@datagrout/conduit 0.4.0 → 0.6.0

package/dist/index.js

@@ -101,7 +101,9 @@ var init_oauth = __esm({
         }
         if (!response.ok) {
           const text = await response.text().catch(() => "");
-          throw new Error(`OAuth token endpoint returned ${response.status}: ${text}`);
+          throw new Error(
+            `OAuth token endpoint returned ${response.status}: ${text}`
+          );
         }
         const data = await response.json();
         const expiresIn = data.expires_in ?? 3600;
@@ -136,7 +138,9 @@ async function fetchWithIdentity(url, init, identity) {
     port: parsedUrl.port || 443,
     path: parsedUrl.pathname + parsedUrl.search,
     method: (init.method ?? "GET").toUpperCase(),
-    headers: flattenHeaders(init.headers),
+    headers: flattenHeaders(
+      init.headers
+    ),
     cert: identity.certPem,
     key: identity.keyPem,
     ...identity.caPem ? { ca: identity.caPem } : {}
@@ -220,7 +224,9 @@ var init_identity = __esm({
        */
       static fromPaths(certPath, keyPath, caPath) {
         if (typeof process === "undefined" || !process.versions?.node) {
-          throw new Error("ConduitIdentity.fromPaths() is only available in Node.js environments");
+          throw new Error(
+            "ConduitIdentity.fromPaths() is only available in Node.js environments"
+          );
         }
         const fs2 = require("fs");
         const certPem = fs2.readFileSync(certPath, "utf8");
@@ -244,7 +250,9 @@ var init_identity = __esm({
         if (!certPem) return null;
         const keyPem = process.env.CONDUIT_MTLS_KEY;
         if (!keyPem) {
-          throw new Error("CONDUIT_MTLS_CERT is set but CONDUIT_MTLS_KEY is missing");
+          throw new Error(
+            "CONDUIT_MTLS_CERT is set but CONDUIT_MTLS_KEY is missing"
+          );
         }
         const caPem = process.env.CONDUIT_MTLS_CA || void 0;
         return _ConduitIdentity.fromPem(certPem, keyPem, caPem);
@@ -334,7 +342,11 @@ var init_identity = __esm({
           const keyPath = `${dir}/identity_key.pem`;
           if (!fs2.existsSync(certPath) || !fs2.existsSync(keyPath)) return null;
           const caPath = `${dir}/ca.pem`;
-          return _ConduitIdentity.fromPaths(certPath, keyPath, fs2.existsSync(caPath) ? caPath : void 0);
+          return _ConduitIdentity.fromPaths(
+            certPath,
+            keyPath,
+            fs2.existsSync(caPath) ? caPath : void 0
+          );
         } catch {
           return null;
         }
@@ -343,6 +355,83 @@ var init_identity = __esm({
   }
 });
 
+// src/onramp.ts
+var onramp_exports = {};
+__export(onramp_exports, {
+  _doRegister: () => _doRegister,
+  _exchangeToken: () => _exchangeToken,
+  registerAndExchange: () => registerAndExchange,
+  registerOnly: () => registerOnly
+});
+async function _doRegister(opts) {
+  const base = opts.gateway.replace(/\/$/, "");
+  const body = { agent_name: opts.agentName };
+  if (opts.agentType) body["agent_type"] = opts.agentType;
+  if (opts.intendedUse) body["intended_use"] = opts.intendedUse;
+  if (opts.accessCode) body["access_code"] = opts.accessCode;
+  const initResp = await fetch(`${base}/onramp`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!initResp.ok) {
+    const text = await initResp.text();
+    throw new Error(`onramp init rejected (HTTP ${initResp.status}): ${text}`);
+  }
+  const initData = await initResp.json();
+  const sessionToken = initData.session_token;
+  const completeResp = await fetch(`${base}/onramp/complete`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${sessionToken}` }
+  });
+  if (!completeResp.ok) {
+    const text = await completeResp.text();
+    throw new Error(
+      `onramp complete rejected (HTTP ${completeResp.status}): ${text}`
+    );
+  }
+  const data = await completeResp.json();
+  return {
+    clientId: data["client_id"],
+    clientSecret: data["client_secret"],
+    tokenUrl: data["token_url"],
+    scopes: data["scopes"] ?? [],
+    expiresIn: data["expires_in"] ?? 0,
+    rpcUrl: data["rpc_url"],
+    mcpUrl: data["mcp_url"]
+  };
+}
+async function _exchangeToken(creds) {
+  const body = new URLSearchParams({
+    grant_type: "client_credentials",
+    client_id: creds.clientId,
+    client_secret: creds.clientSecret
+  });
+  const resp = await fetch(creds.tokenUrl, {
+    method: "POST",
+    body
+  });
+  if (!resp.ok) {
+    const text = await resp.text();
+    throw new Error(`token exchange failed (HTTP ${resp.status}): ${text}`);
+  }
+  const data = await resp.json();
+  return data.access_token;
+}
+async function registerOnly(opts) {
+  return _doRegister(opts);
+}
+async function registerAndExchange(opts) {
+  const creds = await _doRegister(opts);
+  const token = await _exchangeToken(creds);
+  return [creds, token];
+}
+var init_onramp = __esm({
+  "src/onramp.ts"() {
+    "use strict";
+  }
+});
+
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
@@ -369,7 +458,9 @@ __export(index_exports, {
   generateKeypair: () => generateKeypair,
   isDgUrl: () => isDgUrl,
   refreshCaCert: () => refreshCaCert,
+  registerAndExchange: () => registerAndExchange,
   registerIdentity: () => registerIdentity,
+  registerOnly: () => registerOnly,
   rotateIdentity: () => rotateIdentity,
   saveIdentity: () => saveIdentity,
   version: () => version
@@ -488,6 +579,9 @@ var MCPTransport = class extends Transport {
       throw new Error("Not connected. Call connect() first.");
     }
     const result = await this.client.callTool({ name, arguments: args });
+    if (result?.structuredContent !== void 0) {
+      return result.structuredContent;
+    }
     const content = result?.content;
     if (Array.isArray(content) && content.length > 0) {
       const first = content[0];
@@ -498,6 +592,7 @@ var MCPTransport = class extends Transport {
           return { text: first.text };
         }
       }
+      return first;
     }
     return result;
   }
@@ -594,7 +689,11 @@ var InvalidConfigError = class extends ConduitError {
 
 // src/transports/jsonrpc.ts
 function unwrapContent(result) {
-  if (result && Array.isArray(result.content) && result.content.length > 0) {
+  if (!result) return result;
+  if (result.structuredContent !== void 0) {
+    return result.structuredContent;
+  }
+  if (Array.isArray(result.content) && result.content.length > 0) {
     const first = result.content[0];
     if (first && typeof first.text === "string") {
       try {
@@ -603,6 +702,7 @@ function unwrapContent(result) {
         return { text: first.text };
       }
     }
+    return first;
   }
   return result;
 }
@@ -629,7 +729,9 @@ var JSONRPCTransport = class extends Transport {
     this.identity = identity;
     this.timeout = timeout;
     if (identity?.needsRotation(30)) {
-      console.warn("[conduit] mTLS certificate expires within 30 days \u2014 consider rotating");
+      console.warn(
+        "[conduit] mTLS certificate expires within 30 days \u2014 consider rotating"
+      );
     }
     if (auth?.clientCredentials) {
       const cc = auth.clientCredentials;
@@ -662,7 +764,9 @@ var JSONRPCTransport = class extends Transport {
     } else if (this.auth?.bearer) {
       headers["Authorization"] = `Bearer ${this.auth.bearer}`;
     } else if (this.auth?.basic) {
-      const credentials = btoa(`${this.auth.basic.username}:${this.auth.basic.password}`);
+      const credentials = btoa(
+        `${this.auth.basic.username}:${this.auth.basic.password}`
+      );
       headers["Authorization"] = `Basic ${credentials}`;
     } else if (this.auth?.custom) {
       Object.assign(headers, this.auth.custom);
@@ -801,7 +905,9 @@ var WsTransport = class extends Transport {
     super();
     const scheme = new URL(url).protocol.replace(":", "");
     if (scheme !== "ws" && scheme !== "wss") {
-      throw new Error(`WS transport requires a ws:// or wss:// URL, got ${scheme}://`);
+      throw new Error(
+        `WS transport requires a ws:// or wss:// URL, got ${scheme}://`
+      );
     }
     this._url = url;
     this._auth = auth;
@@ -816,7 +922,9 @@ var WsTransport = class extends Transport {
     });
     await new Promise((resolve, reject) => {
       ws.onopen = () => resolve();
-      ws.onerror = (ev) => reject(new Error(`WS connect failed: ${ev.message ?? "unknown"}`));
+      ws.onerror = (ev) => reject(
+        new Error(`WS connect failed: ${ev.message ?? "unknown"}`)
+      );
     });
     ws.onmessage = (ev) => this._handleMessage(ev.data);
     ws.onerror = (_ev) => this._failAll("WS connection error");
@@ -850,7 +958,12 @@ var WsTransport = class extends Transport {
     const id = this._mintId();
     return new Promise((resolve, reject) => {
       this._pendingSubscribe.set(id, { topic, resolve, reject });
-      this._send({ jsonrpc: "2.0", id, method: "subscribe", params: { topic } });
+      this._send({
+        jsonrpc: "2.0",
+        id,
+        method: "subscribe",
+        params: { topic }
+      });
     });
   }
   /**
@@ -920,7 +1033,12 @@ var WsTransport = class extends Transport {
     const id = this._mintId();
     return new Promise((resolve, reject) => {
       this._pending.set(id, { resolve, reject });
-      this._send({ jsonrpc: "2.0", id, method, ...params !== void 0 ? { params } : {} });
+      this._send({
+        jsonrpc: "2.0",
+        id,
+        method,
+        ...params !== void 0 ? { params } : {}
+      });
     });
   }
   _handleMessage(data) {
@@ -932,7 +1050,9 @@ var WsTransport = class extends Transport {
     }
     if (!("id" in msg)) {
       if (msg["method"] === "notification") {
-        this._routeNotification(msg["params"]);
+        this._routeNotification(
+          msg["params"]
+        );
       }
       return;
     }
@@ -942,7 +1062,9 @@ var WsTransport = class extends Transport {
       this._pendingSubscribe.delete(msgId);
       const err = msg["error"];
       if (err !== void 0) {
-        pendingSub.reject(new Error(String(err["message"] ?? "Subscribe failed")));
+        pendingSub.reject(
+          new Error(String(err["message"] ?? "Subscribe failed"))
+        );
         return;
       }
       const result = msg["result"] ?? {};
@@ -999,7 +1121,9 @@ function buildUpgradeHeaders(auth) {
   } else if ("apiKey" in auth && auth.apiKey !== void 0) {
     headers["X-API-Key"] = auth.apiKey;
   } else if ("basic" in auth && auth.basic !== void 0) {
-    const encoded = Buffer.from(`${auth.basic.username}:${auth.basic.password}`).toString("base64");
+    const encoded = Buffer.from(
+      `${auth.basic.username}:${auth.basic.password}`
+    ).toString("base64");
     headers["Authorization"] = `Basic ${encoded}`;
   }
   return headers;
@@ -1038,7 +1162,9 @@ async function fetchDgCaCert(url = DG_CA_URL) {
   }
   const pem = await resp.text();
   if (!pem.includes("-----BEGIN CERTIFICATE-----")) {
-    throw new Error(`Response from ${url} does not look like a PEM certificate`);
+    throw new Error(
+      `Response from ${url} does not look like a PEM certificate`
+    );
   }
   return pem;
 }
@@ -1054,7 +1180,10 @@ function generateKeypair() {
     namedCurve: "P-256"
   });
   return {
-    privateKeyPem: privateKey.export({ type: "pkcs8", format: "pem" }),
+    privateKeyPem: privateKey.export({
+      type: "pkcs8",
+      format: "pem"
+    }),
     publicKeyPem: publicKey.export({ type: "spki", format: "pem" })
   };
 }
@@ -1094,9 +1223,17 @@ async function registerIdentity(keypair, opts) {
   };
 }
 async function rotateIdentity(opts) {
-  const { privateKey, publicKey } = crypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
-  const publicKeyPem = publicKey.export({ type: "spki", format: "pem" });
-  const privateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" });
+  const { privateKey, publicKey } = crypto.generateKeyPairSync("ec", {
+    namedCurve: "P-256"
+  });
+  const publicKeyPem = publicKey.export({
+    type: "spki",
+    format: "pem"
+  });
+  const privateKeyPem = privateKey.export({
+    type: "pkcs8",
+    format: "pem"
+  });
   const url = opts.endpoint.replace(/\/$/, "") + "/rotate";
   const https = await import("https");
   const urlModule = await import("url");
@@ -1111,7 +1248,10 @@ async function rotateIdentity(opts) {
       cert: opts.currentCertPem,
       key: opts.currentKeyPem
     };
-    const body = JSON.stringify({ public_key_pem: publicKeyPem, name: opts.name });
+    const body = JSON.stringify({
+      public_key_pem: publicKeyPem,
+      name: opts.name
+    });
     const req = https.request(reqOptions, (res) => {
       let data = "";
       res.on("data", (chunk) => {
@@ -1121,7 +1261,9 @@ async function rotateIdentity(opts) {
         if (res.statusCode && res.statusCode >= 200 && res.statusCode < 300) {
           resolve(data);
         } else {
-          reject(new Error(`Rotation failed (HTTP ${res.statusCode}): ${data}`));
+          reject(
+            new Error(`Rotation failed (HTTP ${res.statusCode}): ${data}`)
+          );
         }
       });
     });
@@ -1221,8 +1363,12 @@ var PrismNamespace = class {
       data: options.data,
       source_type: options.sourceType,
       target_type: options.targetType,
-      ...options.sourceAnnotations && { source_annotations: options.sourceAnnotations },
-      ...options.targetAnnotations && { target_annotations: options.targetAnnotations },
+      ...options.sourceAnnotations && {
+        source_annotations: options.sourceAnnotations
+      },
+      ...options.targetAnnotations && {
+        target_annotations: options.targetAnnotations
+      },
       ...options.context && { context: options.context }
     };
     return this.callDg("prism.focus", params);
@@ -1247,7 +1393,9 @@ var LogicNamespace = class {
       statement = opts.statement;
     }
     if (!statement && !opts?.facts?.length) {
-      throw new InvalidConfigError("remember() requires either a statement or facts");
+      throw new InvalidConfigError(
+        "remember() requires either a statement or facts"
+      );
     }
     const params = { tag: opts?.tag ?? "default" };
     if (opts?.facts) {
@@ -1268,7 +1416,9 @@ var LogicNamespace = class {
       question = opts.question;
     }
     if (!question && !opts?.patterns?.length) {
-      throw new InvalidConfigError("query() requires either a question or patterns");
+      throw new InvalidConfigError(
+        "query() requires either a question or patterns"
+      );
     }
     const params = { limit: opts?.limit ?? 50 };
     if (opts?.patterns) {
@@ -1281,7 +1431,9 @@ var LogicNamespace = class {
   /** Retract facts from the logic cell (`data-grout/logic.forget`). */
   async forget(options) {
     if (!options.handles?.length && !options.pattern) {
-      throw new InvalidConfigError("forget() requires either handles or pattern");
+      throw new InvalidConfigError(
+        "forget() requires either handles or pattern"
+      );
     }
     const params = {};
     if (options.handles) params.handles = options.handles;
@@ -1290,13 +1442,18 @@ var LogicNamespace = class {
   }
   /** Reflect on the logic cell (`data-grout/logic.reflect`). */
   async reflect(options) {
-    const params = { summary_only: options?.summaryOnly ?? false };
+    const params = {
+      summary_only: options?.summaryOnly ?? false
+    };
     if (options?.entity) params.entity = options.entity;
     return this.callDg("logic.reflect", params);
   }
   /** Add a constraint rule (`data-grout/logic.constrain`). */
   async constrain(rule, options) {
-    const params = { rule, tag: options?.tag ?? "constraint" };
+    const params = {
+      rule,
+      tag: options?.tag ?? "constraint"
+    };
     return this.callDg("logic.constrain", params);
   }
   /** Hydrate the logic cell from external data (`data-grout/logic.hydrate`). */
@@ -1458,7 +1615,9 @@ var FlowNamespace = class {
   /** Get details for a specific execution (`data-grout/inspect.execution-details`). */
   async details(executionId) {
     this.warn("inspect.execution-details");
-    return this.callDg("inspect.execution-details", { execution_id: executionId });
+    return this.callDg("inspect.execution-details", {
+      execution_id: executionId
+    });
   }
 };
 
@@ -1538,10 +1697,7 @@ var Client2 = class _Client {
     this.isDg = isDgUrl(this.url);
     this.useIntelligentInterface = options.useIntelligentInterface ?? this.isDg;
     this.maxRetries = options.maxRetries ?? 3;
-    let identity = options.identity ?? (options.identityAuto ? ConduitIdentity.tryDiscover(options.identityDir) ?? void 0 : void 0);
-    if (identity === void 0 && this.isDg && !options.disableMtls) {
-      identity = ConduitIdentity.tryDiscover(options.identityDir) ?? void 0;
-    }
+    const identity = options.identity ?? (options.identityAuto ? ConduitIdentity.tryDiscover(options.identityDir) ?? void 0 : void 0);
     const transportType = options.transport || "mcp";
     if (transportType === "mcp") {
       this.transport = new MCPTransport(this.url, this.auth, identity);
@@ -1549,10 +1705,20 @@ var Client2 = class _Client {
       let wsUrl = this.url;
       if (wsUrl.startsWith("https://")) wsUrl = "wss://" + wsUrl.slice(8);
       else if (wsUrl.startsWith("http://")) wsUrl = "ws://" + wsUrl.slice(7);
-      this.transport = new WsTransport(wsUrl, this.auth, options.timeout, identity);
+      this.transport = new WsTransport(
+        wsUrl,
+        this.auth,
+        options.timeout,
+        identity
+      );
     } else {
       const rpcUrl = this.url.endsWith("/mcp") ? this.url.slice(0, -4) + "/rpc" : this.url;
-      this.transport = new JSONRPCTransport(rpcUrl, this.auth, options.timeout, identity);
+      this.transport = new JSONRPCTransport(
+        rpcUrl,
+        this.auth,
+        options.timeout,
+        identity
+      );
     }
   }
   // ===== Bootstrap / seamless mTLS =====
@@ -1626,6 +1792,66 @@ var Client2 = class _Client {
       substrateEndpoint: options.substrateEndpoint
     });
   }
+  /**
+   * Register autonomously with DG and bootstrap an mTLS identity.
+   *
+   * The all-in-one flow: onramp (no prior credentials required) →
+   * OAuth token exchange → mTLS identity registration and persistence.
+   *
+   * On subsequent runs the saved mTLS identity is auto-discovered and
+   * no credentials are needed.
+   *
+   * @param options.opts         - Onramp registration options.
+   * @param options.url          - MCP server URL. Required if the onramp
+   *                               response does not include `mcpUrl`.
+   * @param options.identityDir  - Custom identity storage directory.
+   *
+   * @example
+   * ```ts
+   * import { Client } from './client';
+   * import type { OnrampOptions } from './onramp';
+   *
+   * const client = await Client.bootstrapOnramp({
+   *   opts: {
+   *     gateway: 'https://app.datagrout.ai',
+   *     agentName: 'my-research-agent',
+   *     agentType: 'claude-sonnet-4-6',
+   *   },
+   * });
+   * await client.connect();
+   * ```
+   */
+  static async bootstrapOnramp(options) {
+    const { _doRegister: _doRegister2, _exchangeToken: _exchangeToken2 } = await Promise.resolve().then(() => (init_onramp(), onramp_exports));
+    const dir = options.identityDir || DEFAULT_IDENTITY_DIR;
+    const existing = ConduitIdentity.tryDiscover(dir);
+    if (existing && !existing.needsRotation(7)) {
+      if (!options.url) {
+        throw new Error(
+          "'url' must be provided when an existing identity is reused"
+        );
+      }
+      return new _Client({
+        url: options.url,
+        identity: existing,
+        identityDir: dir
+      });
+    }
+    const creds = await _doRegister2(options.opts);
+    const token = await _exchangeToken2(creds);
+    const url = creds.mcpUrl ?? options.url;
+    if (!url) {
+      throw new Error(
+        "'url' must be provided when mcpUrl is absent from the onramp response"
+      );
+    }
+    return _Client.bootstrapIdentity({
+      url,
+      authToken: token,
+      name: options.opts.agentName,
+      identityDir: options.identityDir
+    });
+  }
   // ===== Lifecycle =====
   /**
    * Establish the underlying transport connection.
@@ -1677,7 +1903,9 @@ var Client2 = class _Client {
   // ===== Namespace Accessors =====
   callDgTool = async (tool, params) => {
     this.ensureInitialized();
-    return this.sendWithRetry(() => this.transport.callTool(`data-grout/${tool}`, params));
+    return this.sendWithRetry(
+      () => this.transport.callTool(`data-grout/${tool}`, params)
+    );
   };
   /** Data transformation, charting, rendering, and type bridging. */
   get prism() {
@@ -1693,7 +1921,10 @@ var Client2 = class _Client {
   }
   /** Work product registration, listing, and retrieval. */
   get deliverables() {
-    return new DeliverablesNamespace(this.callDgTool, (m) => this.warnIfNotDg(m));
+    return new DeliverablesNamespace(
+      this.callDgTool,
+      (m) => this.warnIfNotDg(m)
+    );
   }
   /** Cache listing and inspection. */
   get ephemerals() {
@@ -1782,7 +2013,9 @@ var Client2 = class _Client {
    */
   async getPrompt(name, args, options) {
     this.ensureInitialized();
-    return this.sendWithRetry(() => this.transport.getPrompt(name, args, options));
+    return this.sendWithRetry(
+      () => this.transport.getPrompt(name, args, options)
+    );
   }
   // ===== WebSocket push subscriptions =====
   /**
@@ -1883,7 +2116,7 @@ var Client2 = class _Client {
         outputSchema: r.output_contract || r.output_schema || r.outputSchema
       })),
       total: result.total ?? tools.length,
-      limit: result.limit ?? (options.limit ?? 10)
+      limit: result.limit ?? options.limit ?? 10
     };
   }
   /**
@@ -1999,8 +2232,10 @@ var Client2 = class _Client {
     if (options.k !== void 0) params.k = options.k;
     if (options.policy) params.policy = options.policy;
     if (options.have) params.have = options.have;
-    if (options.returnCallHandles !== void 0) params.return_call_handles = options.returnCallHandles;
-    if (options.exposeVirtualSkills !== void 0) params.expose_virtual_skills = options.exposeVirtualSkills;
+    if (options.returnCallHandles !== void 0)
+      params.return_call_handles = options.returnCallHandles;
+    if (options.exposeVirtualSkills !== void 0)
+      params.expose_virtual_skills = options.exposeVirtualSkills;
     if (options.modelOverrides) params.model_overrides = options.modelOverrides;
     return this.sendWithRetry(
       () => this.transport.callTool("data-grout/discovery.plan", params)
@@ -2118,7 +2353,8 @@ function buildToolMeta(raw) {
 }
 
 // src/index.ts
-var version = "0.4.0";
+init_onramp();
+var version = "0.5.0";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuthError,
@@ -2144,7 +2380,9 @@ var version = "0.4.0";
   generateKeypair,
   isDgUrl,
   refreshCaCert,
+  registerAndExchange,
   registerIdentity,
+  registerOnly,
   rotateIdentity,
   saveIdentity,
   version