@datagrout/conduit 0.4.0 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -5,7 +5,7 @@ Production-ready MCP client with mTLS identity, OAuth 2.1, semantic discovery, a
5
5
  ## Installation
6
6
 
7
7
  ```bash
8
- npm install @datagrout/conduit@0.4.0
8
+ npm install @datagrout/conduit@0.5.0
9
9
  ```
10
10
 
11
11
  ## Quick Start
@@ -0,0 +1,33 @@
1
+ var __defProp = Object.defineProperty;
2
+ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
3
+ var __getOwnPropNames = Object.getOwnPropertyNames;
4
+ var __hasOwnProp = Object.prototype.hasOwnProperty;
5
+ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
6
+ get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
7
+ }) : x)(function(x) {
8
+ if (typeof require !== "undefined") return require.apply(this, arguments);
9
+ throw Error('Dynamic require of "' + x + '" is not supported');
10
+ });
11
+ var __esm = (fn, res) => function __init() {
12
+ return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
13
+ };
14
+ var __export = (target, all) => {
15
+ for (var name in all)
16
+ __defProp(target, name, { get: all[name], enumerable: true });
17
+ };
18
+ var __copyProps = (to, from, except, desc) => {
19
+ if (from && typeof from === "object" || typeof from === "function") {
20
+ for (let key of __getOwnPropNames(from))
21
+ if (!__hasOwnProp.call(to, key) && key !== except)
22
+ __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
23
+ }
24
+ return to;
25
+ };
26
+ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
27
+
28
+ export {
29
+ __require,
30
+ __esm,
31
+ __export,
32
+ __toCommonJS
33
+ };
@@ -1,29 +1,7 @@
1
- var __defProp = Object.defineProperty;
2
- var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
3
- var __getOwnPropNames = Object.getOwnPropertyNames;
4
- var __hasOwnProp = Object.prototype.hasOwnProperty;
5
- var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
6
- get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
7
- }) : x)(function(x) {
8
- if (typeof require !== "undefined") return require.apply(this, arguments);
9
- throw Error('Dynamic require of "' + x + '" is not supported');
10
- });
11
- var __esm = (fn, res) => function __init() {
12
- return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
13
- };
14
- var __export = (target, all) => {
15
- for (var name in all)
16
- __defProp(target, name, { get: all[name], enumerable: true });
17
- };
18
- var __copyProps = (to, from, except, desc) => {
19
- if (from && typeof from === "object" || typeof from === "function") {
20
- for (let key of __getOwnPropNames(from))
21
- if (!__hasOwnProp.call(to, key) && key !== except)
22
- __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
23
- }
24
- return to;
25
- };
26
- var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
1
+ import {
2
+ __esm,
3
+ __export
4
+ } from "./chunk-CIESM3BP.mjs";
27
5
 
28
6
  // src/oauth.ts
29
7
  var oauth_exports = {};
@@ -95,7 +73,9 @@ var init_oauth = __esm({
95
73
  }
96
74
  if (!response.ok) {
97
75
  const text = await response.text().catch(() => "");
98
- throw new Error(`OAuth token endpoint returned ${response.status}: ${text}`);
76
+ throw new Error(
77
+ `OAuth token endpoint returned ${response.status}: ${text}`
78
+ );
99
79
  }
100
80
  const data = await response.json();
101
81
  const expiresIn = data.expires_in ?? 3600;
@@ -111,10 +91,6 @@ var init_oauth = __esm({
111
91
  });
112
92
 
113
93
  export {
114
- __require,
115
- __esm,
116
- __export,
117
- __toCommonJS,
118
94
  deriveTokenEndpoint,
119
95
  OAuthTokenProvider,
120
96
  oauth_exports,
@@ -0,0 +1,71 @@
1
+ // src/onramp.ts
2
+ async function _doRegister(opts) {
3
+ const base = opts.gateway.replace(/\/$/, "");
4
+ const body = { agent_name: opts.agentName };
5
+ if (opts.agentType) body["agent_type"] = opts.agentType;
6
+ if (opts.intendedUse) body["intended_use"] = opts.intendedUse;
7
+ if (opts.accessCode) body["access_code"] = opts.accessCode;
8
+ const initResp = await fetch(`${base}/onramp`, {
9
+ method: "POST",
10
+ headers: { "Content-Type": "application/json" },
11
+ body: JSON.stringify(body)
12
+ });
13
+ if (!initResp.ok) {
14
+ const text = await initResp.text();
15
+ throw new Error(`onramp init rejected (HTTP ${initResp.status}): ${text}`);
16
+ }
17
+ const initData = await initResp.json();
18
+ const sessionToken = initData.session_token;
19
+ const completeResp = await fetch(`${base}/onramp/complete`, {
20
+ method: "POST",
21
+ headers: { Authorization: `Bearer ${sessionToken}` }
22
+ });
23
+ if (!completeResp.ok) {
24
+ const text = await completeResp.text();
25
+ throw new Error(
26
+ `onramp complete rejected (HTTP ${completeResp.status}): ${text}`
27
+ );
28
+ }
29
+ const data = await completeResp.json();
30
+ return {
31
+ clientId: data["client_id"],
32
+ clientSecret: data["client_secret"],
33
+ tokenUrl: data["token_url"],
34
+ scopes: data["scopes"] ?? [],
35
+ expiresIn: data["expires_in"] ?? 0,
36
+ rpcUrl: data["rpc_url"],
37
+ mcpUrl: data["mcp_url"]
38
+ };
39
+ }
40
+ async function _exchangeToken(creds) {
41
+ const body = new URLSearchParams({
42
+ grant_type: "client_credentials",
43
+ client_id: creds.clientId,
44
+ client_secret: creds.clientSecret
45
+ });
46
+ const resp = await fetch(creds.tokenUrl, {
47
+ method: "POST",
48
+ body
49
+ });
50
+ if (!resp.ok) {
51
+ const text = await resp.text();
52
+ throw new Error(`token exchange failed (HTTP ${resp.status}): ${text}`);
53
+ }
54
+ const data = await resp.json();
55
+ return data.access_token;
56
+ }
57
+ async function registerOnly(opts) {
58
+ return _doRegister(opts);
59
+ }
60
+ async function registerAndExchange(opts) {
61
+ const creds = await _doRegister(opts);
62
+ const token = await _exchangeToken(creds);
63
+ return [creds, token];
64
+ }
65
+
66
+ export {
67
+ _doRegister,
68
+ _exchangeToken,
69
+ registerOnly,
70
+ registerAndExchange
71
+ };
package/dist/index.d.mts CHANGED
@@ -1,3 +1,97 @@
1
+ /**
2
+ * Autonomous agent self-registration (onramp) for DataGrout.
3
+ *
4
+ * The onramp flow lets a machine intelligence register itself with DG
5
+ * without a human in the loop, using only plain HTTP JSON — no MCP client
6
+ * required. This matters because many agent harnesses gate or restrict MCP
7
+ * connections but allow arbitrary HTTP requests.
8
+ *
9
+ * Flow
10
+ * ----
11
+ * 1. POST to `/onramp` with agent identity metadata (no auth).
12
+ * 2. DG returns a short-lived `session_token` (5 minutes).
13
+ * 3. POST to `/onramp/complete` with `Authorization: Bearer <session_token>`.
14
+ * 4. DG issues provisional `client_id` + `client_secret` (restricted scopes).
15
+ *
16
+ * @example
17
+ * ```ts
18
+ * import { Client } from './client';
19
+ * import { OnrampOptions } from './onramp';
20
+ *
21
+ * // One-shot: autonomous registration + mTLS bootstrap.
22
+ * const client = await Client.bootstrapOnramp({
23
+ * opts: {
24
+ * gateway: 'https://app.datagrout.ai',
25
+ * agentName: 'my-research-agent',
26
+ * agentType: 'claude-sonnet-4-6',
27
+ * intendedUse: 'Summarise documents and extract entities.',
28
+ * },
29
+ * });
30
+ * await client.connect();
31
+ * ```
32
+ */
33
+ /** Options for the autonomous agent onramp flow. */
34
+ interface OnrampOptions {
35
+ /** DataGrout gateway base URL (e.g. `"https://app.datagrout.ai"`). */
36
+ gateway: string;
37
+ /** Human-readable name for this agent instance. */
38
+ agentName: string;
39
+ /** Model or framework identifier (e.g. `"claude-sonnet-4-6"`, `"gpt-4o"`). */
40
+ agentType?: string;
41
+ /** Plain-language description of what the agent intends to do. */
42
+ intendedUse?: string;
43
+ /** Optional access code from the server owner — reserved for scope elevation. */
44
+ accessCode?: string;
45
+ }
46
+ /**
47
+ * Provisional credentials returned by the DG onramp complete endpoint.
48
+ *
49
+ * Store `clientId` and `clientSecret` securely — the secret is shown exactly
50
+ * once and cannot be recovered after this point.
51
+ *
52
+ * `mcpUrl` and `rpcUrl` are provisioned as part of the identity registration
53
+ * step and may be absent from the initial onramp response. Use
54
+ * `Client.bootstrapOnramp` for the all-in-one flow that handles this
55
+ * transparently.
56
+ */
57
+ interface OnrampCredentials {
58
+ /** OAuth client ID. */
59
+ clientId: string;
60
+ /** OAuth client secret. Store this securely — shown once. */
61
+ clientSecret: string;
62
+ /** Token endpoint for the `client_credentials` grant. */
63
+ tokenUrl: string;
64
+ /** Granted OAuth scopes. */
65
+ scopes: string[];
66
+ /** Provisional credential TTL in seconds. */
67
+ expiresIn: number;
68
+ /** JSON-RPC endpoint. Absent until identity is registered. */
69
+ rpcUrl?: string;
70
+ /** MCP endpoint. Absent until identity is registered. */
71
+ mcpUrl?: string;
72
+ }
73
+ /**
74
+ * Perform the onramp handshake and return provisional OAuth credentials.
75
+ *
76
+ * This is the low-level entry point. Most callers should use
77
+ * `Client.bootstrapOnramp` instead, which chains onramp → token exchange →
78
+ * mTLS identity bootstrap in a single call.
79
+ *
80
+ * @param opts Onramp registration options.
81
+ * @returns `OnrampCredentials` containing `clientId` and `clientSecret`.
82
+ */
83
+ declare function registerOnly(opts: OnrampOptions): Promise<OnrampCredentials>;
84
+ /**
85
+ * Perform the full onramp handshake and OAuth token exchange.
86
+ *
87
+ * Returns the provisional credentials alongside a short-lived access token
88
+ * ready for use with `Client.bootstrapIdentity`.
89
+ *
90
+ * @param opts Onramp registration options.
91
+ * @returns Tuple of `[OnrampCredentials, accessToken]`.
92
+ */
93
+ declare function registerAndExchange(opts: OnrampOptions): Promise<[OnrampCredentials, string]>;
94
+
1
95
  /**
2
96
  * Identity and mTLS support for Conduit connections.
3
97
  *
@@ -132,7 +226,7 @@ declare function fetchWithIdentity(url: string, init: RequestInit, identity: Con
132
226
  * - `"unlimited"` — authenticated DataGrout users; the gateway never blocks them.
133
227
  * - `{ perHour: number }` — unauthenticated callers hitting a per-hour cap.
134
228
  */
135
- type RateLimit = 'unlimited' | {
229
+ type RateLimit = "unlimited" | {
136
230
  perHour: number;
137
231
  };
138
232
  /**
@@ -295,6 +389,9 @@ interface ClientOptions {
295
389
  * `~/.conduit/` before falling back to token auth. Equivalent to
296
390
  * calling `ConduitIdentity.tryDefault()` and passing the result as
297
391
  * `identity`.
392
+ *
393
+ * mTLS auto-discovery is **opt-in** — this flag must be set to enable it.
394
+ * DataGrout URLs do not auto-discover an identity by default.
298
395
  */
299
396
  identityAuto?: boolean;
300
397
  /**
@@ -313,16 +410,11 @@ interface ClientOptions {
313
410
  */
314
411
  useIntelligentInterface?: boolean;
315
412
  /**
316
- * Disable automatic mTLS even for DataGrout URLs.
317
- *
318
- * By default, DG URLs (`*.datagrout.ai`) silently attempt to discover an
319
- * mTLS identity from env vars or `~/.conduit/`. Set to `true` to opt out
320
- * and use token-only auth.
321
- *
322
- * @default false
413
+ * @deprecated No-op. mTLS auto-discovery is now opt-in via `identityAuto`.
414
+ * This option is kept for backward compatibility and has no effect.
323
415
  */
324
416
  disableMtls?: boolean;
325
- transport?: 'mcp' | 'jsonrpc' | 'websocket';
417
+ transport?: "mcp" | "jsonrpc" | "websocket";
326
418
  timeout?: number;
327
419
  /**
328
420
  * Maximum number of automatic retries on "server not initialized" errors.
@@ -345,7 +437,7 @@ interface PerformOptions {
345
437
  tool: string;
346
438
  args: Record<string, any>;
347
439
  demux?: boolean;
348
- demuxMode?: 'strict' | 'fuzzy';
440
+ demuxMode?: "strict" | "fuzzy";
349
441
  }
350
442
  interface GuideRequestOptions {
351
443
  goal?: string;
@@ -890,6 +982,40 @@ declare class Client {
890
982
  identityDir?: string;
891
983
  substrateEndpoint?: string;
892
984
  }): Promise<Client>;
985
+ /**
986
+ * Register autonomously with DG and bootstrap an mTLS identity.
987
+ *
988
+ * The all-in-one flow: onramp (no prior credentials required) →
989
+ * OAuth token exchange → mTLS identity registration and persistence.
990
+ *
991
+ * On subsequent runs the saved mTLS identity is auto-discovered and
992
+ * no credentials are needed.
993
+ *
994
+ * @param options.opts - Onramp registration options.
995
+ * @param options.url - MCP server URL. Required if the onramp
996
+ * response does not include `mcpUrl`.
997
+ * @param options.identityDir - Custom identity storage directory.
998
+ *
999
+ * @example
1000
+ * ```ts
1001
+ * import { Client } from './client';
1002
+ * import type { OnrampOptions } from './onramp';
1003
+ *
1004
+ * const client = await Client.bootstrapOnramp({
1005
+ * opts: {
1006
+ * gateway: 'https://app.datagrout.ai',
1007
+ * agentName: 'my-research-agent',
1008
+ * agentType: 'claude-sonnet-4-6',
1009
+ * },
1010
+ * });
1011
+ * await client.connect();
1012
+ * ```
1013
+ */
1014
+ static bootstrapOnramp(options: {
1015
+ opts: OnrampOptions;
1016
+ url?: string;
1017
+ identityDir?: string;
1018
+ }): Promise<Client>;
893
1019
  /**
894
1020
  * Establish the underlying transport connection.
895
1021
  *
@@ -1381,6 +1507,6 @@ declare class InvalidConfigError extends ConduitError {
1381
1507
  * DataGrout Conduit SDK for TypeScript/JavaScript
1382
1508
  */
1383
1509
 
1384
- declare const version = "0.4.0";
1510
+ declare const version = "0.5.0";
1385
1511
 
1386
- export { type AuthConfig, AuthError, type Byok, type ChartOptions, Client, type ClientOptions, ConduitError, ConduitIdentity, type ConstrainOptions, type CreditEstimate, DEFAULT_IDENTITY_DIR, DG_CA_URL, DG_SUBSTRATE_ENDPOINT, type DiscoverOptions, type DiscoverResult, type FlowOptions, type ForgetOptions, type GuideOptions, type GuideRequestOptions, type GuideState, GuidedSession, InvalidConfigError, type Keypair, type MCPPrompt, type MCPResource, type MCPTool, type MtlsConfig, NetworkError, NotInitializedError, OAuthTokenProvider, type PerformOptions, type PerformResult, type PlanOptions, type PrismFocusOptions, type QueryCellOptions, type RateLimit, RateLimitError, type RateLimitStatus, type Receipt, type ReflectOptions, type RefractOptions, type RegisteredIdentity, type RegistrationOptions, type RememberOptions, type RenewalOptions, type RotationOptions, type SavedPaths, ServerError, Subscription, type SubscriptionEvent, type ToolInfo, type ToolMeta, SUBPROTOCOL as WS_SUBPROTOCOL, WsTransport, deriveTokenEndpoint, extractMeta, fetchDgCaCert, fetchWithIdentity, generateKeypair, isDgUrl, refreshCaCert, registerIdentity, rotateIdentity, saveIdentity, version };
1512
+ export { type AuthConfig, AuthError, type Byok, type ChartOptions, Client, type ClientOptions, ConduitError, ConduitIdentity, type ConstrainOptions, type CreditEstimate, DEFAULT_IDENTITY_DIR, DG_CA_URL, DG_SUBSTRATE_ENDPOINT, type DiscoverOptions, type DiscoverResult, type FlowOptions, type ForgetOptions, type GuideOptions, type GuideRequestOptions, type GuideState, GuidedSession, InvalidConfigError, type Keypair, type MCPPrompt, type MCPResource, type MCPTool, type MtlsConfig, NetworkError, NotInitializedError, OAuthTokenProvider, type OnrampCredentials, type OnrampOptions, type PerformOptions, type PerformResult, type PlanOptions, type PrismFocusOptions, type QueryCellOptions, type RateLimit, RateLimitError, type RateLimitStatus, type Receipt, type ReflectOptions, type RefractOptions, type RegisteredIdentity, type RegistrationOptions, type RememberOptions, type RenewalOptions, type RotationOptions, type SavedPaths, ServerError, Subscription, type SubscriptionEvent, type ToolInfo, type ToolMeta, SUBPROTOCOL as WS_SUBPROTOCOL, WsTransport, deriveTokenEndpoint, extractMeta, fetchDgCaCert, fetchWithIdentity, generateKeypair, isDgUrl, refreshCaCert, registerAndExchange, registerIdentity, registerOnly, rotateIdentity, saveIdentity, version };
package/dist/index.d.ts CHANGED
@@ -1,3 +1,97 @@
1
+ /**
2
+ * Autonomous agent self-registration (onramp) for DataGrout.
3
+ *
4
+ * The onramp flow lets a machine intelligence register itself with DG
5
+ * without a human in the loop, using only plain HTTP JSON — no MCP client
6
+ * required. This matters because many agent harnesses gate or restrict MCP
7
+ * connections but allow arbitrary HTTP requests.
8
+ *
9
+ * Flow
10
+ * ----
11
+ * 1. POST to `/onramp` with agent identity metadata (no auth).
12
+ * 2. DG returns a short-lived `session_token` (5 minutes).
13
+ * 3. POST to `/onramp/complete` with `Authorization: Bearer <session_token>`.
14
+ * 4. DG issues provisional `client_id` + `client_secret` (restricted scopes).
15
+ *
16
+ * @example
17
+ * ```ts
18
+ * import { Client } from './client';
19
+ * import { OnrampOptions } from './onramp';
20
+ *
21
+ * // One-shot: autonomous registration + mTLS bootstrap.
22
+ * const client = await Client.bootstrapOnramp({
23
+ * opts: {
24
+ * gateway: 'https://app.datagrout.ai',
25
+ * agentName: 'my-research-agent',
26
+ * agentType: 'claude-sonnet-4-6',
27
+ * intendedUse: 'Summarise documents and extract entities.',
28
+ * },
29
+ * });
30
+ * await client.connect();
31
+ * ```
32
+ */
33
+ /** Options for the autonomous agent onramp flow. */
34
+ interface OnrampOptions {
35
+ /** DataGrout gateway base URL (e.g. `"https://app.datagrout.ai"`). */
36
+ gateway: string;
37
+ /** Human-readable name for this agent instance. */
38
+ agentName: string;
39
+ /** Model or framework identifier (e.g. `"claude-sonnet-4-6"`, `"gpt-4o"`). */
40
+ agentType?: string;
41
+ /** Plain-language description of what the agent intends to do. */
42
+ intendedUse?: string;
43
+ /** Optional access code from the server owner — reserved for scope elevation. */
44
+ accessCode?: string;
45
+ }
46
+ /**
47
+ * Provisional credentials returned by the DG onramp complete endpoint.
48
+ *
49
+ * Store `clientId` and `clientSecret` securely — the secret is shown exactly
50
+ * once and cannot be recovered after this point.
51
+ *
52
+ * `mcpUrl` and `rpcUrl` are provisioned as part of the identity registration
53
+ * step and may be absent from the initial onramp response. Use
54
+ * `Client.bootstrapOnramp` for the all-in-one flow that handles this
55
+ * transparently.
56
+ */
57
+ interface OnrampCredentials {
58
+ /** OAuth client ID. */
59
+ clientId: string;
60
+ /** OAuth client secret. Store this securely — shown once. */
61
+ clientSecret: string;
62
+ /** Token endpoint for the `client_credentials` grant. */
63
+ tokenUrl: string;
64
+ /** Granted OAuth scopes. */
65
+ scopes: string[];
66
+ /** Provisional credential TTL in seconds. */
67
+ expiresIn: number;
68
+ /** JSON-RPC endpoint. Absent until identity is registered. */
69
+ rpcUrl?: string;
70
+ /** MCP endpoint. Absent until identity is registered. */
71
+ mcpUrl?: string;
72
+ }
73
+ /**
74
+ * Perform the onramp handshake and return provisional OAuth credentials.
75
+ *
76
+ * This is the low-level entry point. Most callers should use
77
+ * `Client.bootstrapOnramp` instead, which chains onramp → token exchange →
78
+ * mTLS identity bootstrap in a single call.
79
+ *
80
+ * @param opts Onramp registration options.
81
+ * @returns `OnrampCredentials` containing `clientId` and `clientSecret`.
82
+ */
83
+ declare function registerOnly(opts: OnrampOptions): Promise<OnrampCredentials>;
84
+ /**
85
+ * Perform the full onramp handshake and OAuth token exchange.
86
+ *
87
+ * Returns the provisional credentials alongside a short-lived access token
88
+ * ready for use with `Client.bootstrapIdentity`.
89
+ *
90
+ * @param opts Onramp registration options.
91
+ * @returns Tuple of `[OnrampCredentials, accessToken]`.
92
+ */
93
+ declare function registerAndExchange(opts: OnrampOptions): Promise<[OnrampCredentials, string]>;
94
+
1
95
  /**
2
96
  * Identity and mTLS support for Conduit connections.
3
97
  *
@@ -132,7 +226,7 @@ declare function fetchWithIdentity(url: string, init: RequestInit, identity: Con
132
226
  * - `"unlimited"` — authenticated DataGrout users; the gateway never blocks them.
133
227
  * - `{ perHour: number }` — unauthenticated callers hitting a per-hour cap.
134
228
  */
135
- type RateLimit = 'unlimited' | {
229
+ type RateLimit = "unlimited" | {
136
230
  perHour: number;
137
231
  };
138
232
  /**
@@ -295,6 +389,9 @@ interface ClientOptions {
295
389
  * `~/.conduit/` before falling back to token auth. Equivalent to
296
390
  * calling `ConduitIdentity.tryDefault()` and passing the result as
297
391
  * `identity`.
392
+ *
393
+ * mTLS auto-discovery is **opt-in** — this flag must be set to enable it.
394
+ * DataGrout URLs do not auto-discover an identity by default.
298
395
  */
299
396
  identityAuto?: boolean;
300
397
  /**
@@ -313,16 +410,11 @@ interface ClientOptions {
313
410
  */
314
411
  useIntelligentInterface?: boolean;
315
412
  /**
316
- * Disable automatic mTLS even for DataGrout URLs.
317
- *
318
- * By default, DG URLs (`*.datagrout.ai`) silently attempt to discover an
319
- * mTLS identity from env vars or `~/.conduit/`. Set to `true` to opt out
320
- * and use token-only auth.
321
- *
322
- * @default false
413
+ * @deprecated No-op. mTLS auto-discovery is now opt-in via `identityAuto`.
414
+ * This option is kept for backward compatibility and has no effect.
323
415
  */
324
416
  disableMtls?: boolean;
325
- transport?: 'mcp' | 'jsonrpc' | 'websocket';
417
+ transport?: "mcp" | "jsonrpc" | "websocket";
326
418
  timeout?: number;
327
419
  /**
328
420
  * Maximum number of automatic retries on "server not initialized" errors.
@@ -345,7 +437,7 @@ interface PerformOptions {
345
437
  tool: string;
346
438
  args: Record<string, any>;
347
439
  demux?: boolean;
348
- demuxMode?: 'strict' | 'fuzzy';
440
+ demuxMode?: "strict" | "fuzzy";
349
441
  }
350
442
  interface GuideRequestOptions {
351
443
  goal?: string;
@@ -890,6 +982,40 @@ declare class Client {
890
982
  identityDir?: string;
891
983
  substrateEndpoint?: string;
892
984
  }): Promise<Client>;
985
+ /**
986
+ * Register autonomously with DG and bootstrap an mTLS identity.
987
+ *
988
+ * The all-in-one flow: onramp (no prior credentials required) →
989
+ * OAuth token exchange → mTLS identity registration and persistence.
990
+ *
991
+ * On subsequent runs the saved mTLS identity is auto-discovered and
992
+ * no credentials are needed.
993
+ *
994
+ * @param options.opts - Onramp registration options.
995
+ * @param options.url - MCP server URL. Required if the onramp
996
+ * response does not include `mcpUrl`.
997
+ * @param options.identityDir - Custom identity storage directory.
998
+ *
999
+ * @example
1000
+ * ```ts
1001
+ * import { Client } from './client';
1002
+ * import type { OnrampOptions } from './onramp';
1003
+ *
1004
+ * const client = await Client.bootstrapOnramp({
1005
+ * opts: {
1006
+ * gateway: 'https://app.datagrout.ai',
1007
+ * agentName: 'my-research-agent',
1008
+ * agentType: 'claude-sonnet-4-6',
1009
+ * },
1010
+ * });
1011
+ * await client.connect();
1012
+ * ```
1013
+ */
1014
+ static bootstrapOnramp(options: {
1015
+ opts: OnrampOptions;
1016
+ url?: string;
1017
+ identityDir?: string;
1018
+ }): Promise<Client>;
893
1019
  /**
894
1020
  * Establish the underlying transport connection.
895
1021
  *
@@ -1381,6 +1507,6 @@ declare class InvalidConfigError extends ConduitError {
1381
1507
  * DataGrout Conduit SDK for TypeScript/JavaScript
1382
1508
  */
1383
1509
 
1384
- declare const version = "0.4.0";
1510
+ declare const version = "0.5.0";
1385
1511
 
1386
- export { type AuthConfig, AuthError, type Byok, type ChartOptions, Client, type ClientOptions, ConduitError, ConduitIdentity, type ConstrainOptions, type CreditEstimate, DEFAULT_IDENTITY_DIR, DG_CA_URL, DG_SUBSTRATE_ENDPOINT, type DiscoverOptions, type DiscoverResult, type FlowOptions, type ForgetOptions, type GuideOptions, type GuideRequestOptions, type GuideState, GuidedSession, InvalidConfigError, type Keypair, type MCPPrompt, type MCPResource, type MCPTool, type MtlsConfig, NetworkError, NotInitializedError, OAuthTokenProvider, type PerformOptions, type PerformResult, type PlanOptions, type PrismFocusOptions, type QueryCellOptions, type RateLimit, RateLimitError, type RateLimitStatus, type Receipt, type ReflectOptions, type RefractOptions, type RegisteredIdentity, type RegistrationOptions, type RememberOptions, type RenewalOptions, type RotationOptions, type SavedPaths, ServerError, Subscription, type SubscriptionEvent, type ToolInfo, type ToolMeta, SUBPROTOCOL as WS_SUBPROTOCOL, WsTransport, deriveTokenEndpoint, extractMeta, fetchDgCaCert, fetchWithIdentity, generateKeypair, isDgUrl, refreshCaCert, registerIdentity, rotateIdentity, saveIdentity, version };
1512
+ export { type AuthConfig, AuthError, type Byok, type ChartOptions, Client, type ClientOptions, ConduitError, ConduitIdentity, type ConstrainOptions, type CreditEstimate, DEFAULT_IDENTITY_DIR, DG_CA_URL, DG_SUBSTRATE_ENDPOINT, type DiscoverOptions, type DiscoverResult, type FlowOptions, type ForgetOptions, type GuideOptions, type GuideRequestOptions, type GuideState, GuidedSession, InvalidConfigError, type Keypair, type MCPPrompt, type MCPResource, type MCPTool, type MtlsConfig, NetworkError, NotInitializedError, OAuthTokenProvider, type OnrampCredentials, type OnrampOptions, type PerformOptions, type PerformResult, type PlanOptions, type PrismFocusOptions, type QueryCellOptions, type RateLimit, RateLimitError, type RateLimitStatus, type Receipt, type ReflectOptions, type RefractOptions, type RegisteredIdentity, type RegistrationOptions, type RememberOptions, type RenewalOptions, type RotationOptions, type SavedPaths, ServerError, Subscription, type SubscriptionEvent, type ToolInfo, type ToolMeta, SUBPROTOCOL as WS_SUBPROTOCOL, WsTransport, deriveTokenEndpoint, extractMeta, fetchDgCaCert, fetchWithIdentity, generateKeypair, isDgUrl, refreshCaCert, registerAndExchange, registerIdentity, registerOnly, rotateIdentity, saveIdentity, version };