from the stored login, and only asks for a new one when Keycloak refuses it; a network error keeps it.
+export function storedLoginTokenSource({ client, store, login, warn = console.error, fetchImpl = fetch, clock = Date.now, }) {
+    // A store it cannot write, e.g. a read-only $HOME, costs the next run a login instead of failing this one.
+    async function keep(tokens) {
+        await saveLogin(store, client, tokens).catch((error) => warn(`could not store the login, so the next run may ask for another: ${describeError(error)}`));
+    }
+    async function renewOrLogIn() {
+        const stored = await store.read(client);
+        if (stored) {
+            const renewed = await refreshAccessToken(client, stored.refreshToken, fetchImpl);
+            if (renewed) {
+                await keep(renewed);
+                return renewed.accessToken;
+            }
+            await store
+                .remove(client)
+                .catch((error) => warn(`could not delete the refused login: ${describeError(error)}`));
+        }
+        const tokens = await login();
+        await keep(tokens);
+        return tokens.accessToken;
+    }
+    return cachedToken(renewOrLogIn, clock);
+}

package/dist/token.d.ts

@@ -0,0 +1,22 @@
+import { type FetchLike } from "./http.js";
+export type ClientCredentials = {
+    baseUrl: string;
+    realm: string;
+    clientId: string;
+    clientSecret: string;
+    scope?: string;
+};
+export type TokenSource = () => Promise<string>;
+export type RenewableTokenSource = TokenSource & {
+    renew: () => void;
+};
+export declare function withRenewal<T>(token: TokenSource, call: (accessToken: string) => Promise<T>): Promise<T>;
+export declare const tokenExpiryBufferMs = 60000;
+export declare const unparsableTokenTtlMs = 30000;
+export declare function tokenEndpoint(baseUrl: string, realm: string): string;
+export declare function accessTokenExpiresAt(accessToken: string, now: number): number;
+export declare function accessTokenUsername(accessToken: string): string | undefined;
+export declare function isFresh(expiresAt: number, now: number): boolean;
+export declare function mintWithClientCredentials(credentials: ClientCredentials, fetchImpl?: FetchLike): Promise<string>;
+export declare function cachedToken(mint: TokenSource, clock?: () => number): RenewableTokenSource;
+//# sourceMappingURL=token.d.ts.map

package/dist/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAA4C,MAAM,WAAW,CAAC;AAErF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAGhD,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG;IAAE,KAAK,EAAE,MAAM,IAAI,CAAA;CAAE,CAAC;AAOvE,wBAAsB,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAU9G;AAGD,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAG1C,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AAiBD,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAI7E;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK3E;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/D;AAqBD,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,iBAAiB,EAC9B,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,GAAE,MAAM,MAAiB,GAAG,oBAAoB,CAoBnG"}

package/dist/token.js

@@ -0,0 +1,90 @@
+import { formRequest, postTo, RefusedRequestError } from "./http.js";
+function isRenewable(token) {
+    return typeof token.renew === "function";
+}
+// A token revoked or expired early answers 401 once; renewing and retrying once is what Claude Code does for MCP.
+export async function withRenewal(token, call) {
+    try {
+        return await call(await token());
+    }
+    catch (error) {
+        if (!(error instanceof RefusedRequestError && error.status === 401) || !isRenewable(token))
+            throw error;
+        token.renew();
+        return call(await token());
+    }
+}
+// Re-mint before Keycloak's own exp, so an in-flight request never races an expired token.
+export const tokenExpiryBufferMs = 60_000;
+// The exp claim did not parse, so the token gets a short life rather than none.
+export const unparsableTokenTtlMs = 30_000;
+export function tokenEndpoint(baseUrl, realm) {
+    return `${baseUrl}/realms/${realm}/protocol/openid-connect/token`;
+}
+// Reads the claims without checking the signature: callers only use them to schedule and to label.
+function unverifiedClaims(accessToken) {
+    const payload = accessToken.split(".")[1];
+    if (!payload)
+        return {};
+    try {
+        const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        return typeof claims === "object" && claims !== null ? claims : {};
+    }
+    catch {
+        return {};
+    }
+}
+export function accessTokenExpiresAt(accessToken, now) {
+    const exp = unverifiedClaims(accessToken).exp;
+    return typeof exp === "number" ? exp * 1000 - tokenExpiryBufferMs : now + unparsableTokenTtlMs;
+}
+export function accessTokenUsername(accessToken) {
+    const claims = unverifiedClaims(accessToken);
+    const name = claims.preferred_username ?? claims.email;
+    return typeof name === "string" ? name : undefined;
+}
+export function isFresh(expiresAt, now) {
+    return expiresAt > now;
+}
+function clientCredentialsRequest({ clientId, clientSecret, scope }) {
+    return formRequest({
+        grant_type: "client_credentials",
+        client_id: clientId,
+        client_secret: clientSecret,
+        ...(scope ? { scope } : {}),
+    });
+}
+function readAccessToken(body, realm) {
+    const accessToken = body.access_token;
+    if (typeof accessToken !== "string") {
+        throw new Error(`the Keycloak response for realm ${realm} carries no access_token.`);
+    }
+    return accessToken;
+}
+export async function mintWithClientCredentials(credentials, fetchImpl = fetch) {
+    const { baseUrl, realm } = credentials;
+    const endpoint = tokenEndpoint(baseUrl, realm);
+    const response = await postTo(endpoint, clientCredentialsRequest(credentials), fetchImpl);
+    if (!response.ok) {
+        throw new Error(`Keycloak refused the client credentials for realm ${realm} with status ${response.status}. ` +
+            `Check the client id and the secret against ${endpoint}.`);
+    }
+    return readAccessToken(await response.json(), realm);
+}
+export function cachedToken(mint, clock = Date.now) {
+    let held;
+    const source = async () => {
+        const now = clock();
+        if (held && isFresh(held.expiresAt, now))
+            return held.token;
+        const token = await mint();
+        // A device login blocks until the browser answers, so `now` is already stale here.
+        held = { token, expiresAt: accessTokenExpiresAt(token, clock()) };
+        return token;
+    };
+    return Object.assign(source, {
+        renew: () => {
+            held = undefined;
+        },
+    });
+}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@manta-eu/auth",
+  "version": "0.1.2",
+  "description": "Keycloak login for the SDK CLIs: browser and device-code login, silent token renewal, and credential storage",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "author": "",
+  "license": "MIT",
+  "dependencies": {
+    "commander": "^15.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.13.3",
+    "@typescript-eslint/eslint-plugin": "^8.56.1",
+    "@typescript-eslint/parser": "^8.56.1",
+    "eslint": "^9.39.2",
+    "rimraf": "^6.1.3",
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.8"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "rimraf dist && tsc -p tsconfig.build.json",
+    "build:lib": "pnpm run build",
+    "test": "vitest --run",
+    "types": "tsc --noEmit"
+  }
+}