@agentxv2/gateway 0.1.1

package/src/routes/tenant.ts

@@ -0,0 +1,196 @@
+// ---------------------------------------------------------------------------
+// AgentX Gateway — Tenant Management Routes
+// ---------------------------------------------------------------------------
+
+import { Router, Request, Response } from 'express'
+import { getPool } from '../lib/db'
+import { encryptApiKey, decryptApiKey } from '../lib/crypto'
+import { config } from '../config'
+
+const router = Router()
+
+// GET /api/v1/tenant/me
+router.get('/me', async (req: Request, res: Response) => {
+  const tenant = req.tenant
+
+  const pool = getPool()
+  const [planRow, keysRow, usageRow] = await Promise.all([
+    pool.query(`SELECT name, slug, quota_daily, quota_monthly, platform_models, byok_enabled, rate_limit_rpm, max_concurrent, features FROM plans WHERE id = $1`, [tenant!.planId]),
+    pool.query(`SELECT id, provider, model, label, endpoint, is_active, last_validated, created_at FROM tenant_api_keys WHERE tenant_id = $1 ORDER BY created_at DESC`, [tenant!.id]),
+    pool.query(`SELECT COALESCE(SUM(tokens_total), 0) as total_tokens, COALESCE(SUM(tool_calls), 0) as total_tool_calls FROM usage_logs WHERE tenant_id = $1 AND created_at > NOW() - INTERVAL '24 hours'`, [tenant!.id]),
+  ])
+
+  const platformModels = planRow.rows[0] ? planRow.rows[0].platform_models : []
+  const ownKeys = keysRow.rows.map(r => ({
+    id: r.id,
+    provider: r.provider,
+    model: r.model,
+    label: r.label,
+    endpoint: r.endpoint,
+    is_active: r.is_active,
+    last_validated: r.last_validated,
+    created_at: r.created_at,
+  }))
+
+  res.json({
+    tenant: {
+      id: tenant!.id,
+      wallet_address: tenant!.walletAddress,
+      status: tenant!.status,
+    },
+    plan: planRow.rows[0] ? {
+      name: planRow.rows[0].name,
+      slug: planRow.rows[0].slug,
+      quota_daily: planRow.rows[0].quota_daily,
+      quota_used: tenant!.quotaUsed,
+      platform_models: platformModels,
+      byok_enabled: planRow.rows[0].byok_enabled,
+      rate_limit_rpm: planRow.rows[0].rate_limit_rpm,
+      max_concurrent: planRow.rows[0].max_concurrent,
+    } : null,
+    own_keys: ownKeys,
+    usage_today: {
+      total_tokens: parseInt(usageRow.rows[0]?.total_tokens || '0', 10),
+      total_tool_calls: parseInt(usageRow.rows[0]?.total_tool_calls || '0', 10),
+    },
+  })
+})
+
+// GET /api/v1/tenant/keys
+router.get('/keys', async (req: Request, res: Response) => {
+  const pool = getPool()
+  const result = await pool.query(
+    `SELECT id, provider, model, label, endpoint, is_active, last_validated, created_at FROM tenant_api_keys WHERE tenant_id = $1 ORDER BY created_at DESC`,
+    [req.tenant!.id]
+  )
+  res.json({ keys: result.rows })
+})
+
+// POST /api/v1/tenant/keys
+router.post('/keys', async (req: Request, res: Response) => {
+  const { provider, endpoint, api_key, model, label } = req.body
+
+  if (!provider || !endpoint || !api_key || !model) {
+    res.status(400).json({ error: 'provider, endpoint, api_key, and model are required' })
+    return
+  }
+
+  const encrypted = encryptApiKey(api_key, config.masterEncryptionKey)
+
+  const pool = getPool()
+  const result = await pool.query(
+    `INSERT INTO tenant_api_keys (tenant_id, provider, endpoint, api_key, model, label)
+     VALUES ($1, $2, $3, $4, $5, $6)
+     RETURNING id, provider, model, label, endpoint, is_active, created_at`,
+    [req.tenant!.id, provider, endpoint, encrypted, model, label || null]
+  )
+
+  res.status(201).json({ key: result.rows[0] })
+})
+
+// DELETE /api/v1/tenant/keys/:keyId
+router.delete('/keys/:keyId', async (req: Request, res: Response) => {
+  const pool = getPool()
+  const result = await pool.query(
+    `DELETE FROM tenant_api_keys WHERE id = $1 AND tenant_id = $2 RETURNING id`,
+    [req.params.keyId, req.tenant!.id]
+  )
+  if (result.rows.length === 0) {
+    res.status(404).json({ error: 'Key not found' })
+    return
+  }
+  res.json({ deleted: true })
+})
+
+// POST /api/v1/tenant/keys/:keyId/validate
+router.post('/keys/:keyId/validate', async (req: Request, res: Response) => {
+  const pool = getPool()
+  const keyRow = await pool.query(
+    `SELECT * FROM tenant_api_keys WHERE id = $1 AND tenant_id = $2`,
+    [req.params.keyId, req.tenant!.id]
+  )
+  if (keyRow.rows.length === 0) {
+    res.status(404).json({ error: 'Key not found' })
+    return
+  }
+
+  const tk = keyRow.rows[0]
+  const key = decryptApiKey(tk.api_key, config.masterEncryptionKey)
+
+  try {
+    const testRes = await fetch(`${tk.endpoint}/models`, {
+      headers: { Authorization: `Bearer ${key}` },
+    })
+    if (testRes.ok) {
+      await pool.query(
+        `UPDATE tenant_api_keys SET is_active = true, last_validated = NOW() WHERE id = $1`,
+        [tk.id]
+      )
+      res.json({ valid: true, provider: tk.provider, endpoint: tk.endpoint })
+    } else {
+      await pool.query(
+        `UPDATE tenant_api_keys SET is_active = false WHERE id = $1`,
+        [tk.id]
+      )
+      res.json({ valid: false, error: `HTTP ${testRes.status}` })
+    }
+  } catch (err) {
+    res.json({ valid: false, error: String(err) })
+  }
+})
+
+// GET /api/v1/tenant/usage
+router.get('/usage', async (req: Request, res: Response) => {
+  const days = parseInt(req.query.days as string || '30', 10)
+  const pool = getPool()
+
+  const [summaryRow, timelineRows] = await Promise.all([
+    pool.query(
+      `SELECT
+         key_source,
+         COALESCE(SUM(tokens_total), 0) as total_tokens,
+         COALESCE(SUM(tool_calls), 0) as total_tool_calls,
+         COUNT(*) as request_count
+       FROM usage_logs
+       WHERE tenant_id = $1 AND created_at > NOW() - INTERVAL '1 day' * $2
+       GROUP BY key_source`,
+      [req.tenant!.id, days]
+    ),
+    pool.query(
+      `SELECT DATE(created_at) as day, key_source, COALESCE(SUM(tokens_total), 0) as tokens
+       FROM usage_logs
+       WHERE tenant_id = $1 AND created_at > NOW() - INTERVAL '1 day' * $2
+       GROUP BY DATE(created_at), key_source
+       ORDER BY day`,
+      [req.tenant!.id, days]
+    ),
+  ])
+
+  res.json({
+    summary: summaryRow.rows,
+    timeline: timelineRows.rows,
+  })
+})
+
+// GET /api/v1/models
+router.get('/models', async (req: Request, res: Response) => {
+  const tenant = req.tenant
+
+  const pool = getPool()
+  const [planRow, keysRow] = await Promise.all([
+    pool.query(`SELECT platform_models FROM plans WHERE id = $1`, [tenant!.planId]),
+    pool.query(`SELECT id, provider, model, label FROM tenant_api_keys WHERE tenant_id = $1 AND is_active = true`, [tenant!.id]),
+  ])
+
+  res.json({
+    platform: planRow.rows[0]?.platform_models || [],
+    tenant_owned: keysRow.rows.map(r => ({
+      id: r.id,
+      provider: r.provider,
+      model: r.model,
+      label: r.label,
+    })),
+  })
+})
+
+export default router

package/src/services/a2a-worker.ts

@@ -0,0 +1,486 @@
+// ---------------------------------------------------------------------------
+// AgentX Gateway — A2A Task Worker (v2 — ReAct AgentLoop + Multi-Agent Orchestration)
+// ---------------------------------------------------------------------------
+// Background service that:
+//   1. Polls OxaChain A2A contract for pending tasks (status=Created/Accepted)
+//   2. Runs ReAct-style AgentLoop with A2A tools for each task
+//   3. LLM can autonomously delegate sub-tasks to other agents via createTask()
+//   4. Sub-tasks are processed inline and results fed back to the parent LLM
+//
+// Multi-Agent Orchestration Flow:
+//   Agent A's task → LLM(Agent A) analyzes
+//     → LLM decides: "I need Agent B for auditing"
+//     → calls agentx_a2a_create_task(Agent B, "audit", ...)
+//     → Worker submits tx on-chain, processes Agent B's task inline
+//     → Agent B's result fed back to Agent A's LLM
+//     → LLM(Agent A) continues: "Now I need Agent C to summarize"
+//     → calls agentx_a2a_create_task(Agent C, "summarize", ...)
+//     → Worker processes Agent C's task inline
+//     → Agent A's LLM aggregates all results → final output
+// ---------------------------------------------------------------------------
+
+import { ethers } from 'ethers'
+import { getPool } from '../lib/db'
+import { config } from '../config'
+import { decryptApiKey } from '../lib/crypto'
+
+// ── A2A Contract ABI ──────────────────────────────────────────────────────
+
+const A2A_ABI = [
+  'function getAgentTasks(uint256 agentId) view returns (tuple(uint256,uint256,string,string,string,uint256,address,uint256,uint256,bytes32)[])',
+  'function getTask(uint256 taskId) view returns (uint256,uint256,string,string,string,uint256,address,uint256,uint256)',
+  'function createTask(uint256 agentId, string taskType, string inputData) returns (uint256)',
+  'event TaskCreated(uint256 indexed taskId, uint256 indexed agentId, address indexed client, string taskType, uint256 status)',
+]
+
+// ── Types ──────────────────────────────────────────────────────────────────
+
+interface A2ATaskOnChain {
+  taskId: number
+  agentId: number
+  taskType: string
+  inputData: string
+  outputData: string
+  status: number
+  clientAddress: string
+  createdAt: number
+}
+
+interface AgentInfo {
+  id: number
+  name: string
+  owner: string
+  description: string
+}
+
+// ── Worker State ───────────────────────────────────────────────────────────
+
+let pollingTimer: ReturnType<typeof setInterval> | null = null
+let isRunning = false
+const POLL_INTERVAL_MS = 30_000
+const MAX_BATCH_SIZE = 3            // Reduced since each task may spawn sub-tasks
+const MAX_DEPTH = 3                 // Max delegation depth
+const MAX_REACT_ITERATIONS = 5      // Max LLM tool-call rounds per task
+const processingSet = new Set<number>()
+let totalOrchestrated = 0           // Counter for multi-agent orchestrations
+
+// ── Public API ─────────────────────────────────────────────────────────────
+
+export function startA2AWorker(): void {
+  if (pollingTimer) return
+  console.log('[A2A Worker v2] Starting ReAct AgentLoop mode, poll:', POLL_INTERVAL_MS / 1000, 's')
+  pollingTimer = setInterval(pollAndProcess, POLL_INTERVAL_MS)
+  setTimeout(pollAndProcess, 5_000)
+}
+
+export function stopA2AWorker(): void {
+  if (pollingTimer) { clearInterval(pollingTimer); pollingTimer = null; console.log('[A2A Worker] Stopped') }
+}
+
+export function getWorkerStatus(): { running: boolean; processingSetSize: number; totalOrchestrated: number } {
+  return { running: pollingTimer !== null, processingSetSize: processingSet.size, totalOrchestrated }
+}
+
+// ── Core Logic ─────────────────────────────────────────────────────────────
+
+async function pollAndProcess(): Promise<void> {
+  if (isRunning) { console.log('[A2A Worker] Previous poll still running, skipping'); return }
+  isRunning = true
+  try {
+    const provider = new ethers.JsonRpcProvider(config.rpcUrlOxaChain)
+    const a2aContract = new ethers.Contract(config.a2aProtocolOxaChain, A2A_ABI, provider)
+    const pool = getPool()
+    const { rows: agents } = await pool.query(`SELECT id, name, owner, description FROM agents ORDER BY id`)
+    if (agents.length === 0) { isRunning = false; return }
+
+    let processedCount = 0
+    for (const agent of agents) {
+      if (processedCount >= MAX_BATCH_SIZE) break
+      const agentId = agent.id as number
+      const agentName = agent.name as string
+      const agentOwner = (agent.owner as string || '').toLowerCase()
+      let tenantId: string | null = null
+      if (agentOwner) {
+        const { rows: tenants } = await pool.query(`SELECT id FROM tenants WHERE LOWER(wallet_address) = $1`, [agentOwner])
+        tenantId = tenants[0]?.id || null
+      }
+
+      const { rows: existingResults } = await pool.query(
+        `SELECT task_id FROM a2a_task_results WHERE agent_id = $1 AND status = 2`, [agentId]
+      )
+      const completedTaskIds = new Set(existingResults.map((r: any) => r.task_id))
+
+      try {
+        const tasks: any[] = await a2aContract.getAgentTasks(agentId)
+        for (const task of tasks) {
+          if (processedCount >= MAX_BATCH_SIZE) break
+          const taskId = Number(task[0])
+          const status = Number(task[5])
+          if (status > 1 || completedTaskIds.has(taskId) || processingSet.has(taskId)) continue
+
+          const onChainTask: A2ATaskOnChain = {
+            taskId, agentId: Number(task[1]), taskType: String(task[2] || ''),
+            inputData: String(task[3] || ''), outputData: String(task[4] || ''),
+            status, clientAddress: String(task[6] || ''), createdAt: Number(task[7] || 0),
+          }
+
+          processingSet.add(taskId); processedCount++
+          console.log(`[A2A Worker] Task #${taskId} → Agent #${agentId} (${agentName})`)
+
+          processTask(pool, onChainTask, { id: agentId, name: agentName, owner: agentOwner, description: agent.description as string }, tenantId, agents as AgentInfo[], 0)
+            .catch(err => console.error(`[A2A Worker] Task #${taskId} failed:`, err.message))
+            .finally(() => processingSet.delete(taskId))
+        }
+      } catch (err: any) {
+        if (!err.message?.includes('TaskNotFound') && !err.message?.includes('revert')) {
+          console.warn(`[A2A Worker] Error for agent #${agentId}:`, err.message?.slice(0, 100))
+        }
+      }
+    }
+    if (processedCount > 0) console.log(`[A2A Worker] Queued ${processedCount} task(s)`)
+  } catch (err: any) { console.error('[A2A Worker] Poll error:', err.message) }
+  finally { isRunning = false }
+}
+
+// ── ReAct AgentLoop Task Processing ────────────────────────────────────────
+
+const A2A_TOOLS = [
+  {
+    type: 'function' as const,
+    function: {
+      name: 'agentx_a2a_create_task',
+      description: 'DELEGATE work to another AgentX agent. Creates an on-chain task. Use this when you need another agent\'s expertise. The sub-task will be processed and its result returned to you.',
+      parameters: {
+        type: 'object',
+        properties: {
+          targetAgentId: { type: 'integer', description: 'The agent ID to delegate to' },
+          taskType: { type: 'string', description: 'Type of task (e.g., "audit", "analyze", "summarize", "translate")' },
+          inputData: { type: 'string', description: 'Full task description. Include ALL context the sub-agent needs.' },
+        },
+        required: ['targetAgentId', 'taskType', 'inputData'],
+      },
+    },
+  },
+  {
+    type: 'function' as const,
+    function: {
+      name: 'agentx_a2a_get_task',
+      description: 'Check the status and result of an A2A task by ID. Use to check if a delegated sub-task has completed.',
+      parameters: {
+        type: 'object',
+        properties: { taskId: { type: 'integer', description: 'The task ID to query' } },
+        required: ['taskId'],
+      },
+    },
+  },
+  {
+    type: 'function' as const,
+    function: {
+      name: 'agentx_list_agents',
+      description: 'List ALL available agents with their IDs, names, and descriptions. Use this to discover which agents can help with sub-tasks.',
+      parameters: { type: 'object', properties: {} },
+    },
+  },
+]
+
+async function processTask(
+  pool: ReturnType<typeof getPool>,
+  task: A2ATaskOnChain,
+  agent: AgentInfo,
+  tenantId: string | null,
+  allAgents: AgentInfo[],
+  depth: number,
+): Promise<string> {
+  const indent = '  '.repeat(depth)
+  const taskId = task.taskId
+
+  if (depth >= MAX_DEPTH) {
+    console.log(`${indent}[A2A] Max depth reached for task #${taskId}, processing directly`)
+  }
+
+  await pool.query(
+    `INSERT INTO a2a_task_results (task_id, agent_id, task_type, input_data, tenant_id, status, created_at)
+     VALUES ($1, $2, $3, $4, $5, 1, NOW())
+     ON CONFLICT (task_id) DO UPDATE SET status = 1`,
+    [taskId, task.agentId, task.taskType, task.inputData, tenantId]
+  )
+
+  try {
+    const llmConfig = await resolveLLMConfig(pool, tenantId)
+    if (!llmConfig) throw new Error('No LLM API key available')
+
+    console.log(`${indent}[A2A] ReAct loop for task #${taskId} (Agent: ${agent.name}, depth: ${depth})`)
+
+    // ── ReAct AgentLoop ─────────────────────────────────────────────────
+    const messages: { role: string; content: string | null; tool_calls?: any[]; tool_call_id?: string }[] = [
+      {
+        role: 'system',
+        content: buildOrchestrationSystemPrompt(agent, allAgents),
+      },
+      {
+        role: 'user',
+        content: buildOrchestrationUserPrompt(task),
+      },
+    ]
+
+    let finalContent = ''
+    let totalTokens = 0
+    let subTaskResults: { taskId: number; agentName: string; output: string }[] = []
+
+    for (let iter = 0; iter < MAX_REACT_ITERATIONS; iter++) {
+      const response = await callLLMWithTools(llmConfig, messages, A2A_TOOLS)
+      totalTokens += response.tokens
+      const choice = response.choices[0]
+      const msg = choice.message
+
+      // If no tool calls, we have the final answer
+      if (!msg.tool_calls || msg.tool_calls.length === 0) {
+        finalContent = msg.content || ''
+        messages.push({ role: 'assistant', content: finalContent })
+        break
+      }
+
+      // Process tool calls
+      messages.push({ role: 'assistant', content: msg.content || null, tool_calls: msg.tool_calls })
+
+      for (const tc of msg.tool_calls) {
+        const toolName = tc.function.name
+        let args: Record<string, unknown> = {}
+        try { args = JSON.parse(tc.function.arguments) } catch { /* raw string */ }
+
+        console.log(`${indent}[A2A] LLM calls ${toolName}(${JSON.stringify(args).slice(0, 80)})`)
+
+        let toolResult: string
+
+        switch (toolName) {
+          case 'agentx_list_agents': {
+            const list = allAgents.map(a => `#${a.id} "${a.name}" — ${a.description || '(no description)'}`).join('\n')
+            toolResult = `Available agents:\n${list}`
+            break
+          }
+
+          case 'agentx_a2a_create_task': {
+            const targetId = Number(args.targetAgentId)
+            const subTaskType = String(args.taskType || 'analyze')
+            const subInput = String(args.inputData || '')
+
+            if (!targetId || isNaN(targetId)) {
+              toolResult = 'Error: targetAgentId is required'
+              break
+            }
+
+            const targetAgent = allAgents.find(a => a.id === targetId)
+            const targetName = targetAgent?.name || `Agent #${targetId}`
+
+            // Submit createTask on-chain (permissionless — anyone can call)
+            let subTaskId: number
+            try {
+              subTaskId = await createTaskOnChain(targetId, subTaskType, subInput)
+            } catch (err: any) {
+              toolResult = `Error creating sub-task: ${err.message}`
+              break
+            }
+
+            console.log(`${indent}[A2A] → Delegated to ${targetName} (#${targetId}), sub-task: #${subTaskId}`)
+            totalOrchestrated++
+
+            // Process sub-task recursively inline
+            const subOutput = await processTask(
+              pool,
+              {
+                taskId: subTaskId, agentId: targetId, taskType: subTaskType,
+                inputData: subInput, outputData: '', status: 0,
+                clientAddress: task.clientAddress, createdAt: Math.floor(Date.now() / 1000),
+              },
+              targetAgent || { id: targetId, name: targetName, owner: '', description: '' },
+              tenantId,
+              allAgents,
+              depth + 1,
+            )
+
+            subTaskResults.push({ taskId: subTaskId, agentName: targetName, output: subOutput })
+            toolResult = `Sub-task #${subTaskId} completed by ${targetName}.\nResult: ${subOutput.slice(0, 2000)}`
+            break
+          }
+
+          case 'agentx_a2a_get_task': {
+            const queryId = Number(args.taskId)
+            if (!queryId || isNaN(queryId)) { toolResult = 'Error: taskId required'; break }
+            try {
+              const provider = new ethers.JsonRpcProvider(config.rpcUrlOxaChain)
+              const a2aContract = new ethers.Contract(config.a2aProtocolOxaChain, A2A_ABI, provider)
+              const t = await a2aContract.getTask(queryId)
+              const statusMap = ['Created', 'Accepted', 'InProgress', 'Completed', 'Failed']
+              toolResult = JSON.stringify({
+                taskId: Number(t[0]), agentId: Number(t[1]), taskType: String(t[2]),
+                status: statusMap[Number(t[5])] || 'Unknown',
+                outputData: String(t[4] || ''),
+              })
+            } catch { toolResult = `Task #${queryId} not found` }
+            break
+          }
+
+          default:
+            toolResult = `Unknown tool: ${toolName}`
+        }
+
+        messages.push({ role: 'tool', content: toolResult, tool_call_id: tc.id })
+      }
+    }
+
+    if (!finalContent && messages.length > 2) {
+      // LLM used tools but didn't produce final text — get a summary
+      messages.push({ role: 'user', content: 'Based on all the sub-task results above, provide your final combined output. Return ONLY the final result.' })
+      const finalResp = await callLLMWithTools(llmConfig, messages, [])
+      finalContent = finalResp.choices[0]?.message?.content || 'Task processed via multi-agent orchestration.'
+      totalTokens += finalResp.tokens
+    }
+
+    if (!finalContent) finalContent = 'Task processed.'
+
+    // Store result
+    await pool.query(
+      `UPDATE a2a_task_results SET status = 2, output_data = $2, llm_model = $3, tokens_used = $4, processed_at = NOW()
+       WHERE task_id = $1`,
+      [taskId, finalContent, llmConfig.model, totalTokens]
+    )
+
+    const orchestrationNote = subTaskResults.length > 0
+      ? ` (orchestrated ${subTaskResults.length} sub-task(s): ${subTaskResults.map(s => `#${s.taskId}→${s.agentName}`).join(', ')})`
+      : ''
+    console.log(`${indent}[A2A] Task #${taskId} done, tokens: ${totalTokens}${orchestrationNote}`)
+
+    return finalContent
+  } catch (err: any) {
+    await pool.query(
+      `UPDATE a2a_task_results SET status = 3, error_message = $2, processed_at = NOW() WHERE task_id = $1`,
+      [taskId, err.message.slice(0, 500)]
+    )
+    console.error(`${'  '.repeat(depth)}[A2A] Task #${taskId} failed:`, err.message.slice(0, 100))
+    throw err
+  }
+}
+
+// ── On-Chain Helpers ──────────────────────────────────────────────────────
+
+async function createTaskOnChain(agentId: number, taskType: string, inputData: string): Promise<number> {
+  const workerPk = process.env.A2A_WORKER_PRIVATE_KEY
+  if (!workerPk) throw new Error('A2A_WORKER_PRIVATE_KEY not configured — cannot create sub-tasks')
+
+  const provider = new ethers.JsonRpcProvider(config.rpcUrlOxaChain)
+  const wallet = new ethers.Wallet(workerPk, provider)
+  const a2aContract = new ethers.Contract(config.a2aProtocolOxaChain, A2A_ABI, wallet)
+
+  const tx = await a2aContract.createTask(agentId, taskType, inputData)
+  const receipt = await tx.wait()
+
+  // Parse TaskCreated event to get taskId
+  for (const log of receipt.logs) {
+    if (log.topics.length >= 2) {
+      try { return Number(log.topics[1]) } catch { /* */ }
+    }
+  }
+  throw new Error('Could not parse taskId from createTask tx')
+}
+
+// ── LLM Helpers ────────────────────────────────────────────────────────────
+
+interface LLMConfig {
+  endpoint: string
+  apiKey: string
+  model: string
+}
+
+async function resolveLLMConfig(pool: ReturnType<typeof getPool>, tenantId: string | null): Promise<LLMConfig | null> {
+  if (tenantId) {
+    const { rows } = await pool.query(
+      `SELECT * FROM tenant_api_keys WHERE tenant_id = $1 AND is_active = true ORDER BY random() LIMIT 1`, [tenantId]
+    )
+    if (rows.length > 0) return { endpoint: rows[0].endpoint, apiKey: decryptApiKey(rows[0].api_key, config.masterEncryptionKey), model: rows[0].model || 'deepseek-chat' }
+  }
+  const { rows: pks } = await pool.query(`SELECT * FROM platform_api_keys WHERE is_active = true ORDER BY random() LIMIT 1`)
+  if (pks.length > 0) return { endpoint: pks[0].endpoint, apiKey: decryptApiKey(pks[0].api_key, config.masterEncryptionKey), model: pks[0].models?.[0] || 'deepseek-chat' }
+  return null
+}
+
+function buildOrchestrationSystemPrompt(agent: AgentInfo, allAgents: AgentInfo[]): string {
+  const agentList = allAgents.slice(0, 30).map(a => `  #${a.id} "${a.name}" — ${a.description || 'No description'}`).join('\n')
+
+  return `You are "${agent.name}", an AI agent on the AgentX decentralized platform.
+
+## Your Role
+${agent.description || 'Process delegated tasks professionally and return results.'}
+
+## Multi-Agent Orchestration
+You have access to A2A (Agent-to-Agent) tools that let you DELEGATE work to other agents.
+When a task is complex or requires specialized skills, break it down and delegate sub-tasks.
+
+### Available Agents
+${agentList}
+
+### How to Orchestrate
+1. Analyze the task — what parts need specialized agents?
+2. Call agentx_list_agents to see available agents
+3. Call agentx_a2a_create_task to delegate sub-tasks (each runs autonomously)
+4. Call agentx_a2a_get_task to check sub-task results
+5. Aggregate ALL sub-task results into your final output
+
+### Rules
+- Delegate when another agent has relevant expertise
+- Include ALL context in inputData so the sub-agent can work independently
+- After getting sub-task results, synthesize them into a coherent final answer
+- If the task is simple and you can handle it alone, just answer directly
+- Always provide a final answer (don't leave the user hanging)`
+}
+
+function buildOrchestrationUserPrompt(task: A2ATaskOnChain): string {
+  return `Task Type: ${task.taskType}
+Client: ${task.clientAddress}
+
+Task Input:
+${task.inputData || 'Please process this task.'}
+
+Process this task. If it requires multiple specialized skills, use the available A2A tools to delegate sub-tasks to appropriate agents. Return your final combined output.`
+}
+
+// ── LLM Call with Tools (ReAct) ──────────────────────────────────────────
+
+interface LLMToolCallResponse {
+  choices: { message: { role: string; content: string | null; tool_calls?: { id: string; function: { name: string; arguments: string } }[] } }[]
+  tokens: number
+}
+
+async function callLLMWithTools(
+  cfg: LLMConfig,
+  messages: { role: string; content: string | null; tool_calls?: any[]; tool_call_id?: string }[],
+  tools: typeof A2A_TOOLS,
+): Promise<LLMToolCallResponse> {
+  const body: Record<string, unknown> = {
+    model: cfg.model,
+    messages,
+    max_tokens: 2048,
+    temperature: 0.3,
+  }
+  if (tools.length > 0) {
+    body.tools = tools
+    body.tool_choice = 'auto'
+  }
+
+  const res = await fetch(`${cfg.endpoint}/chat/completions`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${cfg.apiKey}` },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(120_000),
+  })
+
+  if (!res.ok) {
+    const errText = await res.text().catch(() => 'unknown error')
+    throw new Error(`LLM call failed (HTTP ${res.status}): ${errText.slice(0, 200)}`)
+  }
+
+  const data = await res.json()
+  return {
+    choices: data.choices || [],
+    tokens: data.usage?.total_tokens || 0,
+  }
+}