@nekzus/liop 2.1.0-alpha.13 → 2.1.0-alpha.15

package/dist/index-cMV0_yD9.d.ts

@@ -0,0 +1,200 @@
+import { L as LiopVerifier } from './verifier-COnid_dg.js';
+import { MeshNodeConfig } from './mesh.js';
+import { EventEmitter } from 'node:events';
+import { M as McpEra, C as CallToolRequest, a as CallToolResult } from './types-lJIxBlWF.js';
+
+/**
+ * LIOP Certificate Manager (CertManager)
+ * Provides automated certificate monitoring, X.509 validity inspection,
+ * and hot-reloading for mutual TLS (mTLS) without node restarts.
+ *
+ * Compliance:
+ * - NIST SP 800-52 Rev. 2: Guidelines for the Selection and Use of TLS
+ * - Zero-Trust Architecture (NIST SP 800-207): Continuous cryptographic verification
+ */
+
+interface CertManagerOptions {
+    /** Path to the root CA certificate (PEM format) */
+    rootCertPath?: string;
+    /** Path to the server/client certificate chain (PEM format) */
+    certChainPath: string;
+    /** Path to the private key (PEM format) */
+    privateKeyPath: string;
+    /** Expiration warning threshold in days (default: 30) */
+    warningDays?: number;
+    /** Enable file watching for automatic hot-reloading (default: true) */
+    watchFiles?: boolean;
+    /** Debounce delay in ms for hot reloading (default: 150) */
+    debounceMs?: number;
+}
+interface CertInfo {
+    subject: string;
+    issuer: string;
+    validFrom: string;
+    validTo: string;
+    fingerprint256: string;
+    daysRemaining: number;
+    isExpired: boolean;
+    isExpiringSoon: boolean;
+}
+declare class CertManager extends EventEmitter {
+    private readonly options;
+    private rootCertBuffer;
+    private certChainBuffer;
+    private privateKeyBuffer;
+    private watchers;
+    private reloadDebounceTimer;
+    private readonly warningDays;
+    private readonly debounceMs;
+    constructor(options: CertManagerOptions);
+    /**
+     * Synchronously loads or reloads certificates from filesystem into memory.
+     */
+    loadCertificates(): void;
+    /**
+     * Inspects the loaded server/client certificate chain using Node.js native X509Certificate.
+     */
+    inspectCertificate(): CertInfo;
+    /**
+     * Sets up non-blocking filesystem watchers to detect certificate renewals
+     * and trigger hot-reloading without process restarts.
+     */
+    private setupWatchers;
+    /**
+     * Debounces reload events to ensure files have finished writing.
+     */
+    private scheduleReload;
+    /**
+     * Manually triggers a reload of certificates and emits the 'reload' event.
+     */
+    reload(): CertInfo;
+    getRootCert(): Buffer | null;
+    getCertChain(): Buffer;
+    getPrivateKey(): Buffer;
+    /**
+     * Stops all active file watchers and releases resources.
+     */
+    dispose(): void;
+}
+
+/**
+ * LIOP TLS Configuration
+ *
+ * Provides conditional TLS credential factories for gRPC connections.
+ * When TLS options are provided, connections are secured with mutual TLS.
+ * Otherwise, falls back to insecure credentials (alpha/development mode).
+ *
+ * Production Hardening (Phase 128):
+ * - When NODE_ENV=production and TLS is configured but certificate loading
+ *   fails, the system throws a fatal error instead of silently degrading
+ *   to insecure credentials. This prevents MITM/eavesdropping attacks
+ *   caused by misconfigured certificate paths going unnoticed.
+ * - Reference: gRPC-node official docs — "Using insecure credentials in
+ *   production poses significant security risks including eavesdropping,
+ *   MITM attacks, and lack of authentication."
+ */
+
+interface LiopTlsOptions {
+    /** Path to the root CA certificate (PEM format) */
+    rootCert?: string;
+    /** Path to the server/client certificate (PEM format) */
+    certChain?: string;
+    /** Path to the private key (PEM format) */
+    privateKey?: string;
+    /** Require mutual TLS (mTLS): verify client certificate against root CA */
+    mutualTls?: boolean;
+    /** Optional CertManager instance for automated certificate management and hot reloading */
+    certManager?: CertManager;
+}
+
+/**
+ * LIOP Client
+ * High-level orchestration for discovery and execution in the Logic-Injection-on-Origin mesh.
+ */
+declare class LiopClient {
+    private meshNode;
+    private rpcClients;
+    private manifests;
+    private tlsOptions?;
+    private serverInfo?;
+    verifier: LiopVerifier;
+    private oauthToken?;
+    /** Protocol negotiation era */
+    era: McpEra;
+    /** Negotiated protocol version */
+    protocolVersion: string;
+    constructor(tls?: LiopTlsOptions);
+    /**
+     * Requests an M2M access token from the Nexus Authorization Server using Client Credentials.
+     */
+    private acquireM2MToken;
+    /**
+     * Discovers and connects to the target server or mesh capability.
+     * If address is omitted, it sets up the MeshNode to act purely dynamically.
+     */
+    connect(address?: string, options?: {
+        meshConfig?: MeshNodeConfig;
+        auth?: {
+            clientId?: string;
+            clientSecret?: string;
+            nexusUrl?: string;
+            audience?: string;
+            scope?: string;
+            token?: string;
+        };
+    }): Promise<void>;
+    /**
+     * Selects the optimal IP from an array of multiaddrs.
+     * Prioritizes routable non-loopback IPv4 addresses (e.g. Docker bridge, LAN, WAN)
+     * over loopback (127.0.0.1) to prevent inter-container connection failures.
+     */
+    private selectOptimalIp;
+    /**
+     * Dynamically queries Kademlia DHT to find the optimal PeerID providing the Capability
+     * and returns the physical gRPC target (host:port) resolved from the provider's manifest.
+     */
+    resolveCapability(toolName: string): Promise<string>;
+    /**
+     * Probes a remote MCP endpoint using 'server/discover' to negotiate protocol era.
+     * Falls back to legacy initialize handshake if server/discover fails.
+     */
+    probeServerDiscover(mcpUrl: string): Promise<{
+        era: McpEra;
+        protocolVersion: string;
+        supportedVersions: string[];
+    }>;
+    /**
+     * Discovers remote capabilities via the LIOP Manifest Protocol.
+     * Utilizes a memory cache to avoid redundant network dials against live peers.
+     */
+    discoverTools(forceRefresh?: boolean): Promise<{
+        name: string;
+        description?: string;
+    }[]>;
+    /**
+     * Invokes a tool.
+     */
+    callTool(request: CallToolRequest, _wasmPayload?: Buffer): Promise<CallToolResult>;
+    private getOrCreateRpcClient;
+    /**
+     * Reads a specific resource by URI.
+     * In LIOP, resources can be static definitions or dynamic streams.
+     */
+    readResource(uri: string): Promise<{
+        contents: Array<{
+            uri: string;
+            mimeType?: string;
+            text: string;
+        }>;
+    }>;
+    getServerInfo(): {
+        name: string;
+        version: string;
+    } | undefined;
+    /**
+     * Destroys the active Mesh Node resources.
+     */
+    close(): Promise<void>;
+}
+
+export { type CertInfo as C, type LiopTlsOptions as L, CertManager as a, type CertManagerOptions as b, LiopClient as c };

package/dist/index.d.ts

@@ -1,17 +1,19 @@
 export { LiopBridgeOptions, LiopMcpBridge, LiopStreamBridge, LiopStreamBridgeOptions } from './bridge.js';
-import { L as LiopTlsOptions } from './index-qM8ZH8sC.js';
-export { a as LiopClient } from './index-qM8ZH8sC.js';
-export { LiopHybridGateway } from './gateway.js';
+import { L as LiopTlsOptions } from './index-cMV0_yD9.js';
+export { C as CertInfo, a as CertManager, b as CertManagerOptions, c as LiopClient } from './index-cMV0_yD9.js';
+import * as http from 'node:http';
+export { I as InMemoryRateLimiter, L as LiopHybridGateway, a as LiopMcpRouter, R as RateLimitStatus, b as RateLimiterOptions } from './hybrid-CF__0YnC.js';
 export { LiopManifest, MeshNode, MeshNodeConfig } from './mesh.js';
 import * as grpc from '@grpc/grpc-js';
-export { A as AUTH_DEFAULTS, b as AggregationPolicy, c as AuthRole, d as LiopAuthConfig, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, O as OAuthClientConfig, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-BlGc0iym.js';
-import { A as AuthInfo } from './types-sKeUxuky.js';
-export { C as CallToolRequest, a as CallToolResult, G as GetPromptRequest, c as GetPromptResult, J as JwtValidator, M as McpRequest, b as McpResponse, P as Prompt, d as PromptSchema, R as Resource, e as ResourceSchema, S as ServerInfo, T as Tool, f as ToolSchema } from './types-sKeUxuky.js';
+export { A as AUTH_DEFAULTS, b as AggregationPolicy, c as AuditEntry, d as AuditLogger, e as AuditRecordParams, f as AuditStatus, g as AuthRole, G as GENESIS_HASH, h as LiopAuthConfig, L as LiopServer, a as LiopServerOptions, i as LogicExecutionPolicy, N as NerScanner, O as OAuthClientConfig, j as OutputSanitizerConfig, P as PII_PATTERNS, k as PII_PRESETS, l as PiiRule, m as PiiScanner, T as ToolHandler, n as computeEntryHash, o as globalAuditLogger, s as sanitizeOutput } from './index-BW95kAL4.js';
+import { A as AuthInfo } from './types-lJIxBlWF.js';
+export { e as CacheableResult, C as CallToolRequest, a as CallToolResult, D as DiscoverResult, G as GetPromptRequest, d as GetPromptResult, I as InputRequest, f as InputRequiredResult, g as InputResponse, J as JwtValidator, h as MCP_LEGACY_SUPPORT_ENABLED, i as MCP_PROTOCOL_VERSION, j as MCP_PROTOCOL_VERSION_LEGACY, M as McpEra, b as McpRequest, k as McpRequestMeta, c as McpResponse, P as Prompt, l as PromptSchema, R as Resource, m as ResourceSchema, S as ServerInfo, T as Tool, n as ToolSchema } from './types-lJIxBlWF.js';
 import * as jose from 'jose';
 import Provider from 'oidc-provider';
 import '@modelcontextprotocol/sdk/server/mcp.js';
 import 'zod';
 import './verifier-COnid_dg.js';
+import 'node:events';
 
 /**
  * TokenEstimator — Pluggable strategy for counting tokens in text content.
@@ -199,6 +201,162 @@ declare class LiopError extends Error {
     constructor(code: ErrorCode, message: string);
 }
 
+/**
+ * LIOP gRPC-Web Protocol Adapter (HTTP/1.1 Fallback)
+ *
+ * Implements standard gRPC-Web framing per the official gRPC-Web specification:
+ * https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-WEB.md
+ *
+ * Allows web browsers, corporate Layer 7 HTTP/1.1 proxies, and enterprise WAFs
+ * to invoke LIOP nodes over HTTP/1.1 without requiring HTTP/2 streaming or h2c.
+ *
+ * Frame Format:
+ * - 1 byte: Frame Flag (0x00 = Data Frame, 0x80 = Trailers Frame)
+ * - 4 bytes: 32-bit Big-Endian Unsigned Integer (payload length in bytes)
+ * - N bytes: Message or Trailer payload
+ */
+
+declare const GRPC_WEB_CONSTANTS: {
+    readonly FLAG_DATA: 0;
+    readonly FLAG_TRAILERS: 128;
+    readonly HEADER_LENGTH: 5;
+    readonly CONTENT_TYPE_PREFIX: "application/grpc-web";
+    readonly STATUS_OK: 0;
+    readonly STATUS_CANCELLED: 1;
+    readonly STATUS_UNKNOWN: 2;
+    readonly STATUS_INVALID_ARGUMENT: 3;
+    readonly STATUS_DEADLINE_EXCEEDED: 4;
+    readonly STATUS_NOT_FOUND: 5;
+    readonly STATUS_PERMISSION_DENIED: 7;
+    readonly STATUS_UNAUTHENTICATED: 16;
+    readonly STATUS_INTERNAL: 13;
+};
+interface GrpcWebFrame {
+    isTrailer: boolean;
+    payload: Buffer;
+}
+/**
+ * Checks if an incoming HTTP request is a gRPC-Web request.
+ */
+declare function isGrpcWebRequest(contentType?: string): boolean;
+/**
+ * Encodes a binary payload into a standard 5-byte framed gRPC-Web Data Frame.
+ */
+declare function encodeDataFrame(payload: Buffer | Uint8Array): Buffer;
+/**
+ * Encodes gRPC status and optional message into a 5-byte framed gRPC-Web Trailer Frame.
+ */
+declare function encodeTrailerFrame(status?: number, message?: string, customTrailers?: Record<string, string>): Buffer;
+/**
+ * Parses raw gRPC-Web byte streams into an array of frames.
+ */
+declare function decodeFrames(buffer: Buffer): GrpcWebFrame[];
+/**
+ * Dispatches an HTTP/1.1 gRPC-Web request to an underlying protocol handler
+ * and serializes data and trailer frames back to the client.
+ */
+declare function dispatchGrpcWebRequest(req: http.IncomingMessage, res: http.ServerResponse, handler: (path: string, payload: Buffer) => Promise<{
+    status: number;
+    message?: string;
+    data?: Buffer;
+}>): Promise<void>;
+
+/**
+ * LIOP Prometheus Metrics Registry (Phase Beta-3)
+ * Lightweight, zero-dependency, high-performance metrics collector
+ * complying with Prometheus and OpenMetrics exposition format.
+ */
+type MetricLabels = Record<string, string | number>;
+interface MetricDefinition {
+    name: string;
+    help: string;
+    type: "counter" | "gauge" | "histogram";
+    buckets?: number[];
+}
+declare class Counter {
+    readonly name: string;
+    readonly help: string;
+    private values;
+    constructor(name: string, help: string);
+    inc(labels?: MetricLabels, value?: number): void;
+    get(labels?: MetricLabels): number;
+    reset(): void;
+    toPrometheus(): string[];
+}
+declare class Gauge {
+    readonly name: string;
+    readonly help: string;
+    private values;
+    constructor(name: string, help: string);
+    set(labelsOrValue: MetricLabels | number, maybeValue?: number): void;
+    inc(labels?: MetricLabels, value?: number): void;
+    dec(labels?: MetricLabels, value?: number): void;
+    get(labels?: MetricLabels): number;
+    reset(): void;
+    toPrometheus(): string[];
+}
+declare class Histogram {
+    readonly name: string;
+    readonly help: string;
+    readonly buckets: number[];
+    private observations;
+    constructor(name: string, help: string, buckets?: number[]);
+    observe(labelsOrValue: MetricLabels | number, maybeValue?: number): void;
+    reset(): void;
+    toPrometheus(): string[];
+}
+declare class MetricsRegistry {
+    private counters;
+    private gauges;
+    private histograms;
+    counter(name: string, help: string): Counter;
+    gauge(name: string, help: string): Gauge;
+    histogram(name: string, help: string, buckets?: number[]): Histogram;
+    collectProcessMetrics(): void;
+    exportPrometheusText(): string;
+    resetAll(): void;
+}
+declare const protocolMetrics: MetricsRegistry;
+declare const toolCallsTotal: Counter;
+declare const fuelConsumed: Histogram;
+declare const meshPeersConnected: Gauge;
+declare const manifestCacheSize: Gauge;
+declare const egressBlocksTotal: Counter;
+declare const zkVerificationDurationMs: Histogram;
+
+/**
+ * LIOP OpenTelemetry Distributed Tracing (Phase Beta-3)
+ * W3C TraceContext compliant distributed tracer for gRPC & MCP transports.
+ * Spec: https://www.w3.org/TR/trace-context/
+ */
+interface SpanContext {
+    traceId: string;
+    spanId: string;
+    sampled: boolean;
+}
+interface LiopSpan {
+    readonly name: string;
+    readonly context: SpanContext;
+    readonly startTime: number;
+    endTime?: number;
+    attributes: Record<string, string | number | boolean>;
+    status: "OK" | "ERROR";
+    error?: string;
+    setAttribute(key: string, value: string | number | boolean): LiopSpan;
+    recordException(error: Error | string): LiopSpan;
+    end(): void;
+}
+declare class LiopTracer {
+    static generateTraceId(): string;
+    static generateSpanId(): string;
+    static formatTraceparent(traceId: string, spanId: string, sampled?: boolean): string;
+    static parseTraceparent(header?: string | null): SpanContext | null;
+    static injectTraceparent(carrier: Record<string, string | string[] | undefined>, context: SpanContext): void;
+    static extractTraceparent(carrier: Record<string, string | string[] | undefined>): SpanContext | null;
+    startSpan(name: string, parent?: SpanContext | null, attributes?: Record<string, string | number | boolean>): LiopSpan;
+}
+declare const defaultTracer: LiopTracer;
+
 /**
  * LIOP Cross-AI Prompt Adapters (Fase 92)
  *
@@ -216,6 +374,15 @@ interface PromptConfig {
  */
 declare function generateSystemInstructions(provider: AIProvider): string;
 
+/**
+ * LIOP Production-Grade gRPC Channel Options
+ *
+ * Enforces bidirectional symmetry between LiopRpcServer, LiopRpcClient,
+ * and gateway proxy channels per NIST SP 800-207 continuous verification.
+ * Prevents silent disconnections behind corporate stateful firewalls and NAT gateways.
+ */
+declare const GRPC_CHANNEL_OPTIONS: Readonly<Record<string, string | number>>;
+
 /**
  * TypeScript interfaces reflecting liop_core.proto (LIOP v1)
  * Optimized for logic-on-origin and high-performance serialization.
@@ -252,6 +419,7 @@ interface LogicResponse {
 declare class LiopRpcClient {
     private client;
     private token?;
+    readonly address: string;
     constructor(address: string, tls?: LiopTlsOptions, token?: string);
     /**
      * Negotiates intent with the remote host.
@@ -266,6 +434,92 @@ declare class LiopRpcClient {
     close(): void;
 }
 
+/**
+ * LIOP Post-Quantum Digital Signature Wrapper
+ * Implements ML-DSA-65 (CRYSTALS-Dilithium, NIST FIPS 204) for quantum-resistant
+ * manifest attestation, node revocation receipts, and cryptographic integrity.
+ *
+ * Characteristics:
+ * - Security Category: NIST Level 3 (~AES-192 equivalent quantum resistance)
+ * - Public Key Length: 1952 bytes
+ * - Secret Key Length: 4032 bytes
+ * - Signature Length: 3309 bytes
+ * - Implementation: Pure TypeScript/JS via @noble/post-quantum
+ */
+declare const DILITHIUM65_CONSTANTS: {
+    readonly PUBLIC_KEY_BYTES: 1952;
+    readonly SECRET_KEY_BYTES: 4032;
+    readonly SIGNATURE_BYTES: 3309;
+    readonly DEFAULT_CONTEXT: Uint8Array<ArrayBuffer>;
+};
+declare const Dilithium65Wrapper: {
+    /** Constants */
+    PUBLIC_KEY_BYTES: 1952;
+    SECRET_KEY_BYTES: 4032;
+    SIGNATURE_BYTES: 3309;
+    /**
+     * Generates a new ML-DSA-65 (FIPS 204) key pair.
+     * Optionally accepts a 32-byte seed for deterministic key generation.
+     */
+    generateKeyPair(seed?: Uint8Array): {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    /**
+     * Validates and imports a raw ML-DSA-65 public key.
+     */
+    importPublicKey(buffer: Uint8Array): Uint8Array;
+    /**
+     * Signs a message using the post-quantum secret key.
+     * Supports optional domain separation context (up to 255 bytes).
+     */
+    sign(message: Uint8Array | string, secretKey: Uint8Array, context?: Uint8Array): Uint8Array;
+    /**
+     * Verifies an ML-DSA-65 post-quantum digital signature.
+     */
+    verify(signature: Uint8Array, message: Uint8Array | string, publicKey: Uint8Array, context?: Uint8Array): boolean;
+    /**
+     * Signs a structured manifest (LiopManifest) using canonical JSON serialization.
+     * Returns base64-encoded signature and public key for transport over gRPC/MCP.
+     */
+    signManifest(manifest: Record<string, unknown>, secretKey: Uint8Array, publicKey: Uint8Array): {
+        signature: string;
+        publicKey: string;
+    };
+    /**
+     * Verifies the post-quantum signature of a structured manifest.
+     */
+    verifyManifest(manifest: Record<string, unknown>, signatureBase64: string, publicKeyBase64: string): boolean;
+};
+
+declare const Kyber768Wrapper: {
+    /**
+     * Extracts and validates the 1184-byte Public Key from the Rust LIOP Data Node
+     * @param buffer Raw buffer sent via gRPC IntentResponse
+     */
+    importPublicKey(buffer: Uint8Array): Uint8Array;
+    /**
+     * Encapsulates a shared secret using the server's public key.
+     * Returns the 1088-byte ciphertext to be sent back, and the 32-byte shared AES secret.
+     */
+    encapsulateAsymmetric(publicKey: Uint8Array): Promise<{
+        ciphertext: Uint8Array;
+        sharedSecret: Uint8Array;
+    }>;
+    /**
+     * Generates a Kyber768 KeyPair for the server to accept intents.
+     */
+    generateKeyPair(): Promise<{
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    }>;
+    /**
+     * Decapsulates the shared secret using the server's secret key.
+     * Zero-fills the shared secret buffer after extraction for side-channel protection.
+     */
+    decapsulateSymmetric(ciphertext: Uint8Array, secretKey: Uint8Array): Promise<Uint8Array>;
+};
+
 declare class LiopRpcServer {
     private server;
     constructor();
@@ -274,6 +528,7 @@ declare class LiopRpcServer {
         executeLogic: (call: grpc.ServerWritableStream<LogicRequest, LogicResponse>) => void;
     }): void;
     listen(port?: number, tls?: LiopTlsOptions): Promise<number>;
+    gracefulShutdown(timeoutMs?: number): Promise<void>;
     stop(): Promise<void>;
 }
 
@@ -282,6 +537,11 @@ declare class LiopRpcServer {
  * preventing exposure of sensitive credentials and shell function injection.
  */
 declare function getDefaultEnvironment(): Record<string, string>;
+/**
+ * Calculates deterministic execution fuel units based on AST instruction complexity.
+ * Guarantees identical fuel consumption for the same logic across different hardware.
+ */
+declare function calculateAstInstructionFuel(code: string): number;
 interface SandboxConfig {
     allowEnv?: boolean;
     allowedDirectories?: Record<string, string>;
@@ -428,4 +688,4 @@ declare function authorizeRequest(method: string, auth: AuthInfo | null, additio
 declare const LIOP_SCOPES: readonly ["liop:tools:list", "liop:tools:call", "liop:resources:read", "liop:schema:read", "liop:mesh:query"];
 type LiopScope = (typeof LIOP_SCOPES)[number];
 
-export { type AIProvider, AuthInfo, ErrorCode, HeuristicTokenEstimator, LIOP_SCOPES, LiopError, LiopOTelBridge, LiopRpcClient, LiopRpcServer, type LiopScope, type PromptConfig, RealTokenEstimator, type SandboxConfig, type TokenEstimator, type TokenOperationMetric, type TokenSessionReport, TokenTelemetryEngine, type ToolTokenBreakdown, WasiSandbox, authorizeRequest, buildProtectedResourceMetadata, createOAuthServer, createSyncTokenEstimator, createTokenEstimator, generateSystemInstructions, getDefaultEnvironment };
+export { type AIProvider, AuthInfo, Counter, DILITHIUM65_CONSTANTS, Dilithium65Wrapper, ErrorCode, GRPC_CHANNEL_OPTIONS, GRPC_WEB_CONSTANTS, Gauge, type GrpcWebFrame, HeuristicTokenEstimator, Histogram, Kyber768Wrapper, LIOP_SCOPES, LiopError, LiopOTelBridge, LiopRpcClient, LiopRpcServer, type LiopScope, type LiopSpan, LiopTracer, type MetricDefinition, type MetricLabels, MetricsRegistry, type PromptConfig, RealTokenEstimator, type SandboxConfig, type SpanContext, type TokenEstimator, type TokenOperationMetric, type TokenSessionReport, TokenTelemetryEngine, type ToolTokenBreakdown, WasiSandbox, authorizeRequest, buildProtectedResourceMetadata, calculateAstInstructionFuel, createOAuthServer, createSyncTokenEstimator, createTokenEstimator, decodeFrames, defaultTracer, dispatchGrpcWebRequest, egressBlocksTotal, encodeDataFrame, encodeTrailerFrame, fuelConsumed, generateSystemInstructions, getDefaultEnvironment, isGrpcWebRequest, manifestCacheSize, meshPeersConnected, protocolMetrics, toolCallsTotal, zkVerificationDurationMs };