@datagrout/conduit 0.4.0 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/chunk-CIESM3BP.mjs +33 -0
- package/dist/{chunk-RED5DKGI.mjs → chunk-LW7VX5SZ.mjs} +7 -31
- package/dist/chunk-W56N7X6V.mjs +71 -0
- package/dist/index.d.mts +138 -12
- package/dist/index.d.ts +138 -12
- package/dist/index.js +281 -43
- package/dist/index.mjs +210 -48
- package/dist/{oauth-OMPWCI2X.mjs → oauth-T2D3EDCN.mjs} +2 -1
- package/dist/onramp-RDGV3FOI.mjs +13 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -0,0 +1,33 @@
|
|
|
1
|
+
var __defProp = Object.defineProperty;
|
|
2
|
+
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
|
|
3
|
+
var __getOwnPropNames = Object.getOwnPropertyNames;
|
|
4
|
+
var __hasOwnProp = Object.prototype.hasOwnProperty;
|
|
5
|
+
var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
|
|
6
|
+
get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
|
|
7
|
+
}) : x)(function(x) {
|
|
8
|
+
if (typeof require !== "undefined") return require.apply(this, arguments);
|
|
9
|
+
throw Error('Dynamic require of "' + x + '" is not supported');
|
|
10
|
+
});
|
|
11
|
+
var __esm = (fn, res) => function __init() {
|
|
12
|
+
return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
|
|
13
|
+
};
|
|
14
|
+
var __export = (target, all) => {
|
|
15
|
+
for (var name in all)
|
|
16
|
+
__defProp(target, name, { get: all[name], enumerable: true });
|
|
17
|
+
};
|
|
18
|
+
var __copyProps = (to, from, except, desc) => {
|
|
19
|
+
if (from && typeof from === "object" || typeof from === "function") {
|
|
20
|
+
for (let key of __getOwnPropNames(from))
|
|
21
|
+
if (!__hasOwnProp.call(to, key) && key !== except)
|
|
22
|
+
__defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
|
|
23
|
+
}
|
|
24
|
+
return to;
|
|
25
|
+
};
|
|
26
|
+
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
|
|
27
|
+
|
|
28
|
+
export {
|
|
29
|
+
__require,
|
|
30
|
+
__esm,
|
|
31
|
+
__export,
|
|
32
|
+
__toCommonJS
|
|
33
|
+
};
|
|
@@ -1,29 +1,7 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
|
|
6
|
-
get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
|
|
7
|
-
}) : x)(function(x) {
|
|
8
|
-
if (typeof require !== "undefined") return require.apply(this, arguments);
|
|
9
|
-
throw Error('Dynamic require of "' + x + '" is not supported');
|
|
10
|
-
});
|
|
11
|
-
var __esm = (fn, res) => function __init() {
|
|
12
|
-
return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
|
|
13
|
-
};
|
|
14
|
-
var __export = (target, all) => {
|
|
15
|
-
for (var name in all)
|
|
16
|
-
__defProp(target, name, { get: all[name], enumerable: true });
|
|
17
|
-
};
|
|
18
|
-
var __copyProps = (to, from, except, desc) => {
|
|
19
|
-
if (from && typeof from === "object" || typeof from === "function") {
|
|
20
|
-
for (let key of __getOwnPropNames(from))
|
|
21
|
-
if (!__hasOwnProp.call(to, key) && key !== except)
|
|
22
|
-
__defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
|
|
23
|
-
}
|
|
24
|
-
return to;
|
|
25
|
-
};
|
|
26
|
-
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
|
|
1
|
+
import {
|
|
2
|
+
__esm,
|
|
3
|
+
__export
|
|
4
|
+
} from "./chunk-CIESM3BP.mjs";
|
|
27
5
|
|
|
28
6
|
// src/oauth.ts
|
|
29
7
|
var oauth_exports = {};
|
|
@@ -95,7 +73,9 @@ var init_oauth = __esm({
|
|
|
95
73
|
}
|
|
96
74
|
if (!response.ok) {
|
|
97
75
|
const text = await response.text().catch(() => "");
|
|
98
|
-
throw new Error(
|
|
76
|
+
throw new Error(
|
|
77
|
+
`OAuth token endpoint returned ${response.status}: ${text}`
|
|
78
|
+
);
|
|
99
79
|
}
|
|
100
80
|
const data = await response.json();
|
|
101
81
|
const expiresIn = data.expires_in ?? 3600;
|
|
@@ -111,10 +91,6 @@ var init_oauth = __esm({
|
|
|
111
91
|
});
|
|
112
92
|
|
|
113
93
|
export {
|
|
114
|
-
__require,
|
|
115
|
-
__esm,
|
|
116
|
-
__export,
|
|
117
|
-
__toCommonJS,
|
|
118
94
|
deriveTokenEndpoint,
|
|
119
95
|
OAuthTokenProvider,
|
|
120
96
|
oauth_exports,
|
|
@@ -0,0 +1,71 @@
|
|
|
1
|
+
// src/onramp.ts
|
|
2
|
+
async function _doRegister(opts) {
|
|
3
|
+
const base = opts.gateway.replace(/\/$/, "");
|
|
4
|
+
const body = { agent_name: opts.agentName };
|
|
5
|
+
if (opts.agentType) body["agent_type"] = opts.agentType;
|
|
6
|
+
if (opts.intendedUse) body["intended_use"] = opts.intendedUse;
|
|
7
|
+
if (opts.accessCode) body["access_code"] = opts.accessCode;
|
|
8
|
+
const initResp = await fetch(`${base}/onramp`, {
|
|
9
|
+
method: "POST",
|
|
10
|
+
headers: { "Content-Type": "application/json" },
|
|
11
|
+
body: JSON.stringify(body)
|
|
12
|
+
});
|
|
13
|
+
if (!initResp.ok) {
|
|
14
|
+
const text = await initResp.text();
|
|
15
|
+
throw new Error(`onramp init rejected (HTTP ${initResp.status}): ${text}`);
|
|
16
|
+
}
|
|
17
|
+
const initData = await initResp.json();
|
|
18
|
+
const sessionToken = initData.session_token;
|
|
19
|
+
const completeResp = await fetch(`${base}/onramp/complete`, {
|
|
20
|
+
method: "POST",
|
|
21
|
+
headers: { Authorization: `Bearer ${sessionToken}` }
|
|
22
|
+
});
|
|
23
|
+
if (!completeResp.ok) {
|
|
24
|
+
const text = await completeResp.text();
|
|
25
|
+
throw new Error(
|
|
26
|
+
`onramp complete rejected (HTTP ${completeResp.status}): ${text}`
|
|
27
|
+
);
|
|
28
|
+
}
|
|
29
|
+
const data = await completeResp.json();
|
|
30
|
+
return {
|
|
31
|
+
clientId: data["client_id"],
|
|
32
|
+
clientSecret: data["client_secret"],
|
|
33
|
+
tokenUrl: data["token_url"],
|
|
34
|
+
scopes: data["scopes"] ?? [],
|
|
35
|
+
expiresIn: data["expires_in"] ?? 0,
|
|
36
|
+
rpcUrl: data["rpc_url"],
|
|
37
|
+
mcpUrl: data["mcp_url"]
|
|
38
|
+
};
|
|
39
|
+
}
|
|
40
|
+
async function _exchangeToken(creds) {
|
|
41
|
+
const body = new URLSearchParams({
|
|
42
|
+
grant_type: "client_credentials",
|
|
43
|
+
client_id: creds.clientId,
|
|
44
|
+
client_secret: creds.clientSecret
|
|
45
|
+
});
|
|
46
|
+
const resp = await fetch(creds.tokenUrl, {
|
|
47
|
+
method: "POST",
|
|
48
|
+
body
|
|
49
|
+
});
|
|
50
|
+
if (!resp.ok) {
|
|
51
|
+
const text = await resp.text();
|
|
52
|
+
throw new Error(`token exchange failed (HTTP ${resp.status}): ${text}`);
|
|
53
|
+
}
|
|
54
|
+
const data = await resp.json();
|
|
55
|
+
return data.access_token;
|
|
56
|
+
}
|
|
57
|
+
async function registerOnly(opts) {
|
|
58
|
+
return _doRegister(opts);
|
|
59
|
+
}
|
|
60
|
+
async function registerAndExchange(opts) {
|
|
61
|
+
const creds = await _doRegister(opts);
|
|
62
|
+
const token = await _exchangeToken(creds);
|
|
63
|
+
return [creds, token];
|
|
64
|
+
}
|
|
65
|
+
|
|
66
|
+
export {
|
|
67
|
+
_doRegister,
|
|
68
|
+
_exchangeToken,
|
|
69
|
+
registerOnly,
|
|
70
|
+
registerAndExchange
|
|
71
|
+
};
|
package/dist/index.d.mts
CHANGED
|
@@ -1,3 +1,97 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Autonomous agent self-registration (onramp) for DataGrout.
|
|
3
|
+
*
|
|
4
|
+
* The onramp flow lets a machine intelligence register itself with DG
|
|
5
|
+
* without a human in the loop, using only plain HTTP JSON — no MCP client
|
|
6
|
+
* required. This matters because many agent harnesses gate or restrict MCP
|
|
7
|
+
* connections but allow arbitrary HTTP requests.
|
|
8
|
+
*
|
|
9
|
+
* Flow
|
|
10
|
+
* ----
|
|
11
|
+
* 1. POST to `/onramp` with agent identity metadata (no auth).
|
|
12
|
+
* 2. DG returns a short-lived `session_token` (5 minutes).
|
|
13
|
+
* 3. POST to `/onramp/complete` with `Authorization: Bearer <session_token>`.
|
|
14
|
+
* 4. DG issues provisional `client_id` + `client_secret` (restricted scopes).
|
|
15
|
+
*
|
|
16
|
+
* @example
|
|
17
|
+
* ```ts
|
|
18
|
+
* import { Client } from './client';
|
|
19
|
+
* import { OnrampOptions } from './onramp';
|
|
20
|
+
*
|
|
21
|
+
* // One-shot: autonomous registration + mTLS bootstrap.
|
|
22
|
+
* const client = await Client.bootstrapOnramp({
|
|
23
|
+
* opts: {
|
|
24
|
+
* gateway: 'https://app.datagrout.ai',
|
|
25
|
+
* agentName: 'my-research-agent',
|
|
26
|
+
* agentType: 'claude-sonnet-4-6',
|
|
27
|
+
* intendedUse: 'Summarise documents and extract entities.',
|
|
28
|
+
* },
|
|
29
|
+
* });
|
|
30
|
+
* await client.connect();
|
|
31
|
+
* ```
|
|
32
|
+
*/
|
|
33
|
+
/** Options for the autonomous agent onramp flow. */
|
|
34
|
+
interface OnrampOptions {
|
|
35
|
+
/** DataGrout gateway base URL (e.g. `"https://app.datagrout.ai"`). */
|
|
36
|
+
gateway: string;
|
|
37
|
+
/** Human-readable name for this agent instance. */
|
|
38
|
+
agentName: string;
|
|
39
|
+
/** Model or framework identifier (e.g. `"claude-sonnet-4-6"`, `"gpt-4o"`). */
|
|
40
|
+
agentType?: string;
|
|
41
|
+
/** Plain-language description of what the agent intends to do. */
|
|
42
|
+
intendedUse?: string;
|
|
43
|
+
/** Optional access code from the server owner — reserved for scope elevation. */
|
|
44
|
+
accessCode?: string;
|
|
45
|
+
}
|
|
46
|
+
/**
|
|
47
|
+
* Provisional credentials returned by the DG onramp complete endpoint.
|
|
48
|
+
*
|
|
49
|
+
* Store `clientId` and `clientSecret` securely — the secret is shown exactly
|
|
50
|
+
* once and cannot be recovered after this point.
|
|
51
|
+
*
|
|
52
|
+
* `mcpUrl` and `rpcUrl` are provisioned as part of the identity registration
|
|
53
|
+
* step and may be absent from the initial onramp response. Use
|
|
54
|
+
* `Client.bootstrapOnramp` for the all-in-one flow that handles this
|
|
55
|
+
* transparently.
|
|
56
|
+
*/
|
|
57
|
+
interface OnrampCredentials {
|
|
58
|
+
/** OAuth client ID. */
|
|
59
|
+
clientId: string;
|
|
60
|
+
/** OAuth client secret. Store this securely — shown once. */
|
|
61
|
+
clientSecret: string;
|
|
62
|
+
/** Token endpoint for the `client_credentials` grant. */
|
|
63
|
+
tokenUrl: string;
|
|
64
|
+
/** Granted OAuth scopes. */
|
|
65
|
+
scopes: string[];
|
|
66
|
+
/** Provisional credential TTL in seconds. */
|
|
67
|
+
expiresIn: number;
|
|
68
|
+
/** JSON-RPC endpoint. Absent until identity is registered. */
|
|
69
|
+
rpcUrl?: string;
|
|
70
|
+
/** MCP endpoint. Absent until identity is registered. */
|
|
71
|
+
mcpUrl?: string;
|
|
72
|
+
}
|
|
73
|
+
/**
|
|
74
|
+
* Perform the onramp handshake and return provisional OAuth credentials.
|
|
75
|
+
*
|
|
76
|
+
* This is the low-level entry point. Most callers should use
|
|
77
|
+
* `Client.bootstrapOnramp` instead, which chains onramp → token exchange →
|
|
78
|
+
* mTLS identity bootstrap in a single call.
|
|
79
|
+
*
|
|
80
|
+
* @param opts Onramp registration options.
|
|
81
|
+
* @returns `OnrampCredentials` containing `clientId` and `clientSecret`.
|
|
82
|
+
*/
|
|
83
|
+
declare function registerOnly(opts: OnrampOptions): Promise<OnrampCredentials>;
|
|
84
|
+
/**
|
|
85
|
+
* Perform the full onramp handshake and OAuth token exchange.
|
|
86
|
+
*
|
|
87
|
+
* Returns the provisional credentials alongside a short-lived access token
|
|
88
|
+
* ready for use with `Client.bootstrapIdentity`.
|
|
89
|
+
*
|
|
90
|
+
* @param opts Onramp registration options.
|
|
91
|
+
* @returns Tuple of `[OnrampCredentials, accessToken]`.
|
|
92
|
+
*/
|
|
93
|
+
declare function registerAndExchange(opts: OnrampOptions): Promise<[OnrampCredentials, string]>;
|
|
94
|
+
|
|
1
95
|
/**
|
|
2
96
|
* Identity and mTLS support for Conduit connections.
|
|
3
97
|
*
|
|
@@ -132,7 +226,7 @@ declare function fetchWithIdentity(url: string, init: RequestInit, identity: Con
|
|
|
132
226
|
* - `"unlimited"` — authenticated DataGrout users; the gateway never blocks them.
|
|
133
227
|
* - `{ perHour: number }` — unauthenticated callers hitting a per-hour cap.
|
|
134
228
|
*/
|
|
135
|
-
type RateLimit =
|
|
229
|
+
type RateLimit = "unlimited" | {
|
|
136
230
|
perHour: number;
|
|
137
231
|
};
|
|
138
232
|
/**
|
|
@@ -295,6 +389,9 @@ interface ClientOptions {
|
|
|
295
389
|
* `~/.conduit/` before falling back to token auth. Equivalent to
|
|
296
390
|
* calling `ConduitIdentity.tryDefault()` and passing the result as
|
|
297
391
|
* `identity`.
|
|
392
|
+
*
|
|
393
|
+
* mTLS auto-discovery is **opt-in** — this flag must be set to enable it.
|
|
394
|
+
* DataGrout URLs do not auto-discover an identity by default.
|
|
298
395
|
*/
|
|
299
396
|
identityAuto?: boolean;
|
|
300
397
|
/**
|
|
@@ -313,16 +410,11 @@ interface ClientOptions {
|
|
|
313
410
|
*/
|
|
314
411
|
useIntelligentInterface?: boolean;
|
|
315
412
|
/**
|
|
316
|
-
*
|
|
317
|
-
*
|
|
318
|
-
* By default, DG URLs (`*.datagrout.ai`) silently attempt to discover an
|
|
319
|
-
* mTLS identity from env vars or `~/.conduit/`. Set to `true` to opt out
|
|
320
|
-
* and use token-only auth.
|
|
321
|
-
*
|
|
322
|
-
* @default false
|
|
413
|
+
* @deprecated No-op. mTLS auto-discovery is now opt-in via `identityAuto`.
|
|
414
|
+
* This option is kept for backward compatibility and has no effect.
|
|
323
415
|
*/
|
|
324
416
|
disableMtls?: boolean;
|
|
325
|
-
transport?:
|
|
417
|
+
transport?: "mcp" | "jsonrpc" | "websocket";
|
|
326
418
|
timeout?: number;
|
|
327
419
|
/**
|
|
328
420
|
* Maximum number of automatic retries on "server not initialized" errors.
|
|
@@ -345,7 +437,7 @@ interface PerformOptions {
|
|
|
345
437
|
tool: string;
|
|
346
438
|
args: Record<string, any>;
|
|
347
439
|
demux?: boolean;
|
|
348
|
-
demuxMode?:
|
|
440
|
+
demuxMode?: "strict" | "fuzzy";
|
|
349
441
|
}
|
|
350
442
|
interface GuideRequestOptions {
|
|
351
443
|
goal?: string;
|
|
@@ -890,6 +982,40 @@ declare class Client {
|
|
|
890
982
|
identityDir?: string;
|
|
891
983
|
substrateEndpoint?: string;
|
|
892
984
|
}): Promise<Client>;
|
|
985
|
+
/**
|
|
986
|
+
* Register autonomously with DG and bootstrap an mTLS identity.
|
|
987
|
+
*
|
|
988
|
+
* The all-in-one flow: onramp (no prior credentials required) →
|
|
989
|
+
* OAuth token exchange → mTLS identity registration and persistence.
|
|
990
|
+
*
|
|
991
|
+
* On subsequent runs the saved mTLS identity is auto-discovered and
|
|
992
|
+
* no credentials are needed.
|
|
993
|
+
*
|
|
994
|
+
* @param options.opts - Onramp registration options.
|
|
995
|
+
* @param options.url - MCP server URL. Required if the onramp
|
|
996
|
+
* response does not include `mcpUrl`.
|
|
997
|
+
* @param options.identityDir - Custom identity storage directory.
|
|
998
|
+
*
|
|
999
|
+
* @example
|
|
1000
|
+
* ```ts
|
|
1001
|
+
* import { Client } from './client';
|
|
1002
|
+
* import type { OnrampOptions } from './onramp';
|
|
1003
|
+
*
|
|
1004
|
+
* const client = await Client.bootstrapOnramp({
|
|
1005
|
+
* opts: {
|
|
1006
|
+
* gateway: 'https://app.datagrout.ai',
|
|
1007
|
+
* agentName: 'my-research-agent',
|
|
1008
|
+
* agentType: 'claude-sonnet-4-6',
|
|
1009
|
+
* },
|
|
1010
|
+
* });
|
|
1011
|
+
* await client.connect();
|
|
1012
|
+
* ```
|
|
1013
|
+
*/
|
|
1014
|
+
static bootstrapOnramp(options: {
|
|
1015
|
+
opts: OnrampOptions;
|
|
1016
|
+
url?: string;
|
|
1017
|
+
identityDir?: string;
|
|
1018
|
+
}): Promise<Client>;
|
|
893
1019
|
/**
|
|
894
1020
|
* Establish the underlying transport connection.
|
|
895
1021
|
*
|
|
@@ -1381,6 +1507,6 @@ declare class InvalidConfigError extends ConduitError {
|
|
|
1381
1507
|
* DataGrout Conduit SDK for TypeScript/JavaScript
|
|
1382
1508
|
*/
|
|
1383
1509
|
|
|
1384
|
-
declare const version = "0.
|
|
1510
|
+
declare const version = "0.5.0";
|
|
1385
1511
|
|
|
1386
|
-
export { type AuthConfig, AuthError, type Byok, type ChartOptions, Client, type ClientOptions, ConduitError, ConduitIdentity, type ConstrainOptions, type CreditEstimate, DEFAULT_IDENTITY_DIR, DG_CA_URL, DG_SUBSTRATE_ENDPOINT, type DiscoverOptions, type DiscoverResult, type FlowOptions, type ForgetOptions, type GuideOptions, type GuideRequestOptions, type GuideState, GuidedSession, InvalidConfigError, type Keypair, type MCPPrompt, type MCPResource, type MCPTool, type MtlsConfig, NetworkError, NotInitializedError, OAuthTokenProvider, type PerformOptions, type PerformResult, type PlanOptions, type PrismFocusOptions, type QueryCellOptions, type RateLimit, RateLimitError, type RateLimitStatus, type Receipt, type ReflectOptions, type RefractOptions, type RegisteredIdentity, type RegistrationOptions, type RememberOptions, type RenewalOptions, type RotationOptions, type SavedPaths, ServerError, Subscription, type SubscriptionEvent, type ToolInfo, type ToolMeta, SUBPROTOCOL as WS_SUBPROTOCOL, WsTransport, deriveTokenEndpoint, extractMeta, fetchDgCaCert, fetchWithIdentity, generateKeypair, isDgUrl, refreshCaCert, registerIdentity, rotateIdentity, saveIdentity, version };
|
|
1512
|
+
export { type AuthConfig, AuthError, type Byok, type ChartOptions, Client, type ClientOptions, ConduitError, ConduitIdentity, type ConstrainOptions, type CreditEstimate, DEFAULT_IDENTITY_DIR, DG_CA_URL, DG_SUBSTRATE_ENDPOINT, type DiscoverOptions, type DiscoverResult, type FlowOptions, type ForgetOptions, type GuideOptions, type GuideRequestOptions, type GuideState, GuidedSession, InvalidConfigError, type Keypair, type MCPPrompt, type MCPResource, type MCPTool, type MtlsConfig, NetworkError, NotInitializedError, OAuthTokenProvider, type OnrampCredentials, type OnrampOptions, type PerformOptions, type PerformResult, type PlanOptions, type PrismFocusOptions, type QueryCellOptions, type RateLimit, RateLimitError, type RateLimitStatus, type Receipt, type ReflectOptions, type RefractOptions, type RegisteredIdentity, type RegistrationOptions, type RememberOptions, type RenewalOptions, type RotationOptions, type SavedPaths, ServerError, Subscription, type SubscriptionEvent, type ToolInfo, type ToolMeta, SUBPROTOCOL as WS_SUBPROTOCOL, WsTransport, deriveTokenEndpoint, extractMeta, fetchDgCaCert, fetchWithIdentity, generateKeypair, isDgUrl, refreshCaCert, registerAndExchange, registerIdentity, registerOnly, rotateIdentity, saveIdentity, version };
|
package/dist/index.d.ts
CHANGED
|
@@ -1,3 +1,97 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Autonomous agent self-registration (onramp) for DataGrout.
|
|
3
|
+
*
|
|
4
|
+
* The onramp flow lets a machine intelligence register itself with DG
|
|
5
|
+
* without a human in the loop, using only plain HTTP JSON — no MCP client
|
|
6
|
+
* required. This matters because many agent harnesses gate or restrict MCP
|
|
7
|
+
* connections but allow arbitrary HTTP requests.
|
|
8
|
+
*
|
|
9
|
+
* Flow
|
|
10
|
+
* ----
|
|
11
|
+
* 1. POST to `/onramp` with agent identity metadata (no auth).
|
|
12
|
+
* 2. DG returns a short-lived `session_token` (5 minutes).
|
|
13
|
+
* 3. POST to `/onramp/complete` with `Authorization: Bearer <session_token>`.
|
|
14
|
+
* 4. DG issues provisional `client_id` + `client_secret` (restricted scopes).
|
|
15
|
+
*
|
|
16
|
+
* @example
|
|
17
|
+
* ```ts
|
|
18
|
+
* import { Client } from './client';
|
|
19
|
+
* import { OnrampOptions } from './onramp';
|
|
20
|
+
*
|
|
21
|
+
* // One-shot: autonomous registration + mTLS bootstrap.
|
|
22
|
+
* const client = await Client.bootstrapOnramp({
|
|
23
|
+
* opts: {
|
|
24
|
+
* gateway: 'https://app.datagrout.ai',
|
|
25
|
+
* agentName: 'my-research-agent',
|
|
26
|
+
* agentType: 'claude-sonnet-4-6',
|
|
27
|
+
* intendedUse: 'Summarise documents and extract entities.',
|
|
28
|
+
* },
|
|
29
|
+
* });
|
|
30
|
+
* await client.connect();
|
|
31
|
+
* ```
|
|
32
|
+
*/
|
|
33
|
+
/** Options for the autonomous agent onramp flow. */
|
|
34
|
+
interface OnrampOptions {
|
|
35
|
+
/** DataGrout gateway base URL (e.g. `"https://app.datagrout.ai"`). */
|
|
36
|
+
gateway: string;
|
|
37
|
+
/** Human-readable name for this agent instance. */
|
|
38
|
+
agentName: string;
|
|
39
|
+
/** Model or framework identifier (e.g. `"claude-sonnet-4-6"`, `"gpt-4o"`). */
|
|
40
|
+
agentType?: string;
|
|
41
|
+
/** Plain-language description of what the agent intends to do. */
|
|
42
|
+
intendedUse?: string;
|
|
43
|
+
/** Optional access code from the server owner — reserved for scope elevation. */
|
|
44
|
+
accessCode?: string;
|
|
45
|
+
}
|
|
46
|
+
/**
|
|
47
|
+
* Provisional credentials returned by the DG onramp complete endpoint.
|
|
48
|
+
*
|
|
49
|
+
* Store `clientId` and `clientSecret` securely — the secret is shown exactly
|
|
50
|
+
* once and cannot be recovered after this point.
|
|
51
|
+
*
|
|
52
|
+
* `mcpUrl` and `rpcUrl` are provisioned as part of the identity registration
|
|
53
|
+
* step and may be absent from the initial onramp response. Use
|
|
54
|
+
* `Client.bootstrapOnramp` for the all-in-one flow that handles this
|
|
55
|
+
* transparently.
|
|
56
|
+
*/
|
|
57
|
+
interface OnrampCredentials {
|
|
58
|
+
/** OAuth client ID. */
|
|
59
|
+
clientId: string;
|
|
60
|
+
/** OAuth client secret. Store this securely — shown once. */
|
|
61
|
+
clientSecret: string;
|
|
62
|
+
/** Token endpoint for the `client_credentials` grant. */
|
|
63
|
+
tokenUrl: string;
|
|
64
|
+
/** Granted OAuth scopes. */
|
|
65
|
+
scopes: string[];
|
|
66
|
+
/** Provisional credential TTL in seconds. */
|
|
67
|
+
expiresIn: number;
|
|
68
|
+
/** JSON-RPC endpoint. Absent until identity is registered. */
|
|
69
|
+
rpcUrl?: string;
|
|
70
|
+
/** MCP endpoint. Absent until identity is registered. */
|
|
71
|
+
mcpUrl?: string;
|
|
72
|
+
}
|
|
73
|
+
/**
|
|
74
|
+
* Perform the onramp handshake and return provisional OAuth credentials.
|
|
75
|
+
*
|
|
76
|
+
* This is the low-level entry point. Most callers should use
|
|
77
|
+
* `Client.bootstrapOnramp` instead, which chains onramp → token exchange →
|
|
78
|
+
* mTLS identity bootstrap in a single call.
|
|
79
|
+
*
|
|
80
|
+
* @param opts Onramp registration options.
|
|
81
|
+
* @returns `OnrampCredentials` containing `clientId` and `clientSecret`.
|
|
82
|
+
*/
|
|
83
|
+
declare function registerOnly(opts: OnrampOptions): Promise<OnrampCredentials>;
|
|
84
|
+
/**
|
|
85
|
+
* Perform the full onramp handshake and OAuth token exchange.
|
|
86
|
+
*
|
|
87
|
+
* Returns the provisional credentials alongside a short-lived access token
|
|
88
|
+
* ready for use with `Client.bootstrapIdentity`.
|
|
89
|
+
*
|
|
90
|
+
* @param opts Onramp registration options.
|
|
91
|
+
* @returns Tuple of `[OnrampCredentials, accessToken]`.
|
|
92
|
+
*/
|
|
93
|
+
declare function registerAndExchange(opts: OnrampOptions): Promise<[OnrampCredentials, string]>;
|
|
94
|
+
|
|
1
95
|
/**
|
|
2
96
|
* Identity and mTLS support for Conduit connections.
|
|
3
97
|
*
|
|
@@ -132,7 +226,7 @@ declare function fetchWithIdentity(url: string, init: RequestInit, identity: Con
|
|
|
132
226
|
* - `"unlimited"` — authenticated DataGrout users; the gateway never blocks them.
|
|
133
227
|
* - `{ perHour: number }` — unauthenticated callers hitting a per-hour cap.
|
|
134
228
|
*/
|
|
135
|
-
type RateLimit =
|
|
229
|
+
type RateLimit = "unlimited" | {
|
|
136
230
|
perHour: number;
|
|
137
231
|
};
|
|
138
232
|
/**
|
|
@@ -295,6 +389,9 @@ interface ClientOptions {
|
|
|
295
389
|
* `~/.conduit/` before falling back to token auth. Equivalent to
|
|
296
390
|
* calling `ConduitIdentity.tryDefault()` and passing the result as
|
|
297
391
|
* `identity`.
|
|
392
|
+
*
|
|
393
|
+
* mTLS auto-discovery is **opt-in** — this flag must be set to enable it.
|
|
394
|
+
* DataGrout URLs do not auto-discover an identity by default.
|
|
298
395
|
*/
|
|
299
396
|
identityAuto?: boolean;
|
|
300
397
|
/**
|
|
@@ -313,16 +410,11 @@ interface ClientOptions {
|
|
|
313
410
|
*/
|
|
314
411
|
useIntelligentInterface?: boolean;
|
|
315
412
|
/**
|
|
316
|
-
*
|
|
317
|
-
*
|
|
318
|
-
* By default, DG URLs (`*.datagrout.ai`) silently attempt to discover an
|
|
319
|
-
* mTLS identity from env vars or `~/.conduit/`. Set to `true` to opt out
|
|
320
|
-
* and use token-only auth.
|
|
321
|
-
*
|
|
322
|
-
* @default false
|
|
413
|
+
* @deprecated No-op. mTLS auto-discovery is now opt-in via `identityAuto`.
|
|
414
|
+
* This option is kept for backward compatibility and has no effect.
|
|
323
415
|
*/
|
|
324
416
|
disableMtls?: boolean;
|
|
325
|
-
transport?:
|
|
417
|
+
transport?: "mcp" | "jsonrpc" | "websocket";
|
|
326
418
|
timeout?: number;
|
|
327
419
|
/**
|
|
328
420
|
* Maximum number of automatic retries on "server not initialized" errors.
|
|
@@ -345,7 +437,7 @@ interface PerformOptions {
|
|
|
345
437
|
tool: string;
|
|
346
438
|
args: Record<string, any>;
|
|
347
439
|
demux?: boolean;
|
|
348
|
-
demuxMode?:
|
|
440
|
+
demuxMode?: "strict" | "fuzzy";
|
|
349
441
|
}
|
|
350
442
|
interface GuideRequestOptions {
|
|
351
443
|
goal?: string;
|
|
@@ -890,6 +982,40 @@ declare class Client {
|
|
|
890
982
|
identityDir?: string;
|
|
891
983
|
substrateEndpoint?: string;
|
|
892
984
|
}): Promise<Client>;
|
|
985
|
+
/**
|
|
986
|
+
* Register autonomously with DG and bootstrap an mTLS identity.
|
|
987
|
+
*
|
|
988
|
+
* The all-in-one flow: onramp (no prior credentials required) →
|
|
989
|
+
* OAuth token exchange → mTLS identity registration and persistence.
|
|
990
|
+
*
|
|
991
|
+
* On subsequent runs the saved mTLS identity is auto-discovered and
|
|
992
|
+
* no credentials are needed.
|
|
993
|
+
*
|
|
994
|
+
* @param options.opts - Onramp registration options.
|
|
995
|
+
* @param options.url - MCP server URL. Required if the onramp
|
|
996
|
+
* response does not include `mcpUrl`.
|
|
997
|
+
* @param options.identityDir - Custom identity storage directory.
|
|
998
|
+
*
|
|
999
|
+
* @example
|
|
1000
|
+
* ```ts
|
|
1001
|
+
* import { Client } from './client';
|
|
1002
|
+
* import type { OnrampOptions } from './onramp';
|
|
1003
|
+
*
|
|
1004
|
+
* const client = await Client.bootstrapOnramp({
|
|
1005
|
+
* opts: {
|
|
1006
|
+
* gateway: 'https://app.datagrout.ai',
|
|
1007
|
+
* agentName: 'my-research-agent',
|
|
1008
|
+
* agentType: 'claude-sonnet-4-6',
|
|
1009
|
+
* },
|
|
1010
|
+
* });
|
|
1011
|
+
* await client.connect();
|
|
1012
|
+
* ```
|
|
1013
|
+
*/
|
|
1014
|
+
static bootstrapOnramp(options: {
|
|
1015
|
+
opts: OnrampOptions;
|
|
1016
|
+
url?: string;
|
|
1017
|
+
identityDir?: string;
|
|
1018
|
+
}): Promise<Client>;
|
|
893
1019
|
/**
|
|
894
1020
|
* Establish the underlying transport connection.
|
|
895
1021
|
*
|
|
@@ -1381,6 +1507,6 @@ declare class InvalidConfigError extends ConduitError {
|
|
|
1381
1507
|
* DataGrout Conduit SDK for TypeScript/JavaScript
|
|
1382
1508
|
*/
|
|
1383
1509
|
|
|
1384
|
-
declare const version = "0.
|
|
1510
|
+
declare const version = "0.5.0";
|
|
1385
1511
|
|
|
1386
|
-
export { type AuthConfig, AuthError, type Byok, type ChartOptions, Client, type ClientOptions, ConduitError, ConduitIdentity, type ConstrainOptions, type CreditEstimate, DEFAULT_IDENTITY_DIR, DG_CA_URL, DG_SUBSTRATE_ENDPOINT, type DiscoverOptions, type DiscoverResult, type FlowOptions, type ForgetOptions, type GuideOptions, type GuideRequestOptions, type GuideState, GuidedSession, InvalidConfigError, type Keypair, type MCPPrompt, type MCPResource, type MCPTool, type MtlsConfig, NetworkError, NotInitializedError, OAuthTokenProvider, type PerformOptions, type PerformResult, type PlanOptions, type PrismFocusOptions, type QueryCellOptions, type RateLimit, RateLimitError, type RateLimitStatus, type Receipt, type ReflectOptions, type RefractOptions, type RegisteredIdentity, type RegistrationOptions, type RememberOptions, type RenewalOptions, type RotationOptions, type SavedPaths, ServerError, Subscription, type SubscriptionEvent, type ToolInfo, type ToolMeta, SUBPROTOCOL as WS_SUBPROTOCOL, WsTransport, deriveTokenEndpoint, extractMeta, fetchDgCaCert, fetchWithIdentity, generateKeypair, isDgUrl, refreshCaCert, registerIdentity, rotateIdentity, saveIdentity, version };
|
|
1512
|
+
export { type AuthConfig, AuthError, type Byok, type ChartOptions, Client, type ClientOptions, ConduitError, ConduitIdentity, type ConstrainOptions, type CreditEstimate, DEFAULT_IDENTITY_DIR, DG_CA_URL, DG_SUBSTRATE_ENDPOINT, type DiscoverOptions, type DiscoverResult, type FlowOptions, type ForgetOptions, type GuideOptions, type GuideRequestOptions, type GuideState, GuidedSession, InvalidConfigError, type Keypair, type MCPPrompt, type MCPResource, type MCPTool, type MtlsConfig, NetworkError, NotInitializedError, OAuthTokenProvider, type OnrampCredentials, type OnrampOptions, type PerformOptions, type PerformResult, type PlanOptions, type PrismFocusOptions, type QueryCellOptions, type RateLimit, RateLimitError, type RateLimitStatus, type Receipt, type ReflectOptions, type RefractOptions, type RegisteredIdentity, type RegistrationOptions, type RememberOptions, type RenewalOptions, type RotationOptions, type SavedPaths, ServerError, Subscription, type SubscriptionEvent, type ToolInfo, type ToolMeta, SUBPROTOCOL as WS_SUBPROTOCOL, WsTransport, deriveTokenEndpoint, extractMeta, fetchDgCaCert, fetchWithIdentity, generateKeypair, isDgUrl, refreshCaCert, registerAndExchange, registerIdentity, registerOnly, rotateIdentity, saveIdentity, version };
|