@manta-eu/upload 0.1.2 → 0.1.3

package/README.md

@@ -14,24 +14,25 @@ pnpm manta-upload people.csv orders.parquet \
   --api-url https://app.example \
   --datastore your-datastore \
   --keycloak-url https://keycloak.example \
-  --keycloak-realm your-realm \
-  --client-id your-realm-app
+  --keycloak-realm your-realm
 ```
 
 For each file the CLI prints the file's IRI, its media type and its size.
 
 ## Log in
 
-Login works as it does for `manta-codegen`, whose token code this package reuses.
-`MANTA_CLIENT_SECRET` decides the path.
+Login works as it does for `manta-codegen`: both CLIs register the same commands from
+`@manta-eu/auth`. `MANTA_CLIENT_SECRET` decides the path.
 
-**No secret: a person.** The CLI starts the OAuth device flow with PKCE, prints a link and a code,
-then waits for the browser. The upload is attributed to that person. The CLI keeps the refresh token,
-so a long batch renews its access token silently; it asks for a new browser login only if Keycloak
-refuses the refresh token, for example once the session's own lifetime ends.
+**No secret: a person.** Log in once with `manta-upload login`, which takes the same
+`--keycloak-url` and `--keycloak-realm`; `status` and `logout` sit next to it. The
+upload is attributed to that person. The login is stored and renewed silently, and it is the same
+stored login `manta-codegen` uses, so logging in with either CLI serves both. See
+[`@manta-eu/auth`](https://www.npmjs.com/package/@manta-eu/auth) for how the browser login
+works, where the login is stored and how long it lasts.
 
-**A secret: a machine.** The CLI asks for a service account token. Add `--scope` for a narrower
-token.
+**A secret: a machine.** The CLI asks for a service account token, from the realm's `manta-codegen`
+client unless `--client-id` names another. Add `--scope` for a narrower token.
 
 ```shell
 export MANTA_CLIENT_SECRET=...   # never a flag: an argument list is public on the machine

package/dist/cli.js

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
-import { cachedToken, describeError, deviceLoginTokenSource, mintWithClientCredentials, } from "@manta-eu/codegen";
+import { cachedToken, ciClientId, clientIdHelp, describeError, mintWithClientCredentials, publicClientFrom, registerAuthCommands, userTokenSource, } from "@manta-eu/auth";
 import { Command } from "commander";
 import { graphqlClient, graphqlEndpoint } from "./graphql.js";
 import { uploadFile } from "./upload.js";
 // The secret stays out of the flags: an argument list is readable to every process on the machine.
 function tokenSourceFor(options) {
-    const client = { baseUrl: options.keycloakUrl, realm: options.keycloakRealm, clientId: options.clientId };
     const secret = process.env.MANTA_CLIENT_SECRET;
     if (secret) {
+        const client = publicClientFrom({ ...options, clientId: options.clientId ?? ciClientId });
         return cachedToken(() => mintWithClientCredentials({ ...client, clientSecret: secret, scope: options.scope }));
     }
-    // Refreshes silently, so a long batch does not stop for a second browser login.
-    return cachedToken(deviceLoginTokenSource(client, (login) => console.error(`manta-upload: open ${login.verificationUri} and enter the code ${login.userCode}`)));
+    // The same stored login manta-codegen uses, renewed silently, so a long batch never stops for a browser.
+    return userTokenSource(publicClientFrom(options), { label: "manta-upload", useDeviceCode: options.useDeviceCode });
 }
 async function upload(paths, options) {
     const graphql = graphqlClient({
@@ -38,21 +38,27 @@ async function upload(paths, options) {
 }
 const program = new Command()
     .name("manta-upload")
-    .description("Upload files to a Manta datastore. CSV, Parquet, Turtle and N-Triples files are ingested into its knowledge graph.")
+    .description("Upload files to a Manta datastore. CSV, Parquet, Turtle and N-Triples files are ingested into its knowledge graph.");
+// The default command, so `manta-upload <files...>` keeps working next to login, logout and status.
+program
+    .command("upload", { isDefault: true })
+    .description("upload the files; the default when no other command is named")
     .argument("<files...>", "files to upload")
     .requiredOption("--api-url <url>", "Manta API base URL")
     .requiredOption("--datastore <id>", "datastore to upload into")
     .requiredOption("--keycloak-url <url>", "Keycloak base URL")
     .requiredOption("--keycloak-realm <realm>", "Keycloak realm")
-    .requiredOption("--client-id <id>", "Keycloak client")
+    .option("--client-id <id>", clientIdHelp)
     .option("--scope <scope>", "scope to ask a service account token for")
+    .option("--use-device-code", "if a login is needed, use a one-time code instead of a browser redirect")
     .action(async (paths, options) => {
     try {
         await upload(paths, options);
     }
     catch (error) {
-        console.error(describeError(error));
+        console.error(`manta-upload: ${describeError(error)}`);
         process.exitCode = 1;
     }
 });
+registerAuthCommands(program, { label: "manta-upload" });
 await program.parseAsync();

package/dist/graphql.d.ts

@@ -1,10 +1,10 @@
-import { type FetchLike } from "@manta-eu/codegen";
+import { type FetchLike, type TokenSource } from "@manta-eu/auth";
 export declare function graphqlEndpoint(apiUrl: string): string;
 export type GraphqlClient = <T>(query: string, variables: Record<string, unknown>) => Promise<T>;
 export declare function graphqlClient(options: {
     endpoint: string;
     datastore: string;
-    token: () => Promise<string>;
+    token: TokenSource;
     fetchImpl?: FetchLike;
 }): GraphqlClient;
 //# sourceMappingURL=graphql.d.ts.map

package/dist/graphql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graphql.d.ts","sourceRoot":"","sources":["../src/graphql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,SAAS,EAAY,MAAM,mBAAmB,CAAC;AAE5E,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;AAGjG,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,GAAG,aAAa,CAqChB"}
+{"version":3,"file":"graphql.d.ts","sourceRoot":"","sources":["../src/graphql.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,SAAS,EAGd,KAAK,WAAW,EAEjB,MAAM,gBAAgB,CAAC;AAExB,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;AAGjG,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,WAAW,CAAC;IACnB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,GAAG,aAAa,CAmChB"}

package/dist/graphql.js

@@ -1,13 +1,13 @@
-import { describeError, readJson } from "@manta-eu/codegen";
+import { describeError, readJson, RefusedRequestError, withRenewal, } from "@manta-eu/auth";
 export function graphqlEndpoint(apiUrl) {
     return `${apiUrl.replace(/\/$/, "")}/graphql`;
 }
 // The datastore travels as a header: the API refuses the call rather than fall back to another one.
 export function graphqlClient(options) {
     const { endpoint, datastore, token, fetchImpl = fetch } = options;
-    return async (query, variables) => {
-        // Minted outside the try: a login that fails is not the API being unreachable.
-        const authorization = `Bearer ${await token()}`;
+    return (query, variables) => withRenewal(token, (accessToken) => send(accessToken, query, variables));
+    async function send(accessToken, query, variables) {
+        const authorization = `Bearer ${accessToken}`;
         let response;
         try {
             response = await fetchImpl(endpoint, {
@@ -17,17 +17,17 @@ export function graphqlClient(options) {
             });
         }
         catch (cause) {
-            throw new Error(`manta-upload: cannot reach ${endpoint}. ${describeError(cause)}`, { cause });
+            throw new Error(`cannot reach ${endpoint}. ${describeError(cause)}`, { cause });
         }
-        const body = await readJson(response, endpoint, "manta-upload");
+        const body = await readJson(response, endpoint);
         if (body.errors?.length) {
-            throw new Error(`manta-upload: ${body.errors.map((error) => error.message).join("; ")}`);
+            throw new Error(`${body.errors.map((error) => error.message).join("; ")}`);
         }
         if (!response.ok || !body.data) {
             // The Worker's auth middleware answers before Yoga, so its reason is `error`, not `errors`.
             const reason = typeof body.error === "string" ? `: ${body.error}` : " without data";
-            throw new Error(`manta-upload: ${endpoint} answered status ${response.status}${reason}`);
+            throw new RefusedRequestError(`${endpoint} answered status ${response.status}${reason}`, response.status);
         }
         return body.data;
-    };
+    }
 }

package/dist/upload.d.ts

@@ -1,4 +1,4 @@
-import { type FetchLike } from "@manta-eu/codegen";
+import { type FetchLike } from "@manta-eu/auth";
 import type { GraphqlClient } from "./graphql.js";
 export declare const uploadPartSize: number;
 export type UploadedFile = {

package/dist/upload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../src/upload.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,SAAS,EAAqB,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD,eAAO,MAAM,cAAc,QAAkB,CAAC;AAoB9C,MAAM,MAAM,YAAY,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAExG,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5G,CAAC;AAGF,wBAAsB,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAapG;AAED,MAAM,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAiDlD,wBAAsB,UAAU,CAAC,OAAO,EAAE;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,CAAC;IACvB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,GAAG,OAAO,CAAC,YAAY,CAAC,CASxB"}
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../src/upload.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,SAAS,EAAqB,MAAM,gBAAgB,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD,eAAO,MAAM,cAAc,QAAkB,CAAC;AAoB9C,MAAM,MAAM,YAAY,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAExG,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5G,CAAC;AAGF,wBAAsB,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAapG;AAED,MAAM,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAiDlD,wBAAsB,UAAU,CAAC,OAAO,EAAE;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,CAAC;IACvB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,GAAG,OAAO,CAAC,YAAY,CAAC,CASxB"}

package/dist/upload.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { open } from "node:fs/promises";
 import { basename } from "node:path";
-import { isTransientStatus } from "@manta-eu/codegen";
+import { isTransientStatus } from "@manta-eu/auth";
 // Must equal agents' uploadPartSize: the API presigns one part per this many bytes.
 export const uploadPartSize = 8 * 1024 * 1024;
 const initiateMutation = `mutation Initiate($input: InitiateUploadInput!) {
@@ -51,14 +51,14 @@ async function putPartOnce(url, body, fetchImpl) {
     if (!response.ok) {
         // The storage error document is the only thing that says why a part was refused.
         const detail = (await response.text().catch(() => "")).slice(0, 500);
-        const message = `manta-upload: storage refused a part with status ${response.status}: ${detail}`;
+        const message = `storage refused a part with status ${response.status}: ${detail}`;
         throw isTransientStatus(response.status) ? new Error(message) : new NonRetryablePartError(message);
     }
     // The part is already stored, so a body that cannot be discarded must not cost a re-PUT.
     await response.body?.cancel().catch(() => undefined);
     // The part is stored, so repeating the PUT cannot conjure the header completeUpload needs.
     if (!etag) {
-        throw new NonRetryablePartError("manta-upload: storage stored a part but answered without an ETag");
+        throw new NonRetryablePartError("storage stored a part but answered without an ETag");
     }
     return etag;
 }
@@ -77,12 +77,12 @@ async function uploadHandle(file, options) {
     const { path, fileName, graphql, fetchImpl = fetch, sleep = sleepFor } = options;
     const byteSize = (await file.stat()).size;
     if (byteSize === 0)
-        throw new Error(`manta-upload: ${path} is empty`);
+        throw new Error(`${path} is empty`);
     const { initiateUpload } = await graphql(initiateMutation, { input: { fileName, byteSize } });
     const { uploadId, storageKey, partUrls } = initiateUpload;
     try {
         if (partUrls.length !== Math.ceil(byteSize / uploadPartSize)) {
-            throw new Error(`manta-upload: the API split ${fileName} into ${partUrls.length} parts, which this client cannot fill`);
+            throw new Error(`the API split ${fileName} into ${partUrls.length} parts, which this client cannot fill`);
         }
         const parts = [];
         // Hashed from the bytes that went up, so the hash describes the stored object.
@@ -91,7 +91,7 @@ async function uploadHandle(file, options) {
             const start = (partNumber - 1) * uploadPartSize;
             const body = await readFully(file, start, uploadPartSize);
             if (body.length !== Math.min(uploadPartSize, byteSize - start)) {
-                throw new Error(`manta-upload: ${fileName} changed while it was being read`);
+                throw new Error(`${fileName} changed while it was being read`);
             }
             hash.update(body);
             parts.push({ partNumber, etag: await putPart(url, body, fetchImpl, sleep) });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manta-eu/upload",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "CLI that uploads files to a Manta datastore, where supported types are ingested into its knowledge graph",
   "type": "module",
   "bin": {
@@ -16,7 +16,7 @@
   "license": "MIT",
   "dependencies": {
     "commander": "^15.0.0",
-    "@manta-eu/codegen": "0.1.2"
+    "@manta-eu/auth": "0.1.3"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",
@@ -24,8 +24,8 @@
     "@typescript-eslint/parser": "^8.56.1",
     "eslint": "^9.39.2",
     "rimraf": "^6.1.3",
-    "typescript": "^5.0.0",
-    "vitest": "^3.0.0"
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.8"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",