@nekzus/liop 2.4.0-alpha.7 → 2.4.0-alpha.8

package/dist/{chunk-32ADSAJS.js → chunk-PEN3KFLF.js}

@@ -1,5 +1,6 @@
-import { deriveLogicImageDigest } from './chunk-OUUTDSOW.js';
-import { log } from './chunk-72MNYFR6.js';
+import { deriveLogicImageDigest } from './chunk-IK7CGWAZ.js';
+import { zkVerificationDurationMs } from './chunk-PAICJCKJ.js';
+import { log } from './chunk-HA6YZ42O.js';
 import * as fs from 'fs';
 import { createRequire } from 'module';
 import path from 'path';
@@ -61,6 +62,7 @@ var LiopVerifier = class _LiopVerifier {
   async verifyZkReceipt(logicPayload, remoteImageIdHex, zkReceipt, sessionSecret, expectedOutput) {
     const pool = this.getZkPool();
     if (!pool) throw new Error("Worker pool initialization failed");
+    const startTime = performance.now();
     const result = await pool.run({
       action: "verify_receipt",
       logicPayload: new Uint8Array(logicPayload),
@@ -69,6 +71,14 @@ var LiopVerifier = class _LiopVerifier {
       sessionSecret: sessionSecret ? new Uint8Array(sessionSecret) : void 0,
       expectedOutput
     });
+    const durationMs = performance.now() - startTime;
+    try {
+      zkVerificationDurationMs.observe(
+        { status: result.verified ? "verified" : "failed" },
+        durationMs
+      );
+    } catch {
+    }
     if (result.verified) {
       log.info(`[LiopVerifier] ${result.message}`);
       return true;
@@ -100,5 +110,5 @@ var LiopVerifier = class _LiopVerifier {
 };
 
 export { LiopVerifier };
-//# sourceMappingURL=chunk-32ADSAJS.js.map
-//# sourceMappingURL=chunk-32ADSAJS.js.map
+//# sourceMappingURL=chunk-PEN3KFLF.js.map
+//# sourceMappingURL=chunk-PEN3KFLF.js.map

package/dist/chunk-PEN3KFLF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/crypto/verifier.ts"],"names":["__filename","__dirname"],"mappings":";;;;;;;;;AAYA,IAAMA,YAAA,GAAa,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAChD,IAAMC,WAAA,GAAY,IAAA,CAAK,OAAA,CAAQD,YAAU,CAAA;AASlC,IAAM,YAAA,GAAN,MAAM,aAAA,CAAa;AAAA;AAAA,EAEzB,OAAe,YAAA,GAA+B,IAAA;AAAA,EAEtC,SAAA,GAAY;AACnB,IAAA,IAAI,CAAC,cAAa,YAAA,EAAc;AAC/B,MAAA,MAAM,IAAA,GAAO,MAAA,CAAA,IAAA,CAAY,GAAA,CAAI,QAAA,CAAS,KAAK,CAAA;AAC3C,MAAA,MAAM,SAAA,GAAY,OAAO,KAAA,GAAQ,KAAA;AAEjC,MAAA,IAAI,WAAqB,EAAC;AAC1B,MAAA,IAAI,IAAA,EAAM;AACT,QAAA,IAAI;AACH,UAAA,MAAM,GAAA,GAAM,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AACzC,UAAA,MAAM,MAAA,GAAS,GAAA,CAAI,OAAA,CAAQ,kBAAkB,CAAA;AAC7C,UAAA,MAAM,WAAA,GAAc,aAAA;AAAA,YACnB,KAAK,IAAA,CAAK,IAAA,CAAK,QAAQ,MAAM,CAAA,EAAG,QAAQ,YAAY;AAAA,WACrD,CAAE,IAAA;AACF,UAAA,QAAA,GAAW,CAAC,YAAY,WAAW,CAAA;AAAA,QACpC,SAAS,EAAA,EAAI;AACZ,UAAA,QAAA,GAAW,CAAC,YAAY,KAAK,CAAA;AAAA,QAC9B;AAAA,MACD;AAGA,MAAA,MAAM,WAAA,GAAc;AAAA,QACnB,IAAA,CAAK,OAAA,CAAQC,WAAA,EAAW,CAAA,qBAAA,EAAwB,SAAS,CAAA,CAAE,CAAA;AAAA;AAAA,QAC3D,IAAA,CAAK,OAAA,CAAQA,WAAA,EAAW,CAAA,sBAAA,EAAyB,SAAS,CAAA,CAAE;AAAA;AAAA,OAC7D;AAEA,MAAA,MAAM,cAAA,GACL,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAS,cAAW,CAAC,CAAC,CAAA,IAAK,WAAA,CAAY,CAAC,CAAA;AAE3D,MAAA,aAAA,CAAa,YAAA,GAAe,IAAI,OAAA,CAAQ;AAAA,QACvC,QAAA,EAAU,cAAA;AAAA,QACV,UAAA,EAAY,CAAA;AAAA,QACZ,UAAA,EAAY,CAAA;AAAA;AAAA,QACZ,WAAA,EAAa,GAAA;AAAA,QACb;AAAA,OACA,CAAA;AAGD,MAAA,aAAA,CAAa,YAAA,CAAa,IAAI,EAAE,MAAA,EAAQ,UAAU,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ;AAClE,QAAA,GAAA,CAAI,KAAA;AAAA,UACH,CAAA,sDAAA,EAAyD,IAAI,OAAO,CAAA;AAAA,SACrE;AAAA,MACD,CAAC,CAAA;AAAA,IACF;AACA,IAAA,OAAO,aAAA,CAAa,YAAA;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAa,eAAA,CACZ,YAAA,EACA,gBAAA,EACA,SAAA,EACA,eACA,cAAA,EACmB;AACnB,IAAA,MAAM,IAAA,GAAO,KAAK,SAAA,EAAU;AAC5B,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAC9D,IAAA,MAAM,SAAA,GAAY,YAAY,GAAA,EAAI;AAClC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI;AAAA,MAC7B,MAAA,EAAQ,gBAAA;AAAA,MACR,YAAA,EAAc,IAAI,UAAA,CAAW,YAAY,CAAA;AAAA,MACzC,gBAAA;AAAA,MACA,SAAA,EAAW,IAAI,UAAA,CAAW,SAAS,CAAA;AAAA,MACnC,aAAA,EAAe,aAAA,GAAgB,IAAI,UAAA,CAAW,aAAa,CAAA,GAAI,MAAA;AAAA,MAC/D;AAAA,KACA,CAAA;AACD,IAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AAEvC,IAAA,IAAI;AACH,MAAA,wBAAA,CAAyB,OAAA;AAAA,QACxB,EAAE,MAAA,EAAQ,MAAA,CAAO,QAAA,GAAW,aAAa,QAAA,EAAS;AAAA,QAClD;AAAA,OACD;AAAA,IACD,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,IAAI,OAAO,QAAA,EAAU;AACpB,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,eAAA,EAAkB,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAC3C,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,GAAA,CAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AACpD,IAAA,OAAO,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,qBACZ,iBAAA,EACmB;AACnB,IAAA,IAAI,iBAAA,CAAkB,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAE3C,IAAA,IAAI;AAKH,MAAA,GAAA,CAAI,KAAK,yDAAyD,CAAA;AAClE,MAAA,OAAO,IAAA;AAAA,IACR,SAAS,GAAA,EAAK;AACb,MAAA,GAAA,CAAI,KAAA,CAAM,2CAA2C,GAAG,CAAA;AACxD,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,cAAc,YAAA,EAA8B;AAClD,IAAA,OAAO,uBAAuB,YAAY,CAAA;AAAA,EAC3C;AACD","file":"chunk-PEN3KFLF.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport * as fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\nimport { Piscina } from \"piscina\";\nimport { zkVerificationDurationMs } from \"../observability/metrics.js\";\nimport { log } from \"../utils/logger.js\";\nimport { deriveLogicImageDigest } from \"./logic-image-id.js\";\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = path.dirname(__filename);\n\n/**\n * LIOP Tier-0 Industrial Verifier\n *\n * This engine is responsible for the trustless verification of remote logic execution.\n * It validates both the integrity of the code (ZkImageID) and the mathematical proof\n * of its execution (ZkSeal), as well as hardware-level attestation (TEE).\n */\nexport class LiopVerifier {\n\t// Singleton Worker Pool for heavy ZK verification\n\tprivate static zkWorkerPool: Piscina | null = null;\n\n\tprivate getZkPool() {\n\t\tif (!LiopVerifier.zkWorkerPool) {\n\t\t\tconst isTS = import.meta.url.endsWith(\".ts\");\n\t\t\tconst workerExt = isTS ? \".ts\" : \".js\";\n\n\t\t\tlet execArgv: string[] = [];\n\t\t\tif (isTS) {\n\t\t\t\ttry {\n\t\t\t\t\tconst req = createRequire(import.meta.url);\n\t\t\t\t\tconst tsxPkg = req.resolve(\"tsx/package.json\");\n\t\t\t\t\tconst absoluteTsx = pathToFileURL(\n\t\t\t\t\t\tpath.join(path.dirname(tsxPkg), \"dist\", \"loader.mjs\"),\n\t\t\t\t\t).href;\n\t\t\t\t\texecArgv = [\"--import\", absoluteTsx];\n\t\t\t\t} catch (_e) {\n\t\t\t\t\texecArgv = [\"--import\", \"tsx\"];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Support both flat dist/ and original src/ structure\n\t\t\tconst workerPaths = [\n\t\t\t\tpath.resolve(__dirname, `./workers/zk-verifier${workerExt}`), // Flat dist/ (tsup)\n\t\t\t\tpath.resolve(__dirname, `../workers/zk-verifier${workerExt}`), // Original src/\n\t\t\t];\n\n\t\t\tconst workerFilename =\n\t\t\t\tworkerPaths.find((p) => fs.existsSync(p)) || workerPaths[1];\n\n\t\t\tLiopVerifier.zkWorkerPool = new Piscina({\n\t\t\t\tfilename: workerFilename,\n\t\t\t\tminThreads: 1,\n\t\t\t\tmaxThreads: 2, // Minimal footprint since verification is fast compared to generation\n\t\t\t\tidleTimeout: 30000,\n\t\t\t\texecArgv,\n\t\t\t});\n\n\t\t\t// Pre-warm the verification worker\n\t\t\tLiopVerifier.zkWorkerPool.run({ action: \"warmup\" }).catch((err) => {\n\t\t\t\tlog.debug(\n\t\t\t\t\t`[LiopVerifier] Verification pool warm-up ping failed: ${err.message}`,\n\t\t\t\t);\n\t\t\t});\n\t\t}\n\t\treturn LiopVerifier.zkWorkerPool;\n\t}\n\n\t/**\n\t * Verifies a Zero-Knowledge Receipt from a remote LIOP node via Worker Pool.\n\t *\n\t * @param logicPayload The raw WASM or JS logic that was sent to the provider.\n\t * @param remoteImageIdHex The ImageID reported by the provider (must match our local calculation).\n\t * @param zkReceipt The mathematical proof (Seal + Journal) from the zkVM.\n\t */\n\tpublic async verifyZkReceipt(\n\t\tlogicPayload: Buffer,\n\t\tremoteImageIdHex: string,\n\t\tzkReceipt: Buffer,\n\t\tsessionSecret?: Buffer,\n\t\texpectedOutput?: unknown,\n\t): Promise<boolean> {\n\t\tconst pool = this.getZkPool();\n\t\tif (!pool) throw new Error(\"Worker pool initialization failed\");\n\t\tconst startTime = performance.now();\n\t\tconst result = await pool.run({\n\t\t\taction: \"verify_receipt\",\n\t\t\tlogicPayload: new Uint8Array(logicPayload),\n\t\t\tremoteImageIdHex,\n\t\t\tzkReceipt: new Uint8Array(zkReceipt),\n\t\t\tsessionSecret: sessionSecret ? new Uint8Array(sessionSecret) : undefined,\n\t\t\texpectedOutput,\n\t\t});\n\t\tconst durationMs = performance.now() - startTime;\n\n\t\ttry {\n\t\t\tzkVerificationDurationMs.observe(\n\t\t\t\t{ status: result.verified ? \"verified\" : \"failed\" },\n\t\t\t\tdurationMs,\n\t\t\t);\n\t\t} catch {\n\t\t\t// Metrics observation failure must never disrupt cryptographic verification\n\t\t}\n\n\t\tif (result.verified) {\n\t\t\tlog.info(`[LiopVerifier] ${result.message}`);\n\t\t\treturn true;\n\t\t}\n\n\t\tlog.error(`[LiopVerifier] FAILED: ${result.message}`);\n\t\treturn false;\n\t}\n\n\t/**\n\t * Verifies if a node is running inside an authenticated TEE (e.g. AWS Nitro).\n\t *\n\t * @param attestationReport The COSE-signed attestation document from the hardware.\n\t */\n\tpublic async verifyTeeAttestation(\n\t\tattestationReport: Buffer,\n\t): Promise<boolean> {\n\t\tif (attestationReport.length === 0) return true; // Optional in Mesh Alpha\n\n\t\ttry {\n\t\t\t// Architecture for AWS Nitro Enclaves:\n\t\t\t// 1. Decode CBOR/COSE\n\t\t\t// 2. Verify Signature against AWS Nitro Root CA\n\t\t\t// 3. Compare PCRs\n\t\t\tlog.info(\"[LiopVerifier] TEE Attestation: Not configured (no-op).\");\n\t\t\treturn true;\n\t\t} catch (err) {\n\t\t\tlog.error(\"[LiopVerifier] TEE Verification Failed:\", err);\n\t\t\treturn false;\n\t\t}\n\t}\n\n\t/**\n\t * Derives the ImageID of a logic payload following the LIOP v1 Standard.\n\t */\n\tpublic deriveImageId(logicPayload: Buffer): Buffer {\n\t\treturn deriveLogicImageDigest(logicPayload);\n\t}\n}\n"]}

package/dist/{chunk-CRZBVFDV.js → chunk-T7R5HUFD.js}

@@ -1,9 +1,12 @@
-import { LiopVerifier } from './chunk-32ADSAJS.js';
-import { Kyber768Wrapper } from './chunk-QLCOEP5J.js';
-import { createChannelCredentials, liopV1, GRPC_CHANNEL_OPTIONS } from './chunk-WSW6YJNY.js';
-import { MCP_PROTOCOL_VERSION, MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION_LEGACY } from './chunk-PYKRQAER.js';
-import { MeshNode } from './chunk-74CISO2I.js';
-import { log } from './chunk-72MNYFR6.js';
+import { TokenManager } from './chunk-ESRXG36Y.js';
+import { TokenTelemetryEngine } from './chunk-DZ2FQGJD.js';
+import { LiopVerifier } from './chunk-PEN3KFLF.js';
+import { Kyber768Wrapper } from './chunk-7PITYWOV.js';
+import { createChannelCredentials, liopV1, GRPC_CHANNEL_OPTIONS } from './chunk-TKRX6CFI.js';
+import { pqcHandshakesTotal, pqcHandshakeDurationMs, zkVerificationsTotal, toolCallErrorsTotal, wireEgressBytesTotal } from './chunk-PAICJCKJ.js';
+import { MCP_PROTOCOL_VERSION, MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION_LEGACY } from './chunk-EG46XMJT.js';
+import { MeshNode } from './chunk-7RXOIDXP.js';
+import { log } from './chunk-HA6YZ42O.js';
 import * as grpc from '@grpc/grpc-js';
 import { createDecipheriv, randomBytes, createCipheriv } from 'crypto';
 
@@ -11,6 +14,7 @@ var LiopRpcClient = class {
   // biome-ignore lint/suspicious/noExplicitAny: internal gRPC client type
   client;
   token;
+  lastResolvedToken;
   address;
   constructor(address, tls, token) {
     const credentials = createChannelCredentials(tls);
@@ -20,17 +24,35 @@ var LiopRpcClient = class {
       GRPC_CHANNEL_OPTIONS
     );
     this.token = token;
+    if (typeof token === "string") {
+      this.lastResolvedToken = token;
+    }
     this.address = address;
   }
+  setToken(token) {
+    this.token = token;
+    if (typeof token === "string") {
+      this.lastResolvedToken = token;
+    }
+  }
+  async resolveToken() {
+    if (typeof this.token === "function") {
+      this.lastResolvedToken = await this.token();
+      return this.lastResolvedToken;
+    }
+    this.lastResolvedToken = this.token;
+    return this.token;
+  }
   /**
    * Negotiates intent with the remote host.
    * Returns the ephemeral Kyber public key for payload encryption.
    */
   async negotiateIntent(request) {
+    const activeToken = await this.resolveToken();
     return new Promise((resolve, reject) => {
       const metadata = new grpc.Metadata();
-      if (this.token) {
-        metadata.add("authorization", `Bearer ${this.token}`);
+      if (activeToken) {
+        metadata.add("authorization", `Bearer ${activeToken}`);
       }
       this.client.NegotiateIntent(
         request,
@@ -51,8 +73,9 @@ var LiopRpcClient = class {
    */
   executeLogic(request) {
     const metadata = new grpc.Metadata();
-    if (this.token) {
-      metadata.add("authorization", `Bearer ${this.token}`);
+    const activeToken = this.lastResolvedToken || (typeof this.token === "string" ? this.token : void 0);
+    if (activeToken) {
+      metadata.add("authorization", `Bearer ${activeToken}`);
     }
     return this.client.ExecuteLogic(request, metadata);
   }
@@ -108,6 +131,7 @@ var LiopClient = class {
   serverInfo;
   verifier = new LiopVerifier();
   oauthToken;
+  tokenManager;
   /** Protocol negotiation era */
   era = "modern";
   /** Negotiated protocol version */
@@ -115,40 +139,6 @@ var LiopClient = class {
   constructor(tls) {
     this.tlsOptions = tls;
   }
-  /**
-   * Requests an M2M access token from the Nexus Authorization Server using Client Credentials.
-   */
-  async acquireM2MToken(authOpts) {
-    const baseUrl = authOpts.nexusUrl.endsWith("/oidc") ? authOpts.nexusUrl : `${authOpts.nexusUrl}/oidc`;
-    const tokenUrl = `${baseUrl}/token`;
-    log.info(`[LiopClient] Requesting M2M Token from Nexus AS: ${tokenUrl}`);
-    const params = new URLSearchParams({
-      grant_type: "client_credentials",
-      scope: authOpts.scope || "liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query",
-      resource: authOpts.audience,
-      client_id: authOpts.clientId,
-      client_secret: authOpts.clientSecret
-    });
-    const response = await fetch(tokenUrl, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
-      body: params.toString()
-    });
-    if (!response.ok) {
-      const text = await response.text();
-      throw new Error(
-        `OAuth token request failed with status ${response.status}: ${text}`
-      );
-    }
-    const data = await response.json();
-    if (!data.access_token) {
-      throw new Error("OAuth token response did not contain an access_token.");
-    }
-    log.info("[LiopClient] M2M Token acquired successfully.");
-    return data.access_token;
-  }
   /**
    * Discovers and connects to the target server or mesh capability.
    * If address is omitted, it sets up the MeshNode to act purely dynamically.
@@ -161,14 +151,20 @@ var LiopClient = class {
     const scope = options?.auth?.scope || process.env.LIOP_OAUTH_SCOPE || "liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query";
     this.oauthToken = options?.auth?.token || process.env.LIOP_OAUTH_TOKEN || process.env.LIOP_TOKEN;
     if (clientId && clientSecret) {
+      const baseUrl = (nexusUrl).endsWith("/oidc") ? nexusUrl : `${nexusUrl}/oidc`;
+      const tokenEndpoint = `${baseUrl}/token`;
+      this.tokenManager = new TokenManager({
+        tokenEndpoint,
+        clientId,
+        clientSecret,
+        audience,
+        scopes: scope
+      });
       try {
-        this.oauthToken = await this.acquireM2MToken({
-          clientId,
-          clientSecret,
-          nexusUrl,
-          audience,
-          scope
-        });
+        this.oauthToken = await this.tokenManager.getToken();
+        log.info(
+          "[LiopClient] Dynamic TokenManager configured and initial token acquired."
+        );
       } catch (err) {
         log.error(
           `[LiopClient] Failed to acquire OAuth M2M Token: ${err instanceof Error ? err.message : String(err)}`
@@ -181,9 +177,15 @@ var LiopClient = class {
       `[LiopClient] Mesh Node synchronized. PeerID: ${this.meshNode.getPeerId()}`
     );
     if (address) {
+      const tokenResolver = async () => {
+        if (this.tokenManager) {
+          return await this.tokenManager.getToken();
+        }
+        return this.oauthToken;
+      };
       this.rpcClients.set(
         "static",
-        new LiopRpcClient(address, this.tlsOptions, this.oauthToken)
+        new LiopRpcClient(address, this.tlsOptions, tokenResolver)
       );
       this.serverInfo = { name: `LiopServer (${address})`, version: "1.0.0" };
       log.info(`[LiopClient] Static gRPC configured for: ${address}`);
@@ -313,6 +315,7 @@ var LiopClient = class {
     if (!this.meshNode) {
       throw new Error("Client must be connected before discovering tools.");
     }
+    const discoveryStartTime = Date.now();
     log.info(
       `[LiopClient] Discovery started (forceRefresh: ${forceRefresh})...`
     );
@@ -349,6 +352,19 @@ var LiopClient = class {
     log.info(
       `[LiopClient] Discovery finished. Found ${tools.length} unique tools.`
     );
+    try {
+      const telemetry = TokenTelemetryEngine.getInstance();
+      const toolsPayload = JSON.stringify(tools);
+      const toolsResponsePayload = JSON.stringify({ tools });
+      telemetry.record({
+        type: "tools_list",
+        method: "discoverTools",
+        estimatedInputTokens: telemetry.countTokens(toolsPayload),
+        estimatedOutputTokens: telemetry.countTokens(toolsResponsePayload),
+        durationMs: Date.now() - discoveryStartTime
+      });
+    } catch {
+    }
     return tools;
   }
   /**
@@ -358,6 +374,7 @@ var LiopClient = class {
     if (!this.meshNode) {
       throw new Error("Client must be connected before calling tools.");
     }
+    const callStartTime = Date.now();
     const toolName = request.name;
     log.info(`[LiopClient] Resolving Tool: ${toolName}`);
     let rpcClient = this.rpcClients.get("static");
@@ -405,13 +422,52 @@ var LiopClient = class {
     const agentDid = this.meshNode ? `did:liop:${this.meshNode.getPeerId()}` : "did:liop:ephemeral";
     const intentPayload = Buffer.from(`${toolName}:${Date.now()}`);
     const proofOfIntent = this.meshNode ? await this.meshNode.sign(intentPayload) : intentPayload;
-    const intentResponse = await rpcClient.negotiateIntent({
-      agent_did: agentDid,
-      capability_hash: toolName,
-      proof_of_intent: proofOfIntent
-    });
+    let intentResponse;
+    try {
+      intentResponse = await rpcClient.negotiateIntent({
+        agent_did: agentDid,
+        capability_hash: toolName,
+        proof_of_intent: proofOfIntent
+      });
+    } catch (err) {
+      const errMsg = err instanceof Error ? err.message : String(err);
+      if (this.tokenManager && (errMsg.includes("UNAUTHENTICATED") || errMsg.includes("Invalid JWT") || errMsg.includes("timestamp check failed") || errMsg.includes("expired"))) {
+        log.warn(
+          `[LiopClient] Token expired/unauthenticated for ${toolName}. Preemptively refreshing OAuth token and retrying negotiateIntent...`
+        );
+        this.tokenManager.invalidate();
+        const freshToken = await this.tokenManager.getToken();
+        this.oauthToken = freshToken;
+        rpcClient.setToken(freshToken);
+        intentResponse = await rpcClient.negotiateIntent({
+          agent_did: agentDid,
+          capability_hash: toolName,
+          proof_of_intent: proofOfIntent
+        });
+      } else {
+        throw err;
+      }
+    }
     if (!intentResponse.accepted) {
-      throw new Error(`Intent denied by host: ${intentResponse.error_message}`);
+      if (this.tokenManager && (intentResponse.error_message?.includes("token") || intentResponse.error_message?.includes("UNAUTHENTICATED") || intentResponse.error_message?.includes("expired") || intentResponse.error_message?.includes("timestamp check failed"))) {
+        log.warn(
+          `[LiopClient] Intent rejected with auth error: "${intentResponse.error_message}". Refreshing token and retrying...`
+        );
+        this.tokenManager.invalidate();
+        const freshToken = await this.tokenManager.getToken();
+        this.oauthToken = freshToken;
+        rpcClient.setToken(freshToken);
+        intentResponse = await rpcClient.negotiateIntent({
+          agent_did: agentDid,
+          capability_hash: toolName,
+          proof_of_intent: proofOfIntent
+        });
+      }
+      if (!intentResponse.accepted) {
+        throw new Error(
+          `Intent denied by host: ${intentResponse.error_message}`
+        );
+      }
     }
     const publicKey = intentResponse.kyber_public_key || intentResponse.kyberPublicKey;
     const sessionToken = intentResponse.session_token || intentResponse.sessionToken;
@@ -420,6 +476,13 @@ var LiopClient = class {
         "[LiopClient] Critical Error: Kyber Public Key not found in IntentResponse.",
         intentResponse
       );
+      try {
+        pqcHandshakesTotal.inc({
+          algorithm: "ml-kem-768",
+          status: "failure"
+        });
+      } catch {
+      }
       throw new Error(
         "Handshake failed: Remote host did not provide a valid Kyber Public Key."
       );
@@ -427,7 +490,29 @@ var LiopClient = class {
     log.info(
       `[LiopClient] Encapsulating Post-Quantum Shared Secret for ${request.name}...`
     );
-    const { ciphertext: kyberCiphertext, sharedSecret } = await Kyber768Wrapper.encapsulateAsymmetric(publicKey);
+    const pqcStart = performance.now();
+    let kyberCiphertext;
+    let sharedSecret;
+    try {
+      const res = await Kyber768Wrapper.encapsulateAsymmetric(publicKey);
+      kyberCiphertext = res.ciphertext;
+      sharedSecret = res.sharedSecret;
+      const pqcDuration = performance.now() - pqcStart;
+      pqcHandshakeDurationMs.observe({ tool: request.name }, pqcDuration);
+      pqcHandshakesTotal.inc({
+        algorithm: "ml-kem-768",
+        status: "success"
+      });
+    } catch (encapError) {
+      try {
+        pqcHandshakesTotal.inc({
+          algorithm: "ml-kem-768",
+          status: "failure"
+        });
+      } catch {
+      }
+      throw encapError;
+    }
     log.info(`[LiopClient] Sealing WASM Payload and Inputs...`);
     const _safePayload = _wasmPayload || Buffer.from("");
     const { ciphertext: encryptedWasm, nonce: aesNonce } = AesGcmWrapper.encryptPayload(_safePayload, sharedSecret);
@@ -475,7 +560,20 @@ var LiopClient = class {
               Buffer.from(sharedSecret),
               response.semantic_evidence
             );
+            try {
+              zkVerificationsTotal.inc({
+                status: isValid ? "valid" : "invalid"
+              });
+            } catch {
+            }
             if (!isValid) {
+              try {
+                toolCallErrorsTotal.inc({
+                  capability: toolName,
+                  error_type: "zk_verification_failed"
+                });
+              } catch {
+              }
               reject(
                 new Error(
                   "PROTOCOL INTEGRITY VIOLATION: ZK-Receipt verification failed."
@@ -483,8 +581,34 @@ var LiopClient = class {
               );
               return;
             }
+          } else {
+            try {
+              toolCallErrorsTotal.inc({
+                capability: toolName,
+                error_type: "remote_execution_error"
+              });
+            } catch {
+            }
           }
           resultFulfilled = true;
+          try {
+            const telemetry = TokenTelemetryEngine.getInstance();
+            const inputPayload = JSON.stringify(request.arguments ?? {});
+            telemetry.record({
+              type: "tool_call",
+              method: "callTool",
+              toolName,
+              peerId: targetClientKey !== toolName ? targetClientKey : void 0,
+              estimatedInputTokens: telemetry.countTokens(inputPayload),
+              estimatedOutputTokens: telemetry.countTokens(
+                response.semantic_evidence
+              ),
+              durationMs: Date.now() - callStartTime
+            });
+            const egressBytes = Buffer.byteLength(response.semantic_evidence || "") + (response.cryptographic_proof ? response.cryptographic_proof.length : 0) + (response.zk_receipt ? response.zk_receipt.length : 0);
+            wireEgressBytesTotal.inc({ capability: toolName }, egressBytes);
+          } catch {
+          }
           resolve({
             content: [
               {
@@ -495,12 +619,26 @@ var LiopClient = class {
             isError: response.is_error
           });
         } catch (err) {
+          try {
+            toolCallErrorsTotal.inc({
+              capability: toolName,
+              error_type: "verification_exception"
+            });
+          } catch {
+          }
           reject(err);
         }
       });
       stream.on("error", (err) => {
         this.rpcClients.delete(targetClientKey);
         this.rpcClients.delete(toolName);
+        try {
+          toolCallErrorsTotal.inc({
+            capability: toolName,
+            error_type: "stream_error"
+          });
+        } catch {
+        }
         if (resultFulfilled) return;
         log.error("[LiopClient] Stream Error:", err);
         reject(err);
@@ -515,7 +653,6 @@ var LiopClient = class {
   getOrCreateRpcClient(peerId, address) {
     let client = this.rpcClients.get(peerId);
     if (!client) {
-      let nodeToken = this.oauthToken;
       let manifest = this.manifests.get(peerId);
       let realPeerId = peerId;
       if (!manifest) {
@@ -560,9 +697,15 @@ var LiopClient = class {
         log.info(
           `[LiopClient] Resolved node-specific token for peer ${realPeerId.slice(-8)} (${providerName || "unknown"})`
         );
-        nodeToken = envToken;
       }
-      client = new LiopRpcClient(address, this.tlsOptions, nodeToken);
+      const tokenResolver = async () => {
+        if (envToken) return envToken;
+        if (this.tokenManager) {
+          return await this.tokenManager.getToken();
+        }
+        return this.oauthToken;
+      };
+      client = new LiopRpcClient(address, this.tlsOptions, tokenResolver);
       this.rpcClients.set(peerId, client);
     }
     return client;
@@ -575,6 +718,7 @@ var LiopClient = class {
     if (!this.meshNode) {
       throw new Error("Client must be connected before reading resources.");
     }
+    const readStartTime = Date.now();
     log.info(`[LiopClient] Querying Mesh for Resource: ${uri}...`);
     const providers = await this.meshNode.findProviders(uri);
     if (providers.length === 0) {
@@ -588,7 +732,7 @@ var LiopClient = class {
     if (!resourceDef) {
       throw new Error(`Resource ${uri} not listed in remote manifest.`);
     }
-    return {
+    const result = {
       contents: [
         {
           uri,
@@ -597,6 +741,21 @@ var LiopClient = class {
         }
       ]
     };
+    try {
+      const telemetry = TokenTelemetryEngine.getInstance();
+      const outputPayload = JSON.stringify(result);
+      telemetry.record({
+        type: "resource_read",
+        method: "readResource",
+        toolName: uri,
+        peerId: providers[0],
+        estimatedInputTokens: telemetry.countTokens(uri),
+        estimatedOutputTokens: telemetry.countTokens(outputPayload),
+        durationMs: Date.now() - readStartTime
+      });
+    } catch {
+    }
+    return result;
   }
   getServerInfo() {
     return this.serverInfo;
@@ -611,6 +770,6 @@ var LiopClient = class {
   }
 };
 
-export { LiopClient, LiopRpcClient };
-//# sourceMappingURL=chunk-CRZBVFDV.js.map
-//# sourceMappingURL=chunk-CRZBVFDV.js.map
+export { AesGcmWrapper, LiopClient, LiopRpcClient };
+//# sourceMappingURL=chunk-T7R5HUFD.js.map
+//# sourceMappingURL=chunk-T7R5HUFD.js.map