@tonbo/artifacts

TypeScript SDK for Tonbo Artifacts.

import { Artifacts } from '@tonbo/artifacts';

const artifacts = new Artifacts();
const workspaces = await artifacts.workspaces.list();

const mount = await artifacts.workspaces.createMountTicket('panta/cases', {
  mode: 'ro',
  ttlSeconds: 3600,
});

// `mount.mount_ticket` is the signed JSON mount ticket that a platform
// control plane can deliver to a worker as secret material.

Platform delegation flow:

await artifacts.platform.createTenant('acme', { externalId: 'cust_42' });
await artifacts.platform.createAccessGrant('panta/cases', {
  tenantSlug: 'acme',
  runtimeId: 'runtime-42',
  mode: 'rw',
});

const delegated = await artifacts.platform.createMountTicket('acme', 'runtime-42', {
  workspace: 'panta/cases',
  mode: 'rw',
  ttlSeconds: 3600,
});

await artifacts.platform.revokeAccessGrants({
  tenantSlug: 'acme',
  runtimeId: 'runtime-42',
});

Platform delegation helpers keep tenant, grant, and mount-ticket coordination in one production API:

let delegation = artifacts.platform.delegation({
  tenantSlug: 'acme',
  runtimeId: 'runtime-42',
  workspace: 'panta/cases',
});

let step = await delegation.ensureTenant();
delegation = delegation.withContext(step.context);
console.log(step.summary);

step = await delegation.grantWorkspaceAccess();
delegation = delegation.withContext(step.context);
console.log(step.summary);

In a Node REPL, run node --experimental-repl-await, import the SDK, then call the same methods one at a time. The returned context is safe to save between steps; full mount tickets are returned only to the creating call because they contain worker credentials.

By default the SDK reads TONBO_API_KEY and talks to https://artifacts.tonbo.dev.