@datagrout/conduit 0.4.0 → 0.6.0

package/dist/index.mjs

@@ -1,13 +1,19 @@
 import {
   OAuthTokenProvider,
-  __esm,
-  __export,
-  __require,
-  __toCommonJS,
   deriveTokenEndpoint,
   init_oauth,
   oauth_exports
-} from "./chunk-RED5DKGI.mjs";
+} from "./chunk-LW7VX5SZ.mjs";
+import {
+  registerAndExchange,
+  registerOnly
+} from "./chunk-W56N7X6V.mjs";
+import {
+  __esm,
+  __export,
+  __require,
+  __toCommonJS
+} from "./chunk-CIESM3BP.mjs";
 
 // src/identity.ts
 var identity_exports = {};
@@ -29,7 +35,9 @@ async function fetchWithIdentity(url, init, identity) {
     port: parsedUrl.port || 443,
     path: parsedUrl.pathname + parsedUrl.search,
     method: (init.method ?? "GET").toUpperCase(),
-    headers: flattenHeaders(init.headers),
+    headers: flattenHeaders(
+      init.headers
+    ),
     cert: identity.certPem,
     key: identity.keyPem,
     ...identity.caPem ? { ca: identity.caPem } : {}
@@ -113,7 +121,9 @@ var init_identity = __esm({
        */
       static fromPaths(certPath, keyPath, caPath) {
         if (typeof process === "undefined" || !process.versions?.node) {
-          throw new Error("ConduitIdentity.fromPaths() is only available in Node.js environments");
+          throw new Error(
+            "ConduitIdentity.fromPaths() is only available in Node.js environments"
+          );
         }
         const fs2 = __require("fs");
         const certPem = fs2.readFileSync(certPath, "utf8");
@@ -137,7 +147,9 @@ var init_identity = __esm({
         if (!certPem) return null;
         const keyPem = process.env.CONDUIT_MTLS_KEY;
         if (!keyPem) {
-          throw new Error("CONDUIT_MTLS_CERT is set but CONDUIT_MTLS_KEY is missing");
+          throw new Error(
+            "CONDUIT_MTLS_CERT is set but CONDUIT_MTLS_KEY is missing"
+          );
         }
         const caPem = process.env.CONDUIT_MTLS_CA || void 0;
         return _ConduitIdentity.fromPem(certPem, keyPem, caPem);
@@ -227,7 +239,11 @@ var init_identity = __esm({
           const keyPath = `${dir}/identity_key.pem`;
           if (!fs2.existsSync(certPath) || !fs2.existsSync(keyPath)) return null;
           const caPath = `${dir}/ca.pem`;
-          return _ConduitIdentity.fromPaths(certPath, keyPath, fs2.existsSync(caPath) ? caPath : void 0);
+          return _ConduitIdentity.fromPaths(
+            certPath,
+            keyPath,
+            fs2.existsSync(caPath) ? caPath : void 0
+          );
         } catch {
           return null;
         }
@@ -348,6 +364,9 @@ var MCPTransport = class extends Transport {
       throw new Error("Not connected. Call connect() first.");
     }
     const result = await this.client.callTool({ name, arguments: args });
+    if (result?.structuredContent !== void 0) {
+      return result.structuredContent;
+    }
     const content = result?.content;
     if (Array.isArray(content) && content.length > 0) {
       const first = content[0];
@@ -358,6 +377,7 @@ var MCPTransport = class extends Transport {
           return { text: first.text };
         }
       }
+      return first;
     }
     return result;
   }
@@ -454,7 +474,11 @@ var InvalidConfigError = class extends ConduitError {
 
 // src/transports/jsonrpc.ts
 function unwrapContent(result) {
-  if (result && Array.isArray(result.content) && result.content.length > 0) {
+  if (!result) return result;
+  if (result.structuredContent !== void 0) {
+    return result.structuredContent;
+  }
+  if (Array.isArray(result.content) && result.content.length > 0) {
     const first = result.content[0];
     if (first && typeof first.text === "string") {
       try {
@@ -463,6 +487,7 @@ function unwrapContent(result) {
         return { text: first.text };
       }
     }
+    return first;
   }
   return result;
 }
@@ -489,7 +514,9 @@ var JSONRPCTransport = class extends Transport {
     this.identity = identity;
     this.timeout = timeout;
     if (identity?.needsRotation(30)) {
-      console.warn("[conduit] mTLS certificate expires within 30 days \u2014 consider rotating");
+      console.warn(
+        "[conduit] mTLS certificate expires within 30 days \u2014 consider rotating"
+      );
     }
     if (auth?.clientCredentials) {
       const cc = auth.clientCredentials;
@@ -522,7 +549,9 @@ var JSONRPCTransport = class extends Transport {
     } else if (this.auth?.bearer) {
       headers["Authorization"] = `Bearer ${this.auth.bearer}`;
     } else if (this.auth?.basic) {
-      const credentials = btoa(`${this.auth.basic.username}:${this.auth.basic.password}`);
+      const credentials = btoa(
+        `${this.auth.basic.username}:${this.auth.basic.password}`
+      );
       headers["Authorization"] = `Basic ${credentials}`;
     } else if (this.auth?.custom) {
       Object.assign(headers, this.auth.custom);
@@ -661,7 +690,9 @@ var WsTransport = class extends Transport {
     super();
     const scheme = new URL(url).protocol.replace(":", "");
     if (scheme !== "ws" && scheme !== "wss") {
-      throw new Error(`WS transport requires a ws:// or wss:// URL, got ${scheme}://`);
+      throw new Error(
+        `WS transport requires a ws:// or wss:// URL, got ${scheme}://`
+      );
     }
     this._url = url;
     this._auth = auth;
@@ -676,7 +707,9 @@ var WsTransport = class extends Transport {
     });
     await new Promise((resolve, reject) => {
       ws.onopen = () => resolve();
-      ws.onerror = (ev) => reject(new Error(`WS connect failed: ${ev.message ?? "unknown"}`));
+      ws.onerror = (ev) => reject(
+        new Error(`WS connect failed: ${ev.message ?? "unknown"}`)
+      );
     });
     ws.onmessage = (ev) => this._handleMessage(ev.data);
     ws.onerror = (_ev) => this._failAll("WS connection error");
@@ -710,7 +743,12 @@ var WsTransport = class extends Transport {
     const id = this._mintId();
     return new Promise((resolve, reject) => {
       this._pendingSubscribe.set(id, { topic, resolve, reject });
-      this._send({ jsonrpc: "2.0", id, method: "subscribe", params: { topic } });
+      this._send({
+        jsonrpc: "2.0",
+        id,
+        method: "subscribe",
+        params: { topic }
+      });
     });
   }
   /**
@@ -780,7 +818,12 @@ var WsTransport = class extends Transport {
     const id = this._mintId();
     return new Promise((resolve, reject) => {
       this._pending.set(id, { resolve, reject });
-      this._send({ jsonrpc: "2.0", id, method, ...params !== void 0 ? { params } : {} });
+      this._send({
+        jsonrpc: "2.0",
+        id,
+        method,
+        ...params !== void 0 ? { params } : {}
+      });
     });
   }
   _handleMessage(data) {
@@ -792,7 +835,9 @@ var WsTransport = class extends Transport {
     }
     if (!("id" in msg)) {
       if (msg["method"] === "notification") {
-        this._routeNotification(msg["params"]);
+        this._routeNotification(
+          msg["params"]
+        );
       }
       return;
     }
@@ -802,7 +847,9 @@ var WsTransport = class extends Transport {
       this._pendingSubscribe.delete(msgId);
       const err = msg["error"];
       if (err !== void 0) {
-        pendingSub.reject(new Error(String(err["message"] ?? "Subscribe failed")));
+        pendingSub.reject(
+          new Error(String(err["message"] ?? "Subscribe failed"))
+        );
         return;
       }
       const result = msg["result"] ?? {};
@@ -859,7 +906,9 @@ function buildUpgradeHeaders(auth) {
   } else if ("apiKey" in auth && auth.apiKey !== void 0) {
     headers["X-API-Key"] = auth.apiKey;
   } else if ("basic" in auth && auth.basic !== void 0) {
-    const encoded = Buffer.from(`${auth.basic.username}:${auth.basic.password}`).toString("base64");
+    const encoded = Buffer.from(
+      `${auth.basic.username}:${auth.basic.password}`
+    ).toString("base64");
     headers["Authorization"] = `Basic ${encoded}`;
   }
   return headers;
@@ -898,7 +947,9 @@ async function fetchDgCaCert(url = DG_CA_URL) {
   }
   const pem = await resp.text();
   if (!pem.includes("-----BEGIN CERTIFICATE-----")) {
-    throw new Error(`Response from ${url} does not look like a PEM certificate`);
+    throw new Error(
+      `Response from ${url} does not look like a PEM certificate`
+    );
   }
   return pem;
 }
@@ -914,7 +965,10 @@ function generateKeypair() {
     namedCurve: "P-256"
   });
   return {
-    privateKeyPem: privateKey.export({ type: "pkcs8", format: "pem" }),
+    privateKeyPem: privateKey.export({
+      type: "pkcs8",
+      format: "pem"
+    }),
     publicKeyPem: publicKey.export({ type: "spki", format: "pem" })
   };
 }
@@ -954,9 +1008,17 @@ async function registerIdentity(keypair, opts) {
   };
 }
 async function rotateIdentity(opts) {
-  const { privateKey, publicKey } = crypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
-  const publicKeyPem = publicKey.export({ type: "spki", format: "pem" });
-  const privateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" });
+  const { privateKey, publicKey } = crypto.generateKeyPairSync("ec", {
+    namedCurve: "P-256"
+  });
+  const publicKeyPem = publicKey.export({
+    type: "spki",
+    format: "pem"
+  });
+  const privateKeyPem = privateKey.export({
+    type: "pkcs8",
+    format: "pem"
+  });
   const url = opts.endpoint.replace(/\/$/, "") + "/rotate";
   const https = await import("https");
   const urlModule = await import("url");
@@ -971,7 +1033,10 @@ async function rotateIdentity(opts) {
       cert: opts.currentCertPem,
       key: opts.currentKeyPem
     };
-    const body = JSON.stringify({ public_key_pem: publicKeyPem, name: opts.name });
+    const body = JSON.stringify({
+      public_key_pem: publicKeyPem,
+      name: opts.name
+    });
     const req = https.request(reqOptions, (res) => {
       let data = "";
       res.on("data", (chunk) => {
@@ -981,7 +1046,9 @@ async function rotateIdentity(opts) {
         if (res.statusCode && res.statusCode >= 200 && res.statusCode < 300) {
           resolve(data);
         } else {
-          reject(new Error(`Rotation failed (HTTP ${res.statusCode}): ${data}`));
+          reject(
+            new Error(`Rotation failed (HTTP ${res.statusCode}): ${data}`)
+          );
         }
       });
     });
@@ -1081,8 +1148,12 @@ var PrismNamespace = class {
       data: options.data,
       source_type: options.sourceType,
       target_type: options.targetType,
-      ...options.sourceAnnotations && { source_annotations: options.sourceAnnotations },
-      ...options.targetAnnotations && { target_annotations: options.targetAnnotations },
+      ...options.sourceAnnotations && {
+        source_annotations: options.sourceAnnotations
+      },
+      ...options.targetAnnotations && {
+        target_annotations: options.targetAnnotations
+      },
       ...options.context && { context: options.context }
     };
     return this.callDg("prism.focus", params);
@@ -1107,7 +1178,9 @@ var LogicNamespace = class {
       statement = opts.statement;
     }
     if (!statement && !opts?.facts?.length) {
-      throw new InvalidConfigError("remember() requires either a statement or facts");
+      throw new InvalidConfigError(
+        "remember() requires either a statement or facts"
+      );
     }
     const params = { tag: opts?.tag ?? "default" };
     if (opts?.facts) {
@@ -1128,7 +1201,9 @@ var LogicNamespace = class {
       question = opts.question;
     }
     if (!question && !opts?.patterns?.length) {
-      throw new InvalidConfigError("query() requires either a question or patterns");
+      throw new InvalidConfigError(
+        "query() requires either a question or patterns"
+      );
     }
     const params = { limit: opts?.limit ?? 50 };
     if (opts?.patterns) {
@@ -1141,7 +1216,9 @@ var LogicNamespace = class {
   /** Retract facts from the logic cell (`data-grout/logic.forget`). */
   async forget(options) {
     if (!options.handles?.length && !options.pattern) {
-      throw new InvalidConfigError("forget() requires either handles or pattern");
+      throw new InvalidConfigError(
+        "forget() requires either handles or pattern"
+      );
     }
     const params = {};
     if (options.handles) params.handles = options.handles;
@@ -1150,13 +1227,18 @@ var LogicNamespace = class {
   }
   /** Reflect on the logic cell (`data-grout/logic.reflect`). */
   async reflect(options) {
-    const params = { summary_only: options?.summaryOnly ?? false };
+    const params = {
+      summary_only: options?.summaryOnly ?? false
+    };
     if (options?.entity) params.entity = options.entity;
     return this.callDg("logic.reflect", params);
   }
   /** Add a constraint rule (`data-grout/logic.constrain`). */
   async constrain(rule, options) {
-    const params = { rule, tag: options?.tag ?? "constraint" };
+    const params = {
+      rule,
+      tag: options?.tag ?? "constraint"
+    };
     return this.callDg("logic.constrain", params);
   }
   /** Hydrate the logic cell from external data (`data-grout/logic.hydrate`). */
@@ -1318,7 +1400,9 @@ var FlowNamespace = class {
   /** Get details for a specific execution (`data-grout/inspect.execution-details`). */
   async details(executionId) {
     this.warn("inspect.execution-details");
-    return this.callDg("inspect.execution-details", { execution_id: executionId });
+    return this.callDg("inspect.execution-details", {
+      execution_id: executionId
+    });
   }
 };
 
@@ -1398,10 +1482,7 @@ var Client2 = class _Client {
     this.isDg = isDgUrl(this.url);
     this.useIntelligentInterface = options.useIntelligentInterface ?? this.isDg;
     this.maxRetries = options.maxRetries ?? 3;
-    let identity = options.identity ?? (options.identityAuto ? ConduitIdentity.tryDiscover(options.identityDir) ?? void 0 : void 0);
-    if (identity === void 0 && this.isDg && !options.disableMtls) {
-      identity = ConduitIdentity.tryDiscover(options.identityDir) ?? void 0;
-    }
+    const identity = options.identity ?? (options.identityAuto ? ConduitIdentity.tryDiscover(options.identityDir) ?? void 0 : void 0);
     const transportType = options.transport || "mcp";
     if (transportType === "mcp") {
       this.transport = new MCPTransport(this.url, this.auth, identity);
@@ -1409,10 +1490,20 @@ var Client2 = class _Client {
       let wsUrl = this.url;
       if (wsUrl.startsWith("https://")) wsUrl = "wss://" + wsUrl.slice(8);
       else if (wsUrl.startsWith("http://")) wsUrl = "ws://" + wsUrl.slice(7);
-      this.transport = new WsTransport(wsUrl, this.auth, options.timeout, identity);
+      this.transport = new WsTransport(
+        wsUrl,
+        this.auth,
+        options.timeout,
+        identity
+      );
     } else {
       const rpcUrl = this.url.endsWith("/mcp") ? this.url.slice(0, -4) + "/rpc" : this.url;
-      this.transport = new JSONRPCTransport(rpcUrl, this.auth, options.timeout, identity);
+      this.transport = new JSONRPCTransport(
+        rpcUrl,
+        this.auth,
+        options.timeout,
+        identity
+      );
     }
   }
   // ===== Bootstrap / seamless mTLS =====
@@ -1470,7 +1561,7 @@ var Client2 = class _Client {
    * @param options.substrateEndpoint - Override the DG Substrate endpoint.
    */
   static async bootstrapIdentityOAuth(options) {
-    const { OAuthTokenProvider: OAuthTokenProvider2, deriveTokenEndpoint: deriveTokenEndpoint2 } = await import("./oauth-OMPWCI2X.mjs");
+    const { OAuthTokenProvider: OAuthTokenProvider2, deriveTokenEndpoint: deriveTokenEndpoint2 } = await import("./oauth-T2D3EDCN.mjs");
     const tokenEndpoint = deriveTokenEndpoint2(options.url);
     const provider = new OAuthTokenProvider2({
       clientId: options.clientId,
@@ -1486,6 +1577,66 @@ var Client2 = class _Client {
       substrateEndpoint: options.substrateEndpoint
     });
   }
+  /**
+   * Register autonomously with DG and bootstrap an mTLS identity.
+   *
+   * The all-in-one flow: onramp (no prior credentials required) →
+   * OAuth token exchange → mTLS identity registration and persistence.
+   *
+   * On subsequent runs the saved mTLS identity is auto-discovered and
+   * no credentials are needed.
+   *
+   * @param options.opts         - Onramp registration options.
+   * @param options.url          - MCP server URL. Required if the onramp
+   *                               response does not include `mcpUrl`.
+   * @param options.identityDir  - Custom identity storage directory.
+   *
+   * @example
+   * ```ts
+   * import { Client } from './client';
+   * import type { OnrampOptions } from './onramp';
+   *
+   * const client = await Client.bootstrapOnramp({
+   *   opts: {
+   *     gateway: 'https://app.datagrout.ai',
+   *     agentName: 'my-research-agent',
+   *     agentType: 'claude-sonnet-4-6',
+   *   },
+   * });
+   * await client.connect();
+   * ```
+   */
+  static async bootstrapOnramp(options) {
+    const { _doRegister, _exchangeToken } = await import("./onramp-RDGV3FOI.mjs");
+    const dir = options.identityDir || DEFAULT_IDENTITY_DIR;
+    const existing = ConduitIdentity.tryDiscover(dir);
+    if (existing && !existing.needsRotation(7)) {
+      if (!options.url) {
+        throw new Error(
+          "'url' must be provided when an existing identity is reused"
+        );
+      }
+      return new _Client({
+        url: options.url,
+        identity: existing,
+        identityDir: dir
+      });
+    }
+    const creds = await _doRegister(options.opts);
+    const token = await _exchangeToken(creds);
+    const url = creds.mcpUrl ?? options.url;
+    if (!url) {
+      throw new Error(
+        "'url' must be provided when mcpUrl is absent from the onramp response"
+      );
+    }
+    return _Client.bootstrapIdentity({
+      url,
+      authToken: token,
+      name: options.opts.agentName,
+      identityDir: options.identityDir
+    });
+  }
   // ===== Lifecycle =====
   /**
    * Establish the underlying transport connection.
@@ -1537,7 +1688,9 @@ var Client2 = class _Client {
   // ===== Namespace Accessors =====
   callDgTool = async (tool, params) => {
     this.ensureInitialized();
-    return this.sendWithRetry(() => this.transport.callTool(`data-grout/${tool}`, params));
+    return this.sendWithRetry(
+      () => this.transport.callTool(`data-grout/${tool}`, params)
+    );
   };
   /** Data transformation, charting, rendering, and type bridging. */
   get prism() {
@@ -1553,7 +1706,10 @@ var Client2 = class _Client {
   }
   /** Work product registration, listing, and retrieval. */
   get deliverables() {
-    return new DeliverablesNamespace(this.callDgTool, (m) => this.warnIfNotDg(m));
+    return new DeliverablesNamespace(
+      this.callDgTool,
+      (m) => this.warnIfNotDg(m)
+    );
   }
   /** Cache listing and inspection. */
   get ephemerals() {
@@ -1642,7 +1798,9 @@ var Client2 = class _Client {
    */
   async getPrompt(name, args, options) {
     this.ensureInitialized();
-    return this.sendWithRetry(() => this.transport.getPrompt(name, args, options));
+    return this.sendWithRetry(
+      () => this.transport.getPrompt(name, args, options)
+    );
   }
   // ===== WebSocket push subscriptions =====
   /**
@@ -1743,7 +1901,7 @@ var Client2 = class _Client {
         outputSchema: r.output_contract || r.output_schema || r.outputSchema
       })),
       total: result.total ?? tools.length,
-      limit: result.limit ?? (options.limit ?? 10)
+      limit: result.limit ?? options.limit ?? 10
     };
   }
   /**
@@ -1859,8 +2017,10 @@ var Client2 = class _Client {
     if (options.k !== void 0) params.k = options.k;
     if (options.policy) params.policy = options.policy;
     if (options.have) params.have = options.have;
-    if (options.returnCallHandles !== void 0) params.return_call_handles = options.returnCallHandles;
-    if (options.exposeVirtualSkills !== void 0) params.expose_virtual_skills = options.exposeVirtualSkills;
+    if (options.returnCallHandles !== void 0)
+      params.return_call_handles = options.returnCallHandles;
+    if (options.exposeVirtualSkills !== void 0)
+      params.expose_virtual_skills = options.exposeVirtualSkills;
     if (options.modelOverrides) params.model_overrides = options.modelOverrides;
     return this.sendWithRetry(
       () => this.transport.callTool("data-grout/discovery.plan", params)
@@ -1978,7 +2138,7 @@ function buildToolMeta(raw) {
 }
 
 // src/index.ts
-var version = "0.4.0";
+var version = "0.5.0";
 export {
   AuthError,
   Client2 as Client,
@@ -2003,7 +2163,9 @@ export {
   generateKeypair,
   isDgUrl,
   refreshCaCert,
+  registerAndExchange,
   registerIdentity,
+  registerOnly,
   rotateIdentity,
   saveIdentity,
   version

package/dist/{oauth-OMPWCI2X.mjs → oauth-T2D3EDCN.mjs}

@@ -2,7 +2,8 @@ import {
   OAuthTokenProvider,
   deriveTokenEndpoint,
   init_oauth
-} from "./chunk-RED5DKGI.mjs";
+} from "./chunk-LW7VX5SZ.mjs";
+import "./chunk-CIESM3BP.mjs";
 init_oauth();
 export {
   OAuthTokenProvider,

package/dist/onramp-RDGV3FOI.mjs

@@ -0,0 +1,13 @@
+import {
+  _doRegister,
+  _exchangeToken,
+  registerAndExchange,
+  registerOnly
+} from "./chunk-W56N7X6V.mjs";
+import "./chunk-CIESM3BP.mjs";
+export {
+  _doRegister,
+  _exchangeToken,
+  registerAndExchange,
+  registerOnly
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datagrout/conduit",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Production-ready MCP client with mTLS, OAuth 2.1, and semantic discovery",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",