@datagrout/conduit 0.4.0 → 0.5.0

package/README.md

@@ -5,7 +5,7 @@ Production-ready MCP client with mTLS identity, OAuth 2.1, semantic discovery, a
 ## Installation
 
 ```bash
-npm install @datagrout/conduit@0.4.0
+npm install @datagrout/conduit@0.5.0
 ```
 
 ## Quick Start

package/dist/{chunk-RED5DKGI.mjs → chunk-26DYCD4G.mjs}

@@ -1,29 +1,7 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+import {
+  __esm,
+  __export
+} from "./chunk-CIESM3BP.mjs";
 
 // src/oauth.ts
 var oauth_exports = {};
@@ -111,10 +89,6 @@ var init_oauth = __esm({
 });
 
 export {
-  __require,
-  __esm,
-  __export,
-  __toCommonJS,
   deriveTokenEndpoint,
   OAuthTokenProvider,
   oauth_exports,

package/dist/chunk-CIESM3BP.mjs

@@ -0,0 +1,33 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+export {
+  __require,
+  __esm,
+  __export,
+  __toCommonJS
+};

package/dist/chunk-SWH5Y2U7.mjs

@@ -0,0 +1,69 @@
+// src/onramp.ts
+async function _doRegister(opts) {
+  const base = opts.gateway.replace(/\/$/, "");
+  const body = { agent_name: opts.agentName };
+  if (opts.agentType) body["agent_type"] = opts.agentType;
+  if (opts.intendedUse) body["intended_use"] = opts.intendedUse;
+  if (opts.accessCode) body["access_code"] = opts.accessCode;
+  const initResp = await fetch(`${base}/onramp`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!initResp.ok) {
+    const text = await initResp.text();
+    throw new Error(`onramp init rejected (HTTP ${initResp.status}): ${text}`);
+  }
+  const initData = await initResp.json();
+  const sessionToken = initData.session_token;
+  const completeResp = await fetch(`${base}/onramp/complete`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${sessionToken}` }
+  });
+  if (!completeResp.ok) {
+    const text = await completeResp.text();
+    throw new Error(`onramp complete rejected (HTTP ${completeResp.status}): ${text}`);
+  }
+  const data = await completeResp.json();
+  return {
+    clientId: data["client_id"],
+    clientSecret: data["client_secret"],
+    tokenUrl: data["token_url"],
+    scopes: data["scopes"] ?? [],
+    expiresIn: data["expires_in"] ?? 0,
+    rpcUrl: data["rpc_url"],
+    mcpUrl: data["mcp_url"]
+  };
+}
+async function _exchangeToken(creds) {
+  const body = new URLSearchParams({
+    grant_type: "client_credentials",
+    client_id: creds.clientId,
+    client_secret: creds.clientSecret
+  });
+  const resp = await fetch(creds.tokenUrl, {
+    method: "POST",
+    body
+  });
+  if (!resp.ok) {
+    const text = await resp.text();
+    throw new Error(`token exchange failed (HTTP ${resp.status}): ${text}`);
+  }
+  const data = await resp.json();
+  return data.access_token;
+}
+async function registerOnly(opts) {
+  return _doRegister(opts);
+}
+async function registerAndExchange(opts) {
+  const creds = await _doRegister(opts);
+  const token = await _exchangeToken(creds);
+  return [creds, token];
+}
+
+export {
+  _doRegister,
+  _exchangeToken,
+  registerOnly,
+  registerAndExchange
+};

package/dist/index.d.mts

@@ -1,3 +1,97 @@
+/**
+ * Autonomous agent self-registration (onramp) for DataGrout.
+ *
+ * The onramp flow lets a machine intelligence register itself with DG
+ * without a human in the loop, using only plain HTTP JSON — no MCP client
+ * required. This matters because many agent harnesses gate or restrict MCP
+ * connections but allow arbitrary HTTP requests.
+ *
+ * Flow
+ * ----
+ * 1. POST to `/onramp` with agent identity metadata (no auth).
+ * 2. DG returns a short-lived `session_token` (5 minutes).
+ * 3. POST to `/onramp/complete` with `Authorization: Bearer <session_token>`.
+ * 4. DG issues provisional `client_id` + `client_secret` (restricted scopes).
+ *
+ * @example
+ * ```ts
+ * import { Client } from './client';
+ * import { OnrampOptions } from './onramp';
+ *
+ * // One-shot: autonomous registration + mTLS bootstrap.
+ * const client = await Client.bootstrapOnramp({
+ *   opts: {
+ *     gateway: 'https://app.datagrout.ai',
+ *     agentName: 'my-research-agent',
+ *     agentType: 'claude-sonnet-4-6',
+ *     intendedUse: 'Summarise documents and extract entities.',
+ *   },
+ * });
+ * await client.connect();
+ * ```
+ */
+/** Options for the autonomous agent onramp flow. */
+interface OnrampOptions {
+    /** DataGrout gateway base URL (e.g. `"https://app.datagrout.ai"`). */
+    gateway: string;
+    /** Human-readable name for this agent instance. */
+    agentName: string;
+    /** Model or framework identifier (e.g. `"claude-sonnet-4-6"`, `"gpt-4o"`). */
+    agentType?: string;
+    /** Plain-language description of what the agent intends to do. */
+    intendedUse?: string;
+    /** Optional access code from the server owner — reserved for scope elevation. */
+    accessCode?: string;
+}
+/**
+ * Provisional credentials returned by the DG onramp complete endpoint.
+ *
+ * Store `clientId` and `clientSecret` securely — the secret is shown exactly
+ * once and cannot be recovered after this point.
+ *
+ * `mcpUrl` and `rpcUrl` are provisioned as part of the identity registration
+ * step and may be absent from the initial onramp response. Use
+ * `Client.bootstrapOnramp` for the all-in-one flow that handles this
+ * transparently.
+ */
+interface OnrampCredentials {
+    /** OAuth client ID. */
+    clientId: string;
+    /** OAuth client secret. Store this securely — shown once. */
+    clientSecret: string;
+    /** Token endpoint for the `client_credentials` grant. */
+    tokenUrl: string;
+    /** Granted OAuth scopes. */
+    scopes: string[];
+    /** Provisional credential TTL in seconds. */
+    expiresIn: number;
+    /** JSON-RPC endpoint. Absent until identity is registered. */
+    rpcUrl?: string;
+    /** MCP endpoint. Absent until identity is registered. */
+    mcpUrl?: string;
+}
+/**
+ * Perform the onramp handshake and return provisional OAuth credentials.
+ *
+ * This is the low-level entry point. Most callers should use
+ * `Client.bootstrapOnramp` instead, which chains onramp → token exchange →
+ * mTLS identity bootstrap in a single call.
+ *
+ * @param opts Onramp registration options.
+ * @returns `OnrampCredentials` containing `clientId` and `clientSecret`.
+ */
+declare function registerOnly(opts: OnrampOptions): Promise<OnrampCredentials>;
+/**
+ * Perform the full onramp handshake and OAuth token exchange.
+ *
+ * Returns the provisional credentials alongside a short-lived access token
+ * ready for use with `Client.bootstrapIdentity`.
+ *
+ * @param opts Onramp registration options.
+ * @returns Tuple of `[OnrampCredentials, accessToken]`.
+ */
+declare function registerAndExchange(opts: OnrampOptions): Promise<[OnrampCredentials, string]>;
+
 /**
  * Identity and mTLS support for Conduit connections.
  *
@@ -295,6 +389,9 @@ interface ClientOptions {
      * `~/.conduit/` before falling back to token auth.  Equivalent to
      * calling `ConduitIdentity.tryDefault()` and passing the result as
      * `identity`.
+     *
+     * mTLS auto-discovery is **opt-in** — this flag must be set to enable it.
+     * DataGrout URLs do not auto-discover an identity by default.
      */
     identityAuto?: boolean;
     /**
@@ -313,13 +410,8 @@ interface ClientOptions {
      */
     useIntelligentInterface?: boolean;
     /**
-     * Disable automatic mTLS even for DataGrout URLs.
-     *
-     * By default, DG URLs (`*.datagrout.ai`) silently attempt to discover an
-     * mTLS identity from env vars or `~/.conduit/`.  Set to `true` to opt out
-     * and use token-only auth.
-     *
-     * @default false
+     * @deprecated No-op. mTLS auto-discovery is now opt-in via `identityAuto`.
+     * This option is kept for backward compatibility and has no effect.
      */
     disableMtls?: boolean;
     transport?: 'mcp' | 'jsonrpc' | 'websocket';
@@ -890,6 +982,40 @@ declare class Client {
         identityDir?: string;
         substrateEndpoint?: string;
     }): Promise<Client>;
+    /**
+     * Register autonomously with DG and bootstrap an mTLS identity.
+     *
+     * The all-in-one flow: onramp (no prior credentials required) →
+     * OAuth token exchange → mTLS identity registration and persistence.
+     *
+     * On subsequent runs the saved mTLS identity is auto-discovered and
+     * no credentials are needed.
+     *
+     * @param options.opts         - Onramp registration options.
+     * @param options.url          - MCP server URL. Required if the onramp
+     *                               response does not include `mcpUrl`.
+     * @param options.identityDir  - Custom identity storage directory.
+     *
+     * @example
+     * ```ts
+     * import { Client } from './client';
+     * import type { OnrampOptions } from './onramp';
+     *
+     * const client = await Client.bootstrapOnramp({
+     *   opts: {
+     *     gateway: 'https://app.datagrout.ai',
+     *     agentName: 'my-research-agent',
+     *     agentType: 'claude-sonnet-4-6',
+     *   },
+     * });
+     * await client.connect();
+     * ```
+     */
+    static bootstrapOnramp(options: {
+        opts: OnrampOptions;
+        url?: string;
+        identityDir?: string;
+    }): Promise<Client>;
     /**
      * Establish the underlying transport connection.
      *
@@ -1381,6 +1507,6 @@ declare class InvalidConfigError extends ConduitError {
  * DataGrout Conduit SDK for TypeScript/JavaScript
  */
 
-declare const version = "0.4.0";
+declare const version = "0.5.0";
 
-export { type AuthConfig, AuthError, type Byok, type ChartOptions, Client, type ClientOptions, ConduitError, ConduitIdentity, type ConstrainOptions, type CreditEstimate, DEFAULT_IDENTITY_DIR, DG_CA_URL, DG_SUBSTRATE_ENDPOINT, type DiscoverOptions, type DiscoverResult, type FlowOptions, type ForgetOptions, type GuideOptions, type GuideRequestOptions, type GuideState, GuidedSession, InvalidConfigError, type Keypair, type MCPPrompt, type MCPResource, type MCPTool, type MtlsConfig, NetworkError, NotInitializedError, OAuthTokenProvider, type PerformOptions, type PerformResult, type PlanOptions, type PrismFocusOptions, type QueryCellOptions, type RateLimit, RateLimitError, type RateLimitStatus, type Receipt, type ReflectOptions, type RefractOptions, type RegisteredIdentity, type RegistrationOptions, type RememberOptions, type RenewalOptions, type RotationOptions, type SavedPaths, ServerError, Subscription, type SubscriptionEvent, type ToolInfo, type ToolMeta, SUBPROTOCOL as WS_SUBPROTOCOL, WsTransport, deriveTokenEndpoint, extractMeta, fetchDgCaCert, fetchWithIdentity, generateKeypair, isDgUrl, refreshCaCert, registerIdentity, rotateIdentity, saveIdentity, version };
+export { type AuthConfig, AuthError, type Byok, type ChartOptions, Client, type ClientOptions, ConduitError, ConduitIdentity, type ConstrainOptions, type CreditEstimate, DEFAULT_IDENTITY_DIR, DG_CA_URL, DG_SUBSTRATE_ENDPOINT, type DiscoverOptions, type DiscoverResult, type FlowOptions, type ForgetOptions, type GuideOptions, type GuideRequestOptions, type GuideState, GuidedSession, InvalidConfigError, type Keypair, type MCPPrompt, type MCPResource, type MCPTool, type MtlsConfig, NetworkError, NotInitializedError, OAuthTokenProvider, type OnrampCredentials, type OnrampOptions, type PerformOptions, type PerformResult, type PlanOptions, type PrismFocusOptions, type QueryCellOptions, type RateLimit, RateLimitError, type RateLimitStatus, type Receipt, type ReflectOptions, type RefractOptions, type RegisteredIdentity, type RegistrationOptions, type RememberOptions, type RenewalOptions, type RotationOptions, type SavedPaths, ServerError, Subscription, type SubscriptionEvent, type ToolInfo, type ToolMeta, SUBPROTOCOL as WS_SUBPROTOCOL, WsTransport, deriveTokenEndpoint, extractMeta, fetchDgCaCert, fetchWithIdentity, generateKeypair, isDgUrl, refreshCaCert, registerAndExchange, registerIdentity, registerOnly, rotateIdentity, saveIdentity, version };

package/dist/index.d.ts

@@ -1,3 +1,97 @@
+/**
+ * Autonomous agent self-registration (onramp) for DataGrout.
+ *
+ * The onramp flow lets a machine intelligence register itself with DG
+ * without a human in the loop, using only plain HTTP JSON — no MCP client
+ * required. This matters because many agent harnesses gate or restrict MCP
+ * connections but allow arbitrary HTTP requests.
+ *
+ * Flow
+ * ----
+ * 1. POST to `/onramp` with agent identity metadata (no auth).
+ * 2. DG returns a short-lived `session_token` (5 minutes).
+ * 3. POST to `/onramp/complete` with `Authorization: Bearer <session_token>`.
+ * 4. DG issues provisional `client_id` + `client_secret` (restricted scopes).
+ *
+ * @example
+ * ```ts
+ * import { Client } from './client';
+ * import { OnrampOptions } from './onramp';
+ *
+ * // One-shot: autonomous registration + mTLS bootstrap.
+ * const client = await Client.bootstrapOnramp({
+ *   opts: {
+ *     gateway: 'https://app.datagrout.ai',
+ *     agentName: 'my-research-agent',
+ *     agentType: 'claude-sonnet-4-6',
+ *     intendedUse: 'Summarise documents and extract entities.',
+ *   },
+ * });
+ * await client.connect();
+ * ```
+ */
+/** Options for the autonomous agent onramp flow. */
+interface OnrampOptions {
+    /** DataGrout gateway base URL (e.g. `"https://app.datagrout.ai"`). */
+    gateway: string;
+    /** Human-readable name for this agent instance. */
+    agentName: string;
+    /** Model or framework identifier (e.g. `"claude-sonnet-4-6"`, `"gpt-4o"`). */
+    agentType?: string;
+    /** Plain-language description of what the agent intends to do. */
+    intendedUse?: string;
+    /** Optional access code from the server owner — reserved for scope elevation. */
+    accessCode?: string;
+}
+/**
+ * Provisional credentials returned by the DG onramp complete endpoint.
+ *
+ * Store `clientId` and `clientSecret` securely — the secret is shown exactly
+ * once and cannot be recovered after this point.
+ *
+ * `mcpUrl` and `rpcUrl` are provisioned as part of the identity registration
+ * step and may be absent from the initial onramp response. Use
+ * `Client.bootstrapOnramp` for the all-in-one flow that handles this
+ * transparently.
+ */
+interface OnrampCredentials {
+    /** OAuth client ID. */
+    clientId: string;
+    /** OAuth client secret. Store this securely — shown once. */
+    clientSecret: string;
+    /** Token endpoint for the `client_credentials` grant. */
+    tokenUrl: string;
+    /** Granted OAuth scopes. */
+    scopes: string[];
+    /** Provisional credential TTL in seconds. */
+    expiresIn: number;
+    /** JSON-RPC endpoint. Absent until identity is registered. */
+    rpcUrl?: string;
+    /** MCP endpoint. Absent until identity is registered. */
+    mcpUrl?: string;
+}
+/**
+ * Perform the onramp handshake and return provisional OAuth credentials.
+ *
+ * This is the low-level entry point. Most callers should use
+ * `Client.bootstrapOnramp` instead, which chains onramp → token exchange →
+ * mTLS identity bootstrap in a single call.
+ *
+ * @param opts Onramp registration options.
+ * @returns `OnrampCredentials` containing `clientId` and `clientSecret`.
+ */
+declare function registerOnly(opts: OnrampOptions): Promise<OnrampCredentials>;
+/**
+ * Perform the full onramp handshake and OAuth token exchange.
+ *
+ * Returns the provisional credentials alongside a short-lived access token
+ * ready for use with `Client.bootstrapIdentity`.
+ *
+ * @param opts Onramp registration options.
+ * @returns Tuple of `[OnrampCredentials, accessToken]`.
+ */
+declare function registerAndExchange(opts: OnrampOptions): Promise<[OnrampCredentials, string]>;
+
 /**
  * Identity and mTLS support for Conduit connections.
  *
@@ -295,6 +389,9 @@ interface ClientOptions {
      * `~/.conduit/` before falling back to token auth.  Equivalent to
      * calling `ConduitIdentity.tryDefault()` and passing the result as
      * `identity`.
+     *
+     * mTLS auto-discovery is **opt-in** — this flag must be set to enable it.
+     * DataGrout URLs do not auto-discover an identity by default.
      */
     identityAuto?: boolean;
     /**
@@ -313,13 +410,8 @@ interface ClientOptions {
      */
     useIntelligentInterface?: boolean;
     /**
-     * Disable automatic mTLS even for DataGrout URLs.
-     *
-     * By default, DG URLs (`*.datagrout.ai`) silently attempt to discover an
-     * mTLS identity from env vars or `~/.conduit/`.  Set to `true` to opt out
-     * and use token-only auth.
-     *
-     * @default false
+     * @deprecated No-op. mTLS auto-discovery is now opt-in via `identityAuto`.
+     * This option is kept for backward compatibility and has no effect.
      */
     disableMtls?: boolean;
     transport?: 'mcp' | 'jsonrpc' | 'websocket';
@@ -890,6 +982,40 @@ declare class Client {
         identityDir?: string;
         substrateEndpoint?: string;
     }): Promise<Client>;
+    /**
+     * Register autonomously with DG and bootstrap an mTLS identity.
+     *
+     * The all-in-one flow: onramp (no prior credentials required) →
+     * OAuth token exchange → mTLS identity registration and persistence.
+     *
+     * On subsequent runs the saved mTLS identity is auto-discovered and
+     * no credentials are needed.
+     *
+     * @param options.opts         - Onramp registration options.
+     * @param options.url          - MCP server URL. Required if the onramp
+     *                               response does not include `mcpUrl`.
+     * @param options.identityDir  - Custom identity storage directory.
+     *
+     * @example
+     * ```ts
+     * import { Client } from './client';
+     * import type { OnrampOptions } from './onramp';
+     *
+     * const client = await Client.bootstrapOnramp({
+     *   opts: {
+     *     gateway: 'https://app.datagrout.ai',
+     *     agentName: 'my-research-agent',
+     *     agentType: 'claude-sonnet-4-6',
+     *   },
+     * });
+     * await client.connect();
+     * ```
+     */
+    static bootstrapOnramp(options: {
+        opts: OnrampOptions;
+        url?: string;
+        identityDir?: string;
+    }): Promise<Client>;
     /**
      * Establish the underlying transport connection.
      *
@@ -1381,6 +1507,6 @@ declare class InvalidConfigError extends ConduitError {
  * DataGrout Conduit SDK for TypeScript/JavaScript
  */
 
-declare const version = "0.4.0";
+declare const version = "0.5.0";
 
-export { type AuthConfig, AuthError, type Byok, type ChartOptions, Client, type ClientOptions, ConduitError, ConduitIdentity, type ConstrainOptions, type CreditEstimate, DEFAULT_IDENTITY_DIR, DG_CA_URL, DG_SUBSTRATE_ENDPOINT, type DiscoverOptions, type DiscoverResult, type FlowOptions, type ForgetOptions, type GuideOptions, type GuideRequestOptions, type GuideState, GuidedSession, InvalidConfigError, type Keypair, type MCPPrompt, type MCPResource, type MCPTool, type MtlsConfig, NetworkError, NotInitializedError, OAuthTokenProvider, type PerformOptions, type PerformResult, type PlanOptions, type PrismFocusOptions, type QueryCellOptions, type RateLimit, RateLimitError, type RateLimitStatus, type Receipt, type ReflectOptions, type RefractOptions, type RegisteredIdentity, type RegistrationOptions, type RememberOptions, type RenewalOptions, type RotationOptions, type SavedPaths, ServerError, Subscription, type SubscriptionEvent, type ToolInfo, type ToolMeta, SUBPROTOCOL as WS_SUBPROTOCOL, WsTransport, deriveTokenEndpoint, extractMeta, fetchDgCaCert, fetchWithIdentity, generateKeypair, isDgUrl, refreshCaCert, registerIdentity, rotateIdentity, saveIdentity, version };
+export { type AuthConfig, AuthError, type Byok, type ChartOptions, Client, type ClientOptions, ConduitError, ConduitIdentity, type ConstrainOptions, type CreditEstimate, DEFAULT_IDENTITY_DIR, DG_CA_URL, DG_SUBSTRATE_ENDPOINT, type DiscoverOptions, type DiscoverResult, type FlowOptions, type ForgetOptions, type GuideOptions, type GuideRequestOptions, type GuideState, GuidedSession, InvalidConfigError, type Keypair, type MCPPrompt, type MCPResource, type MCPTool, type MtlsConfig, NetworkError, NotInitializedError, OAuthTokenProvider, type OnrampCredentials, type OnrampOptions, type PerformOptions, type PerformResult, type PlanOptions, type PrismFocusOptions, type QueryCellOptions, type RateLimit, RateLimitError, type RateLimitStatus, type Receipt, type ReflectOptions, type RefractOptions, type RegisteredIdentity, type RegistrationOptions, type RememberOptions, type RenewalOptions, type RotationOptions, type SavedPaths, ServerError, Subscription, type SubscriptionEvent, type ToolInfo, type ToolMeta, SUBPROTOCOL as WS_SUBPROTOCOL, WsTransport, deriveTokenEndpoint, extractMeta, fetchDgCaCert, fetchWithIdentity, generateKeypair, isDgUrl, refreshCaCert, registerAndExchange, registerIdentity, registerOnly, rotateIdentity, saveIdentity, version };

package/dist/index.js

@@ -343,6 +343,81 @@ var init_identity = __esm({
   }
 });
 
+// src/onramp.ts
+var onramp_exports = {};
+__export(onramp_exports, {
+  _doRegister: () => _doRegister,
+  _exchangeToken: () => _exchangeToken,
+  registerAndExchange: () => registerAndExchange,
+  registerOnly: () => registerOnly
+});
+async function _doRegister(opts) {
+  const base = opts.gateway.replace(/\/$/, "");
+  const body = { agent_name: opts.agentName };
+  if (opts.agentType) body["agent_type"] = opts.agentType;
+  if (opts.intendedUse) body["intended_use"] = opts.intendedUse;
+  if (opts.accessCode) body["access_code"] = opts.accessCode;
+  const initResp = await fetch(`${base}/onramp`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!initResp.ok) {
+    const text = await initResp.text();
+    throw new Error(`onramp init rejected (HTTP ${initResp.status}): ${text}`);
+  }
+  const initData = await initResp.json();
+  const sessionToken = initData.session_token;
+  const completeResp = await fetch(`${base}/onramp/complete`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${sessionToken}` }
+  });
+  if (!completeResp.ok) {
+    const text = await completeResp.text();
+    throw new Error(`onramp complete rejected (HTTP ${completeResp.status}): ${text}`);
+  }
+  const data = await completeResp.json();
+  return {
+    clientId: data["client_id"],
+    clientSecret: data["client_secret"],
+    tokenUrl: data["token_url"],
+    scopes: data["scopes"] ?? [],
+    expiresIn: data["expires_in"] ?? 0,
+    rpcUrl: data["rpc_url"],
+    mcpUrl: data["mcp_url"]
+  };
+}
+async function _exchangeToken(creds) {
+  const body = new URLSearchParams({
+    grant_type: "client_credentials",
+    client_id: creds.clientId,
+    client_secret: creds.clientSecret
+  });
+  const resp = await fetch(creds.tokenUrl, {
+    method: "POST",
+    body
+  });
+  if (!resp.ok) {
+    const text = await resp.text();
+    throw new Error(`token exchange failed (HTTP ${resp.status}): ${text}`);
+  }
+  const data = await resp.json();
+  return data.access_token;
+}
+async function registerOnly(opts) {
+  return _doRegister(opts);
+}
+async function registerAndExchange(opts) {
+  const creds = await _doRegister(opts);
+  const token = await _exchangeToken(creds);
+  return [creds, token];
+}
+var init_onramp = __esm({
+  "src/onramp.ts"() {
+    "use strict";
+  }
+});
+
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
@@ -369,7 +444,9 @@ __export(index_exports, {
   generateKeypair: () => generateKeypair,
   isDgUrl: () => isDgUrl,
   refreshCaCert: () => refreshCaCert,
+  registerAndExchange: () => registerAndExchange,
   registerIdentity: () => registerIdentity,
+  registerOnly: () => registerOnly,
   rotateIdentity: () => rotateIdentity,
   saveIdentity: () => saveIdentity,
   version: () => version
@@ -1538,10 +1615,7 @@ var Client2 = class _Client {
     this.isDg = isDgUrl(this.url);
     this.useIntelligentInterface = options.useIntelligentInterface ?? this.isDg;
     this.maxRetries = options.maxRetries ?? 3;
-    let identity = options.identity ?? (options.identityAuto ? ConduitIdentity.tryDiscover(options.identityDir) ?? void 0 : void 0);
-    if (identity === void 0 && this.isDg && !options.disableMtls) {
-      identity = ConduitIdentity.tryDiscover(options.identityDir) ?? void 0;
-    }
+    const identity = options.identity ?? (options.identityAuto ? ConduitIdentity.tryDiscover(options.identityDir) ?? void 0 : void 0);
     const transportType = options.transport || "mcp";
     if (transportType === "mcp") {
       this.transport = new MCPTransport(this.url, this.auth, identity);
@@ -1626,6 +1700,60 @@ var Client2 = class _Client {
       substrateEndpoint: options.substrateEndpoint
     });
   }
+  /**
+   * Register autonomously with DG and bootstrap an mTLS identity.
+   *
+   * The all-in-one flow: onramp (no prior credentials required) →
+   * OAuth token exchange → mTLS identity registration and persistence.
+   *
+   * On subsequent runs the saved mTLS identity is auto-discovered and
+   * no credentials are needed.
+   *
+   * @param options.opts         - Onramp registration options.
+   * @param options.url          - MCP server URL. Required if the onramp
+   *                               response does not include `mcpUrl`.
+   * @param options.identityDir  - Custom identity storage directory.
+   *
+   * @example
+   * ```ts
+   * import { Client } from './client';
+   * import type { OnrampOptions } from './onramp';
+   *
+   * const client = await Client.bootstrapOnramp({
+   *   opts: {
+   *     gateway: 'https://app.datagrout.ai',
+   *     agentName: 'my-research-agent',
+   *     agentType: 'claude-sonnet-4-6',
+   *   },
+   * });
+   * await client.connect();
+   * ```
+   */
+  static async bootstrapOnramp(options) {
+    const { _doRegister: _doRegister2, _exchangeToken: _exchangeToken2 } = await Promise.resolve().then(() => (init_onramp(), onramp_exports));
+    const dir = options.identityDir || DEFAULT_IDENTITY_DIR;
+    const existing = ConduitIdentity.tryDiscover(dir);
+    if (existing && !existing.needsRotation(7)) {
+      if (!options.url) {
+        throw new Error("'url' must be provided when an existing identity is reused");
+      }
+      return new _Client({ url: options.url, identity: existing, identityDir: dir });
+    }
+    const creds = await _doRegister2(options.opts);
+    const token = await _exchangeToken2(creds);
+    const url = creds.mcpUrl ?? options.url;
+    if (!url) {
+      throw new Error(
+        "'url' must be provided when mcpUrl is absent from the onramp response"
+      );
+    }
+    return _Client.bootstrapIdentity({
+      url,
+      authToken: token,
+      name: options.opts.agentName,
+      identityDir: options.identityDir
+    });
+  }
   // ===== Lifecycle =====
   /**
    * Establish the underlying transport connection.
@@ -2118,7 +2246,8 @@ function buildToolMeta(raw) {
 }
 
 // src/index.ts
-var version = "0.4.0";
+init_onramp();
+var version = "0.5.0";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuthError,
@@ -2144,7 +2273,9 @@ var version = "0.4.0";
   generateKeypair,
   isDgUrl,
   refreshCaCert,
+  registerAndExchange,
   registerIdentity,
+  registerOnly,
   rotateIdentity,
   saveIdentity,
   version

package/dist/index.mjs

@@ -1,13 +1,19 @@
 import {
   OAuthTokenProvider,
-  __esm,
-  __export,
-  __require,
-  __toCommonJS,
   deriveTokenEndpoint,
   init_oauth,
   oauth_exports
-} from "./chunk-RED5DKGI.mjs";
+} from "./chunk-26DYCD4G.mjs";
+import {
+  registerAndExchange,
+  registerOnly
+} from "./chunk-SWH5Y2U7.mjs";
+import {
+  __esm,
+  __export,
+  __require,
+  __toCommonJS
+} from "./chunk-CIESM3BP.mjs";
 
 // src/identity.ts
 var identity_exports = {};
@@ -1398,10 +1404,7 @@ var Client2 = class _Client {
     this.isDg = isDgUrl(this.url);
     this.useIntelligentInterface = options.useIntelligentInterface ?? this.isDg;
     this.maxRetries = options.maxRetries ?? 3;
-    let identity = options.identity ?? (options.identityAuto ? ConduitIdentity.tryDiscover(options.identityDir) ?? void 0 : void 0);
-    if (identity === void 0 && this.isDg && !options.disableMtls) {
-      identity = ConduitIdentity.tryDiscover(options.identityDir) ?? void 0;
-    }
+    const identity = options.identity ?? (options.identityAuto ? ConduitIdentity.tryDiscover(options.identityDir) ?? void 0 : void 0);
     const transportType = options.transport || "mcp";
     if (transportType === "mcp") {
       this.transport = new MCPTransport(this.url, this.auth, identity);
@@ -1470,7 +1473,7 @@ var Client2 = class _Client {
    * @param options.substrateEndpoint - Override the DG Substrate endpoint.
    */
   static async bootstrapIdentityOAuth(options) {
-    const { OAuthTokenProvider: OAuthTokenProvider2, deriveTokenEndpoint: deriveTokenEndpoint2 } = await import("./oauth-OMPWCI2X.mjs");
+    const { OAuthTokenProvider: OAuthTokenProvider2, deriveTokenEndpoint: deriveTokenEndpoint2 } = await import("./oauth-NSDC2G7W.mjs");
     const tokenEndpoint = deriveTokenEndpoint2(options.url);
     const provider = new OAuthTokenProvider2({
       clientId: options.clientId,
@@ -1486,6 +1489,60 @@ var Client2 = class _Client {
       substrateEndpoint: options.substrateEndpoint
     });
   }
+  /**
+   * Register autonomously with DG and bootstrap an mTLS identity.
+   *
+   * The all-in-one flow: onramp (no prior credentials required) →
+   * OAuth token exchange → mTLS identity registration and persistence.
+   *
+   * On subsequent runs the saved mTLS identity is auto-discovered and
+   * no credentials are needed.
+   *
+   * @param options.opts         - Onramp registration options.
+   * @param options.url          - MCP server URL. Required if the onramp
+   *                               response does not include `mcpUrl`.
+   * @param options.identityDir  - Custom identity storage directory.
+   *
+   * @example
+   * ```ts
+   * import { Client } from './client';
+   * import type { OnrampOptions } from './onramp';
+   *
+   * const client = await Client.bootstrapOnramp({
+   *   opts: {
+   *     gateway: 'https://app.datagrout.ai',
+   *     agentName: 'my-research-agent',
+   *     agentType: 'claude-sonnet-4-6',
+   *   },
+   * });
+   * await client.connect();
+   * ```
+   */
+  static async bootstrapOnramp(options) {
+    const { _doRegister, _exchangeToken } = await import("./onramp-743RJTNI.mjs");
+    const dir = options.identityDir || DEFAULT_IDENTITY_DIR;
+    const existing = ConduitIdentity.tryDiscover(dir);
+    if (existing && !existing.needsRotation(7)) {
+      if (!options.url) {
+        throw new Error("'url' must be provided when an existing identity is reused");
+      }
+      return new _Client({ url: options.url, identity: existing, identityDir: dir });
+    }
+    const creds = await _doRegister(options.opts);
+    const token = await _exchangeToken(creds);
+    const url = creds.mcpUrl ?? options.url;
+    if (!url) {
+      throw new Error(
+        "'url' must be provided when mcpUrl is absent from the onramp response"
+      );
+    }
+    return _Client.bootstrapIdentity({
+      url,
+      authToken: token,
+      name: options.opts.agentName,
+      identityDir: options.identityDir
+    });
+  }
   // ===== Lifecycle =====
   /**
    * Establish the underlying transport connection.
@@ -1978,7 +2035,7 @@ function buildToolMeta(raw) {
 }
 
 // src/index.ts
-var version = "0.4.0";
+var version = "0.5.0";
 export {
   AuthError,
   Client2 as Client,
@@ -2003,7 +2060,9 @@ export {
   generateKeypair,
   isDgUrl,
   refreshCaCert,
+  registerAndExchange,
   registerIdentity,
+  registerOnly,
   rotateIdentity,
   saveIdentity,
   version

package/dist/{oauth-OMPWCI2X.mjs → oauth-NSDC2G7W.mjs}

@@ -2,7 +2,8 @@ import {
   OAuthTokenProvider,
   deriveTokenEndpoint,
   init_oauth
-} from "./chunk-RED5DKGI.mjs";
+} from "./chunk-26DYCD4G.mjs";
+import "./chunk-CIESM3BP.mjs";
 init_oauth();
 export {
   OAuthTokenProvider,

package/dist/onramp-743RJTNI.mjs

@@ -0,0 +1,13 @@
+import {
+  _doRegister,
+  _exchangeToken,
+  registerAndExchange,
+  registerOnly
+} from "./chunk-SWH5Y2U7.mjs";
+import "./chunk-CIESM3BP.mjs";
+export {
+  _doRegister,
+  _exchangeToken,
+  registerAndExchange,
+  registerOnly
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datagrout/conduit",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Production-ready MCP client with mTLS, OAuth 2.1, and semantic discovery",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",