ailogger-client-dev 0.1.51__py3-none-any.whl

ailogger_client/__init__.py

@@ -0,0 +1,96 @@
+"""
+ailogger service client.
+
+This package provides the client for the ai-logger service, distributed and
+installed independently of the service itself. It is a wrapper around the
+adapter framework's ``JsonRpcClient`` (from ``mcp_proxy_adapter.client.jsonrpc_client``)
+and adds only the dialogue vocabulary of the ai-logger service: the command
+methods, the generic call surface and the typed error vocabulary.
+
+The wrapper is constructed from a named section of the consuming process's
+configuration document - the same sectioned shape every fleet client in the
+ai-logger fleet uses: a top-level ``protocol``, a ``server`` sub-section
+carrying host and port, a ``client`` sub-section that may carry ssl material
+overriding the server's own, a top-level ``ssl`` sub-section used as a
+fallback, and an ``auth`` sub-section carrying a token and the header it
+travels in.
+
+Transport, request serialization, response parsing, retries, job tracking,
+queue operations, file transfer with integrity checking and connection
+management all belong to the adapter framework's client: this package wraps
+that client and adds only the dialogue vocabulary on top.
+
+A-009 SECTION: Published Surface
+
+The package's public surface is declared explicitly by ``__all__`` and holds
+the client class, the construction entry points, and the complete typed error
+vocabulary. A caller that wants to catch everything this client can raise
+catches the single base kind (``AiLoggerClientError``), and every specific kind
+is reachable from the package root. This closes the vocabulary: a consumer
+never reaches into a private module path to catch a typed error of this client.
+
+Deliberately unpublished from the package root (but still importable via
+submodule paths like ``ailogger_client.errors`` or ``ailogger_client.client``):
+the adapter framework's client class and its entire transport and exception
+hierarchy; the nine mixin classes (InvocationMixin, QueuedMixin,
+ObservationMixin, SessionMixin, MessageMixin, ReadMixin, RetrievalMixin,
+ServiceMixin, FileTransferMixin)
+that compose the client; the translation table and its supporting machinery
+(``translate_framework_failure``, ``translated_failures``, ``refusal_from_answer``);
+and the private attribute holding the framework client. This design keeps
+this package a wrapper over the framework rather than a second way of
+importing it, and ensures that transport details remain behind the client's
+boundary.
+"""
+
+from __future__ import annotations
+
+from .client import AiLoggerClient
+from .config import (
+    ConfigError,
+    load_client_section,
+    load_config_kwargs,
+    load_config_kwargs_from_document,
+)
+from .errors import (
+    AiLoggerClientError,
+    CompletionFailedError,
+    CompletionTimeoutError,
+    DialogueFileTransferError,
+    InadmissibleArgumentValueError,
+    MissingArgumentError,
+    QueuedCompletionError,
+    QueuedProtocolError,
+    RequestRejectedError,
+    ResultUnavailableError,
+    SchemaDisagreementError,
+    ServiceRefusalError,
+    ServiceUnreachableError,
+    SyncFallbackWaitExhaustedError,
+    UnknownCommandError,
+    WrongArgumentTypeError,
+)
+
+__all__ = [
+    "AiLoggerClient",
+    "AiLoggerClientError",
+    "CompletionFailedError",
+    "CompletionTimeoutError",
+    "ConfigError",
+    "DialogueFileTransferError",
+    "InadmissibleArgumentValueError",
+    "MissingArgumentError",
+    "QueuedCompletionError",
+    "QueuedProtocolError",
+    "RequestRejectedError",
+    "ResultUnavailableError",
+    "SchemaDisagreementError",
+    "ServiceRefusalError",
+    "ServiceUnreachableError",
+    "SyncFallbackWaitExhaustedError",
+    "UnknownCommandError",
+    "WrongArgumentTypeError",
+    "load_client_section",
+    "load_config_kwargs",
+    "load_config_kwargs_from_document",
+]

ailogger_client/client.py

@@ -0,0 +1,220 @@
+"""
+Client for the ai-logger service.
+
+This module declares the client class of the ai-logger service: the construction
+and encapsulation boundary before any command of the surface reaches it.
+
+CONSTRUCTION SHAPE. The client is built from its own named section of the
+configuration document of the process that uses it, in the sectioned fleet shape,
+by handing that section to the configuration translation of ailogger_client.config
+and passing the resulting keyword arguments straight to the framework client's
+constructor. Two construction routes are offered: from a section already read as
+a mapping, and from a configuration document identified by path together with the
+name of the section to read. Both routes end in the same single place where the
+framework client is built, so there is exactly one construction path in the class.
+
+ENCAPSULATION. The client holds an instance of JsonRpcClient from
+mcp_proxy_adapter.client.jsonrpc_client on a private attribute. The held instance
+leaves the object by no route: no public attribute, no property, no accessor method,
+no return value, no argument default, no representation string or attribute-forwarding
+hook. A caller holding this client cannot reach a connection through it. Inside the
+package a single private route to the held instance exists, so the typed methods
+have somewhere to call through without the attribute becoming part of the caller-facing
+surface.
+
+LIFECYCLE. Whatever opening and closing the client needs is delegated to the held
+instance. The client supports use as an asynchronous context manager, so entering
+and leaving a client is entering and leaving what the framework client already
+provides. Closing twice is harmless.
+
+CALLER SURFACE. No host, no connection, no retry, no status code and no transport
+envelope appears in any argument, in any return value or in any readable attribute
+of this class. The caller works only in the terms the service itself publishes.
+"""
+
+from __future__ import annotations
+
+import json
+from collections.abc import Mapping
+from pathlib import Path
+from typing import Any
+
+from mcp_proxy_adapter.client.jsonrpc_client import JsonRpcClient
+
+from .config import (
+    ConfigError,
+    load_client_section,
+    load_config_kwargs,
+    load_sync_fallback_wait,
+)
+from .file_transfer import FileTransferMixin
+from .invocation import InvocationMixin
+from .message_methods import MessageMixin
+from .observation_methods import ObservationMixin
+from .queued_methods import QueuedMixin
+from .read_methods import ReadMixin
+from .retrieval_methods import RetrievalMixin
+from .service_methods import ServiceMixin
+from .session_methods import SessionMixin
+
+__all__ = ["AiLoggerClient"]
+
+
+class AiLoggerClient(
+    InvocationMixin,
+    QueuedMixin,
+    ObservationMixin,
+    SessionMixin,
+    MessageMixin,
+    ReadMixin,
+    RetrievalMixin,
+    ServiceMixin,
+    FileTransferMixin,
+):
+    """
+    Wrapper over the installed adapter framework's JsonRpcClient, adding the
+    dialogue vocabulary of the ai-logger service.
+
+    The client is constructed from the consuming process's configuration document,
+    in the sectioned fleet shape. It holds an instance of JsonRpcClient privately,
+    delegating all transport, connection, retry and job tracking to the framework
+    client.
+
+    The client supports use as an asynchronous context manager. Lifecycle operations
+    (enter, exit, close) are delegated to the held JsonRpcClient instance.
+
+    COMPOSITION (G-012/T-003/A-008). The client is assembled from nine mixin
+    classes (QueuedMixin, which owns the machinery of always-queued commands,
+    and ObservationMixin, which carries the probe, help, health-route and
+    answer-mode methods, precede the mixins whose typed methods build on
+    it), each contributing a set of typed methods to the caller-facing
+    surface:
+    InvocationMixin provides the private invocation seam and the generic call, plus
+    job observation; SessionMixin provides session lifecycle commands; MessageMixin
+    provides message append; ReadMixin provides the five session reads and session
+    listing; RetrievalMixin provides working-set assembly and similarity search;
+    ServiceMixin provides info and health; FileTransferMixin declares dialogue
+    import and export (not yet designed). Every caller-facing method reaches the
+    held JsonRpcClient through the single private _invoke entry point that
+    InvocationMixin establishes, so there is one seam and one route. The composition
+    is order-independent for callers: all typed methods are reachable on an instance
+    regardless of the base order, because each mixin declares disjoint public names.
+    """
+
+    def __init__(
+        self,
+        section: Mapping[str, Any],
+        base_dir: str | None = None,
+    ) -> None:
+        """
+        Construct the client from a configuration section.
+
+        Args:
+            section: The "ailogger_client" section from the consuming process's
+                configuration document, as a mapping. Must carry the sectioned
+                fleet shape: a top-level ``protocol``, a ``server`` sub-section
+                with ``host`` and ``port``, optional ``client`` and ``ssl``
+                sub-sections, and an optional ``auth`` sub-section.
+
+            base_dir: When provided, the directory against which relative certificate
+                paths in the section are resolved. When absent, paths are resolved
+                against the calling process's current working directory.
+
+        Raises:
+            ConfigError: If the section is missing required keys or if any key
+                has the wrong type, including ``client.sync_fallback_wait_seconds``
+                that is not a number greater than zero.
+        """
+        kwargs = load_config_kwargs(section, base_dir)
+        self._sync_fallback_wait_seconds: float = load_sync_fallback_wait(section)
+        self._client: JsonRpcClient = JsonRpcClient(**kwargs)
+
+    @classmethod
+    def from_document_path(
+        cls,
+        path: str | Path,
+        section_name: str = "ailogger_client",
+    ) -> AiLoggerClient:
+        """
+        Construct the client from a configuration document file.
+
+        Reads the specified JSON configuration file, extracts the named section,
+        resolves relative certificate paths against the document's directory,
+        and constructs the client. This is a convenience route that combines
+        file reading, section extraction, and client construction.
+
+        Args:
+            path: The filesystem path to a JSON configuration document.
+
+            section_name: The name of the section to read from the document.
+                Defaults to "ailogger_client". This parameter exists for
+                flexibility but should remain at the default for the ai-logger client.
+
+        Returns:
+            An AiLoggerClient instance.
+
+        Raises:
+            ConfigError: If the document carries no section with the given name
+                or if the section is malformed.
+            FileNotFoundError: If the file does not exist.
+            json.JSONDecodeError: If the file is not valid JSON.
+        """
+        path_obj = Path(path).resolve()
+        with open(path_obj) as f:
+            document = json.load(f)
+
+        base_dir = str(path_obj.parent)
+
+        # Extract the section from the document
+        if section_name == "ailogger_client":
+            section = load_client_section(document)
+        else:
+            section = document.get(section_name)
+        if not isinstance(section, Mapping):
+            raise ConfigError(
+                f"configuration document carries no '{section_name}' "
+                "section for this client"
+            )
+
+        # Use the main constructor (single construction path)
+        return cls(section, base_dir=base_dir)
+
+    async def close(self) -> None:
+        """
+        Close the underlying transport and release resources.
+
+        Delegates to the held JsonRpcClient's close method. Closing twice
+        is harmless; the underlying client handles idempotency.
+        """
+        await self._client.close()
+
+    async def __aenter__(self) -> AiLoggerClient:
+        """
+        Async context manager entry.
+
+        Returns self for use in `async with` statements. The held JsonRpcClient
+        does not require explicit initialization, so no setup is performed here.
+        """
+        return self
+
+    async def __aexit__(
+        self,
+        exc_type: type[BaseException] | None,
+        exc_val: BaseException | None,
+        exc_tb: Any,
+    ) -> None:
+        """
+        Async context manager exit.
+
+        Closes the underlying transport and releases resources by delegating
+        to close().
+        """
+        await self.close()
+
+    def __repr__(self) -> str:
+        """
+        Return a string representation of the client.
+
+        Does not expose the held instance or any transport details.
+        """
+        return f"{self.__class__.__name__}()"

ailogger_client/config.py

@@ -0,0 +1,386 @@
+"""
+Configuration loading for the ai-logger client.
+
+This module reads the ai-logger client section from a consuming process's
+configuration document and produces the keyword arguments the JsonRpcClient
+constructor requires. It is the only place in this client package where a
+configuration value is read.
+
+CONSTRUCTION SHAPE. The client section is named "ailogger_client" and carries:
+a top-level ``protocol`` (http, https, or mtls), a ``server`` sub-section with
+``host`` and ``port``, a ``client`` sub-section that may carry ssl material
+overriding the server's own, a top-level ``ssl`` sub-section used as a fallback,
+and an ``auth`` sub-section carrying a ``token`` and the HTTP header name
+``token_header`` the token travels in.
+
+The section is read from the configuration document of the consuming process,
+never from the service's own document: a consumer runs in another process and
+often on another host, so reading the service's own configuration would
+introduce a second notion of where the service lives.
+
+WHAT THIS MODULE PRODUCES. Exactly the keyword arguments the JsonRpcClient
+constructor takes: protocol, host, port, token_header, token, cert, key, ca,
+check_hostname and timeout. Certificate material is passed as absolute filesystem
+paths for the client to use, never loaded or parsed here. The set is derived
+from the JsonRpcClient constructor signature, verified at module load time.
+
+WHAT THIS MODULE MUST NOT DO. It never builds a URL, base address or endpoint
+string. It never loads, parses or turns certificate material into a security
+context. It never opens a connection, socket or session. It reads no environment
+variable to locate the service and writes no service address into itself. It
+imports nothing from the service's own package, and makes no network call.
+"""
+
+from __future__ import annotations
+
+import inspect
+import math
+import os
+from collections.abc import Mapping
+from pathlib import Path
+from typing import Any, Final
+
+from mcp_proxy_adapter.client.jsonrpc_client import JsonRpcClient
+
+__all__ = [
+    "SYNC_FALLBACK_WAIT_SECONDS",
+    "ConfigError",
+    "load_client_section",
+    "load_config_kwargs",
+    "load_config_kwargs_from_document",
+    "load_sync_fallback_wait",
+]
+
+
+# The client owns these existing constructor parameters. The adapter may add
+# explicitly allowed optional keyword-only extensions without breaking import.
+_REQUIRED_KWARGS = frozenset(
+    {
+        "protocol",
+        "host",
+        "port",
+        "token_header",
+        "token",
+        "cert",
+        "key",
+        "ca",
+        "check_hostname",
+        "timeout",
+    }
+)
+# http_socket_options: adapter 8.11.3 and later. ws_config: adapter 8.11.9 and
+# later. The client passes neither; each is optional on both adapter lines.
+_OPTIONAL_EXTENSION_KWARGS = frozenset({"http_socket_options", "ws_config"})
+_LIVE_SIGNATURE = inspect.signature(JsonRpcClient.__init__)
+_LIVE_KWARGS = frozenset(_LIVE_SIGNATURE.parameters) - {"self"}
+_UNEXPECTED_KWARGS = _LIVE_KWARGS - _REQUIRED_KWARGS - _OPTIONAL_EXTENSION_KWARGS
+_MISSING_KWARGS = _REQUIRED_KWARGS - _LIVE_KWARGS
+_LIVE_OPTIONAL_EXTENSIONS = tuple(
+    _LIVE_SIGNATURE.parameters[name]
+    for name in sorted(_OPTIONAL_EXTENSION_KWARGS)
+    if name in _LIVE_SIGNATURE.parameters
+)
+
+if (
+    _MISSING_KWARGS
+    or _UNEXPECTED_KWARGS
+    or any(
+        extension.kind is not inspect.Parameter.KEYWORD_ONLY
+        or extension.default is inspect.Parameter.empty
+        for extension in _LIVE_OPTIONAL_EXTENSIONS
+    )
+):
+    raise RuntimeError(
+        "JsonRpcClient constructor signature has diverged from supported kwargs. "
+        f"Required: {sorted(_REQUIRED_KWARGS)}, "
+        f"Allowed optional extensions: {sorted(_OPTIONAL_EXTENSION_KWARGS)}, "
+        f"Live: {sorted(_LIVE_KWARGS)}"
+    )
+
+
+#: How long the client waits, in seconds, for the queued job of a command that
+#: overran the service's sync cap, when ``client.sync_fallback_wait_seconds`` is
+#: not configured.
+SYNC_FALLBACK_WAIT_SECONDS: Final[float] = 600.0
+
+
+class ConfigError(Exception):
+    """Raised when configuration is invalid or missing."""
+
+    pass
+
+
+def _get_nested(section: Mapping[str, Any], *keys: str) -> Any:
+    """
+    Read a nested value from ``section``, returning None if any level is
+    absent or non-mapping.
+    """
+    node: Any = section
+    for key in keys:
+        if not isinstance(node, Mapping):
+            return None
+        node = node.get(key)
+    return node
+
+
+def _to_absolute_path(path: str | None, base_dir: str | None = None) -> str | None:
+    """
+    Convert a path to an absolute filesystem path. Returns None if path is None.
+
+    When ``base_dir`` is provided, paths are resolved relative to that directory,
+    making the result independent of the calling process's working directory.
+
+    When ``base_dir`` is None (bare mapping route with no document context),
+    paths are resolved relative to the current working directory. In this case,
+    the result depends on the caller's cwd at call time.
+    """
+    if path is None:
+        return None
+    if base_dir is not None:
+        return str(Path(base_dir) / path).replace("//", "/")
+    return os.path.abspath(path)
+
+
+def _extract_server_config(
+    section: Mapping[str, Any],
+) -> tuple[str, int, str]:
+    """
+    Extract protocol, host, and port from section. Host and port are required.
+    Protocol defaults to 'http' if absent.
+    """
+    protocol = section.get("protocol", "http")
+    if not isinstance(protocol, str):
+        raise ConfigError(f"protocol must be a string, got {type(protocol).__name__}")
+
+    server_section = section.get("server")
+    if not isinstance(server_section, Mapping):
+        raise ConfigError("server section must be a mapping")
+
+    host = server_section.get("host")
+    if not isinstance(host, str):
+        host_type = type(host).__name__ if host is not None else "None"
+        raise ConfigError(f"server.host must be a string, got {host_type}")
+
+    port = server_section.get("port")
+    if not isinstance(port, int):
+        port_type = type(port).__name__ if port is not None else "None"
+        raise ConfigError(f"server.port must be an integer, got {port_type}")
+
+    return protocol, port, host
+
+
+def _extract_timeout(client_section: Mapping[str, Any] | None) -> float | None:
+    """Extract timeout from client section, or None if absent."""
+    if not isinstance(client_section, Mapping):
+        return None
+    resolved_timeout = client_section.get("timeout")
+    if resolved_timeout is None:
+        return None
+    if isinstance(resolved_timeout, (int, float)):
+        return float(resolved_timeout)
+    raise ConfigError(
+        f"client.timeout must be a number, got {type(resolved_timeout).__name__}"
+    )
+
+
+def load_sync_fallback_wait(section: Mapping[str, Any]) -> float:
+    """
+    The wait, in seconds, for the queued job of a command that overran the
+    service's sync cap: ``client.sync_fallback_wait_seconds`` of the section, or
+    ``SYNC_FALLBACK_WAIT_SECONDS`` when it is absent.
+
+    Raises:
+        ConfigError: If the configured value is not a number greater than zero
+            (a string, a boolean, zero, a negative number, null or a
+            non-finite number is refused).
+    """
+    client_section = section.get("client")
+    if not isinstance(client_section, Mapping):
+        return SYNC_FALLBACK_WAIT_SECONDS
+    if "sync_fallback_wait_seconds" not in client_section:
+        return SYNC_FALLBACK_WAIT_SECONDS
+    wait = client_section["sync_fallback_wait_seconds"]
+    if (
+        isinstance(wait, bool)
+        or not isinstance(wait, (int, float))
+        or not math.isfinite(wait)
+        or wait <= 0
+    ):
+        raise ConfigError(
+            "client.sync_fallback_wait_seconds must be a number greater than 0, "
+            f"got {wait!r}"
+        )
+    return float(wait)
+
+
+def _extract_ssl_config(
+    section: Mapping[str, Any],
+    client_section: Mapping[str, Any] | None,
+    base_dir: str | None = None,
+) -> tuple[str | None, str | None, str | None]:
+    """
+    Extract and validate cert, key, ca from client.ssl (taking precedence)
+    or ssl section (fallback). Resolves paths to absolute paths.
+    """
+    cert: str | None = None
+    key: str | None = None
+    ca: str | None = None
+
+    if isinstance(client_section, Mapping):
+        client_ssl = client_section.get("ssl")
+        if isinstance(client_ssl, Mapping):
+            cert = client_ssl.get("cert")
+            key = client_ssl.get("key")
+            ca = client_ssl.get("ca")
+
+    ssl_section = section.get("ssl")
+    if isinstance(ssl_section, Mapping):
+        if cert is None:
+            cert = ssl_section.get("cert")
+        if key is None:
+            key = ssl_section.get("key")
+        if ca is None:
+            ca = ssl_section.get("ca")
+
+    # Validate types
+    if cert is not None and not isinstance(cert, str):
+        raise ConfigError(f"cert must be a string path, got {type(cert).__name__}")
+    if key is not None and not isinstance(key, str):
+        raise ConfigError(f"key must be a string path, got {type(key).__name__}")
+    if ca is not None and not isinstance(ca, str):
+        raise ConfigError(f"ca must be a string path, got {type(ca).__name__}")
+
+    cert_abs = _to_absolute_path(cert, base_dir)
+    key_abs = _to_absolute_path(key, base_dir)
+    ca_abs = _to_absolute_path(ca, base_dir)
+
+    return cert_abs, key_abs, ca_abs
+
+
+def _extract_check_hostname(ssl_section: Mapping[str, Any] | None) -> bool:
+    """Extract check_hostname from ssl section, defaulting to False."""
+    if not isinstance(ssl_section, Mapping):
+        return False
+    resolved_check_hostname = ssl_section.get("check_hostname")
+    if resolved_check_hostname is None:
+        return False
+    if isinstance(resolved_check_hostname, bool):
+        return resolved_check_hostname
+    raise ConfigError(
+        f"ssl.check_hostname must be a boolean, "
+        f"got {type(resolved_check_hostname).__name__}"
+    )
+
+
+def _extract_auth_config(
+    auth_section: Mapping[str, Any] | None,
+) -> tuple[str | None, str | None]:
+    """Extract token and token_header from auth section."""
+    if not isinstance(auth_section, Mapping):
+        return None, None
+
+    token = auth_section.get("token")
+    token_header = auth_section.get("token_header")
+
+    if token is not None and not isinstance(token, str):
+        raise ConfigError(f"auth.token must be a string, got {type(token).__name__}")
+    if token_header is not None and not isinstance(token_header, str):
+        token_header_type = type(token_header).__name__
+        raise ConfigError(
+            f"auth.token_header must be a string, got {token_header_type}"
+        )
+
+    return token, token_header
+
+
+def load_client_section(document: Mapping[str, Any]) -> Mapping[str, Any]:
+    """
+    Extract the "ailogger_client" configuration section from a consuming
+    process's configuration document.
+
+    Raises ConfigError if the document carries no "ailogger_client" section.
+
+    Returns the section mapping for further processing.
+    """
+    section = document.get("ailogger_client")
+    if not isinstance(section, Mapping):
+        raise ConfigError(
+            "configuration document carries no 'ailogger_client' "
+            "section for this client"
+        )
+    return section
+
+
+def load_config_kwargs(
+    section: Mapping[str, Any], base_dir: str | None = None
+) -> dict[str, Any]:
+    """
+    Read the ai-logger client configuration section and produce the keyword
+    arguments the JsonRpcClient constructor requires.
+
+    ``section`` must be the mapping from a consuming process's configuration
+    document; this function does not read a configuration file, resolve a path,
+    or read an environment variable itself.
+
+    ``base_dir``, when provided, is the directory against which relative
+    certificate paths in the section are resolved. When absent, paths are
+    resolved against the calling process's current working directory.
+
+    Raises ConfigError if ``section`` is missing or if required keys are absent
+    or have the wrong type.
+
+    Returns a dict with keys: protocol, host, port, token_header, token, cert,
+    key, ca, check_hostname, timeout. Each key's value is the type JsonRpcClient
+    expects. Certificate paths, if present, are absolute paths.
+    """
+    protocol, port, host = _extract_server_config(section)
+
+    client_section = section.get("client")
+    timeout = _extract_timeout(client_section)
+
+    cert, key, ca = _extract_ssl_config(section, client_section, base_dir)
+
+    ssl_section = section.get("ssl")
+    check_hostname = _extract_check_hostname(ssl_section)
+
+    auth_section = section.get("auth")
+    token, token_header = _extract_auth_config(auth_section)
+
+    # Build and return the kwargs dict
+    kwargs: dict[str, Any] = {
+        "protocol": protocol,
+        "host": host,
+        "port": port,
+        "token_header": token_header,
+        "token": token,
+        "cert": cert,
+        "key": key,
+        "ca": ca,
+        "check_hostname": check_hostname,
+        "timeout": timeout,
+    }
+
+    return kwargs
+
+
+def load_config_kwargs_from_document(
+    document: Mapping[str, Any], base_dir: str | None = None
+) -> dict[str, Any]:
+    """
+    Extract the "ailogger_client" section from a consuming process's
+    configuration document and produce the keyword arguments the JsonRpcClient
+    constructor requires. Combines load_client_section and load_config_kwargs
+    in a single call.
+
+    ``base_dir``, when provided, is the directory against which relative
+    certificate paths are resolved. When absent, paths are resolved against
+    the calling process's current working directory.
+
+    Raises ConfigError if the document carries no "ailogger_client" section
+    or if the section is malformed.
+
+    Returns a dict with keys: protocol, host, port, token_header, token, cert,
+    key, ca, check_hostname, timeout.
+    """
+    section = load_client_section(document)
+    return load_config_kwargs(section, base_dir)