@nekzus/liop 2.2.0 → 2.3.0

package/dist/index.d.ts

@@ -1,17 +1,19 @@
 export { LiopBridgeOptions, LiopMcpBridge, LiopStreamBridge, LiopStreamBridgeOptions } from './bridge.js';
-import { L as LiopTlsOptions } from './index-qM8ZH8sC.js';
-export { a as LiopClient } from './index-qM8ZH8sC.js';
-export { LiopHybridGateway } from './gateway.js';
+import { L as LiopTlsOptions } from './index-cMV0_yD9.js';
+export { C as CertInfo, a as CertManager, b as CertManagerOptions, c as LiopClient } from './index-cMV0_yD9.js';
+import * as http from 'node:http';
+export { I as InMemoryRateLimiter, L as LiopHybridGateway, a as LiopMcpRouter, R as RateLimitStatus, b as RateLimiterOptions } from './hybrid-CF__0YnC.js';
 export { LiopManifest, MeshNode, MeshNodeConfig } from './mesh.js';
 import * as grpc from '@grpc/grpc-js';
-export { A as AUTH_DEFAULTS, b as AggregationPolicy, c as AuthRole, d as LiopAuthConfig, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, O as OAuthClientConfig, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-BlGc0iym.js';
-import { A as AuthInfo } from './types-sKeUxuky.js';
-export { C as CallToolRequest, a as CallToolResult, G as GetPromptRequest, c as GetPromptResult, J as JwtValidator, M as McpRequest, b as McpResponse, P as Prompt, d as PromptSchema, R as Resource, e as ResourceSchema, S as ServerInfo, T as Tool, f as ToolSchema } from './types-sKeUxuky.js';
+export { A as AUTH_DEFAULTS, b as AggregationPolicy, c as AuditEntry, d as AuditLogger, e as AuditRecordParams, f as AuditStatus, g as AuthRole, G as GENESIS_HASH, h as LiopAuthConfig, L as LiopServer, a as LiopServerOptions, i as LogicExecutionPolicy, N as NerScanner, O as OAuthClientConfig, j as OutputSanitizerConfig, P as PII_PATTERNS, k as PII_PRESETS, l as PiiRule, m as PiiScanner, T as ToolHandler, n as computeEntryHash, o as globalAuditLogger, s as sanitizeOutput } from './index-BW95kAL4.js';
+import { A as AuthInfo } from './types-lJIxBlWF.js';
+export { e as CacheableResult, C as CallToolRequest, a as CallToolResult, D as DiscoverResult, G as GetPromptRequest, d as GetPromptResult, I as InputRequest, f as InputRequiredResult, g as InputResponse, J as JwtValidator, h as MCP_LEGACY_SUPPORT_ENABLED, i as MCP_PROTOCOL_VERSION, j as MCP_PROTOCOL_VERSION_LEGACY, M as McpEra, b as McpRequest, k as McpRequestMeta, c as McpResponse, P as Prompt, l as PromptSchema, R as Resource, m as ResourceSchema, S as ServerInfo, T as Tool, n as ToolSchema } from './types-lJIxBlWF.js';
 import * as jose from 'jose';
 import Provider from 'oidc-provider';
 import '@modelcontextprotocol/sdk/server/mcp.js';
 import 'zod';
 import './verifier-COnid_dg.js';
+import 'node:events';
 
 /**
  * TokenEstimator — Pluggable strategy for counting tokens in text content.
@@ -26,7 +28,7 @@ interface TokenEstimator {
     readonly name: string;
 }
 /**
- * Exact BPE tokenizer using o200k_base encoding.
+ * Exact BPE tokenizer using inlined o200k_base encoding.
  *
  * o200k_base is the standard encoding for all modern OpenAI models
  * (GPT-4o, GPT-4.1, o1, o3, o4) and provides a reasonable baseline
@@ -34,7 +36,7 @@ interface TokenEstimator {
  *
  * - Synchronous: safe for hot-path usage without async overhead
  * - Merge cache reduced to 10K entries for long-running server processes
- * - Zero runtime dependencies beyond gpt-tokenizer itself
+ * - Inlined at build-time: zero external runtime dependencies in node_modules
  */
 declare class RealTokenEstimator implements TokenEstimator {
     readonly name = "o200k_base";
@@ -46,24 +48,19 @@ declare class RealTokenEstimator implements TokenEstimator {
  * Fallback heuristic estimator: ~4 characters per token.
  *
  * Industry-standard approximation (±10% for English/code content).
- * Used only when gpt-tokenizer fails to load in constrained environments.
+ * Used only when tokenizer fails in constrained environments.
  */
 declare class HeuristicTokenEstimator implements TokenEstimator {
     readonly name = "heuristic (chars/4)";
     countTokens(text: string): number;
 }
 /**
- * Factory: creates a RealTokenEstimator with gpt-tokenizer,
- * falling back to HeuristicTokenEstimator if the import fails.
- *
- * Uses dynamic import to avoid blocking SDK initialization and to
- * gracefully degrade in environments where gpt-tokenizer is unavailable.
+ * Factory: creates a RealTokenEstimator with inlined o200k_base,
+ * falling back to HeuristicTokenEstimator if an unexpected error occurs.
  */
 declare function createTokenEstimator(): Promise<TokenEstimator>;
 /**
- * Synchronous factory: creates a HeuristicTokenEstimator immediately.
- * Used when the async factory cannot be awaited (e.g., constructor contexts).
- * The engine should upgrade to the real estimator via setEstimator() later.
+ * Synchronous factory: creates a RealTokenEstimator immediately.
  */
 declare function createSyncTokenEstimator(): TokenEstimator;
 
@@ -199,6 +196,162 @@ declare class LiopError extends Error {
     constructor(code: ErrorCode, message: string);
 }
 
+/**
+ * LIOP gRPC-Web Protocol Adapter (HTTP/1.1 Fallback)
+ *
+ * Implements standard gRPC-Web framing per the official gRPC-Web specification:
+ * https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-WEB.md
+ *
+ * Allows web browsers, corporate Layer 7 HTTP/1.1 proxies, and enterprise WAFs
+ * to invoke LIOP nodes over HTTP/1.1 without requiring HTTP/2 streaming or h2c.
+ *
+ * Frame Format:
+ * - 1 byte: Frame Flag (0x00 = Data Frame, 0x80 = Trailers Frame)
+ * - 4 bytes: 32-bit Big-Endian Unsigned Integer (payload length in bytes)
+ * - N bytes: Message or Trailer payload
+ */
+
+declare const GRPC_WEB_CONSTANTS: {
+    readonly FLAG_DATA: 0;
+    readonly FLAG_TRAILERS: 128;
+    readonly HEADER_LENGTH: 5;
+    readonly CONTENT_TYPE_PREFIX: "application/grpc-web";
+    readonly STATUS_OK: 0;
+    readonly STATUS_CANCELLED: 1;
+    readonly STATUS_UNKNOWN: 2;
+    readonly STATUS_INVALID_ARGUMENT: 3;
+    readonly STATUS_DEADLINE_EXCEEDED: 4;
+    readonly STATUS_NOT_FOUND: 5;
+    readonly STATUS_PERMISSION_DENIED: 7;
+    readonly STATUS_UNAUTHENTICATED: 16;
+    readonly STATUS_INTERNAL: 13;
+};
+interface GrpcWebFrame {
+    isTrailer: boolean;
+    payload: Buffer;
+}
+/**
+ * Checks if an incoming HTTP request is a gRPC-Web request.
+ */
+declare function isGrpcWebRequest(contentType?: string): boolean;
+/**
+ * Encodes a binary payload into a standard 5-byte framed gRPC-Web Data Frame.
+ */
+declare function encodeDataFrame(payload: Buffer | Uint8Array): Buffer;
+/**
+ * Encodes gRPC status and optional message into a 5-byte framed gRPC-Web Trailer Frame.
+ */
+declare function encodeTrailerFrame(status?: number, message?: string, customTrailers?: Record<string, string>): Buffer;
+/**
+ * Parses raw gRPC-Web byte streams into an array of frames.
+ */
+declare function decodeFrames(buffer: Buffer): GrpcWebFrame[];
+/**
+ * Dispatches an HTTP/1.1 gRPC-Web request to an underlying protocol handler
+ * and serializes data and trailer frames back to the client.
+ */
+declare function dispatchGrpcWebRequest(req: http.IncomingMessage, res: http.ServerResponse, handler: (path: string, payload: Buffer) => Promise<{
+    status: number;
+    message?: string;
+    data?: Buffer;
+}>): Promise<void>;
+
+/**
+ * LIOP Prometheus Metrics Registry (Phase Beta-3)
+ * Lightweight, zero-dependency, high-performance metrics collector
+ * complying with Prometheus and OpenMetrics exposition format.
+ */
+type MetricLabels = Record<string, string | number>;
+interface MetricDefinition {
+    name: string;
+    help: string;
+    type: "counter" | "gauge" | "histogram";
+    buckets?: number[];
+}
+declare class Counter {
+    readonly name: string;
+    readonly help: string;
+    private values;
+    constructor(name: string, help: string);
+    inc(labels?: MetricLabels, value?: number): void;
+    get(labels?: MetricLabels): number;
+    reset(): void;
+    toPrometheus(): string[];
+}
+declare class Gauge {
+    readonly name: string;
+    readonly help: string;
+    private values;
+    constructor(name: string, help: string);
+    set(labelsOrValue: MetricLabels | number, maybeValue?: number): void;
+    inc(labels?: MetricLabels, value?: number): void;
+    dec(labels?: MetricLabels, value?: number): void;
+    get(labels?: MetricLabels): number;
+    reset(): void;
+    toPrometheus(): string[];
+}
+declare class Histogram {
+    readonly name: string;
+    readonly help: string;
+    readonly buckets: number[];
+    private observations;
+    constructor(name: string, help: string, buckets?: number[]);
+    observe(labelsOrValue: MetricLabels | number, maybeValue?: number): void;
+    reset(): void;
+    toPrometheus(): string[];
+}
+declare class MetricsRegistry {
+    private counters;
+    private gauges;
+    private histograms;
+    counter(name: string, help: string): Counter;
+    gauge(name: string, help: string): Gauge;
+    histogram(name: string, help: string, buckets?: number[]): Histogram;
+    collectProcessMetrics(): void;
+    exportPrometheusText(): string;
+    resetAll(): void;
+}
+declare const protocolMetrics: MetricsRegistry;
+declare const toolCallsTotal: Counter;
+declare const fuelConsumed: Histogram;
+declare const meshPeersConnected: Gauge;
+declare const manifestCacheSize: Gauge;
+declare const egressBlocksTotal: Counter;
+declare const zkVerificationDurationMs: Histogram;
+
+/**
+ * LIOP OpenTelemetry Distributed Tracing (Phase Beta-3)
+ * W3C TraceContext compliant distributed tracer for gRPC & MCP transports.
+ * Spec: https://www.w3.org/TR/trace-context/
+ */
+interface SpanContext {
+    traceId: string;
+    spanId: string;
+    sampled: boolean;
+}
+interface LiopSpan {
+    readonly name: string;
+    readonly context: SpanContext;
+    readonly startTime: number;
+    endTime?: number;
+    attributes: Record<string, string | number | boolean>;
+    status: "OK" | "ERROR";
+    error?: string;
+    setAttribute(key: string, value: string | number | boolean): LiopSpan;
+    recordException(error: Error | string): LiopSpan;
+    end(): void;
+}
+declare class LiopTracer {
+    static generateTraceId(): string;
+    static generateSpanId(): string;
+    static formatTraceparent(traceId: string, spanId: string, sampled?: boolean): string;
+    static parseTraceparent(header?: string | null): SpanContext | null;
+    static injectTraceparent(carrier: Record<string, string | string[] | undefined>, context: SpanContext): void;
+    static extractTraceparent(carrier: Record<string, string | string[] | undefined>): SpanContext | null;
+    startSpan(name: string, parent?: SpanContext | null, attributes?: Record<string, string | number | boolean>): LiopSpan;
+}
+declare const defaultTracer: LiopTracer;
+
 /**
  * LIOP Cross-AI Prompt Adapters (Fase 92)
  *
@@ -216,6 +369,15 @@ interface PromptConfig {
  */
 declare function generateSystemInstructions(provider: AIProvider): string;
 
+/**
+ * LIOP Production-Grade gRPC Channel Options
+ *
+ * Enforces bidirectional symmetry between LiopRpcServer, LiopRpcClient,
+ * and gateway proxy channels per NIST SP 800-207 continuous verification.
+ * Prevents silent disconnections behind corporate stateful firewalls and NAT gateways.
+ */
+declare const GRPC_CHANNEL_OPTIONS: Readonly<Record<string, string | number>>;
+
 /**
  * TypeScript interfaces reflecting liop_core.proto (LIOP v1)
  * Optimized for logic-on-origin and high-performance serialization.
@@ -252,6 +414,7 @@ interface LogicResponse {
 declare class LiopRpcClient {
     private client;
     private token?;
+    readonly address: string;
     constructor(address: string, tls?: LiopTlsOptions, token?: string);
     /**
      * Negotiates intent with the remote host.
@@ -266,6 +429,92 @@ declare class LiopRpcClient {
     close(): void;
 }
 
+/**
+ * LIOP Post-Quantum Digital Signature Wrapper
+ * Implements ML-DSA-65 (CRYSTALS-Dilithium, NIST FIPS 204) for quantum-resistant
+ * manifest attestation, node revocation receipts, and cryptographic integrity.
+ *
+ * Characteristics:
+ * - Security Category: NIST Level 3 (~AES-192 equivalent quantum resistance)
+ * - Public Key Length: 1952 bytes
+ * - Secret Key Length: 4032 bytes
+ * - Signature Length: 3309 bytes
+ * - Implementation: Pure TypeScript/JS via @noble/post-quantum
+ */
+declare const DILITHIUM65_CONSTANTS: {
+    readonly PUBLIC_KEY_BYTES: 1952;
+    readonly SECRET_KEY_BYTES: 4032;
+    readonly SIGNATURE_BYTES: 3309;
+    readonly DEFAULT_CONTEXT: Uint8Array<ArrayBuffer>;
+};
+declare const Dilithium65Wrapper: {
+    /** Constants */
+    PUBLIC_KEY_BYTES: 1952;
+    SECRET_KEY_BYTES: 4032;
+    SIGNATURE_BYTES: 3309;
+    /**
+     * Generates a new ML-DSA-65 (FIPS 204) key pair.
+     * Optionally accepts a 32-byte seed for deterministic key generation.
+     */
+    generateKeyPair(seed?: Uint8Array): {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    /**
+     * Validates and imports a raw ML-DSA-65 public key.
+     */
+    importPublicKey(buffer: Uint8Array): Uint8Array;
+    /**
+     * Signs a message using the post-quantum secret key.
+     * Supports optional domain separation context (up to 255 bytes).
+     */
+    sign(message: Uint8Array | string, secretKey: Uint8Array, context?: Uint8Array): Uint8Array;
+    /**
+     * Verifies an ML-DSA-65 post-quantum digital signature.
+     */
+    verify(signature: Uint8Array, message: Uint8Array | string, publicKey: Uint8Array, context?: Uint8Array): boolean;
+    /**
+     * Signs a structured manifest (LiopManifest) using canonical JSON serialization.
+     * Returns base64-encoded signature and public key for transport over gRPC/MCP.
+     */
+    signManifest(manifest: Record<string, unknown>, secretKey: Uint8Array, publicKey: Uint8Array): {
+        signature: string;
+        publicKey: string;
+    };
+    /**
+     * Verifies the post-quantum signature of a structured manifest.
+     */
+    verifyManifest(manifest: Record<string, unknown>, signatureBase64: string, publicKeyBase64: string): boolean;
+};
+
+declare const Kyber768Wrapper: {
+    /**
+     * Extracts and validates the 1184-byte Public Key from the Rust LIOP Data Node
+     * @param buffer Raw buffer sent via gRPC IntentResponse
+     */
+    importPublicKey(buffer: Uint8Array): Uint8Array;
+    /**
+     * Encapsulates a shared secret using the server's public key.
+     * Returns the 1088-byte ciphertext to be sent back, and the 32-byte shared AES secret.
+     */
+    encapsulateAsymmetric(publicKey: Uint8Array): Promise<{
+        ciphertext: Uint8Array;
+        sharedSecret: Uint8Array;
+    }>;
+    /**
+     * Generates a Kyber768 KeyPair for the server to accept intents.
+     */
+    generateKeyPair(): Promise<{
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    }>;
+    /**
+     * Decapsulates the shared secret using the server's secret key.
+     * Zero-fills the shared secret buffer after extraction for side-channel protection.
+     */
+    decapsulateSymmetric(ciphertext: Uint8Array, secretKey: Uint8Array): Promise<Uint8Array>;
+};
+
 declare class LiopRpcServer {
     private server;
     constructor();
@@ -274,6 +523,7 @@ declare class LiopRpcServer {
         executeLogic: (call: grpc.ServerWritableStream<LogicRequest, LogicResponse>) => void;
     }): void;
     listen(port?: number, tls?: LiopTlsOptions): Promise<number>;
+    gracefulShutdown(timeoutMs?: number): Promise<void>;
     stop(): Promise<void>;
 }
 
@@ -282,6 +532,11 @@ declare class LiopRpcServer {
  * preventing exposure of sensitive credentials and shell function injection.
  */
 declare function getDefaultEnvironment(): Record<string, string>;
+/**
+ * Calculates deterministic execution fuel units based on AST instruction complexity.
+ * Guarantees identical fuel consumption for the same logic across different hardware.
+ */
+declare function calculateAstInstructionFuel(code: string): number;
 interface SandboxConfig {
     allowEnv?: boolean;
     allowedDirectories?: Record<string, string>;
@@ -428,4 +683,4 @@ declare function authorizeRequest(method: string, auth: AuthInfo | null, additio
 declare const LIOP_SCOPES: readonly ["liop:tools:list", "liop:tools:call", "liop:resources:read", "liop:schema:read", "liop:mesh:query"];
 type LiopScope = (typeof LIOP_SCOPES)[number];
 
-export { type AIProvider, AuthInfo, ErrorCode, HeuristicTokenEstimator, LIOP_SCOPES, LiopError, LiopOTelBridge, LiopRpcClient, LiopRpcServer, type LiopScope, type PromptConfig, RealTokenEstimator, type SandboxConfig, type TokenEstimator, type TokenOperationMetric, type TokenSessionReport, TokenTelemetryEngine, type ToolTokenBreakdown, WasiSandbox, authorizeRequest, buildProtectedResourceMetadata, createOAuthServer, createSyncTokenEstimator, createTokenEstimator, generateSystemInstructions, getDefaultEnvironment };
+export { type AIProvider, AuthInfo, Counter, DILITHIUM65_CONSTANTS, Dilithium65Wrapper, ErrorCode, GRPC_CHANNEL_OPTIONS, GRPC_WEB_CONSTANTS, Gauge, type GrpcWebFrame, HeuristicTokenEstimator, Histogram, Kyber768Wrapper, LIOP_SCOPES, LiopError, LiopOTelBridge, LiopRpcClient, LiopRpcServer, type LiopScope, type LiopSpan, LiopTracer, type MetricDefinition, type MetricLabels, MetricsRegistry, type PromptConfig, RealTokenEstimator, type SandboxConfig, type SpanContext, type TokenEstimator, type TokenOperationMetric, type TokenSessionReport, TokenTelemetryEngine, type ToolTokenBreakdown, WasiSandbox, authorizeRequest, buildProtectedResourceMetadata, calculateAstInstructionFuel, createOAuthServer, createSyncTokenEstimator, createTokenEstimator, decodeFrames, defaultTracer, dispatchGrpcWebRequest, egressBlocksTotal, encodeDataFrame, encodeTrailerFrame, fuelConsumed, generateSystemInstructions, getDefaultEnvironment, isGrpcWebRequest, manifestCacheSize, meshPeersConnected, protocolMetrics, toolCallsTotal, zkVerificationDurationMs };

package/dist/index.js

@@ -1,17 +1,21 @@
-export { WasiSandbox, getDefaultEnvironment } from './chunk-J3WPBMJ5.js';
-export { LiopClient, LiopRpcClient } from './chunk-E5QBDD5E.js';
-export { PromptSchema, ResourceSchema, ToolSchema } from './chunk-CT6NHSYP.js';
-export { LiopMcpBridge, LiopStreamBridge } from './chunk-UVO7DII3.js';
-export { LiopHybridGateway, buildProtectedResourceMetadata } from './chunk-PHTWUTY7.js';
-export { AUTH_DEFAULTS, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, createOAuthServer, sanitizeOutput } from './chunk-2JLG4DET.js';
-export { HeuristicTokenEstimator, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createSyncTokenEstimator, createTokenEstimator } from './chunk-HB5DXX3Q.js';
+export { WasiSandbox, calculateAstInstructionFuel, getDefaultEnvironment } from './chunk-SONUORBT.js';
+export { LiopClient, LiopRpcClient } from './chunk-CRZBVFDV.js';
+export { LiopMcpBridge, LiopStreamBridge } from './chunk-4LQPDN3W.js';
+export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, isGrpcWebRequest } from './chunk-UCJEK75U.js';
+export { AUTH_DEFAULTS, AuditLogger, GENESIS_HASH, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, computeEntryHash, createOAuthServer, globalAuditLogger } from './chunk-UBOQZVV5.js';
+export { sanitizeOutput } from './chunk-JIJPZFR2.js';
+export { HeuristicTokenEstimator, LiopMcpRouter, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createSyncTokenEstimator, createTokenEstimator } from './chunk-GKV6M2PQ.js';
 import './chunk-32ADSAJS.js';
 import './chunk-OUUTDSOW.js';
-import './chunk-QLCOEP5J.js';
-export { LIOP_SCOPES, authorizeRequest } from './chunk-IJHTRIZC.js';
-import './chunk-RDWCGZ2A.js';
-export { MeshNode } from './chunk-NJRSFFD7.js';
-import './chunk-72MNYFR6.js';
+export { Kyber768Wrapper } from './chunk-QLCOEP5J.js';
+export { Counter, DILITHIUM65_CONSTANTS, Dilithium65Wrapper, Gauge, Histogram, LIOP_SCOPES, MetricsRegistry, authorizeRequest, egressBlocksTotal, fuelConsumed, manifestCacheSize, meshPeersConnected, protocolMetrics, toolCallsTotal, zkVerificationDurationMs } from './chunk-OIMJZ64E.js';
+export { GRPC_CHANNEL_OPTIONS } from './chunk-WSW6YJNY.js';
+export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, ToolSchema } from './chunk-PYKRQAER.js';
+export { MeshNode } from './chunk-74CISO2I.js';
+import { log } from './chunk-72MNYFR6.js';
+import * as crypto from 'crypto';
+import { EventEmitter } from 'events';
+import * as fs from 'fs';
 
 // src/errors.ts
 var ErrorCode = /* @__PURE__ */ ((ErrorCode2) => {
@@ -33,6 +37,94 @@ var LiopError = class extends Error {
     this.code = code;
   }
 };
+var TRACEPARENT_REGEX = /^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;
+var LiopTracer = class _LiopTracer {
+  static generateTraceId() {
+    let id;
+    do {
+      id = crypto.randomBytes(16).toString("hex");
+    } while (id === "0".repeat(32));
+    return id;
+  }
+  static generateSpanId() {
+    let id;
+    do {
+      id = crypto.randomBytes(8).toString("hex");
+    } while (id === "0".repeat(16));
+    return id;
+  }
+  static formatTraceparent(traceId, spanId, sampled = true) {
+    const flags = sampled ? "01" : "00";
+    return `00-${traceId}-${spanId}-${flags}`;
+  }
+  static parseTraceparent(header) {
+    if (!header || typeof header !== "string") {
+      return null;
+    }
+    const trimmed = header.trim();
+    const match = TRACEPARENT_REGEX.exec(trimmed);
+    if (!match) {
+      return null;
+    }
+    const [, version, traceId, spanId, flags] = match;
+    if (version === "00") {
+      if (traceId === "0".repeat(32) || spanId === "0".repeat(16)) {
+        return null;
+      }
+    }
+    const sampled = (Number.parseInt(flags, 16) & 1) === 1;
+    return {
+      traceId,
+      spanId,
+      sampled
+    };
+  }
+  static injectTraceparent(carrier, context) {
+    carrier.traceparent = _LiopTracer.formatTraceparent(
+      context.traceId,
+      context.spanId,
+      context.sampled
+    );
+  }
+  static extractTraceparent(carrier) {
+    const val = carrier.traceparent || carrier.Traceparent;
+    if (Array.isArray(val)) {
+      return _LiopTracer.parseTraceparent(val[0]);
+    }
+    return _LiopTracer.parseTraceparent(val);
+  }
+  startSpan(name, parent, attributes = {}) {
+    const traceId = parent?.traceId || _LiopTracer.generateTraceId();
+    const spanId = _LiopTracer.generateSpanId();
+    const sampled = parent ? parent.sampled : true;
+    const context = {
+      traceId,
+      spanId,
+      sampled
+    };
+    const span = {
+      name,
+      context,
+      startTime: Date.now(),
+      attributes: { ...attributes },
+      status: "OK",
+      setAttribute(key, value) {
+        this.attributes[key] = value;
+        return this;
+      },
+      recordException(err) {
+        this.status = "ERROR";
+        this.error = typeof err === "string" ? err : err.message;
+        return this;
+      },
+      end() {
+        this.endTime = Date.now();
+      }
+    };
+    return span;
+  }
+};
+var defaultTracer = new LiopTracer();
 
 // src/prompts/adapters.ts
 var PROVIDER_CONFIGS = {
@@ -92,7 +184,168 @@ Example:
   }
   return instructions;
 }
+var CertManager = class extends EventEmitter {
+  constructor(options) {
+    super();
+    this.options = options;
+    this.warningDays = options.warningDays ?? 30;
+    this.debounceMs = options.debounceMs ?? 150;
+    this.loadCertificates();
+    if (options.watchFiles !== false) {
+      this.setupWatchers();
+    }
+  }
+  rootCertBuffer = null;
+  certChainBuffer = null;
+  privateKeyBuffer = null;
+  watchers = [];
+  reloadDebounceTimer = null;
+  warningDays;
+  debounceMs;
+  /**
+   * Synchronously loads or reloads certificates from filesystem into memory.
+   */
+  loadCertificates() {
+    try {
+      if (this.options.rootCertPath && fs.existsSync(this.options.rootCertPath)) {
+        this.rootCertBuffer = fs.readFileSync(this.options.rootCertPath);
+      }
+      if (!fs.existsSync(this.options.certChainPath)) {
+        throw new Error(
+          `Certificate chain file not found: ${this.options.certChainPath}`
+        );
+      }
+      if (!fs.existsSync(this.options.privateKeyPath)) {
+        throw new Error(
+          `Private key file not found: ${this.options.privateKeyPath}`
+        );
+      }
+      this.certChainBuffer = fs.readFileSync(this.options.certChainPath);
+      this.privateKeyBuffer = fs.readFileSync(this.options.privateKeyPath);
+      log.info("[CertManager] Certificates loaded successfully.");
+    } catch (error) {
+      log.error(`[CertManager] Failed to load certificates: ${error}`);
+      throw error;
+    }
+  }
+  /**
+   * Inspects the loaded server/client certificate chain using Node.js native X509Certificate.
+   */
+  inspectCertificate() {
+    if (!this.certChainBuffer) {
+      throw new Error("[CertManager] No certificate loaded to inspect.");
+    }
+    const x509 = new crypto.X509Certificate(this.certChainBuffer);
+    const validToDate = new Date(x509.validTo);
+    const now = /* @__PURE__ */ new Date();
+    const msRemaining = validToDate.getTime() - now.getTime();
+    const daysRemaining = Math.max(
+      0,
+      Math.floor(msRemaining / (1e3 * 60 * 60 * 24))
+    );
+    const isExpired = msRemaining <= 0;
+    const isExpiringSoon = daysRemaining <= this.warningDays;
+    return {
+      subject: x509.subject,
+      issuer: x509.issuer,
+      validFrom: x509.validFrom,
+      validTo: x509.validTo,
+      fingerprint256: x509.fingerprint256,
+      daysRemaining,
+      isExpired,
+      isExpiringSoon
+    };
+  }
+  /**
+   * Sets up non-blocking filesystem watchers to detect certificate renewals
+   * and trigger hot-reloading without process restarts.
+   */
+  setupWatchers() {
+    const filesToWatch = [
+      this.options.certChainPath,
+      this.options.privateKeyPath,
+      this.options.rootCertPath
+    ].filter((p) => Boolean(p && fs.existsSync(p)));
+    for (const filePath of filesToWatch) {
+      try {
+        const watcher = fs.watch(filePath, () => {
+          this.scheduleReload();
+        });
+        this.watchers.push(watcher);
+      } catch (err) {
+        log.warn(
+          `[CertManager] Could not watch ${filePath} for hot reloading: ${err}`
+        );
+      }
+    }
+  }
+  /**
+   * Debounces reload events to ensure files have finished writing.
+   */
+  scheduleReload() {
+    if (this.reloadDebounceTimer) {
+      clearTimeout(this.reloadDebounceTimer);
+    }
+    this.reloadDebounceTimer = setTimeout(() => {
+      try {
+        this.loadCertificates();
+        const certInfo = this.inspectCertificate();
+        log.info(
+          `[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`
+        );
+        this.emit("reload", certInfo);
+      } catch (error) {
+        log.error(`[CertManager] Hot reload failed: ${error}`);
+        this.emit("error", error);
+      }
+    }, this.debounceMs);
+  }
+  /**
+   * Manually triggers a reload of certificates and emits the 'reload' event.
+   */
+  reload() {
+    this.loadCertificates();
+    const certInfo = this.inspectCertificate();
+    log.info(
+      `[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`
+    );
+    this.emit("reload", certInfo);
+    return certInfo;
+  }
+  getRootCert() {
+    return this.rootCertBuffer;
+  }
+  getCertChain() {
+    if (!this.certChainBuffer) {
+      throw new Error("[CertManager] Certificate chain not loaded.");
+    }
+    return this.certChainBuffer;
+  }
+  getPrivateKey() {
+    if (!this.privateKeyBuffer) {
+      throw new Error("[CertManager] Private key not loaded.");
+    }
+    return this.privateKeyBuffer;
+  }
+  /**
+   * Stops all active file watchers and releases resources.
+   */
+  dispose() {
+    if (this.reloadDebounceTimer) {
+      clearTimeout(this.reloadDebounceTimer);
+      this.reloadDebounceTimer = null;
+    }
+    for (const watcher of this.watchers) {
+      try {
+        watcher.close();
+      } catch {
+      }
+    }
+    this.watchers = [];
+    this.removeAllListeners();
+  }
+};
 
-export { ErrorCode, LiopError, generateSystemInstructions };
+export { CertManager, ErrorCode, LiopError, LiopTracer, defaultTracer, generateSystemInstructions };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map