@manta-eu/codegen 0.1.2 → 0.1.4

package/README.md

@@ -12,7 +12,6 @@ pnpm manta-codegen generate \
   --datastore your-datastore \
   --keycloak-url https://keycloak.example \
   --keycloak-realm your-realm \
-  --client-id your-realm-app \
   --out ./.ldkit
 ```
 
@@ -27,14 +26,33 @@ Only `namespaces.ts` holds the realm IRIs.
 
 ## Log in
 
-`MANTA_CLIENT_SECRET` decides the path.
+`MANTA_CLIENT_SECRET` decides the path. Login itself is `@manta-eu/auth`'s job — see
+[its README](https://www.npmjs.com/package/@manta-eu/auth) for how the browser login works, where
+the login is stored and how long it lasts. `@manta-eu/upload` reads and writes the same store, so
+one login serves both CLIs.
 
-**No secret — a person.** The CLI starts the OAuth device flow with PKCE. It prints a link and a
-code, then waits for the browser. Keycloak needs a public client that carries
-`oauth2.device.authorization.grant.enabled`.
+**No secret — a person.** Log in once:
 
-**A secret — a machine.** The CLI asks for a service account token. Keycloak needs a confidential
-client with service account roles. Add `--scope` to ask for a narrow token.
+```shell
+pnpm manta-codegen login \
+  --keycloak-url https://keycloak.example \
+  --keycloak-realm your-realm
+```
+
+| Command  | What it does                                                        |
+| -------- | ------------------------------------------------------------------- |
+| `login`  | Logs in and stores the login.                                       |
+| `status` | Says whether a login is stored, and for whom. Exits 1 when none is. |
+| `logout` | Revokes the login at Keycloak and deletes the stored copy.          |
+
+Each takes the same `--keycloak-url` and `--keycloak-realm` as `generate`, because a login belongs to
+one Keycloak, realm and client. The client defaults to the realm's `<realm>-cli`, a public client
+made for this, so `--client-id` is only needed for another one. `generate` logs in by itself when
+nothing is stored and a terminal is attached; without one it fails and names `login` instead of
+waiting for a browser.
+
+**A secret — a machine.** Set `MANTA_CLIENT_SECRET` to the secret of the realm's `manta-codegen`
+client, which the CLI then uses by default. The CLI asks for a service account token. Add `--scope` to ask for a narrow token.
 
 ```shell
 export MANTA_CLIENT_SECRET=...   # never a flag: an argument list is public on the machine
@@ -42,12 +60,11 @@ export MANTA_CLIENT_SECRET=...   # never a flag: an argument list is public on t
 
 Two traps:
 
-- `--client-id` must name the realm's **app** client. The API compares the token's `azp` against its
-  own `VITE_KEYCLOAK_CLIENT_ID`, and answers 401 for any other client.
 - The API grants a datastore to a person, or to a service account holding the `operator` realm role.
-  Without that role a service account token is refused the datastore, so a local run needs either the
-  device login or a client shaped like `manta-codegen`, which has no device flow and needs
-  `MANTA_CLIENT_SECRET`.
+  `manta-codegen` holds it; a service account without it is refused the datastore.
+- The API can compare the token's `azp` against its own `VITE_KEYCLOAK_CLIENT_ID` and answer 401 for
+  any other client. That check is off today (`authorizedPartyCheckEnabled`). Turning it on 401s
+  both `<realm>-cli` and `manta-codegen` unless it learns to accept them.
 
 ## What the datastore does not hold
 

package/dist/cli.js

@@ -1,23 +1,17 @@
 #!/usr/bin/env node
 import { Command, Option } from "commander";
 import { resolve } from "node:path";
+import { cachedToken, ciClientId, clientIdHelp, describeError, mintWithClientCredentials, publicClientFrom, registerAuthCommands, userTokenSource, } from "@manta-eu/auth";
 import { fetchRealmShapes, sparqlEndpoint } from "./fetch-shapes.js";
-import { pollForDeviceToken, startDeviceLogin } from "./device-login.js";
-import { describeError } from "./http.js";
 import { generatePackage } from "./generate.js";
-import { cachedToken, mintWithClientCredentials } from "./token.js";
 // The secret stays out of the flags: an argument list is readable to every process on the machine.
 function tokenSourceFor(options) {
-    const client = { baseUrl: options.keycloakUrl, realm: options.keycloakRealm, clientId: options.clientId };
     const secret = process.env.MANTA_CLIENT_SECRET;
     if (secret) {
+        const client = publicClientFrom({ ...options, clientId: options.clientId ?? ciClientId });
         return cachedToken(() => mintWithClientCredentials({ ...client, clientSecret: secret, scope: options.scope }));
     }
-    return cachedToken(async () => {
-        const login = await startDeviceLogin(client);
-        console.error(`manta-codegen: open ${login.verificationUri} and enter the code ${login.userCode}`);
-        return pollForDeviceToken(client, login);
-    });
+    return userTokenSource(publicClientFrom(options), { label: "manta-codegen", useDeviceCode: options.useDeviceCode });
 }
 function reportTargetClasses(targetClasses) {
     const total = Object.values(targetClasses).reduce((sum, count) => sum + count, 0);
@@ -53,16 +47,18 @@ program
     .requiredOption("--datastore <id>", "datastore to read")
     .requiredOption("--keycloak-url <url>", "Keycloak base URL")
     .requiredOption("--keycloak-realm <realm>", "Keycloak realm")
-    .requiredOption("--client-id <id>", "Keycloak client id")
-    .option("--scope <scope>", "OAuth scope to ask for")
+    .option("--client-id <id>", clientIdHelp)
+    .option("--scope <scope>", "OAuth scope to ask a service account token for")
+    .option("--use-device-code", "if a login is needed, use a one-time code instead of a browser redirect")
     .addOption(new Option("--out <dir>", "directory to write into").default("./.ldkit"))
     .action(async (options) => {
     try {
         await generate(options);
     }
     catch (error) {
-        console.error(describeError(error));
+        console.error(`manta-codegen: ${describeError(error)}`);
         process.exit(1);
     }
 });
-program.parse();
+registerAuthCommands(program, { label: "manta-codegen" });
+await program.parseAsync();

package/dist/fetch-shapes.d.ts

@@ -1,5 +1,4 @@
-import type { FetchLike } from "./http.js";
-import type { TokenSource } from "./token.js";
+import { type FetchLike, type TokenSource } from "@manta-eu/auth";
 export type RealmShapes = {
     vocabBase: string;
     ontologyGraphIri: string;

package/dist/fetch-shapes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-shapes.d.ts","sourceRoot":"","sources":["../src/fetch-shapes.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,CAAC;AAEF,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,WAAW,EAClB,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,WAAW,CAAC,CActB"}
+{"version":3,"file":"fetch-shapes.d.ts","sourceRoot":"","sources":["../src/fetch-shapes.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,WAAW,EAAe,MAAM,gBAAgB,CAAC;AAE/E,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,CAAC;AAEF,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,WAAW,EAClB,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,WAAW,CAAC,CAkBtB"}

package/dist/fetch-shapes.js

@@ -1,12 +1,13 @@
 import { countTargetClasses, fetchGraphList, fetchGraphTurtle, findOntologyGraph, shaclGraphIri, vocabBaseFromOntologyGraph, } from "./shapes.js";
+import { withRenewal } from "@manta-eu/auth";
 export function sparqlEndpoint(apiUrl, datastoreId) {
     return `${apiUrl.replace(/\/$/, "")}/d/${encodeURIComponent(datastoreId)}/sparql`;
 }
 export async function fetchRealmShapes(endpoint, token, fetchImpl = fetch) {
-    const graphs = await fetchGraphList({ endpoint, token: await token() }, fetchImpl);
+    const graphs = await withRenewal(token, (accessToken) => fetchGraphList({ endpoint, token: accessToken }, fetchImpl));
     const ontologyGraphIri = findOntologyGraph(graphs);
-    const shacl = await fetchGraphTurtle({ endpoint, graphIri: shaclGraphIri, token: await token() }, fetchImpl);
-    const ontology = await fetchGraphTurtle({ endpoint, graphIri: ontologyGraphIri, token: await token() }, fetchImpl);
+    const shacl = await withRenewal(token, (accessToken) => fetchGraphTurtle({ endpoint, graphIri: shaclGraphIri, token: accessToken }, fetchImpl));
+    const ontology = await withRenewal(token, (accessToken) => fetchGraphTurtle({ endpoint, graphIri: ontologyGraphIri, token: accessToken }, fetchImpl));
     return {
         vocabBase: vocabBaseFromOntologyGraph(ontologyGraphIri),
         ontologyGraphIri,

package/dist/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../src/generate.ts"],"names":[],"mappings":"AAYA,wBAAgB,YAAY,CAAC,KAAK,GAAE,MAAqB,GAAG,MAAM,CAOjE;AAOD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAGD,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpF;AAOD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ3E;AAMD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAU3D;AAGD,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAchE;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAElF,wBAAsB,eAAe,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWjH"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../src/generate.ts"],"names":[],"mappings":"AAYA,wBAAgB,YAAY,CAAC,KAAK,GAAE,MAAqB,GAAG,MAAM,CAOjE;AAOD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAGD,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpF;AAOD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ3E;AAMD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAQ3D;AAGD,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAchE;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAElF,wBAAsB,eAAe,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWjH"}

package/dist/generate.js

@@ -14,7 +14,7 @@ export function ldkitCliPath(entry = ldkitEntry()) {
         if (existsSync(candidate))
             return candidate;
     }
-    throw new Error("manta-codegen: cannot find the LDkit CLI beside the resolved ldkit package.");
+    throw new Error("cannot find the LDkit CLI beside the resolved ldkit package.");
 }
 // LDkit writes a property name as a bare object key, and Meta sends terms such as `1dClick`.
 const objectKey = /(?<=^\s+)[^\s"':]+(?=:\s)/gm;
@@ -51,7 +51,7 @@ export function failOnUnknownNamespace(outDir) {
     if (!existsSync(path))
         return;
     const names = splitDeclarations(readFileSync(path, "utf8")).declarations.map((each) => each.name);
-    throw new Error(`manta-codegen: the endpoint named no prefix for some terms, so LDkit wrote ${unknownFile}: ${names.join(", ")}.`);
+    throw new Error(`the endpoint named no prefix for some terms, so LDkit wrote ${unknownFile}: ${names.join(", ")}.`);
 }
 // The LDkit CLI reports a failure on stderr and still exits 0, so an empty directory is the signal.
 export function runLdkit(shaclPath, outDir) {
@@ -59,7 +59,7 @@ export function runLdkit(shaclPath, outDir) {
     mkdirSync(outDir, { recursive: true });
     execFileSync(process.execPath, [ldkitCliPath(), "shacl-to-package", "--prefix-alias", `${realmPrefix}=Manta`, "file", shaclPath, outDir], { stdio: "inherit" });
     if (!existsSync(join(outDir, "index.ts"))) {
-        throw new Error(`manta-codegen: LDkit wrote no schema into ${outDir}. Read the error above.`);
+        throw new Error(`LDkit wrote no schema into ${outDir}. Read the error above.`);
     }
     failOnUnknownNamespace(outDir);
 }

package/dist/index.d.ts

@@ -1,9 +1,6 @@
-export { deviceLoginTokenSource, pollForDeviceToken, pollForDeviceTokens, refreshAccessToken, startDeviceLogin, type DeviceLogin, type DeviceTokens, type PkcePair, type PublicClient, type Sleep, } from "./device-login.js";
 export { fetchRealmShapes, sparqlEndpoint, type RealmShapes } from "./fetch-shapes.js";
 export { failOnUnknownNamespace, generatePackage, removeGeneratedFiles, type ShapeSources } from "./generate.js";
 export { sortSchemas } from "./sort-schemas.js";
-export { describeError, isTransientStatus, readJson, type FetchLike } from "./http.js";
 export { countTargetClasses } from "./shapes.js";
-export { cachedToken, mintWithClientCredentials, type ClientCredentials, type TokenSource } from "./token.js";
 export { mergeShapes, realmPrefix, sortQuads } from "./turtle.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,KAAK,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,oBAAoB,EAAE,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AACjH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAE,KAAK,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9G,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,oBAAoB,EAAE,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AACjH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -1,8 +1,5 @@
-export { deviceLoginTokenSource, pollForDeviceToken, pollForDeviceTokens, refreshAccessToken, startDeviceLogin, } from "./device-login.js";
 export { fetchRealmShapes, sparqlEndpoint } from "./fetch-shapes.js";
 export { failOnUnknownNamespace, generatePackage, removeGeneratedFiles } from "./generate.js";
 export { sortSchemas } from "./sort-schemas.js";
-export { describeError, isTransientStatus, readJson } from "./http.js";
 export { countTargetClasses } from "./shapes.js";
-export { cachedToken, mintWithClientCredentials } from "./token.js";
 export { mergeShapes, realmPrefix, sortQuads } from "./turtle.js";

package/dist/shapes.d.ts

@@ -1,4 +1,4 @@
-import { type FetchLike } from "./http.js";
+import { type FetchLike } from "@manta-eu/auth";
 export declare const shaclGraphIri = "https://rdfox.com/default-base-iri/shacl";
 export declare function constructGraphQuery(graphIri: string): string;
 export declare function graphListQuery(): string;

package/dist/shapes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shapes.d.ts","sourceRoot":"","sources":["../src/shapes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAU,MAAM,WAAW,CAAC;AAGnD,eAAO,MAAM,aAAa,6CAA6C,CAAC;AAMxE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM5D;AAED,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAID,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAIxD;AAID,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAiBtE;AAED,wBAAgB,0BAA0B,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE,MAAM,MAAM,YAAY,GAAG,eAAe,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAiClE,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,GAAE,SAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ3G;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,GAAE,SAAiB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAI7G;AAMD,eAAO,MAAM,UAAU,YAAY,CAAC;AAGpC,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAazE"}
+{"version":3,"file":"shapes.d.ts","sourceRoot":"","sources":["../src/shapes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAA+B,MAAM,gBAAgB,CAAC;AAG7E,eAAO,MAAM,aAAa,6CAA6C,CAAC;AAMxE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM5D;AAED,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAID,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAIxD;AAID,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAiBtE;AAED,wBAAgB,0BAA0B,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE,MAAM,MAAM,YAAY,GAAG,eAAe,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAkClE,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,GAAE,SAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ3G;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,GAAE,SAAiB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAI7G;AAMD,eAAO,MAAM,UAAU,YAAY,CAAC;AAGpC,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAazE"}

package/dist/shapes.js

@@ -1,11 +1,11 @@
-import { postTo } from "./http.js";
+import { postTo, RefusedRequestError } from "@manta-eu/auth";
 // The store puts the shapes here for every realm, so this one carries no realm identifier.
 export const shaclGraphIri = "https://rdfox.com/default-base-iri/shacl";
 const storeDefaultBaseIri = "https://rdfox.com/default-base-iri/";
 const ontologyGraphSuffix = "ontology";
 export function constructGraphQuery(graphIri) {
     if (graphIri.includes(">")) {
-        throw new Error(`manta-codegen: the graph IRI ${graphIri} carries a ">", which cannot go into a query.`);
+        throw new Error(`the graph IRI ${graphIri} carries a ">", which cannot go into a query.`);
     }
     return `CONSTRUCT { ?s ?p ?o } WHERE { GRAPH <${graphIri}> { ?s ?p ?o } }`;
 }
@@ -21,11 +21,11 @@ export function readGraphList(results) {
 export function findOntologyGraph(graphIris) {
     const candidates = graphIris.filter((iri) => iri.endsWith(ontologyGraphSuffix) && !iri.startsWith(storeDefaultBaseIri));
     if (candidates.length === 0) {
-        throw new Error(`manta-codegen: the datastore holds no ontology graph. Looked for an IRI that ends with ` +
+        throw new Error(`the datastore holds no ontology graph. Looked for an IRI that ends with ` +
             `"${ontologyGraphSuffix}" among: ${graphIris.join(", ")}.`);
     }
     if (candidates.length > 1) {
-        throw new Error(`manta-codegen: the datastore holds more than one ontology graph: ${candidates.join(", ")}.`);
+        throw new Error(`the datastore holds more than one ontology graph: ${candidates.join(", ")}.`);
     }
     return candidates[0];
 }
@@ -45,7 +45,7 @@ async function runSparql({ endpoint, token }, { query, accept, action }, fetchIm
 function refusal(call, response, body) {
     const rejectsToken = response.status === 401 || response.status === 403;
     const hint = rejectsToken ? " Check that the token carries access to this datastore." : "";
-    return new Error(`manta-codegen: ${call.endpoint} refused ${call.action} with status ${response.status}.${hint} ${body.trim()}`);
+    return new RefusedRequestError(`${call.endpoint} refused ${call.action} with status ${response.status}.${hint} ${body.trim()}`, response.status);
 }
 export async function fetchGraphTurtle(request, fetchImpl = fetch) {
     const call = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manta-eu/codegen",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "CLI that generates LDkit schemas from a realm's SHACL shapes, read from its datastore",
   "type": "module",
   "bin": {
@@ -17,9 +17,10 @@
   "dependencies": {
     "@types/n3": "^1.26.0",
     "commander": "^15.0.0",
-    "ldkit": "2.8.0",
+    "ldkit": "^2.8.0",
     "n3": "^2.7.12",
-    "prettier": "^3.8.1"
+    "prettier": "^3.8.1",
+    "@manta-eu/auth": "0.1.4"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",
@@ -27,8 +28,8 @@
     "@typescript-eslint/parser": "^8.56.1",
     "eslint": "^9.39.2",
     "rimraf": "^6.1.3",
-    "typescript": "^5.0.0",
-    "vitest": "^3.0.0"
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.8"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/dist/device-login.d.ts

@@ -1,45 +0,0 @@
-import { type FetchLike } from "./http.js";
-import { type TokenSource } from "./token.js";
-export type PublicClient = {
-    baseUrl: string;
-    realm: string;
-    clientId: string;
-};
-export type DeviceLogin = {
-    deviceCode: string;
-    userCode: string;
-    verificationUri: string;
-    intervalMs: number;
-    expiresInMs: number;
-    codeVerifier: string;
-};
-export type PkcePair = {
-    verifier: string;
-    challenge: string;
-};
-export type Sleep = (ms: number) => Promise<void>;
-export declare function deviceAuthEndpoint(baseUrl: string, realm: string): string;
-export declare function createPkcePair(): PkcePair;
-export declare function startDeviceLogin(client: PublicClient, fetchImpl?: FetchLike, pkce?: PkcePair): Promise<DeviceLogin>;
-export type DeviceTokens = {
-    accessToken: string;
-    refreshToken?: string;
-};
-export declare function pollForDeviceToken(...args: Parameters<typeof pollForDeviceTokens>): Promise<string>;
-export declare function pollForDeviceTokens(client: PublicClient, { deviceCode, codeVerifier, intervalMs, expiresInMs, }: Pick<DeviceLogin, "deviceCode" | "codeVerifier"> & {
-    intervalMs?: number;
-    expiresInMs?: number;
-}, { fetchImpl, sleep, clock, }?: {
-    fetchImpl?: FetchLike;
-    sleep?: Sleep;
-    clock?: () => number;
-}): Promise<DeviceTokens>;
-export declare function refreshAccessToken(client: PublicClient, refreshToken: string, fetchImpl?: FetchLike): Promise<DeviceTokens | undefined>;
-export declare function deviceLoginTokenSource(client: PublicClient, prompt: (login: DeviceLogin) => void, { fetchImpl, login, poll, }?: {
-    fetchImpl?: FetchLike;
-    login?: (client: PublicClient, fetchImpl: FetchLike) => Promise<DeviceLogin>;
-    poll?: (client: PublicClient, login: DeviceLogin, options: {
-        fetchImpl: FetchLike;
-    }) => Promise<DeviceTokens>;
-}): TokenSource;
-//# sourceMappingURL=device-login.d.ts.map

package/dist/device-login.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"device-login.d.ts","sourceRoot":"","sources":["../src/device-login.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,SAAS,EAAoD,MAAM,WAAW,CAAC;AAC7F,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAE7D,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,MAAM,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAclD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE;AAGD,wBAAgB,cAAc,IAAI,QAAQ,CAIzC;AA+BD,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,YAAY,EACpB,SAAS,GAAE,SAAiB,EAC5B,IAAI,GAAE,QAA2B,GAChC,OAAO,CAAC,WAAW,CAAC,CAiBtB;AAyBD,MAAM,MAAM,YAAY,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E,wBAAsB,kBAAkB,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAEzG;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,YAAY,EACpB,EACE,UAAU,EACV,YAAY,EACZ,UAA8B,EAC9B,WAAgC,GACjC,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,GAAG,cAAc,CAAC,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EACnG,EACE,SAAiB,EACjB,KAAgB,EAChB,KAAgB,GACjB,GAAE;IAAE,SAAS,CAAC,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CAAO,GACrE,OAAO,CAAC,YAAY,CAAC,CAwBvB;AAGD,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,EACpB,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAiBnC;AAGD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,EACpC,EACE,SAAiB,EACjB,KAAwB,EACxB,IAA0B,GAC3B,GAAE;IACD,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE;QAAE,SAAS,EAAE,SAAS,CAAA;KAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CAC1G,GACL,WAAW,CAkBb"}

package/dist/device-login.js

@@ -1,127 +0,0 @@
-import { createHash, randomBytes } from "node:crypto";
-import { formRequest, isTransientStatus, postTo, readJson } from "./http.js";
-import { tokenEndpoint } from "./token.js";
-const deviceCodeGrant = "urn:ietf:params:oauth:grant-type:device_code";
-// RFC 8628 says to add this much whenever the server answers slow_down.
-const slowDownStepMs = 5_000;
-const defaultIntervalMs = 5_000;
-// RFC 8628 makes expires_in optional, and Keycloak sends ten minutes.
-const defaultExpiresInMs = 600_000;
-const sleepFor = (ms) => new Promise((done) => setTimeout(done, ms));
-export function deviceAuthEndpoint(baseUrl, realm) {
-    return `${baseUrl}/realms/${realm}/protocol/openid-connect/auth/device`;
-}
-// A public client holds no secret, so PKCE is what ties the token request back to this process.
-export function createPkcePair() {
-    const verifier = randomBytes(32).toString("base64url");
-    return { verifier, challenge: createHash("sha256").update(verifier).digest("base64url") };
-}
-function readDeviceLogin(body, endpoint, codeVerifier) {
-    const deviceCode = body.device_code;
-    const userCode = body.user_code;
-    const verificationUri = body.verification_uri_complete ?? body.verification_uri;
-    if (!deviceCode || !userCode || !verificationUri) {
-        throw new Error(`manta-codegen: the device login response from ${endpoint} is incomplete.`);
-    }
-    return {
-        deviceCode,
-        userCode,
-        verificationUri,
-        intervalMs: body.interval ? body.interval * 1000 : defaultIntervalMs,
-        expiresInMs: body.expires_in ? body.expires_in * 1000 : defaultExpiresInMs,
-        codeVerifier,
-    };
-}
-// No secret lives on the machine: a developer needs nothing beyond a browser login.
-export async function startDeviceLogin(client, fetchImpl = fetch, pkce = createPkcePair()) {
-    const endpoint = deviceAuthEndpoint(client.baseUrl, client.realm);
-    const request = formRequest({
-        client_id: client.clientId,
-        code_challenge: pkce.challenge,
-        code_challenge_method: "S256",
-    });
-    const response = await postTo(endpoint, request, fetchImpl);
-    if (!response.ok) {
-        throw new Error(`manta-codegen: ${endpoint} refused the device login with status ${response.status}. ` +
-            `Check that the client ${client.clientId} is public and allows the OAuth device flow.`);
-    }
-    return readDeviceLogin(await readJson(response, endpoint), endpoint, pkce.verifier);
-}
-function deviceLoginFailure(error, status) {
-    switch (error) {
-        case "access_denied":
-            return new Error("manta-codegen: the login was refused in the browser.");
-        case "expired_token":
-            return new Error("manta-codegen: the login code expired. Run the command again.");
-        case "authorization_pending":
-        case "slow_down":
-            return undefined;
-        default:
-            return new Error(`manta-codegen: the device login failed with "${error ?? status}".`);
-    }
-}
-function deviceTokenRequest(client, deviceCode, codeVerifier) {
-    return formRequest({
-        grant_type: deviceCodeGrant,
-        device_code: deviceCode,
-        client_id: client.clientId,
-        code_verifier: codeVerifier,
-    });
-}
-export async function pollForDeviceToken(...args) {
-    return (await pollForDeviceTokens(...args)).accessToken;
-}
-export async function pollForDeviceTokens(client, { deviceCode, codeVerifier, intervalMs = defaultIntervalMs, expiresInMs = defaultExpiresInMs, }, { fetchImpl = fetch, sleep = sleepFor, clock = Date.now, } = {}) {
-    const endpoint = tokenEndpoint(client.baseUrl, client.realm);
-    const request = deviceTokenRequest(client, deviceCode, codeVerifier);
-    const deadline = clock() + expiresInMs;
-    let wait = intervalMs;
-    for (;;) {
-        // Keycloak answers authorization_pending for ever if nobody opens the link.
-        if (clock() >= deadline)
-            throw new Error("manta-codegen: nobody approved the login in time. Run it again.");
-        const response = await postTo(endpoint, request, fetchImpl);
-        const body = await readJson(response, endpoint);
-        if (response.ok && body.access_token) {
-            return { accessToken: body.access_token, ...(body.refresh_token ? { refreshToken: body.refresh_token } : {}) };
-        }
-        const failure = deviceLoginFailure(body.error, response.status);
-        if (failure)
-            throw failure;
-        if (body.error === "slow_down")
-            wait += slowDownStepMs;
-        await sleep(wait);
-    }
-}
-// A refresh token outlives many access tokens, so a long run renews without a second browser login.
-export async function refreshAccessToken(client, refreshToken, fetchImpl = fetch) {
-    const endpoint = tokenEndpoint(client.baseUrl, client.realm);
-    const request = formRequest({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: client.clientId });
-    const response = await postTo(endpoint, request, fetchImpl);
-    // A refused refresh token is terminal and earns a new login; an overloaded Keycloak must not cost one.
-    if (isTransientStatus(response.status)) {
-        throw new Error(`manta-codegen: ${endpoint} could not renew the token (status ${response.status}).`);
-    }
-    if (!response.ok)
-        return undefined;
-    const body = await readJson(response, endpoint);
-    if (!body.access_token)
-        return undefined;
-    return { accessToken: body.access_token, refreshToken: body.refresh_token ?? refreshToken };
-}
-// One device login, then silent refreshes until the refresh token itself is refused.
-export function deviceLoginTokenSource(client, prompt, { fetchImpl = fetch, login = startDeviceLogin, poll = pollForDeviceTokens, } = {}) {
-    let refreshToken;
-    return async () => {
-        const refreshed = refreshToken ? await refreshAccessToken(client, refreshToken, fetchImpl) : undefined;
-        if (refreshed) {
-            refreshToken = refreshed.refreshToken;
-            return refreshed.accessToken;
-        }
-        const started = await login(client, fetchImpl);
-        prompt(started);
-        const tokens = await poll(client, started, { fetchImpl });
-        refreshToken = tokens.refreshToken;
-        return tokens.accessToken;
-    };
-}

package/dist/http.d.ts

@@ -1,7 +0,0 @@
-export type FetchLike = (url: string, init: RequestInit) => Promise<Response>;
-export declare function formRequest(fields: Record<string, string>): RequestInit;
-export declare function isTransientStatus(status: number): boolean;
-export declare function readJson<T>(response: Response, endpoint: string, label?: string): Promise<T>;
-export declare function postTo(endpoint: string, init: RequestInit, fetchImpl?: FetchLike): Promise<Response>;
-export declare function describeError(error: unknown): string;
-//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE9E,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,WAAW,CAMvE;AAGD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD;AAGD,wBAAsB,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,SAAkB,GAAG,OAAO,CAAC,CAAC,CAAC,CAQ3G;AAGD,wBAAsB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,GAAE,SAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAMjH;AAGD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIpD"}

package/dist/http.js

@@ -1,36 +0,0 @@
-export function formRequest(fields) {
-    return {
-        method: "POST",
-        headers: { "content-type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams(fields).toString(),
-    };
-}
-// Overload and timeout, which are worth repeating; every other refusal is the server's final word.
-export function isTransientStatus(status) {
-    return status >= 500 || status === 429 || status === 408;
-}
-// A proxy answers an HTML page, and response.json() then throws a bare SyntaxError.
-export async function readJson(response, endpoint, label = "manta-codegen") {
-    const body = await response.text();
-    try {
-        return JSON.parse(body);
-    }
-    catch {
-        throw new Error(`${label}: ${endpoint} answered status ${response.status} with text, not JSON: ${body}`);
-    }
-}
-// A thrown fetch says only "fetch failed", which names neither the host nor the step.
-export async function postTo(endpoint, init, fetchImpl = fetch) {
-    try {
-        return await fetchImpl(endpoint, init);
-    }
-    catch (cause) {
-        throw new Error(`manta-codegen: cannot reach ${endpoint}.`, { cause });
-    }
-}
-// postTo puts the real failure in the cause, and the message alone names only the host.
-export function describeError(error) {
-    if (!(error instanceof Error))
-        return String(error);
-    return error.cause instanceof Error ? `${error.message}\n  caused by: ${error.cause.message}` : error.message;
-}

package/dist/token.d.ts

@@ -1,17 +0,0 @@
-import { type FetchLike } from "./http.js";
-export type ClientCredentials = {
-    baseUrl: string;
-    realm: string;
-    clientId: string;
-    clientSecret: string;
-    scope?: string;
-};
-export type TokenSource = () => Promise<string>;
-export declare const tokenExpiryBufferMs = 60000;
-export declare const unparsableTokenTtlMs = 30000;
-export declare function tokenEndpoint(baseUrl: string, realm: string): string;
-export declare function accessTokenExpiresAt(accessToken: string, now: number): number;
-export declare function isFresh(expiresAt: number, now: number): boolean;
-export declare function mintWithClientCredentials(credentials: ClientCredentials, fetchImpl?: FetchLike): Promise<string>;
-export declare function cachedToken(mint: TokenSource, clock?: () => number): TokenSource;
-//# sourceMappingURL=token.d.ts.map

package/dist/token.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAuB,MAAM,WAAW,CAAC;AAEhE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAGhD,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAG1C,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AAGD,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAc7E;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/D;AAqBD,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,iBAAiB,EAC9B,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,GAAE,MAAM,MAAiB,GAAG,WAAW,CAc1F"}

package/dist/token.js

@@ -1,63 +0,0 @@
-import { formRequest, postTo } from "./http.js";
-// Re-mint before Keycloak's own exp, so an in-flight request never races an expired token.
-export const tokenExpiryBufferMs = 60_000;
-// The exp claim did not parse, so the token gets a short life rather than none.
-export const unparsableTokenTtlMs = 30_000;
-export function tokenEndpoint(baseUrl, realm) {
-    return `${baseUrl}/realms/${realm}/protocol/openid-connect/token`;
-}
-// Reads exp without checking the signature: the caller only decides when to re-mint.
-export function accessTokenExpiresAt(accessToken, now) {
-    const fallback = now + unparsableTokenTtlMs;
-    const payload = accessToken.split(".")[1];
-    if (!payload)
-        return fallback;
-    try {
-        const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-        const exp = claims.exp;
-        return typeof exp === "number" ? exp * 1000 - tokenExpiryBufferMs : fallback;
-    }
-    catch {
-        return fallback;
-    }
-}
-export function isFresh(expiresAt, now) {
-    return expiresAt > now;
-}
-function clientCredentialsRequest({ clientId, clientSecret, scope }) {
-    return formRequest({
-        grant_type: "client_credentials",
-        client_id: clientId,
-        client_secret: clientSecret,
-        ...(scope ? { scope } : {}),
-    });
-}
-function readAccessToken(body, realm) {
-    const accessToken = body.access_token;
-    if (typeof accessToken !== "string") {
-        throw new Error(`manta-codegen: the Keycloak response for realm ${realm} carries no access_token.`);
-    }
-    return accessToken;
-}
-export async function mintWithClientCredentials(credentials, fetchImpl = fetch) {
-    const { baseUrl, realm } = credentials;
-    const endpoint = tokenEndpoint(baseUrl, realm);
-    const response = await postTo(endpoint, clientCredentialsRequest(credentials), fetchImpl);
-    if (!response.ok) {
-        throw new Error(`manta-codegen: Keycloak refused the client credentials for realm ${realm} with status ${response.status}. ` +
-            `Check the client id and the secret against ${endpoint}.`);
-    }
-    return readAccessToken(await response.json(), realm);
-}
-export function cachedToken(mint, clock = Date.now) {
-    let held;
-    return async () => {
-        const now = clock();
-        if (held && isFresh(held.expiresAt, now))
-            return held.token;
-        const token = await mint();
-        // A device login blocks until the browser answers, so `now` is already stale here.
-        held = { token, expiresAt: accessTokenExpiresAt(token, clock()) };
-        return token;
-    };
-}