@manta-eu/codegen 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Manta AI AS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,63 @@
+# @manta-eu/codegen
+
+A CLI that generates LDkit schemas for one realm, from the SHACL shapes that realm's datastore
+holds. `@manta-eu/ldo` builds the same types from local files in this repository. An app outside this
+repository has neither the files nor Nix, so this package reads the shapes over HTTP instead.
+
+## Use
+
+```shell
+pnpm manta-codegen generate \
+  --api-url https://app.example \
+  --datastore salthouse \
+  --keycloak-url https://keycloak.example \
+  --keycloak-realm your-realm \
+  --client-id your-realm-app \
+  --out ./.ldkit
+```
+
+The run writes one `.ts` file per namespace (`manta.ts`, `meta.ts`, `google.ts` and so on),
+`namespaces.ts` for the vocabulary constants, and an `index.ts` that re-exports every file. It writes
+nothing else: the directory holds generated code, and the CLI keeps no copy of either graph it read.
+
+A run removes the `.ts` files of the run before it, so a class the shapes no longer describe loses
+its file. It leaves every other file in the directory alone.
+
+Only `namespaces.ts` holds the realm IRIs.
+
+## Log in
+
+`MANTA_CLIENT_SECRET` decides the path.
+
+**No secret — a person.** The CLI starts the OAuth device flow with PKCE. It prints a link and a
+code, then waits for the browser. Keycloak needs a public client that carries
+`oauth2.device.authorization.grant.enabled`.
+
+**A secret — a machine.** The CLI asks for a service account token. Keycloak needs a confidential
+client with service account roles. Add `--scope` to ask for a narrow token.
+
+```shell
+export MANTA_CLIENT_SECRET=...   # never a flag: an argument list is public on the machine
+```
+
+Two traps:
+
+- `--client-id` must name the realm's **app** client. The API compares the token's `azp` against its
+  own `VITE_KEYCLOAK_CLIENT_ID`, and answers 401 for any other client. That check is off today
+  (`authorizedPartyCheckEnabled`), which is the only reason the `manta-codegen` service client works
+  from CI. Turning it on 401s this caller.
+- The API grants a datastore to a person, or to a service account holding the `operator` realm role.
+  Without that role a service account token is refused the datastore, so a local run needs either the
+  device login or a client shaped like `manta-codegen`, which has no device flow and needs
+  `MANTA_CLIENT_SECRET`.
+
+## What the datastore does not hold
+
+`observed-entities.ttl` reaches no graph. It describes 35 classes, among them `meta:Body`,
+`meta:Title` and `google:Headline`. A consumer generates without them.
+
+This is a decision, not an oversight. `kgc/kgc/realms/lib/term_structure.py` writes that file from
+the instance data of a live datastore. A new realm therefore has none, and the shapes move with the
+data. See WEB-1536.
+
+The CLI prints the class count for each namespace, so a thin result is visible at once.

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+import { Command, Option } from "commander";
+import { resolve } from "node:path";
+import { fetchRealmShapes, sparqlEndpoint } from "./fetch-shapes.js";
+import { pollForDeviceToken, startDeviceLogin } from "./device-login.js";
+import { describeError } from "./http.js";
+import { generatePackage } from "./generate.js";
+import { cachedToken, mintWithClientCredentials } from "./token.js";
+// The secret stays out of the flags: an argument list is readable to every process on the machine.
+function tokenSourceFor(options) {
+    const client = { baseUrl: options.keycloakUrl, realm: options.keycloakRealm, clientId: options.clientId };
+    const secret = process.env.MANTA_CLIENT_SECRET;
+    if (secret) {
+        return cachedToken(() => mintWithClientCredentials({ ...client, clientSecret: secret, scope: options.scope }));
+    }
+    return cachedToken(async () => {
+        const login = await startDeviceLogin(client);
+        console.error(`manta-codegen: open ${login.verificationUri} and enter the code ${login.userCode}`);
+        return pollForDeviceToken(client, login);
+    });
+}
+function reportTargetClasses(targetClasses) {
+    const total = Object.values(targetClasses).reduce((sum, count) => sum + count, 0);
+    console.error(`manta-codegen: the datastore describes ${total} class(es):`);
+    for (const [prefix, count] of Object.entries(targetClasses))
+        console.error(`  ${prefix}: ${count}`);
+    if (total === 0)
+        console.error("manta-codegen: the datastore describes no class. Check the datastore id.");
+}
+async function readShapes(options) {
+    const token = tokenSourceFor(options);
+    const endpoint = sparqlEndpoint(options.apiUrl, options.datastore);
+    console.error(`manta-codegen: reading the shapes from ${endpoint}`);
+    const shapes = await fetchRealmShapes(endpoint, token);
+    console.error(`manta-codegen: the realm vocabulary base is ${shapes.vocabBase}`);
+    reportTargetClasses(shapes.targetClasses);
+    return shapes;
+}
+// The CLI keeps no copy of either graph: the directory holds generated code and nothing else.
+async function generate(options) {
+    const shapes = await readShapes(options);
+    const outDir = resolve(options.out);
+    await generatePackage(shapes, outDir);
+    console.error(`manta-codegen: wrote the LDkit schemas to ${outDir}`);
+}
+const program = new Command()
+    .name("manta-codegen")
+    .description("Generate LDkit schemas from a realm's SHACL shapes, read from its datastore.");
+program
+    .command("generate")
+    .description("read the realm's shapes and generate the LDkit schemas, one file per namespace")
+    .requiredOption("--api-url <url>", "Manta API base URL")
+    .requiredOption("--datastore <id>", "datastore to read")
+    .requiredOption("--keycloak-url <url>", "Keycloak base URL")
+    .requiredOption("--keycloak-realm <realm>", "Keycloak realm")
+    .requiredOption("--client-id <id>", "Keycloak client id")
+    .option("--scope <scope>", "OAuth scope to ask for")
+    .addOption(new Option("--out <dir>", "directory to write into").default("./.ldkit"))
+    .action(async (options) => {
+    try {
+        await generate(options);
+    }
+    catch (error) {
+        console.error(describeError(error));
+        process.exit(1);
+    }
+});
+program.parse();

package/dist/device-login.d.ts

@@ -0,0 +1,45 @@
+import { type FetchLike } from "./http.js";
+import { type TokenSource } from "./token.js";
+export type PublicClient = {
+    baseUrl: string;
+    realm: string;
+    clientId: string;
+};
+export type DeviceLogin = {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    intervalMs: number;
+    expiresInMs: number;
+    codeVerifier: string;
+};
+export type PkcePair = {
+    verifier: string;
+    challenge: string;
+};
+export type Sleep = (ms: number) => Promise<void>;
+export declare function deviceAuthEndpoint(baseUrl: string, realm: string): string;
+export declare function createPkcePair(): PkcePair;
+export declare function startDeviceLogin(client: PublicClient, fetchImpl?: FetchLike, pkce?: PkcePair): Promise<DeviceLogin>;
+export type DeviceTokens = {
+    accessToken: string;
+    refreshToken?: string;
+};
+export declare function pollForDeviceToken(...args: Parameters<typeof pollForDeviceTokens>): Promise<string>;
+export declare function pollForDeviceTokens(client: PublicClient, { deviceCode, codeVerifier, intervalMs, expiresInMs, }: Pick<DeviceLogin, "deviceCode" | "codeVerifier"> & {
+    intervalMs?: number;
+    expiresInMs?: number;
+}, { fetchImpl, sleep, clock, }?: {
+    fetchImpl?: FetchLike;
+    sleep?: Sleep;
+    clock?: () => number;
+}): Promise<DeviceTokens>;
+export declare function refreshAccessToken(client: PublicClient, refreshToken: string, fetchImpl?: FetchLike): Promise<DeviceTokens | undefined>;
+export declare function deviceLoginTokenSource(client: PublicClient, prompt: (login: DeviceLogin) => void, { fetchImpl, login, poll, }?: {
+    fetchImpl?: FetchLike;
+    login?: (client: PublicClient, fetchImpl: FetchLike) => Promise<DeviceLogin>;
+    poll?: (client: PublicClient, login: DeviceLogin, options: {
+        fetchImpl: FetchLike;
+    }) => Promise<DeviceTokens>;
+}): TokenSource;
+//# sourceMappingURL=device-login.d.ts.map

package/dist/device-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-login.d.ts","sourceRoot":"","sources":["../src/device-login.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,SAAS,EAAoD,MAAM,WAAW,CAAC;AAC7F,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAE7D,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,MAAM,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAclD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE;AAGD,wBAAgB,cAAc,IAAI,QAAQ,CAIzC;AA+BD,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,YAAY,EACpB,SAAS,GAAE,SAAiB,EAC5B,IAAI,GAAE,QAA2B,GAChC,OAAO,CAAC,WAAW,CAAC,CAiBtB;AAyBD,MAAM,MAAM,YAAY,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E,wBAAsB,kBAAkB,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAEzG;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,YAAY,EACpB,EACE,UAAU,EACV,YAAY,EACZ,UAA8B,EAC9B,WAAgC,GACjC,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,GAAG,cAAc,CAAC,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EACnG,EACE,SAAiB,EACjB,KAAgB,EAChB,KAAgB,GACjB,GAAE;IAAE,SAAS,CAAC,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CAAO,GACrE,OAAO,CAAC,YAAY,CAAC,CAwBvB;AAGD,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,EACpB,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAiBnC;AAGD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,EACpC,EACE,SAAiB,EACjB,KAAwB,EACxB,IAA0B,GAC3B,GAAE;IACD,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE;QAAE,SAAS,EAAE,SAAS,CAAA;KAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CAC1G,GACL,WAAW,CAkBb"}

package/dist/device-login.js

@@ -0,0 +1,127 @@
+import { createHash, randomBytes } from "node:crypto";
+import { formRequest, isTransientStatus, postTo, readJson } from "./http.js";
+import { tokenEndpoint } from "./token.js";
+const deviceCodeGrant = "urn:ietf:params:oauth:grant-type:device_code";
+// RFC 8628 says to add this much whenever the server answers slow_down.
+const slowDownStepMs = 5_000;
+const defaultIntervalMs = 5_000;
+// RFC 8628 makes expires_in optional, and Keycloak sends ten minutes.
+const defaultExpiresInMs = 600_000;
+const sleepFor = (ms) => new Promise((done) => setTimeout(done, ms));
+export function deviceAuthEndpoint(baseUrl, realm) {
+    return `${baseUrl}/realms/${realm}/protocol/openid-connect/auth/device`;
+}
+// A public client holds no secret, so PKCE is what ties the token request back to this process.
+export function createPkcePair() {
+    const verifier = randomBytes(32).toString("base64url");
+    return { verifier, challenge: createHash("sha256").update(verifier).digest("base64url") };
+}
+function readDeviceLogin(body, endpoint, codeVerifier) {
+    const deviceCode = body.device_code;
+    const userCode = body.user_code;
+    const verificationUri = body.verification_uri_complete ?? body.verification_uri;
+    if (!deviceCode || !userCode || !verificationUri) {
+        throw new Error(`manta-codegen: the device login response from ${endpoint} is incomplete.`);
+    }
+    return {
+        deviceCode,
+        userCode,
+        verificationUri,
+        intervalMs: body.interval ? body.interval * 1000 : defaultIntervalMs,
+        expiresInMs: body.expires_in ? body.expires_in * 1000 : defaultExpiresInMs,
+        codeVerifier,
+    };
+}
+// No secret lives on the machine: a developer needs nothing beyond a browser login.
+export async function startDeviceLogin(client, fetchImpl = fetch, pkce = createPkcePair()) {
+    const endpoint = deviceAuthEndpoint(client.baseUrl, client.realm);
+    const request = formRequest({
+        client_id: client.clientId,
+        code_challenge: pkce.challenge,
+        code_challenge_method: "S256",
+    });
+    const response = await postTo(endpoint, request, fetchImpl);
+    if (!response.ok) {
+        throw new Error(`manta-codegen: ${endpoint} refused the device login with status ${response.status}. ` +
+            `Check that the client ${client.clientId} is public and allows the OAuth device flow.`);
+    }
+    return readDeviceLogin(await readJson(response, endpoint), endpoint, pkce.verifier);
+}
+function deviceLoginFailure(error, status) {
+    switch (error) {
+        case "access_denied":
+            return new Error("manta-codegen: the login was refused in the browser.");
+        case "expired_token":
+            return new Error("manta-codegen: the login code expired. Run the command again.");
+        case "authorization_pending":
+        case "slow_down":
+            return undefined;
+        default:
+            return new Error(`manta-codegen: the device login failed with "${error ?? status}".`);
+    }
+}
+function deviceTokenRequest(client, deviceCode, codeVerifier) {
+    return formRequest({
+        grant_type: deviceCodeGrant,
+        device_code: deviceCode,
+        client_id: client.clientId,
+        code_verifier: codeVerifier,
+    });
+}
+export async function pollForDeviceToken(...args) {
+    return (await pollForDeviceTokens(...args)).accessToken;
+}
+export async function pollForDeviceTokens(client, { deviceCode, codeVerifier, intervalMs = defaultIntervalMs, expiresInMs = defaultExpiresInMs, }, { fetchImpl = fetch, sleep = sleepFor, clock = Date.now, } = {}) {
+    const endpoint = tokenEndpoint(client.baseUrl, client.realm);
+    const request = deviceTokenRequest(client, deviceCode, codeVerifier);
+    const deadline = clock() + expiresInMs;
+    let wait = intervalMs;
+    for (;;) {
+        // Keycloak answers authorization_pending for ever if nobody opens the link.
+        if (clock() >= deadline)
+            throw new Error("manta-codegen: nobody approved the login in time. Run it again.");
+        const response = await postTo(endpoint, request, fetchImpl);
+        const body = await readJson(response, endpoint);
+        if (response.ok && body.access_token) {
+            return { accessToken: body.access_token, ...(body.refresh_token ? { refreshToken: body.refresh_token } : {}) };
+        }
+        const failure = deviceLoginFailure(body.error, response.status);
+        if (failure)
+            throw failure;
+        if (body.error === "slow_down")
+            wait += slowDownStepMs;
+        await sleep(wait);
+    }
+}
+// A refresh token outlives many access tokens, so a long run renews without a second browser login.
+export async function refreshAccessToken(client, refreshToken, fetchImpl = fetch) {
+    const endpoint = tokenEndpoint(client.baseUrl, client.realm);
+    const request = formRequest({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: client.clientId });
+    const response = await postTo(endpoint, request, fetchImpl);
+    // A refused refresh token is terminal and earns a new login; an overloaded Keycloak must not cost one.
+    if (isTransientStatus(response.status)) {
+        throw new Error(`manta-codegen: ${endpoint} could not renew the token (status ${response.status}).`);
+    }
+    if (!response.ok)
+        return undefined;
+    const body = await readJson(response, endpoint);
+    if (!body.access_token)
+        return undefined;
+    return { accessToken: body.access_token, refreshToken: body.refresh_token ?? refreshToken };
+}
+// One device login, then silent refreshes until the refresh token itself is refused.
+export function deviceLoginTokenSource(client, prompt, { fetchImpl = fetch, login = startDeviceLogin, poll = pollForDeviceTokens, } = {}) {
+    let refreshToken;
+    return async () => {
+        const refreshed = refreshToken ? await refreshAccessToken(client, refreshToken, fetchImpl) : undefined;
+        if (refreshed) {
+            refreshToken = refreshed.refreshToken;
+            return refreshed.accessToken;
+        }
+        const started = await login(client, fetchImpl);
+        prompt(started);
+        const tokens = await poll(client, started, { fetchImpl });
+        refreshToken = tokens.refreshToken;
+        return tokens.accessToken;
+    };
+}

package/dist/fetch-shapes.d.ts

@@ -0,0 +1,12 @@
+import type { FetchLike } from "./http.js";
+import type { TokenSource } from "./token.js";
+export type RealmShapes = {
+    vocabBase: string;
+    ontologyGraphIri: string;
+    shacl: string;
+    ontology: string;
+    targetClasses: Record<string, number>;
+};
+export declare function sparqlEndpoint(apiUrl: string, datastoreId: string): string;
+export declare function fetchRealmShapes(endpoint: string, token: TokenSource, fetchImpl?: FetchLike): Promise<RealmShapes>;
+//# sourceMappingURL=fetch-shapes.d.ts.map

package/dist/fetch-shapes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-shapes.d.ts","sourceRoot":"","sources":["../src/fetch-shapes.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,CAAC;AAEF,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,WAAW,EAClB,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,WAAW,CAAC,CActB"}

package/dist/fetch-shapes.js

@@ -0,0 +1,17 @@
+import { countTargetClasses, fetchGraphList, fetchGraphTurtle, findOntologyGraph, shaclGraphIri, vocabBaseFromOntologyGraph, } from "./shapes.js";
+export function sparqlEndpoint(apiUrl, datastoreId) {
+    return `${apiUrl.replace(/\/$/, "")}/d/${encodeURIComponent(datastoreId)}/sparql`;
+}
+export async function fetchRealmShapes(endpoint, token, fetchImpl = fetch) {
+    const graphs = await fetchGraphList({ endpoint, token: await token() }, fetchImpl);
+    const ontologyGraphIri = findOntologyGraph(graphs);
+    const shacl = await fetchGraphTurtle({ endpoint, graphIri: shaclGraphIri, token: await token() }, fetchImpl);
+    const ontology = await fetchGraphTurtle({ endpoint, graphIri: ontologyGraphIri, token: await token() }, fetchImpl);
+    return {
+        vocabBase: vocabBaseFromOntologyGraph(ontologyGraphIri),
+        ontologyGraphIri,
+        shacl,
+        ontology,
+        targetClasses: countTargetClasses(`${shacl}\n${ontology}`),
+    };
+}

package/dist/generate.d.ts

@@ -0,0 +1,14 @@
+export declare function ldkitCliPath(entry?: string): string;
+export declare function quoteInvalidKeys(source: string): string;
+export declare function formatTypeScript(source: string, path: string): Promise<string>;
+export declare function removeGeneratedFiles(outDir: string): void;
+export declare function normalizeGeneratedFiles(outDir: string): Promise<void>;
+export declare function failOnUnknownNamespace(outDir: string): void;
+export declare function runLdkit(shaclPath: string, outDir: string): void;
+export type ShapeSources = {
+    shacl: string;
+    ontology: string;
+    vocabBase: string;
+};
+export declare function generatePackage({ shacl, ontology, vocabBase }: ShapeSources, outDir: string): Promise<void>;
+//# sourceMappingURL=generate.d.ts.map

package/dist/generate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../src/generate.ts"],"names":[],"mappings":"AAYA,wBAAgB,YAAY,CAAC,KAAK,GAAE,MAAqB,GAAG,MAAM,CAOjE;AAOD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAGD,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpF;AAOD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ3E;AAMD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAU3D;AAGD,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAchE;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAElF,wBAAsB,eAAe,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWjH"}

package/dist/generate.js

@@ -0,0 +1,77 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { format, resolveConfig } from "prettier";
+import { sortSchemas, splitDeclarations } from "./sort-schemas.js";
+import { mergeShapes, realmPrefix } from "./turtle.js";
+const ldkitEntry = () => createRequire(import.meta.url).resolve("ldkit");
+// LDkit exports no entry for its own CLI, so the run addresses the file beside the package entry.
+export function ldkitCliPath(entry = ldkitEntry()) {
+    for (let dir = dirname(entry); dir !== dirname(dir); dir = dirname(dir)) {
+        const candidate = join(dir, "esm", "cli.js");
+        if (existsSync(candidate))
+            return candidate;
+    }
+    throw new Error("manta-codegen: cannot find the LDkit CLI beside the resolved ldkit package.");
+}
+// LDkit writes a property name as a bare object key, and Meta sends terms such as `1dClick`.
+const objectKey = /(?<=^\s+)[^\s"':]+(?=:\s)/gm;
+const validName = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+export function quoteInvalidKeys(source) {
+    return source.replace(objectKey, (key) => (validName.test(key) ? key : `"${key}"`));
+}
+// The settings come from the repository the file lands in, so the code matches its neighbors.
+export async function formatTypeScript(source, path) {
+    return format(source, { ...(await resolveConfig(path)), filepath: path });
+}
+function generatedFiles(outDir) {
+    return existsSync(outDir) ? readdirSync(outDir).filter((name) => name.endsWith(".ts")) : [];
+}
+// A schema the shapes no longer describe would keep its file, and its re-export, for ever.
+export function removeGeneratedFiles(outDir) {
+    for (const file of generatedFiles(outDir))
+        rmSync(join(outDir, file));
+}
+export async function normalizeGeneratedFiles(outDir) {
+    for (const file of generatedFiles(outDir)) {
+        const path = join(outDir, file);
+        const source = readFileSync(path, "utf8");
+        const normalized = await formatTypeScript(sortSchemas(quoteInvalidKeys(source)), path);
+        if (normalized !== source)
+            writeFileSync(path, normalized);
+    }
+}
+const unknownFile = "_unknown.ts";
+// LDkit cannot name a term whose prefix the endpoint left out, so it writes the IRI in full.
+// That schema then addresses one realm for ever, whatever realm the next run reads.
+export function failOnUnknownNamespace(outDir) {
+    const path = join(outDir, unknownFile);
+    if (!existsSync(path))
+        return;
+    const names = splitDeclarations(readFileSync(path, "utf8")).declarations.map((each) => each.name);
+    throw new Error(`manta-codegen: the endpoint named no prefix for some terms, so LDkit wrote ${unknownFile}: ${names.join(", ")}.`);
+}
+// The LDkit CLI reports a failure on stderr and still exits 0, so an empty directory is the signal.
+export function runLdkit(shaclPath, outDir) {
+    removeGeneratedFiles(outDir);
+    mkdirSync(outDir, { recursive: true });
+    execFileSync(process.execPath, [ldkitCliPath(), "shacl-to-package", "--prefix-alias", `${realmPrefix}=Manta`, "file", shaclPath, outDir], { stdio: "inherit" });
+    if (!existsSync(join(outDir, "index.ts"))) {
+        throw new Error(`manta-codegen: LDkit wrote no schema into ${outDir}. Read the error above.`);
+    }
+    failOnUnknownNamespace(outDir);
+}
+export async function generatePackage({ shacl, ontology, vocabBase }, outDir) {
+    const stageDir = mkdtempSync(join(tmpdir(), "manta-codegen-"));
+    try {
+        const merged = join(stageDir, "shapes.ttl");
+        writeFileSync(merged, await mergeShapes(shacl, ontology, vocabBase));
+        runLdkit(merged, outDir);
+        await normalizeGeneratedFiles(outDir);
+    }
+    finally {
+        rmSync(stageDir, { recursive: true, force: true });
+    }
+}

package/dist/http.d.ts

@@ -0,0 +1,7 @@
+export type FetchLike = (url: string, init: RequestInit) => Promise<Response>;
+export declare function formRequest(fields: Record<string, string>): RequestInit;
+export declare function isTransientStatus(status: number): boolean;
+export declare function readJson<T>(response: Response, endpoint: string, label?: string): Promise<T>;
+export declare function postTo(endpoint: string, init: RequestInit, fetchImpl?: FetchLike): Promise<Response>;
+export declare function describeError(error: unknown): string;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE9E,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,WAAW,CAMvE;AAGD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD;AAGD,wBAAsB,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,SAAkB,GAAG,OAAO,CAAC,CAAC,CAAC,CAQ3G;AAGD,wBAAsB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,GAAE,SAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAMjH;AAGD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIpD"}

package/dist/http.js

@@ -0,0 +1,36 @@
+export function formRequest(fields) {
+    return {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams(fields).toString(),
+    };
+}
+// Overload and timeout, which are worth repeating; every other refusal is the server's final word.
+export function isTransientStatus(status) {
+    return status >= 500 || status === 429 || status === 408;
+}
+// A proxy answers an HTML page, and response.json() then throws a bare SyntaxError.
+export async function readJson(response, endpoint, label = "manta-codegen") {
+    const body = await response.text();
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        throw new Error(`${label}: ${endpoint} answered status ${response.status} with text, not JSON: ${body}`);
+    }
+}
+// A thrown fetch says only "fetch failed", which names neither the host nor the step.
+export async function postTo(endpoint, init, fetchImpl = fetch) {
+    try {
+        return await fetchImpl(endpoint, init);
+    }
+    catch (cause) {
+        throw new Error(`manta-codegen: cannot reach ${endpoint}.`, { cause });
+    }
+}
+// postTo puts the real failure in the cause, and the message alone names only the host.
+export function describeError(error) {
+    if (!(error instanceof Error))
+        return String(error);
+    return error.cause instanceof Error ? `${error.message}\n  caused by: ${error.cause.message}` : error.message;
+}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export { deviceLoginTokenSource, pollForDeviceToken, pollForDeviceTokens, refreshAccessToken, startDeviceLogin, type DeviceLogin, type DeviceTokens, type PkcePair, type PublicClient, type Sleep, } from "./device-login.js";
+export { fetchRealmShapes, sparqlEndpoint, type RealmShapes } from "./fetch-shapes.js";
+export { failOnUnknownNamespace, generatePackage, removeGeneratedFiles, type ShapeSources } from "./generate.js";
+export { sortSchemas } from "./sort-schemas.js";
+export { describeError, isTransientStatus, readJson, type FetchLike } from "./http.js";
+export { countTargetClasses } from "./shapes.js";
+export { cachedToken, mintWithClientCredentials, type ClientCredentials, type TokenSource } from "./token.js";
+export { mergeShapes, realmPrefix, sortQuads } from "./turtle.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,KAAK,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,oBAAoB,EAAE,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AACjH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAE,KAAK,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9G,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,8 @@
+export { deviceLoginTokenSource, pollForDeviceToken, pollForDeviceTokens, refreshAccessToken, startDeviceLogin, } from "./device-login.js";
+export { fetchRealmShapes, sparqlEndpoint } from "./fetch-shapes.js";
+export { failOnUnknownNamespace, generatePackage, removeGeneratedFiles } from "./generate.js";
+export { sortSchemas } from "./sort-schemas.js";
+export { describeError, isTransientStatus, readJson } from "./http.js";
+export { countTargetClasses } from "./shapes.js";
+export { cachedToken, mintWithClientCredentials } from "./token.js";
+export { mergeShapes, realmPrefix, sortQuads } from "./turtle.js";

package/dist/shapes.d.ts

@@ -0,0 +1,19 @@
+import { type FetchLike } from "./http.js";
+export declare const shaclGraphIri = "https://rdfox.com/default-base-iri/shacl";
+export declare function constructGraphQuery(graphIri: string): string;
+export declare function graphListQuery(): string;
+export declare function readGraphList(results: unknown): string[];
+export declare function findOntologyGraph(graphIris: readonly string[]): string;
+export declare function vocabBaseFromOntologyGraph(ontologyGraphIri: string): string;
+export type DatastoreAccess = {
+    endpoint: string;
+    token: string;
+};
+export type GraphRequest = DatastoreAccess & {
+    graphIri: string;
+};
+export declare function fetchGraphTurtle(request: GraphRequest, fetchImpl?: FetchLike): Promise<string>;
+export declare function fetchGraphList(access: DatastoreAccess, fetchImpl?: FetchLike): Promise<string[]>;
+export declare const realmGroup = "(realm)";
+export declare function countTargetClasses(turtle: string): Record<string, number>;
+//# sourceMappingURL=shapes.d.ts.map

package/dist/shapes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shapes.d.ts","sourceRoot":"","sources":["../src/shapes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAU,MAAM,WAAW,CAAC;AAGnD,eAAO,MAAM,aAAa,6CAA6C,CAAC;AAMxE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM5D;AAED,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAID,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAIxD;AAID,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAiBtE;AAED,wBAAgB,0BAA0B,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE,MAAM,MAAM,YAAY,GAAG,eAAe,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAiClE,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,GAAE,SAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ3G;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,GAAE,SAAiB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAI7G;AAMD,eAAO,MAAM,UAAU,YAAY,CAAC;AAGpC,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAazE"}

package/dist/shapes.js

@@ -0,0 +1,78 @@
+import { postTo } from "./http.js";
+// The store puts the shapes here for every realm, so this one carries no realm identifier.
+export const shaclGraphIri = "https://rdfox.com/default-base-iri/shacl";
+const storeDefaultBaseIri = "https://rdfox.com/default-base-iri/";
+const ontologyGraphSuffix = "ontology";
+export function constructGraphQuery(graphIri) {
+    if (graphIri.includes(">")) {
+        throw new Error(`manta-codegen: the graph IRI ${graphIri} carries a ">", which cannot go into a query.`);
+    }
+    return `CONSTRUCT { ?s ?p ?o } WHERE { GRAPH <${graphIri}> { ?s ?p ?o } }`;
+}
+export function graphListQuery() {
+    return "SELECT DISTINCT ?g WHERE { GRAPH ?g { ?s ?p ?o } }";
+}
+export function readGraphList(results) {
+    const bindings = results.results?.bindings ?? [];
+    return bindings.map((binding) => binding.g?.value).filter((value) => typeof value === "string");
+}
+// The realm ontology graph is `<vocab base>ontology`, so finding it also yields the vocab base. The
+// CLI therefore needs no realm name and ships no realm list.
+export function findOntologyGraph(graphIris) {
+    const candidates = graphIris.filter((iri) => iri.endsWith(ontologyGraphSuffix) && !iri.startsWith(storeDefaultBaseIri));
+    if (candidates.length === 0) {
+        throw new Error(`manta-codegen: the datastore holds no ontology graph. Looked for an IRI that ends with ` +
+            `"${ontologyGraphSuffix}" among: ${graphIris.join(", ")}.`);
+    }
+    if (candidates.length > 1) {
+        throw new Error(`manta-codegen: the datastore holds more than one ontology graph: ${candidates.join(", ")}.`);
+    }
+    return candidates[0];
+}
+export function vocabBaseFromOntologyGraph(ontologyGraphIri) {
+    return ontologyGraphIri.slice(0, -ontologyGraphSuffix.length);
+}
+async function runSparql({ endpoint, token }, { query, accept, action }, fetchImpl) {
+    const response = await postTo(endpoint, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/sparql-query", Accept: accept },
+        body: query,
+    }, fetchImpl);
+    if (!response.ok)
+        throw refusal({ endpoint, action }, response, await response.text());
+    return response;
+}
+function refusal(call, response, body) {
+    const rejectsToken = response.status === 401 || response.status === 403;
+    const hint = rejectsToken ? " Check that the token carries access to this datastore." : "";
+    return new Error(`manta-codegen: ${call.endpoint} refused ${call.action} with status ${response.status}.${hint} ${body.trim()}`);
+}
+export async function fetchGraphTurtle(request, fetchImpl = fetch) {
+    const call = {
+        query: constructGraphQuery(request.graphIri),
+        accept: "text/turtle",
+        action: `the read of <${request.graphIri}>`,
+    };
+    return (await runSparql(request, call, fetchImpl)).text();
+}
+export async function fetchGraphList(access, fetchImpl = fetch) {
+    const call = { query: graphListQuery(), accept: "application/sparql-results+json", action: "the graph list" };
+    return readGraphList(await (await runSparql(access, call, fetchImpl)).json());
+}
+// The datastore serves the realm's own classes on the empty prefix, so the prefix group is optional.
+const targetClass = /sh:targetClass\s+([A-Za-z][\w-]*)?:([A-Za-z][\w-]*)/g;
+// The empty prefix reads as nothing in a report, and the reader needs a name for that group.
+export const realmGroup = "(realm)";
+// A thin result must be visible at once, rather than found later at query time.
+export function countTargetClasses(turtle) {
+    const seen = new Map();
+    for (const [, prefix, localName] of turtle.matchAll(targetClass)) {
+        if (!localName)
+            continue;
+        const group = prefix ?? realmGroup;
+        const classes = seen.get(group) ?? new Set();
+        classes.add(localName);
+        seen.set(group, classes);
+    }
+    return Object.fromEntries([...seen].map(([group, classes]) => [group, classes.size]).sort());
+}

package/dist/sort-schemas.d.ts

@@ -0,0 +1,11 @@
+export type Declaration = {
+    name: string;
+    text: string;
+};
+export type SplitSource = {
+    header: string[];
+    declarations: Declaration[];
+};
+export declare function splitDeclarations(source: string): SplitSource;
+export declare function sortSchemas(source: string): string;
+//# sourceMappingURL=sort-schemas.d.ts.map

package/dist/sort-schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sort-schemas.d.ts","sourceRoot":"","sources":["../src/sort-schemas.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,MAAM,MAAM,WAAW,GAAG;IAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAiB5E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAO7D;AASD,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQlD"}

package/dist/sort-schemas.js

@@ -0,0 +1,33 @@
+const declaration = /^export const (\w+)/;
+function groupByDeclaration(lines) {
+    const blocks = [];
+    for (const line of lines) {
+        if (declaration.test(line))
+            blocks.push([]);
+        blocks[blocks.length - 1]?.push(line);
+    }
+    return blocks;
+}
+function toDeclaration(block) {
+    return { name: declaration.exec(block[0] ?? "")?.[1] ?? "", text: block.join("\n").trimEnd() };
+}
+export function splitDeclarations(source) {
+    const lines = source.split("\n");
+    const start = lines.findIndex((line) => declaration.test(line));
+    if (start < 0)
+        return { header: lines, declarations: [] };
+    return { header: lines.slice(0, start), declarations: groupByDeclaration(lines.slice(start)).map(toDeclaration) };
+}
+// A code point order, never localeCompare: the order must not follow the machine that ran the build.
+function byName(left, right) {
+    return left.name < right.name ? -1 : left.name > right.name ? 1 : 0;
+}
+// LDkit writes each schema in the order its shape arrives, so one new shape moves whole blocks.
+// packages/ldo/scripts/sort-schemas.mjs holds the same rule, so the two outputs compare.
+export function sortSchemas(source) {
+    const { header, declarations } = splitDeclarations(source);
+    if (declarations.length === 0)
+        return source;
+    const sorted = [...declarations].sort(byName).map((each) => each.text);
+    return `${[...header, sorted.join("\n\n")].join("\n")}\n`;
+}

package/dist/token.d.ts

@@ -0,0 +1,17 @@
+import { type FetchLike } from "./http.js";
+export type ClientCredentials = {
+    baseUrl: string;
+    realm: string;
+    clientId: string;
+    clientSecret: string;
+    scope?: string;
+};
+export type TokenSource = () => Promise<string>;
+export declare const tokenExpiryBufferMs = 60000;
+export declare const unparsableTokenTtlMs = 30000;
+export declare function tokenEndpoint(baseUrl: string, realm: string): string;
+export declare function accessTokenExpiresAt(accessToken: string, now: number): number;
+export declare function isFresh(expiresAt: number, now: number): boolean;
+export declare function mintWithClientCredentials(credentials: ClientCredentials, fetchImpl?: FetchLike): Promise<string>;
+export declare function cachedToken(mint: TokenSource, clock?: () => number): TokenSource;
+//# sourceMappingURL=token.d.ts.map

package/dist/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAuB,MAAM,WAAW,CAAC;AAEhE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAGhD,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAG1C,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AAGD,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAc7E;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/D;AAqBD,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,iBAAiB,EAC9B,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,GAAE,MAAM,MAAiB,GAAG,WAAW,CAc1F"}

package/dist/token.js

@@ -0,0 +1,63 @@
+import { formRequest, postTo } from "./http.js";
+// Re-mint before Keycloak's own exp, so an in-flight request never races an expired token.
+export const tokenExpiryBufferMs = 60_000;
+// The exp claim did not parse, so the token gets a short life rather than none.
+export const unparsableTokenTtlMs = 30_000;
+export function tokenEndpoint(baseUrl, realm) {
+    return `${baseUrl}/realms/${realm}/protocol/openid-connect/token`;
+}
+// Reads exp without checking the signature: the caller only decides when to re-mint.
+export function accessTokenExpiresAt(accessToken, now) {
+    const fallback = now + unparsableTokenTtlMs;
+    const payload = accessToken.split(".")[1];
+    if (!payload)
+        return fallback;
+    try {
+        const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        const exp = claims.exp;
+        return typeof exp === "number" ? exp * 1000 - tokenExpiryBufferMs : fallback;
+    }
+    catch {
+        return fallback;
+    }
+}
+export function isFresh(expiresAt, now) {
+    return expiresAt > now;
+}
+function clientCredentialsRequest({ clientId, clientSecret, scope }) {
+    return formRequest({
+        grant_type: "client_credentials",
+        client_id: clientId,
+        client_secret: clientSecret,
+        ...(scope ? { scope } : {}),
+    });
+}
+function readAccessToken(body, realm) {
+    const accessToken = body.access_token;
+    if (typeof accessToken !== "string") {
+        throw new Error(`manta-codegen: the Keycloak response for realm ${realm} carries no access_token.`);
+    }
+    return accessToken;
+}
+export async function mintWithClientCredentials(credentials, fetchImpl = fetch) {
+    const { baseUrl, realm } = credentials;
+    const endpoint = tokenEndpoint(baseUrl, realm);
+    const response = await postTo(endpoint, clientCredentialsRequest(credentials), fetchImpl);
+    if (!response.ok) {
+        throw new Error(`manta-codegen: Keycloak refused the client credentials for realm ${realm} with status ${response.status}. ` +
+            `Check the client id and the secret against ${endpoint}.`);
+    }
+    return readAccessToken(await response.json(), realm);
+}
+export function cachedToken(mint, clock = Date.now) {
+    let held;
+    return async () => {
+        const now = clock();
+        if (held && isFresh(held.expiresAt, now))
+            return held.token;
+        const token = await mint();
+        // A device login blocks until the browser answers, so `now` is already stale here.
+        held = { token, expiresAt: accessTokenExpiresAt(token, clock()) };
+        return token;
+    };
+}

package/dist/turtle.d.ts

@@ -0,0 +1,13 @@
+import type { Quad } from "n3";
+export declare const realmPrefix = "m";
+export type ParsedTurtle = {
+    quads: Quad[];
+    prefixes: Record<string, string>;
+};
+export declare function parseTurtle(turtle: string): ParsedTurtle;
+export declare function writeTurtle({ quads, prefixes }: ParsedTurtle): Promise<string>;
+export declare function namePrefixes(prefixes: Record<string, string>, vocabBase: string): Record<string, string>;
+export declare function quadKey(quad: Quad): string;
+export declare function sortQuads(quads: readonly Quad[]): Quad[];
+export declare function mergeShapes(shacl: string, ontology: string, vocabBase: string): Promise<string>;
+//# sourceMappingURL=turtle.d.ts.map

package/dist/turtle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turtle.d.ts","sourceRoot":"","sources":["../src/turtle.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAQ,MAAM,IAAI,CAAC;AAIrC,eAAO,MAAM,WAAW,MAAM,CAAC;AAE/B,MAAM,MAAM,YAAY,GAAG;IAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AAE/E,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAOxD;AAED,wBAAgB,WAAW,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAO9E;AAGD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQxG;AAUD,wBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAE1C;AAID,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,GAAG,IAAI,EAAE,CAKxD;AAGD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ/F"}

package/dist/turtle.js

@@ -0,0 +1,54 @@
+import { Parser, Writer } from "n3";
+// LDkit names each generated file after the prefix of the term it holds. The realm vocabulary
+// reaches us on the empty prefix, which LDkit sends to `_unknown.ts`, so it needs a name here.
+export const realmPrefix = "m";
+export function parseTurtle(turtle) {
+    const prefixes = {};
+    const quads = new Parser().parse(turtle, null, (prefix, iri) => {
+        prefixes[prefix] = iri.value;
+    });
+    return { quads, prefixes };
+}
+export function writeTurtle({ quads, prefixes }) {
+    const writer = new Writer({ prefixes });
+    writer.addQuads(quads);
+    return new Promise((resolve, reject) => {
+        writer.end((error, result) => (error ? reject(error) : resolve(result)));
+    });
+}
+// A second prefix on the same IRI would let the writer pick either one, so the realm keeps only `m`.
+export function namePrefixes(prefixes, vocabBase) {
+    const named = { [realmPrefix]: vocabBase };
+    for (const [prefix, iri] of Object.entries(prefixes)) {
+        if (prefix !== "" && iri !== vocabBase)
+            named[prefix] = iri;
+    }
+    return named;
+}
+function termParts(term) {
+    if (term.termType === "Literal")
+        return ["2", term.value, term.language, term.datatype.value];
+    if (term.termType === "BlankNode")
+        return ["1", term.value];
+    return ["0", term.value];
+}
+// A literal holds any text, so a separator character could give one key to two different quads.
+export function quadKey(quad) {
+    return JSON.stringify([quad.subject, quad.predicate, quad.object, quad.graph].map(termParts));
+}
+// A SPARQL CONSTRUCT promises no order, and LDkit reads the shapes in the order they arrive: it
+// resolves an ambiguous term to whichever namespace it met last. One order gives one answer.
+export function sortQuads(quads) {
+    const keyed = quads.map((quad) => ({ key: quadKey(quad), quad }));
+    keyed.sort((left, right) => (left.key < right.key ? -1 : left.key > right.key ? 1 : 0));
+    return keyed.map((each) => each.quad);
+}
+// LDkit reads one document.
+export function mergeShapes(shacl, ontology, vocabBase) {
+    const shapes = parseTurtle(shacl);
+    const subclasses = parseTurtle(ontology);
+    return writeTurtle({
+        quads: sortQuads([...shapes.quads, ...subclasses.quads]),
+        prefixes: namePrefixes({ ...shapes.prefixes, ...subclasses.prefixes }, vocabBase),
+    });
+}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@manta-eu/codegen",
+  "version": "0.1.0",
+  "description": "CLI that generates LDkit schemas from a realm's SHACL shapes, read from its datastore",
+  "type": "module",
+  "bin": {
+    "manta-codegen": "./dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "author": "",
+  "license": "MIT",
+  "dependencies": {
+    "@types/n3": "^1.26.0",
+    "commander": "^15.0.0",
+    "ldkit": "2.8.0",
+    "n3": "^2.7.12",
+    "prettier": "^3.8.1"
+  },
+  "devDependencies": {
+    "@types/node": "^24.13.3",
+    "@typescript-eslint/eslint-plugin": "^8.56.1",
+    "@typescript-eslint/parser": "^8.56.1",
+    "eslint": "^9.39.2",
+    "tsx": "^4.20.6",
+    "typescript": "^5.0.0",
+    "vitest": "^3.0.0"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "build:lib": "pnpm run build",
+    "test": "vitest --run",
+    "types": "tsc --noEmit"
+  }
+}