@agentxv2/gateway 0.1.1

package/dist/index.js

@@ -0,0 +1,149 @@
+"use strict";
+// ---------------------------------------------------------------------------
+// AgentX Gateway — Entry Point
+// ---------------------------------------------------------------------------
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = __importDefault(require("express"));
+const cors_1 = __importDefault(require("cors"));
+const helmet_1 = __importDefault(require("helmet"));
+const express_rate_limit_1 = __importDefault(require("express-rate-limit"));
+const config_1 = require("./config");
+const auth_1 = require("./middleware/auth");
+const rate_limiter_1 = require("./middleware/rate-limiter");
+const error_handler_1 = require("./middleware/error-handler");
+const chat_1 = __importDefault(require("./routes/chat"));
+const tenant_1 = __importDefault(require("./routes/tenant"));
+const history_1 = __importDefault(require("./routes/history"));
+const mcp_1 = __importDefault(require("./routes/mcp"));
+const agents_1 = __importDefault(require("./routes/agents"));
+const a2a_1 = __importDefault(require("./routes/a2a"));
+const admin_1 = __importDefault(require("./routes/admin"));
+const app = (0, express_1.default)();
+// ── Security ──────────────────────────────────────────────────────────────
+app.use((0, helmet_1.default)({
+    contentSecurityPolicy: false,
+    crossOriginEmbedderPolicy: false,
+}));
+app.use((0, cors_1.default)({
+    origin: process.env.CORS_ORIGIN || '*',
+    credentials: true,
+}));
+// ── Global rate limit ─────────────────────────────────────────────────────
+app.use((0, express_rate_limit_1.default)({
+    windowMs: 60_000,
+    max: 1000,
+    standardHeaders: true,
+    legacyHeaders: false,
+    message: { error: 'Too many requests, please try again later.' },
+}));
+// ── Body parsing ──────────────────────────────────────────────────────────
+app.use(express_1.default.json({ limit: '1mb' }));
+// Handle malformed JSON (return 400 instead of 500)
+app.use((err, _req, res, next) => {
+    if (err && err.type === 'entity.parse.failed') {
+        return res.status(400).json({ error: 'Invalid JSON in request body' });
+    }
+    next(err);
+});
+// ── Health check ──────────────────────────────────────────────────────────
+app.get('/api/v1/health', async (_req, res) => {
+    res.json({ status: 'ok', time: new Date().toISOString() });
+});
+// ── MCP endpoint (public JSON-RPC 2.0) ────────────────────────────────────
+app.use('/mcp', mcp_1.default);
+// ── Admin API (protected by admin key, not wallet auth) ──────────────────
+app.use('/api/v1/admin', admin_1.default);
+// ── Auth routes (public) ──────────────────────────────────────────────────
+app.get('/api/v1/auth/challenge', auth_1.getChallenge);
+app.post('/api/v1/auth/verify', auth_1.verifyChallenge);
+// ── Agents API (public, no auth needed) ────────────────────────────────────
+app.use('/api/v1/agents', agents_1.default);
+// ── A2A Task Results API (public, SDK daemon queries this) ────────────────
+app.use('/api/v1/a2a', a2a_1.default);
+// Agent sync (public, for cron)
+app.post('/api/v1/agents-sync', async (_req, res, next) => {
+    try {
+        const { syncAgents } = await Promise.resolve().then(() => __importStar(require('./services/agent-indexer')));
+        const result = await syncAgents();
+        res.json({ success: true, ...result });
+    }
+    catch (err) {
+        next(err);
+    }
+});
+// ── Protected routes (auth + rate-limit only on known paths) ─────────────
+// Known protected API path prefixes (anything else under /api/v1 returns 404)
+const PROTECTED_PREFIXES = ['/chat/completions', '/chat/history', '/tenant/'];
+app.use('/api/v1', (req, _res, next) => {
+    if (PROTECTED_PREFIXES.some(p => req.path.startsWith(p))) {
+        next();
+    }
+    else {
+        // Path is not a known API route → 404, skip auth middleware
+        _res.status(404).json({ error: 'Not found' });
+    }
+});
+const api = express_1.default.Router();
+api.use(auth_1.authMiddleware);
+api.use(rate_limiter_1.tenantRateLimiter);
+api.use(chat_1.default);
+api.use('/tenant', tenant_1.default);
+api.use('/chat', history_1.default);
+app.use('/api/v1', api);
+// ── 404 handler ───────────────────────────────────────────────────────────
+app.use((_req, res) => {
+    if (!res.headersSent) {
+        res.status(404).json({ error: 'Not found' });
+    }
+});
+// ── Error handler ─────────────────────────────────────────────────────────
+app.use(error_handler_1.globalErrorHandler);
+// ── Start ─────────────────────────────────────────────────────────────────
+app.listen(config_1.config.port, () => {
+    console.log(`[AgentX Gateway] Running on port ${config_1.config.port}`);
+    console.log(`[AgentX Gateway] Mode: ${config_1.config.nodeEnv}`);
+    // Start A2A background worker for multi-agent task processing
+    Promise.resolve().then(() => __importStar(require('./services/a2a-worker'))).then(({ startA2AWorker }) => {
+        startA2AWorker();
+        console.log('[AgentX Gateway] A2A Worker started');
+    }).catch(err => {
+        console.error('[AgentX Gateway] Failed to start A2A Worker:', err.message);
+    });
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAE9E,sDAA6B;AAC7B,gDAAuB;AACvB,oDAA2B;AAC3B,4EAA0C;AAC1C,qCAAiC;AACjC,4CAAiF;AACjF,4DAA6D;AAC7D,8DAA+D;AAC/D,yDAAsC;AACtC,6DAA0C;AAC1C,+DAA4C;AAC5C,uDAAoC;AACpC,6DAA0C;AAC1C,uDAAoC;AACpC,2DAAwC;AAExC,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAA;AAErB,6EAA6E;AAE7E,GAAG,CAAC,GAAG,CAAC,IAAA,gBAAM,EAAC;IACb,qBAAqB,EAAE,KAAK;IAC5B,yBAAyB,EAAE,KAAK;CACjC,CAAC,CAAC,CAAA;AACH,GAAG,CAAC,GAAG,CAAC,IAAA,cAAI,EAAC;IACX,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG;IACtC,WAAW,EAAE,IAAI;CAClB,CAAC,CAAC,CAAA;AAEH,6EAA6E;AAE7E,GAAG,CAAC,GAAG,CAAC,IAAA,4BAAS,EAAC;IAChB,QAAQ,EAAE,MAAM;IAChB,GAAG,EAAE,IAAI;IACT,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;IACpB,OAAO,EAAE,EAAE,KAAK,EAAE,4CAA4C,EAAE;CACjE,CAAC,CAAC,CAAA;AAEH,6EAA6E;AAE7E,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;AAEvC,oDAAoD;AACpD,GAAG,CAAC,GAAG,CAAC,CAAC,GAAQ,EAAE,IAAqB,EAAE,GAAqB,EAAE,IAA0B,EAAE,EAAE;IAC7F,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QAC9C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,CAAA;AACX,CAAC,CAAC,CAAA;AAEF,6EAA6E;AAE7E,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;AAC5D,CAAC,CAAC,CAAA;AAEF,6EAA6E;AAE7E,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,aAAS,CAAC,CAAA;AAE1B,4EAA4E;AAE5E,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,eAAW,CAAC,CAAA;AAErC,6EAA6E;AAE7E,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,mBAAY,CAAC,CAAA;AAC/C,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,sBAAe,CAAC,CAAA;AAEhD,8EAA8E;AAE9E,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,gBAAY,CAAC,CAAA;AAEvC,6EAA6E;AAE7E,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,aAAS,CAAC,CAAA;AAEjC,gCAAgC;AAChC,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACxD,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,GAAG,wDAAa,0BAA0B,GAAC,CAAA;QAC/D,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;QACjC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,GAAG,CAAC,CAAA;IACX,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,4EAA4E;AAE5E,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,CAAC,mBAAmB,EAAE,eAAe,EAAE,UAAU,CAAC,CAAA;AAE7E,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IACrC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,EAAE,CAAA;IACR,CAAC;SAAM,CAAC;QACN,4DAA4D;QAC5D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,MAAM,GAAG,GAAG,iBAAO,CAAC,MAAM,EAAE,CAAA;AAC5B,GAAG,CAAC,GAAG,CAAC,qBAAc,CAAC,CAAA;AACvB,GAAG,CAAC,GAAG,CAAC,gCAAiB,CAAC,CAAA;AAE1B,GAAG,CAAC,GAAG,CAAC,cAAU,CAAC,CAAA;AACnB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,gBAAY,CAAC,CAAA;AAChC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAa,CAAC,CAAA;AAE/B,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;AAEvB,6EAA6E;AAE7E,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACpB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;IAC9C,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,6EAA6E;AAE7E,GAAG,CAAC,GAAG,CAAC,kCAAkB,CAAC,CAAA;AAE3B,6EAA6E;AAE7E,GAAG,CAAC,MAAM,CAAC,eAAM,CAAC,IAAI,EAAE,GAAG,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,oCAAoC,eAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9D,OAAO,CAAC,GAAG,CAAC,0BAA0B,eAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IAEvD,8DAA8D;IAC9D,kDAAO,uBAAuB,IAAE,IAAI,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE;QAC1D,cAAc,EAAE,CAAA;QAChB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAA;IACpD,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QACb,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/lib/crypto.d.ts

@@ -0,0 +1,2 @@
+export declare function encryptApiKey(plaintext: string, masterKeyHex: string): string;
+export declare function decryptApiKey(ciphertext: string, masterKeyHex: string): string;

package/dist/lib/crypto.js

@@ -0,0 +1,43 @@
+"use strict";
+// ---------------------------------------------------------------------------
+// AgentX Gateway — Crypto Utilities
+// ---------------------------------------------------------------------------
+// AES-256-GCM encrypt/decrypt for tenant API keys at rest.
+// ---------------------------------------------------------------------------
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encryptApiKey = encryptApiKey;
+exports.decryptApiKey = decryptApiKey;
+const crypto_1 = __importDefault(require("crypto"));
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+function encryptApiKey(plaintext, masterKeyHex) {
+    const key = Buffer.from(masterKeyHex, 'hex');
+    const iv = crypto_1.default.randomBytes(IV_LENGTH);
+    const cipher = crypto_1.default.createCipheriv(ALGORITHM, key, iv);
+    const encrypted = Buffer.concat([
+        cipher.update(plaintext, 'utf8'),
+        cipher.final(),
+    ]);
+    const authTag = cipher.getAuthTag();
+    const combined = Buffer.concat([iv, authTag, encrypted]);
+    return combined.toString('base64');
+}
+function decryptApiKey(ciphertext, masterKeyHex) {
+    const key = Buffer.from(masterKeyHex, 'hex');
+    const combined = Buffer.from(ciphertext, 'base64');
+    const iv = combined.subarray(0, IV_LENGTH);
+    const authTag = combined.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
+    const encrypted = combined.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
+    const decipher = crypto_1.default.createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([
+        decipher.update(encrypted),
+        decipher.final(),
+    ]);
+    return decrypted.toString('utf8');
+}
+//# sourceMappingURL=crypto.js.map

package/dist/lib/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/lib/crypto.ts"],"names":[],"mappings":";AAAA,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;;;;;AAQ9E,sCAaC;AAED,sCAgBC;AArCD,oDAA2B;AAE3B,MAAM,SAAS,GAAG,aAAa,CAAA;AAC/B,MAAM,SAAS,GAAG,EAAE,CAAA;AACpB,MAAM,eAAe,GAAG,EAAE,CAAA;AAE1B,SAAgB,aAAa,CAAC,SAAiB,EAAE,YAAoB;IACnE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;IAC5C,MAAM,EAAE,GAAG,gBAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,gBAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;IAExD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAEnC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;IACxD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AACpC,CAAC;AAED,SAAgB,aAAa,CAAC,UAAkB,EAAE,YAAoB;IACpE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IAElD,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IAC1C,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,eAAe,CAAC,CAAA;IACzE,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,GAAG,eAAe,CAAC,CAAA;IAEhE,MAAM,QAAQ,GAAG,gBAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;IAChE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IAE5B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;QAC1B,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAA;IACF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AACnC,CAAC"}

package/dist/lib/db.d.ts

@@ -0,0 +1,3 @@
+import { Pool } from 'pg';
+export declare function getPool(): Pool;
+export declare function closePool(): Promise<void>;

package/dist/lib/db.js

@@ -0,0 +1,26 @@
+"use strict";
+// ---------------------------------------------------------------------------
+// AgentX Gateway — Database Pool
+// ---------------------------------------------------------------------------
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPool = getPool;
+exports.closePool = closePool;
+const pg_1 = require("pg");
+let pool = null;
+function getPool() {
+    if (!pool) {
+        pool = new pg_1.Pool({
+            connectionString: process.env.DATABASE_URL,
+            max: 20,
+            idleTimeoutMillis: 30_000,
+        });
+    }
+    return pool;
+}
+async function closePool() {
+    if (pool) {
+        await pool.end();
+        pool = null;
+    }
+}
+//# sourceMappingURL=db.js.map

package/dist/lib/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":";AAAA,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;;AAM9E,0BASC;AAED,8BAKC;AApBD,2BAAyB;AAEzB,IAAI,IAAI,GAAgB,IAAI,CAAA;AAE5B,SAAgB,OAAO;IACrB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,IAAI,SAAI,CAAC;YACd,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;YAC1C,GAAG,EAAE,EAAE;YACP,iBAAiB,EAAE,MAAM;SAC1B,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAEM,KAAK,UAAU,SAAS;IAC7B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAA;QAChB,IAAI,GAAG,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/lib/ethers-utils.d.ts

@@ -0,0 +1,60 @@
+import { ethers } from 'ethers';
+/**
+ * Encode registerWithMetadata(string, (string,bytes)[]) call data.
+ *
+ * ethers.js v6 Interface.encodeFunctionData fails on the inner tuple array
+ * when values are Uint8Array or hex strings (misidentified as string type).
+ * This bypasses Interface entirely and uses raw AbiCoder.
+ *
+ * Usage:
+ *   const data = encodeRegisterWithMetadata(tokenURI, [
+ *     ['name', 'SecurityAuditor'],
+ *     ['description', 'AI auditor'],
+ *   ])
+ *   await wallet.sendTransaction({ to: identityRegistry, data, value: fee })
+ */
+export declare function encodeRegisterWithMetadata(tokenURI: string, meta: [string, string][]): string;
+/**
+ * Encode hasActiveSubscription(address,uint256) call data.
+ *
+ * Works around ethers.js v6 address validation edge case where string
+ * addresses passed through JSON parsing may be rejected.
+ * Uses ethers.getAddress() for strict checksum validation.
+ */
+export declare function encodeHasActiveSubscription(subscriber: string, agentId: number): string;
+/**
+ * Safely call getPlan(uint256) and decode the SubscriptionPlan struct.
+ *
+ * Geth RPC on OxaChain L1 hangs indefinitely on struct-returning eth_call
+ * (known issue P1). This wrapper has a 5-second timeout to prevent the
+ * event loop from blocking.
+ *
+ * Returns null if the call fails, times out, or returns empty data.
+ */
+export declare function safeGetPlan(provider: ethers.Provider, contractAddress: string, planId: number, timeoutMs?: number): Promise<Record<string, unknown> | null>;
+/**
+ * Encode giveFeedback(uint256,uint8,bytes32,bytes32,string,bytes32,bytes)
+ *
+ * This uses named parameters in the ABI to ensure proper type matching.
+ * The bytes feedbackAuth parameter is the EIP-191 signed authorization.
+ */
+export declare function encodeGiveFeedback(agentId: number, score: number, tag1: string, tag2: string, fileuri: string, filehash: string, feedbackAuth: string): string;
+/**
+ * Safely call getSubscriptionDetail(uint256) via raw eth_call.
+ *
+ * ethers.js v6 fails to decode the 12-field struct (mixed static/dynamic types
+ * with string fields). This bypasses ethers.js entirely and uses raw eth_call
+ * + manual AbiCoder.decode, same pattern as safeGetPlan.
+ *
+ * Returns null on failure.
+ */
+export declare function safeGetSubscriptionDetail(provider: ethers.Provider, contractAddress: string, subscriptionId: number, timeoutMs?: number): Promise<Record<string, unknown> | null>;
+/**
+ * Safely call getTask(uint256) via raw eth_call.
+ *
+ * ethers.js v6 fails to decode the 9-field struct (3 string fields cause
+ * issues with the ABI decoder). This bypasses ethers.js entirely.
+ *
+ * Returns null on failure.
+ */
+export declare function safeGetTask(provider: ethers.Provider, contractAddress: string, taskId: number, timeoutMs?: number): Promise<Record<string, unknown> | null>;

package/dist/lib/ethers-utils.js

@@ -0,0 +1,186 @@
+"use strict";
+// ---------------------------------------------------------------------------
+// Gateway — ethers.js v6 Utilities
+// ---------------------------------------------------------------------------
+// Workarounds for known ethers.js v6 bugs when interacting with Solidity
+// contracts that use complex tuple types (structs with mixed static/dynamic
+// fields, nested tuple arrays, etc.).
+//
+// Issues tracked:
+//   P4 — ethers.js v6 cannot encode `(string,bytes)[]` tuple arrays
+//         via Interface.encodeFunctionData when values contain Uint8Array
+//         or hex-encoded strings.
+//         Workaround: manual AbiCoder.encode()
+//   P6 — estimateGas reverts on Geth for functions returning complex structs
+//         (getPlan, completeTask). Workaround: skip estimateGas, use fixed
+//         gasLimit.
+// ---------------------------------------------------------------------------
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encodeRegisterWithMetadata = encodeRegisterWithMetadata;
+exports.encodeHasActiveSubscription = encodeHasActiveSubscription;
+exports.safeGetPlan = safeGetPlan;
+exports.encodeGiveFeedback = encodeGiveFeedback;
+exports.safeGetSubscriptionDetail = safeGetSubscriptionDetail;
+exports.safeGetTask = safeGetTask;
+const ethers_1 = require("ethers");
+const coder = ethers_1.ethers.AbiCoder.defaultAbiCoder();
+/**
+ * Encode registerWithMetadata(string, (string,bytes)[]) call data.
+ *
+ * ethers.js v6 Interface.encodeFunctionData fails on the inner tuple array
+ * when values are Uint8Array or hex strings (misidentified as string type).
+ * This bypasses Interface entirely and uses raw AbiCoder.
+ *
+ * Usage:
+ *   const data = encodeRegisterWithMetadata(tokenURI, [
+ *     ['name', 'SecurityAuditor'],
+ *     ['description', 'AI auditor'],
+ *   ])
+ *   await wallet.sendTransaction({ to: identityRegistry, data, value: fee })
+ */
+function encodeRegisterWithMetadata(tokenURI, meta) {
+    // keccak256("registerWithMetadata(string,(string,bytes)[])") = 0x5ac4d1c3
+    const encoded = coder.encode(['string', 'tuple(string,bytes)[]'], [
+        tokenURI,
+        meta.map(([k, v]) => [k, '0x' + Buffer.from(v).toString('hex')]),
+    ]);
+    return '0x5ac4d1c3' + encoded.slice(2);
+}
+/**
+ * Encode hasActiveSubscription(address,uint256) call data.
+ *
+ * Works around ethers.js v6 address validation edge case where string
+ * addresses passed through JSON parsing may be rejected.
+ * Uses ethers.getAddress() for strict checksum validation.
+ */
+function encodeHasActiveSubscription(subscriber, agentId) {
+    // keccak256("hasActiveSubscription(address,uint256)") = 0x9b2f1234
+    const addr = ethers_1.ethers.getAddress(subscriber);
+    const encoded = coder.encode(['address', 'uint256'], [addr, agentId]);
+    return '0x9b2f1234' + encoded.slice(2);
+}
+/**
+ * Safely call getPlan(uint256) and decode the SubscriptionPlan struct.
+ *
+ * Geth RPC on OxaChain L1 hangs indefinitely on struct-returning eth_call
+ * (known issue P1). This wrapper has a 5-second timeout to prevent the
+ * event loop from blocking.
+ *
+ * Returns null if the call fails, times out, or returns empty data.
+ */
+async function safeGetPlan(provider, contractAddress, planId, timeoutMs = 5000) {
+    const selector = '0x26cd5274'; // keccak256("getPlan(uint256)")
+    const encPid = coder.encode(['uint256'], [planId]).slice(2);
+    try {
+        const raw = await Promise.race([
+            provider.call({ to: contractAddress, data: selector + encPid }),
+            new Promise((_, reject) => setTimeout(() => reject(new Error('getPlan timeout')), timeoutMs)),
+        ]);
+        if (!raw || raw === '0x')
+            return null;
+        const decoded = coder.decode(['uint256', 'uint256', 'address', 'uint256', 'string', 'bool', 'address', 'uint256'], raw);
+        return {
+            planId: Number(decoded[0]),
+            agentId: Number(decoded[1]),
+            creator: decoded[2],
+            price: Number(decoded[3]),
+            period: decoded[4],
+            active: decoded[5],
+            payToken: decoded[6],
+            trialDays: Number(decoded[7]),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Encode giveFeedback(uint256,uint8,bytes32,bytes32,string,bytes32,bytes)
+ *
+ * This uses named parameters in the ABI to ensure proper type matching.
+ * The bytes feedbackAuth parameter is the EIP-191 signed authorization.
+ */
+function encodeGiveFeedback(agentId, score, tag1, tag2, fileuri, filehash, feedbackAuth) {
+    // keccak256("giveFeedback(uint256,uint8,bytes32,bytes32,string,bytes32,bytes)")
+    const encoded = coder.encode(['uint256', 'uint8', 'bytes32', 'bytes32', 'string', 'bytes32', 'bytes'], [agentId, score, tag1, tag2, fileuri, filehash, feedbackAuth]);
+    return '0x155e5bbd' + encoded.slice(2);
+}
+/**
+ * Safely call getSubscriptionDetail(uint256) via raw eth_call.
+ *
+ * ethers.js v6 fails to decode the 12-field struct (mixed static/dynamic types
+ * with string fields). This bypasses ethers.js entirely and uses raw eth_call
+ * + manual AbiCoder.decode, same pattern as safeGetPlan.
+ *
+ * Returns null on failure.
+ */
+async function safeGetSubscriptionDetail(provider, contractAddress, subscriptionId, timeoutMs = 5000) {
+    // keccak256("getSubscriptionDetail(uint256)") = 0xae823f57
+    const selector = '0xae823f57';
+    const encId = coder.encode(['uint256'], [subscriptionId]).slice(2);
+    try {
+        const raw = await Promise.race([
+            provider.call({ to: contractAddress, data: selector + encId }),
+            new Promise((_, reject) => setTimeout(() => reject(new Error('getSubscriptionDetail timeout')), timeoutMs)),
+        ]);
+        if (!raw || raw === '0x')
+            return null;
+        // Struct: (uint256,address,uint256,uint8,uint256,uint256,string,address,uint256,bool,uint256,bool)
+        const decoded = coder.decode(['uint256', 'address', 'uint256', 'uint8', 'uint256', 'uint256', 'string', 'address', 'uint256', 'bool', 'uint256', 'bool'], raw);
+        return {
+            subscriptionId: Number(decoded[0]),
+            subscriber: decoded[1],
+            planId: Number(decoded[2]),
+            status: decoded[3],
+            startedAt: Number(decoded[4]),
+            expiresAt: Number(decoded[5]),
+            period: decoded[6],
+            payToken: decoded[7],
+            amountPaid: Number(decoded[8]),
+            trialActive: decoded[9],
+            trialEndsAt: Number(decoded[10]),
+            fundsReleased: decoded[11],
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Safely call getTask(uint256) via raw eth_call.
+ *
+ * ethers.js v6 fails to decode the 9-field struct (3 string fields cause
+ * issues with the ABI decoder). This bypasses ethers.js entirely.
+ *
+ * Returns null on failure.
+ */
+async function safeGetTask(provider, contractAddress, taskId, timeoutMs = 5000) {
+    // keccak256("getTask(uint256)") = 0x1d65e77e (verify with ethers.id)
+    const selector = '0x1d65e77e';
+    const encId = coder.encode(['uint256'], [taskId]).slice(2);
+    try {
+        const raw = await Promise.race([
+            provider.call({ to: contractAddress, data: selector + encId }),
+            new Promise((_, reject) => setTimeout(() => reject(new Error('getTask timeout')), timeoutMs)),
+        ]);
+        if (!raw || raw === '0x')
+            return null;
+        // Struct: (uint256,uint256,string,string,string,uint256,address,uint256,uint256)
+        const decoded = coder.decode(['uint256', 'uint256', 'string', 'string', 'string', 'uint256', 'address', 'uint256', 'uint256'], raw);
+        return {
+            taskId: Number(decoded[0]),
+            agentId: Number(decoded[1]),
+            taskType: decoded[2],
+            inputData: decoded[3],
+            outputData: decoded[4],
+            status: decoded[5],
+            clientAddress: decoded[6],
+            createdAt: Number(decoded[7]),
+            completedAt: Number(decoded[8]),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=ethers-utils.js.map

package/dist/lib/ethers-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ethers-utils.js","sourceRoot":"","sources":["../../src/lib/ethers-utils.ts"],"names":[],"mappings":";AAAA,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAC9E,yEAAyE;AACzE,4EAA4E;AAC5E,sCAAsC;AACtC,EAAE;AACF,kBAAkB;AAClB,oEAAoE;AACpE,0EAA0E;AAC1E,kCAAkC;AAClC,+CAA+C;AAC/C,6EAA6E;AAC7E,2EAA2E;AAC3E,oBAAoB;AACpB,8EAA8E;;AAoB9E,gEAaC;AASD,kEAQC;AAWD,kCAiCC;AAQD,gDAeC;AAWD,8DAuCC;AAUD,kCAoCC;AAnND,mCAA+B;AAE/B,MAAM,KAAK,GAAG,eAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAA;AAE/C;;;;;;;;;;;;;GAaG;AACH,SAAgB,0BAA0B,CACxC,QAAgB,EAChB,IAAwB;IAExB,0EAA0E;IAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAC1B,CAAC,QAAQ,EAAE,uBAAuB,CAAC,EACnC;QACE,QAAQ;QACR,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;KACjE,CACF,CAAA;IACD,OAAO,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACxC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,2BAA2B,CACzC,UAAkB,EAClB,OAAe;IAEf,mEAAmE;IACnE,MAAM,IAAI,GAAG,eAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;IACrE,OAAO,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACxC,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,WAAW,CAC/B,QAAyB,EACzB,eAAuB,EACvB,MAAc,EACd,SAAS,GAAG,IAAI;IAEhB,MAAM,QAAQ,GAAG,YAAY,CAAA,CAAC,gCAAgC;IAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,GAAG,MAAM,EAAE,CAAC;YAC/D,IAAI,OAAO,CAAS,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAChC,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,EAAE,SAAS,CAAC,CAClE;SACF,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAC1B,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,EACpF,GAAG,CACJ,CAAA;QACD,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC3B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACnB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YAClB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YAClB,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YACpB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SAC9B,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAChC,OAAe,EACf,KAAa,EACb,IAAY,EACZ,IAAY,EACZ,OAAe,EACf,QAAgB,EAChB,YAAoB;IAEpB,gFAAgF;IAChF,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAC1B,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,EACxE,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,CAC9D,CAAA;IACD,OAAO,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACxC,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,yBAAyB,CAC7C,QAAyB,EACzB,eAAuB,EACvB,cAAsB,EACtB,SAAS,GAAG,IAAI;IAEhB,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,YAAY,CAAA;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAClE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,GAAG,KAAK,EAAE,CAAC;YAC9D,IAAI,OAAO,CAAS,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAChC,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,SAAS,CAAC,CAChF;SACF,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QACrC,mGAAmG;QACnG,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAC1B,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAC3H,GAAG,CACJ,CAAA;QACD,OAAO;YACL,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAClC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YACtB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YAClB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC7B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YAClB,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YACpB,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC9B,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YACvB,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAChC,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC;SAC3B,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,WAAW,CAC/B,QAAyB,EACzB,eAAuB,EACvB,MAAc,EACd,SAAS,GAAG,IAAI;IAEhB,qEAAqE;IACrE,MAAM,QAAQ,GAAG,YAAY,CAAA;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,GAAG,KAAK,EAAE,CAAC;YAC9D,IAAI,OAAO,CAAS,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAChC,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,EAAE,SAAS,CAAC,CAClE;SACF,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QACrC,iFAAiF;QACjF,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAC1B,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,EAChG,GAAG,CACJ,CAAA;QACD,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC3B,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YACpB,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YACrB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YACtB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YAClB,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;YACzB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC7B,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SAChC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/middleware/adminAuth.d.ts

@@ -0,0 +1,2 @@
+import { Request, Response, NextFunction } from 'express';
+export declare function adminAuth(req: Request, res: Response, next: NextFunction): void;

package/dist/middleware/adminAuth.js

@@ -0,0 +1,31 @@
+"use strict";
+// ---------------------------------------------------------------------------
+// AgentX Gateway — Admin Auth Middleware
+// ---------------------------------------------------------------------------
+// Simple shared-secret auth for admin routes.
+// Pass via Authorization: Bearer <ADMIN_KEY> or X-Admin-Key header.
+// ---------------------------------------------------------------------------
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.adminAuth = adminAuth;
+function adminAuth(req, res, next) {
+    const adminKey = process.env.ADMIN_KEY;
+    if (!adminKey) {
+        res.status(500).json({ error: 'Admin key not configured on server' });
+        return;
+    }
+    const authHeader = req.headers.authorization;
+    const xAdminKey = req.headers['x-admin-key'];
+    let token;
+    if (authHeader && authHeader.startsWith('Bearer ')) {
+        token = authHeader.slice(7);
+    }
+    else if (xAdminKey) {
+        token = xAdminKey;
+    }
+    if (!token || token !== adminKey) {
+        res.status(401).json({ error: 'Unauthorized: invalid admin key' });
+        return;
+    }
+    next();
+}
+//# sourceMappingURL=adminAuth.js.map

package/dist/middleware/adminAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminAuth.js","sourceRoot":"","sources":["../../src/middleware/adminAuth.ts"],"names":[],"mappings":";AAAA,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAC9E,8CAA8C;AAC9C,oEAAoE;AACpE,8EAA8E;;AAI9E,8BAwBC;AAxBD,SAAgB,SAAS,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAA;IAEtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAA;QACrE,OAAM;IACR,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAA;IAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAuB,CAAA;IAElE,IAAI,KAAyB,CAAA;IAC7B,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC7B,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,KAAK,GAAG,SAAS,CAAA;IACnB,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAA;QAClE,OAAM;IACR,CAAC;IAED,IAAI,EAAE,CAAA;AACR,CAAC"}

package/dist/middleware/auth.d.ts

@@ -0,0 +1,22 @@
+import { Request, Response, NextFunction } from 'express';
+export interface TenantContext {
+    id: string;
+    walletAddress: string;
+    planId: string;
+    planSlug: string;
+    quotaDaily: number;
+    quotaUsed: number;
+    rateLimitRpm: number;
+    maxConcurrent: number;
+    status: string;
+}
+declare global {
+    namespace Express {
+        interface Request {
+            tenant?: TenantContext;
+        }
+    }
+}
+export declare function getChallenge(req: Request, res: Response): Promise<void>;
+export declare function verifyChallenge(req: Request, res: Response): Promise<void>;
+export declare function authMiddleware(req: Request, res: Response, next: NextFunction): void;