@agentvault/agentvault 0.9.6 → 0.9.8

package/dist/crypto-helpers.js

@@ -0,0 +1,4 @@
+// Re-export transport utilities from shared @agentvault/crypto package.
+// Plugin code continues importing from ./crypto-helpers.js — no import changes needed.
+export { hexToBytes, bytesToHex, base64ToBytes, bytesToBase64, encryptedMessageToTransport, transportToEncryptedMessage, } from "@agentvault/crypto";
+//# sourceMappingURL=crypto-helpers.js.map

package/dist/crypto-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-helpers.js","sourceRoot":"","sources":["../src/crypto-helpers.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,uFAAuF;AACvF,OAAO,EACL,UAAU,EACV,UAAU,EACV,aAAa,EACb,aAAa,EACb,2BAA2B,EAC3B,2BAA2B,GAE5B,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -6,7 +6,7 @@ import { writeFile as writeFile2, mkdir as mkdir2 } from "node:fs/promises";
 import { join as join2 } from "node:path";
 import { readFile as readFile2 } from "node:fs/promises";
 
-// ../../../../../node_modules/libsodium-sumo/dist/modules-sumo-esm/libsodium-sumo.mjs
+// ../../node_modules/libsodium-sumo/dist/modules-sumo-esm/libsodium-sumo.mjs
 var __filename;
 var __dirname;
 try {
@@ -73,9 +73,9 @@ if (typeof Module.getRandomValue === "undefined") {
     Module.getRandomValue = randomValuesStandard;
   } catch (e) {
     try {
-      crypto = null;
+      crypto2 = null;
       randomValueNodeJS = function() {
-        var buf = crypto["randomBytes"](4);
+        var buf = crypto2["randomBytes"](4);
         return (buf[0] << 24 | buf[1] << 16 | buf[2] << 8 | buf[3]) >>> 0;
       };
       randomValueNodeJS();
@@ -88,7 +88,7 @@ if (typeof Module.getRandomValue === "undefined") {
 var window_;
 var crypto_;
 var randomValuesStandard;
-var crypto;
+var crypto2;
 var randomValueNodeJS;
 var _Module = Module;
 Module.ready = new Promise(function(resolve2, reject) {
@@ -214,7 +214,7 @@ Module.ready = new Promise(function(resolve2, reject) {
       }, Module: function(binary) {
       }, Instance: function(module2, info) {
         this.exports = // EMSCRIPTEN_START_ASM
-        function instantiate(ea2) {
+        (function instantiate(ea2) {
           var a2;
           var b2 = new Uint8Array(123);
           for (var c2 = 25; c2 >= 0; --c2) {
@@ -40009,7 +40009,7 @@ Module.ready = new Promise(function(resolve2, reject) {
             } } }), f: yi, g: ma2, h: Ba2, i: ma2, j: ka2, k: Le2, l: Je2, m: zg, n: yg, o: xg, p: wg, q: ka2, r: Ba2, s: ka2, t: ka2, u: Le2, v: ra2, w: vg, x: ug, y: tg, z: sg, A: Ba2, B: rg, C: qg, D: pg, E: ng, F: mg, G: lg, H: kg, I: jg, J: ka2, K: Ce2, L: Ba2, M: ma2, N: Ta2, O: ra2, P: ka2, Q: Oa2, R: Ba2, S: ma2, T: Ta2, U: ra2, V: ig, W: hg, X: gg, Y: fg, Z: ka2, _: Ma2, $: Ba2, aa: ma2, ba: Ta2, ca: ra2, da: ka2, ea: ka2, fa: Kg, ga: wd, ha: vd, ia: ra2, ja: ka2, ka: ka2, la: Cb, ma: ra2, na: Xa2, oa: eg, pa: qb, qa: dg, ra: cg, sa: ua2, ta: ka2, ua: Dc, va: ra2, wa: Va2, xa: ud, ya: Ya2, za: bg, Aa: ag, Ba: ka2, Ca: ka2, Da: Dc, Ea: ra2, Fa: ze2, Ga: ud, Ha: Ng, Ia: wd, Ja: vd, Ka: ka2, La: ka2, Ma: ka2, Na: ka2, Oa: Ma2, Pa: ka2, Qa: ma2, Ra: ma2, Sa: Ta2, Ta: dh2, Ua: ch, Va: bh, Wa: ah, Xa: Lb, Ya: Kb, Za: td, _a: sd, $a: rd, ab: $f, bb: _f, cb: Zf, db: qd, eb: Yf, fb: pd, gb: Xf, hb: Wf, ib: Uf, jb: Md, kb: tc, lb: nb, mb, nb: Lb, ob: Kb, pb: td, qb: sd, rb: ka2, sb: ka2, tb: ka2, ub: ka2, vb: Ma2, wb: ka2, xb: ma2, yb: ma2, zb: Ta2, Ab: Aa2, Bb: ka2, Cb: ma2, Db: ka2, Eb: ma2, Fb: Sa2, Gb: ka2, Hb: ma2, Ib: ka2, Jb: ma2, Kb: vb, Lb: ua2, Mb: ma2, Nb: ka2, Ob: ma2, Pb: ub, Qb: ua2, Rb: ma2, Sb: ka2, Tb: ma2, Ub: tb, Vb: ua2, Wb: ma2, Xb: ka2, Yb: ma2, Zb: ma2, _b: ua2, $b: ka2, ac: ma2, bc: ua2, cc: ka2, dc: Nd, ec: pe2, fc: od, gc: fh, hc: nd, ic: eh, jc: ra2, kc: ma2, lc: ua2, mc: ka2, nc: ma2, oc: ua2, pc: ka2, qc: ma2, rc: ma2, sc: pe2, tc: ra2, uc: od, vc: Tf, wc: Ja2, xc: xh, yc: nd, zc: Ia2, Ac: ua2, Bc: md, Cc: Lg, Dc: ka2, Ec: Ag, Fc: Ub, Gc: Sf, Hc: Ua2, Ic: Rf, Jc: ua2, Kc: Cb, Lc: Za2, Mc: ic, Nc: Ca2, Oc: md, Pc: ma2, Qc: ua2, Rc: Oa2, Sc: ka2, Tc: ld, Uc: Nd, Vc: ma2, Wc: ua2, Xc: Oa2, Yc: ka2, Zc: ld, _c: ra2, $c: Gh, ad: Fh, bd: Eh, cd: Dh, dd: ra2, ed: Ch, fd: ka2, gd: Ba2, hd: Bh, id: Cb, jd: ze2, kd: hi, ld: gi, md: fi, nd: ei, od: di, pd: ua2, qd: Ba2, rd: ci, sd: Dc, td: Gg, ud: nb, vd: Fg, wd: Eg, xd: ka2, yd: ka2, zd: ka2, Ad: ka2, Bd: Dg, Cd: Rc, Dd: ma2, Ed: ka2, Fd: kd, Gd: jd, Hd: Sg, Id: id, Jd: Rg, Kd: Qg, Ld: ra2, Md: kd, Nd: jd, Od: Ga2, Pd: id, Qd: Fa2, Rd: ma2, Sd: ka2, Td: Rc, Ud: ra2, Vd: Db, Wd: ma2, Xd: wa2, Yd: Ba2, Zd: wa2, _d: ma2, $d: yc, ae: wh, be: Vb, ce: wa2, de: xc, ee: wc, fe: vc, ge: me2, he: vh, ie: uh, je: Oa2, ke: th, le: Pf, me: Of, ne: Nf, oe: Mf, pe: Lf, qe: fb, re: ma2, se: wa2, te: Ba2, ue: wa2, ve: ma2, we: yc, xe: fe2, ye: Db, ze: wa2, Ae: xc, Be: wc, Ce: fb, De: ee2, Ee: Vb, Fe: de2, Ge: vc, He: uc, Ie: Kf, Je: hd, Ke: Jf, Le: Db, Me: fb, Ne: fb, Oe: ma2, Pe: wa2, Qe: Ba2, Re: wa2, Se: ma2, Te: yc, Ue: fe2, Ve: Db, We: wa2, Xe: xc, Ye: wc, Ze: fb, _e: ee2, $e: Vb, af: de2, bf: vc, cf: uc, df: Hf, ef: hd, ff: Gf, gf: Ff, hf: Ef, jf: sh, kf: Jg, lf: Ig, mf: Hg, nf: ka2, of: ka2, pf: Ea2, qf: wb, rf: ka2, sf: ka2, tf: ka2, uf: Ma2, vf: ka2, wf: ma2, xf: ma2, yf: Ta2, zf: Mg, Af: Lb, Bf: Kb, Cf: ra2, Df: rd, Ef: Df, Ff: qd, Gf: pd, Hf: Lb, If: Kb, Jf: ka2, Kf: Ma2, Lf: ka2, Mf: ma2, Nf: ma2, Of: Ta2, Pf: ra2, Qf: ra2, Rf: Mh, Sf: Lh, Tf: Kh, Uf: Cf, Vf: Bf, Wf: Jh, Xf: Ih, Yf: Ma2, Zf: ka2, _f: Hh, $f: Ba2, ag: Db, bg: fb, cg: Vb, dg: Oa2, eg: ma2, fg: Tg, gg: gd, hg: Je2, ig: Oa2, jg: ma2, kg: gd, lg: Cb, mg: ua2, ng: ka2, og: ka2, pg: ua2, qg: Wd, rg: lh, sg: kh, tg: jh, ug: fd, vg: ed, wg: dd, xg: cd, yg: ih, zg: ic, Ag: hh, Bg: gh, Cg: Cb, Dg: ua2, Eg: ka2, Fg: ka2, Gg: ua2, Hg: Wd, Ig: nh, Jg: mh, Kg: Vd, Lg: ic, Mg: Ud, Ng: Td, Og: Yd, Pg: Xd, Qg: ph, Rg: oh, Sg: cd, Tg: ed, Ug: dd, Vg: fd, Wg: ka2, Xg: Oa2, Yg: wa2, Zg: ka2, _g: Ce2, $g: wa2, ah: zf, bh: yf, ch: xf, dh: wf, eh: vf, fh: uf, gh: ra2, hh: ra2, ih: ka2, jh: Ma2, kh: wa2, lh: qh, mh: bd, nh: ad, oh: ra2, ph: ka2, qh: Oa2, rh: wa2, sh: tf, th: sf, uh: rf, vh: ra2, wh: bd, xh: qf, yh: ad, zh: ka2, Ah: Ma2, Bh: wa2, Ch: ra2, Dh: ma2, Eh: ka2, Fh: ua2, Gh: db, Hh: kb, Ih: xd, Jh: oi, Kh: ni, Lh: Ae2, Mh: mi, Nh: za2, Oh: li, Ph: ka2, Qh: ki, Rh: pf, Sh: Ah, Th: zh, Uh: yh, Vh: Bc, Wh: Ac, Xh: ti, Yh: ji, Zh: ii, _h: Cg, $h: Bg, ai: fb, bi: Ba2, ci: tc, di: nb, ei: rh, fi: $c, gi: of, hi: nf, ii: mf, ji: _c, ki: lf, li: Yc, mi: kf, ni: ka2, oi: ka2, pi: ka2, qi: ka2, ri: Ma2, si: ma2, ti: Ta2, ui: jf, vi: hf, wi: Md, xi: bi, yi: ai, zi: $h, Ai: _h, Bi: Zh, Ci: ye2, Di: xe2, Ei: we2, Fi: ve2, Gi: ue2, Hi: te2, Ii: se2, Ji: re2, Ki: ka2, Li: ua2, Mi: ka2, Ni: ua2, Oi: ka2, Pi: Yh, Qi: Xh, Ri: Wh, Si: Vh, Ti: Uh, Ui: Th, Vi: Sh, Wi: Rh, Xi: Qh, Yi: Ph, Zi: Oh, _i: re2, $i: Nh, aj: ka2, bj: ua2, cj: ua2, dj: ka2, ej: gf, fj: ma2, gj: wa2, hj: Ba2, ij: wa2, jj: ka2, kj: $g, lj: _g, mj: Zg, nj: wa2, oj: Ed, pj: wa2, qj: Yg, rj: Ed, sj: me2, tj: uc, uj: ff, vj: ef, wj: df, xj: cf, yj: Xg, zj: Wg, Aj: Vg, Bj: Ug, Cj: ka2, Dj: ka2, Ej: Pg, Fj: Og, Gj: ka2, Hj: ka2, Ij: $c, Jj: bf, Kj: _c, Lj: Yc, Mj: ka2, Nj: Ma2, Oj: ma2, Pj: Ta2, Qj: ma2, Rj: ma2, Sj: af, Tj: $e2, Uj: _e2, Vj: ka2, Wj: Oa2, Xj: wa2, Yj: ra2, Zj: Ze2, _j: Ye2, $j: ka2, ak: Oa2, bk: wa2, ck: ra2, dk: ka2, ek: Ma2, fk: wa2, gk: Xe2, hk: We2, ik: Ve2, jk: ra2, kk: Da2, lk: ta2 };
           }
           return da2(ea2);
-        }(info);
+        })(info);
       }, instantiate: function(binary, info) {
         return { then: function(ok) {
           var module2 = new WebAssembly2.Module(binary);
@@ -40283,7 +40283,7 @@ Module.ready = new Promise(function(resolve2, reject) {
           try {
             var window_ = "object" === typeof window ? window : self;
             var crypto_ = typeof window_.crypto !== "undefined" ? window_.crypto : window_.msCrypto;
-            crypto_ = crypto_ === void 0 ? crypto : crypto_;
+            crypto_ = crypto_ === void 0 ? crypto2 : crypto_;
             var randomValuesStandard = function() {
               var buf = new Uint32Array(1);
               crypto_.getRandomValues(buf);
@@ -40293,9 +40293,9 @@ Module.ready = new Promise(function(resolve2, reject) {
             Module3.getRandomValue = randomValuesStandard;
           } catch (e) {
             try {
-              var crypto = null;
+              var crypto2 = null;
               var randomValueNodeJS = function() {
-                var buf = crypto["randomBytes"](4);
+                var buf = crypto2["randomBytes"](4);
                 return (buf[0] << 24 | buf[1] << 16 | buf[2] << 8 | buf[3]) >>> 0;
               };
               randomValueNodeJS();
@@ -41343,7 +41343,7 @@ Module.ready = new Promise(function(resolve2, reject) {
       try {
         var window_ = "object" === typeof window ? window : self;
         var crypto_ = typeof window_.crypto !== "undefined" ? window_.crypto : window_.msCrypto;
-        crypto_ = crypto_ === void 0 ? crypto : crypto_;
+        crypto_ = crypto_ === void 0 ? crypto2 : crypto_;
         var randomValuesStandard = function() {
           var buf = new Uint32Array(1);
           crypto_.getRandomValues(buf);
@@ -41353,9 +41353,9 @@ Module.ready = new Promise(function(resolve2, reject) {
         Module2.getRandomValue = randomValuesStandard;
       } catch (e) {
         try {
-          var crypto = null;
+          var crypto2 = null;
           var randomValueNodeJS = function() {
-            var buf = crypto["randomBytes"](4);
+            var buf = crypto2["randomBytes"](4);
             return (buf[0] << 24 | buf[1] << 16 | buf[2] << 8 | buf[3]) >>> 0;
           };
           randomValueNodeJS();
@@ -42011,7 +42011,7 @@ Module.ready = new Promise(function(resolve2, reject) {
 });
 var libsodium_sumo_default = Module;
 
-// ../../../../../node_modules/libsodium-wrappers-sumo/dist/modules-sumo-esm/libsodium-wrappers.mjs
+// ../../node_modules/libsodium-wrappers-sumo/dist/modules-sumo-esm/libsodium-wrappers.mjs
 var a;
 var r = {};
 var t = libsodium_sumo_default.ready.then(function() {
@@ -44611,7 +44611,7 @@ var libsodium_wrappers_default = r;
 // src/channel.ts
 import WebSocket from "ws";
 
-// ../../../../../packages/crypto/dist/keys.js
+// ../crypto/dist/keys.js
 async function generateIdentityKeypair() {
   await libsodium_wrappers_default.ready;
   const kp = libsodium_wrappers_default.crypto_sign_keypair();
@@ -44638,7 +44638,7 @@ function createProofOfPossession(privateKey, publicKey) {
   return libsodium_wrappers_default.crypto_sign_detached(publicKey, privateKey);
 }
 
-// ../../../../../packages/crypto/dist/x3dh.js
+// ../crypto/dist/x3dh.js
 function ed25519PrivateToX25519(edPrivate) {
   return libsodium_wrappers_default.crypto_sign_ed25519_sk_to_curve25519(edPrivate);
 }
@@ -44660,7 +44660,7 @@ function performX3DH(params) {
   return libsodium_wrappers_default.crypto_generichash(32, combined);
 }
 
-// ../../../../../packages/crypto/dist/ratchet.js
+// ../crypto/dist/ratchet.js
 var MAX_SKIP = 100;
 var CHAIN_KEY_SEED = new Uint8Array([1]);
 var MSG_KEY_SEED = new Uint8Array([2]);
@@ -44766,6 +44766,22 @@ var DoubleRatchet = class _DoubleRatchet {
     const currentDhHex = this.state.dhReceivingPublicKey ? libsodium_wrappers_default.to_hex(this.state.dhReceivingPublicKey) : null;
     if (currentDhHex === null && this.state.receivingChain) {
       this.state.dhReceivingPublicKey = message.header.dhPublicKey;
+    } else if (currentDhHex === null && !this.state.receivingChain) {
+      if (message.header.messageNumber === 0) {
+        try {
+          const { messageKey: testKey, nextChainKey: nextChainKey2 } = kdfChainKey(this.state.rootKey);
+          const ad2 = serializeHeader(message.header);
+          const ptBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, ad2, message.nonce, testKey);
+          this.state.dhReceivingPublicKey = message.header.dhPublicKey;
+          this.state.receivingChain = {
+            chainKey: nextChainKey2,
+            messageNumber: 1
+          };
+          return libsodium_wrappers_default.to_string(ptBytes);
+        } catch {
+        }
+      }
+      this.dhRatchetReceive(message.header.dhPublicKey);
     } else if (headerDhHex !== currentDhHex) {
       if (this.state.receivingChain && this.state.dhReceivingPublicKey) {
         this.skipMessages(this.state.receivingChain, message.header.previousChainLength, this.state.dhReceivingPublicKey);
@@ -44921,7 +44937,7 @@ var DoubleRatchet = class _DoubleRatchet {
   }
 };
 
-// ../../../../../packages/crypto/dist/file-crypto.js
+// ../crypto/dist/file-crypto.js
 function encryptFile(plainData) {
   const fileKey = libsodium_wrappers_default.randombytes_buf(libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_KEYBYTES);
   const fileNonce = libsodium_wrappers_default.randombytes_buf(libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
@@ -44954,7 +44970,7 @@ function computeFileDigest(data) {
   return libsodium_wrappers_default.to_hex(digestBytes);
 }
 
-// ../../../../../packages/crypto/dist/scan-engine.js
+// ../crypto/dist/scan-engine.js
 var BUILTIN_PATTERNS = {
   pii_ssn: [/\b\d{3}-\d{2}-\d{4}\b/g, /\b\d{9}\b/g],
   pii_credit_card: [
@@ -45106,7 +45122,7 @@ var ScanEngine = class {
   }
 };
 
-// ../../../../../packages/crypto/dist/transport.js
+// ../crypto/dist/transport.js
 function hexToBytes(hex) {
   return libsodium_wrappers_default.from_hex(hex);
 }
@@ -45149,6 +45165,208 @@ function transportToEncryptedMessage(transport) {
   };
 }
 
+// ../crypto/dist/telemetry.js
+function randomHex(byteCount) {
+  const bytes = new Uint8Array(byteCount);
+  crypto.getRandomValues(bytes);
+  let hex = "";
+  for (let i2 = 0; i2 < bytes.length; i2++) {
+    hex += bytes[i2].toString(16).padStart(2, "0");
+  }
+  return hex;
+}
+function generateTraceId() {
+  return randomHex(16);
+}
+function generateSpanId() {
+  return randomHex(8);
+}
+function buildLlmSpan(opts) {
+  const now = Date.now();
+  const attributes = {
+    "ai.agent.llm.model": opts.model,
+    "ai.agent.llm.latency_ms": opts.latencyMs,
+    "ai.agent.llm.tokens_input": opts.tokensInput,
+    "ai.agent.llm.tokens_output": opts.tokensOutput
+  };
+  if (opts.provider !== void 0) {
+    attributes["ai.agent.llm.provider"] = opts.provider;
+  }
+  const isError = opts.status === "error";
+  const status = isError ? { code: 2, ...opts.statusMessage ? { message: opts.statusMessage } : {} } : { code: 0 };
+  return {
+    traceId: opts.traceId ?? generateTraceId(),
+    spanId: opts.spanId ?? generateSpanId(),
+    parentSpanId: opts.parentSpanId,
+    name: "llm.inference",
+    kind: "internal",
+    startTime: now - opts.latencyMs,
+    endTime: now,
+    attributes,
+    status
+  };
+}
+function buildToolSpan(opts) {
+  const now = Date.now();
+  const attributes = {
+    "ai.agent.tool.name": opts.toolName,
+    "ai.agent.tool.latency_ms": opts.latencyMs,
+    "ai.agent.tool.success": opts.success
+  };
+  const status = opts.success ? { code: 0 } : { code: 2, ...opts.errorMessage ? { message: opts.errorMessage } : {} };
+  return {
+    traceId: opts.traceId ?? generateTraceId(),
+    spanId: opts.spanId ?? generateSpanId(),
+    parentSpanId: opts.parentSpanId,
+    name: "tool.execute",
+    kind: "internal",
+    startTime: now - opts.latencyMs,
+    endTime: now,
+    attributes,
+    status
+  };
+}
+function buildErrorSpan(opts) {
+  const now = Date.now();
+  return {
+    traceId: opts.traceId ?? generateTraceId(),
+    spanId: opts.spanId ?? generateSpanId(),
+    parentSpanId: opts.parentSpanId,
+    name: "error",
+    kind: opts.spanKind ?? "internal",
+    startTime: now,
+    endTime: now,
+    attributes: {
+      "ai.agent.error.type": opts.errorType,
+      "ai.agent.error.message": opts.errorMessage
+    },
+    status: { code: 2, message: opts.errorMessage }
+  };
+}
+
+// ../crypto/dist/telemetry-reporter.js
+function toOtlpAttributes(attrs) {
+  return Object.entries(attrs).map(([key, val]) => {
+    if (typeof val === "string") {
+      return { key, value: { stringValue: val } };
+    }
+    if (typeof val === "boolean") {
+      return { key, value: { boolValue: val } };
+    }
+    if (Number.isInteger(val)) {
+      return { key, value: { intValue: val } };
+    }
+    return { key, value: { doubleValue: val } };
+  });
+}
+function spanToOtlp(span) {
+  const otlp = {
+    traceId: span.traceId,
+    spanId: span.spanId,
+    name: span.name,
+    kind: span.kind,
+    startTimeUnixNano: String(span.startTime * 1e6),
+    endTimeUnixNano: String(span.endTime * 1e6),
+    attributes: toOtlpAttributes(span.attributes)
+  };
+  if (span.parentSpanId !== void 0) {
+    otlp.parentSpanId = span.parentSpanId;
+  }
+  if (span.status) {
+    otlp.status = span.status;
+  }
+  if (span.events && span.events.length > 0) {
+    otlp.events = span.events;
+  }
+  return otlp;
+}
+var TelemetryReporter = class {
+  _apiBase;
+  _hubId;
+  _authHeader;
+  _fetch;
+  _buffer = [];
+  _timer = null;
+  constructor(config) {
+    this._apiBase = config.apiBase.replace(/\/+$/, "");
+    this._hubId = config.hubId;
+    this._authHeader = config.authHeader;
+    this._fetch = config.fetchImpl ?? globalThis.fetch;
+  }
+  /** Number of spans waiting to be flushed. */
+  get pendingCount() {
+    return this._buffer.length;
+  }
+  // -- Report methods ---------------------------------------------------------
+  /** Record an LLM inference call. */
+  reportLlmCall(opts) {
+    this._buffer.push(buildLlmSpan(opts));
+  }
+  /** Record a tool/function invocation. */
+  reportToolCall(opts) {
+    this._buffer.push(buildToolSpan(opts));
+  }
+  /** Record an error event. */
+  reportError(opts) {
+    this._buffer.push(buildErrorSpan(opts));
+  }
+  /** Record an arbitrary pre-built span. */
+  reportCustomSpan(span) {
+    this._buffer.push(span);
+  }
+  // -- Flush ------------------------------------------------------------------
+  /**
+   * POST all buffered spans to the backend ingest endpoint.
+   *
+   * - On success (HTTP 2xx): clears the buffer.
+   * - On failure: keeps spans in the buffer for retry.
+   * - Never throws — telemetry is best-effort.
+   */
+  async flush() {
+    if (this._buffer.length === 0) {
+      return;
+    }
+    const spans = this._buffer;
+    this._buffer = [];
+    try {
+      const response = await this._fetch(`${this._apiBase}/api/v1/telemetry/ingest`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: this._authHeader
+        },
+        body: JSON.stringify({
+          hub_id: this._hubId,
+          spans: spans.map(spanToOtlp)
+        })
+      });
+      if (!response.ok) {
+        this._buffer = spans.concat(this._buffer);
+      }
+    } catch {
+      this._buffer = spans.concat(this._buffer);
+    }
+  }
+  // -- Auto-flush -------------------------------------------------------------
+  /**
+   * Start a periodic flush timer.
+   * @param intervalMs  Flush interval in milliseconds (default 30 000).
+   */
+  startAutoFlush(intervalMs = 3e4) {
+    this.stopAutoFlush();
+    this._timer = setInterval(() => {
+      void this.flush();
+    }, intervalMs);
+  }
+  /** Stop the periodic flush timer. Safe to call when not started. */
+  stopAutoFlush() {
+    if (this._timer !== null) {
+      clearInterval(this._timer);
+      this._timer = null;
+    }
+  }
+};
+
 // src/state.ts
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
@@ -45296,6 +45514,7 @@ var SecureChannel = class _SecureChannel extends EventEmitter {
   _a2aPendingQueue = {};
   _scanEngine = null;
   _scanRuleSetVersion = 0;
+  _telemetryReporter = null;
   /** Topic ID from the most recent inbound message — used as fallback for replies. */
   _lastIncomingTopicId;
   // Liveness detection: server sends app-level {"event":"ping"} every 30s.
@@ -45326,6 +45545,10 @@ var SecureChannel = class _SecureChannel extends EventEmitter {
   get sessionCount() {
     return this._sessions.size;
   }
+  /** Returns the TelemetryReporter instance (available after WebSocket connect). */
+  get telemetry() {
+    return this._telemetryReporter;
+  }
   async start() {
     this._stopped = false;
     await libsodium_wrappers_default.ready;
@@ -45870,6 +46093,11 @@ var SecureChannel = class _SecureChannel extends EventEmitter {
       clearTimeout(this._reconnectTimer);
       this._reconnectTimer = null;
     }
+    if (this._telemetryReporter) {
+      this._telemetryReporter.stopAutoFlush();
+      await this._telemetryReporter.flush();
+      this._telemetryReporter = null;
+    }
     if (this._ws) {
       this._ws.removeAllListeners();
       this._ws.close();
@@ -46393,6 +46621,31 @@ var SecureChannel = class _SecureChannel extends EventEmitter {
           this._scanEngine = new ScanEngine();
           await this._fetchScanRules();
         }
+        if (this._persisted && this._persisted.hubAddress && !this._persisted.hubId && this._persisted.deviceJwt) {
+          try {
+            const listRes = await fetch(
+              `${this.config.apiUrl}/api/v1/hub/identities`,
+              { headers: { Authorization: `Bearer ${this._persisted.deviceJwt}` } }
+            );
+            if (listRes.ok) {
+              const identities = await listRes.json();
+              const match = identities.find((h2) => h2.hub_address === this._persisted.hubAddress);
+              if (match) {
+                this._persisted.hubId = match.hub_id;
+                this._persistState();
+              }
+            }
+          } catch {
+          }
+        }
+        if (!this._telemetryReporter && this._persisted?.deviceJwt && this._persisted?.hubId) {
+          this._telemetryReporter = new TelemetryReporter({
+            apiBase: this.config.apiUrl,
+            hubId: this._persisted.hubId,
+            authHeader: `Bearer ${this._persisted.deviceJwt}`
+          });
+          this._telemetryReporter.startAutoFlush(3e4);
+        }
         this.emit("ready");
       } catch (openErr) {
         console.error("[SecureChannel] Error in WS open handler:", openErr);
@@ -46494,6 +46747,7 @@ var SecureChannel = class _SecureChannel extends EventEmitter {
         if (data.event === "hub_identity_assigned") {
           if (this._persisted) {
             this._persisted.hubAddress = data.data.hub_address;
+            this._persisted.hubId = data.data.hub_id;
             this._persistState();
           }
           this.emit("hub_identity_assigned", data.data);
@@ -46501,6 +46755,7 @@ var SecureChannel = class _SecureChannel extends EventEmitter {
         if (data.event === "hub_identity_removed") {
           if (this._persisted) {
             delete this._persisted.hubAddress;
+            delete this._persisted.hubId;
             this._persistState();
           }
           this.emit("hub_identity_removed", data.data);