@dominusnode/ai-tools 1.1.1 → 1.3.0

package/dist/tools.js

@@ -1,5 +1,6 @@
 import { tool } from "ai";
 import { z } from "zod";
+import * as crypto from "node:crypto";
 import dns from "dns/promises";
 import * as http from "node:http";
 import * as tls from "node:tls";
@@ -73,11 +74,66 @@ function isPrivateIp(hostname) {
         return true;
     return false;
 }
+// ---------------------------------------------------------------------------
+// SHA-256 Proof-of-Work solver
+// ---------------------------------------------------------------------------
+function countLeadingZeroBits(buf) {
+    let count = 0;
+    for (const byte of buf) {
+        if (byte === 0) {
+            count += 8;
+            continue;
+        }
+        let mask = 0x80;
+        while (mask && !(byte & mask)) {
+            count++;
+            mask >>= 1;
+        }
+        break;
+    }
+    return count;
+}
+async function solvePoW(powBaseUrl) {
+    try {
+        const resp = await fetch(`${powBaseUrl}/api/auth/pow/challenge`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            redirect: "error",
+        });
+        if (!resp.ok)
+            return null;
+        const text = await resp.text();
+        if (text.length > 10_485_760)
+            return null;
+        const challenge = JSON.parse(text);
+        const prefix = challenge.prefix ?? "";
+        const difficulty = challenge.difficulty ?? 20;
+        const challengeId = challenge.challengeId ?? "";
+        if (!prefix || !challengeId)
+            return null;
+        for (let nonce = 0; nonce < 100_000_000; nonce++) {
+            const hash = crypto
+                .createHash("sha256")
+                .update(prefix + nonce.toString())
+                .digest();
+            if (countLeadingZeroBits(hash) >= difficulty) {
+                return { challengeId, nonce: nonce.toString() };
+            }
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
 /** Validate a URL is safe to fetch through the proxy. */
 function validateUrl(urlStr) {
     // Length limit
     if (urlStr.length > 2048) {
-        return { valid: false, error: "URL exceeds maximum length of 2048 characters" };
+        return {
+            valid: false,
+            error: "URL exceeds maximum length of 2048 characters",
+        };
     }
     let url;
     try {
@@ -88,7 +144,10 @@ function validateUrl(urlStr) {
     }
     // Protocol check — only http(s)
     if (url.protocol !== "http:" && url.protocol !== "https:") {
-        return { valid: false, error: `Unsupported protocol: ${url.protocol} — only http and https are allowed` };
+        return {
+            valid: false,
+            error: `Unsupported protocol: ${url.protocol} — only http and https are allowed`,
+        };
     }
     // Hostname must be present
     if (!url.hostname) {
@@ -103,16 +162,27 @@ function validateUrl(urlStr) {
         return { valid: false, error: "Requests to localhost are not allowed" };
     }
     // Block internal network TLDs
-    if (lowerHost.endsWith(".local") || lowerHost.endsWith(".internal") || lowerHost.endsWith(".arpa")) {
-        return { valid: false, error: "Requests to internal network hostnames are not allowed" };
+    if (lowerHost.endsWith(".local") ||
+        lowerHost.endsWith(".internal") ||
+        lowerHost.endsWith(".arpa")) {
+        return {
+            valid: false,
+            error: "Requests to internal network hostnames are not allowed",
+        };
     }
     // Block private/reserved IPs
     if (isPrivateIp(url.hostname)) {
-        return { valid: false, error: "Requests to private/reserved IP addresses are not allowed" };
+        return {
+            valid: false,
+            error: "Requests to private/reserved IP addresses are not allowed",
+        };
     }
     // Block credentials in URL (user:pass@host)
     if (url.username || url.password) {
-        return { valid: false, error: "URLs with embedded credentials are not allowed" };
+        return {
+            valid: false,
+            error: "URLs with embedded credentials are not allowed",
+        };
     }
     return { valid: true, url };
 }
@@ -122,7 +192,8 @@ const MAX_BODY_LENGTH = 4000;
 function truncateBody(body) {
     if (body.length <= MAX_BODY_LENGTH)
         return body;
-    return body.slice(0, MAX_BODY_LENGTH) + `\n...[truncated, ${body.length - MAX_BODY_LENGTH} chars omitted]`;
+    return (body.slice(0, MAX_BODY_LENGTH) +
+        `\n...[truncated, ${body.length - MAX_BODY_LENGTH} chars omitted]`);
 }
 // ---------------------------------------------------------------------------
 // Safe header subset — never forward sensitive headers to the AI
@@ -197,7 +268,7 @@ async function checkDnsRebinding(hostname) {
 // ---------------------------------------------------------------------------
 // Credential sanitization for error messages
 // ---------------------------------------------------------------------------
-const CREDENTIAL_RE = /dn_(live|test)_[a-zA-Z0-9]+|eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g;
+const CREDENTIAL_RE = /dn_(live|test|proxy)_[a-zA-Z0-9]+|eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g;
 function sanitizeError(message) {
     return message.replace(CREDENTIAL_RE, "***");
 }
@@ -245,7 +316,11 @@ export function createProxiedFetchTool(client, apiKey) {
             "Supports geo-targeting by country and choice of datacenter (dc) or residential proxy. " +
             "Use this to fetch web pages, APIs, or any HTTP resource through a proxy IP.",
         parameters: z.object({
-            url: z.string().max(2048).url().describe("The URL to fetch through the proxy"),
+            url: z
+                .string()
+                .max(2048)
+                .url()
+                .describe("The URL to fetch through the proxy"),
             method: z
                 .enum(["GET", "HEAD", "OPTIONS"])
                 .default("GET")
@@ -264,7 +339,7 @@ export function createProxiedFetchTool(client, apiKey) {
                 .optional()
                 .describe("Optional HTTP headers to include in the request"),
         }),
-        execute: async ({ url, method, country, proxyType, headers }) => {
+        execute: async ({ url, method, country, proxyType, headers, }) => {
             // SSRF validation
             const validation = validateUrl(url);
             if (!validation.valid) {
@@ -272,14 +347,18 @@ export function createProxiedFetchTool(client, apiKey) {
             }
             // OFAC sanctioned country check
             if (country && SANCTIONED_COUNTRIES.has(country.toUpperCase())) {
-                return { error: `Country '${country.toUpperCase()}' is blocked (OFAC sanctioned)` };
+                return {
+                    error: `Country '${country.toUpperCase()}' is blocked (OFAC sanctioned)`,
+                };
             }
             // DNS rebinding protection
             try {
                 await checkDnsRebinding(validation.url.hostname);
             }
             catch (err) {
-                return { error: err instanceof Error ? err.message : "DNS validation failed" };
+                return {
+                    error: err instanceof Error ? err.message : "DNS validation failed",
+                };
             }
             // Build the proxy URL using the SDK
             const proxyUrl = client.proxy.buildUrl(apiKey, {
@@ -293,12 +372,22 @@ export function createProxiedFetchTool(client, apiKey) {
                 const proxyAuth = "Basic " +
                     Buffer.from(`${proxyUrlObj.username}:${proxyUrlObj.password}`).toString("base64");
                 // Validate custom headers for CRLF injection
-                const STRIPPED_HEADERS = new Set(["host", "connection", "content-length", "transfer-encoding", "proxy-authorization", "authorization", "user-agent"]);
+                const STRIPPED_HEADERS = new Set([
+                    "host",
+                    "connection",
+                    "content-length",
+                    "transfer-encoding",
+                    "proxy-authorization",
+                    "authorization",
+                    "user-agent",
+                ]);
                 const safeHeaders = {};
                 if (headers) {
                     for (const [k, v] of Object.entries(headers)) {
                         if (/[\r\n\0]/.test(k) || /[\r\n\0]/.test(v)) {
-                            return { error: `Header "${k.replace(/[\r\n\0]/g, "")}" contains invalid characters` };
+                            return {
+                                error: `Header "${k.replace(/[\r\n\0]/g, "")}" contains invalid characters`,
+                            };
                         }
                         if (!STRIPPED_HEADERS.has(k.toLowerCase())) {
                             safeHeaders[k] = v;
@@ -309,14 +398,23 @@ export function createProxiedFetchTool(client, apiKey) {
                 const MAX_RESP = 1_048_576; // 1MB
                 const result = await new Promise((resolve, reject) => {
                     const timer = setTimeout(() => reject(new Error("Proxy request timed out")), 30_000);
-                    const customHeaderLines = Object.entries(safeHeaders).map(([k, v]) => `${k}: ${v}\r\n`).join("");
+                    const customHeaderLines = Object.entries(safeHeaders)
+                        .map(([k, v]) => `${k}: ${v}\r\n`)
+                        .join("");
                     if (targetUrl.protocol === "https:") {
                         // HTTPS: use CONNECT tunnel through proxy
-                        const connectHost = targetUrl.hostname.includes(":") ? `[${targetUrl.hostname}]` : targetUrl.hostname;
+                        const connectHost = targetUrl.hostname.includes(":")
+                            ? `[${targetUrl.hostname}]`
+                            : targetUrl.hostname;
                         const connectReq = http.request({
-                            hostname: proxyHost, port: proxyPort, method: "CONNECT",
+                            hostname: proxyHost,
+                            port: proxyPort,
+                            method: "CONNECT",
                             path: `${connectHost}:${targetUrl.port || 443}`,
-                            headers: { "Proxy-Authorization": proxyAuth, Host: `${connectHost}:${targetUrl.port || 443}` },
+                            headers: {
+                                "Proxy-Authorization": proxyAuth,
+                                Host: `${connectHost}:${targetUrl.port || 443}`,
+                            },
                         });
                         connectReq.on("connect", (_res, sock) => {
                             if (_res.statusCode !== 200) {
@@ -325,13 +423,21 @@ export function createProxiedFetchTool(client, apiKey) {
                                 reject(new Error(`CONNECT failed: ${_res.statusCode}`));
                                 return;
                             }
-                            const tlsSock = tls.connect({ host: targetUrl.hostname, socket: sock, servername: targetUrl.hostname, minVersion: "TLSv1.2" }, () => {
+                            const tlsSock = tls.connect({
+                                host: targetUrl.hostname,
+                                socket: sock,
+                                servername: targetUrl.hostname,
+                                minVersion: "TLSv1.2",
+                            }, () => {
                                 const reqLine = `${method} ${targetUrl.pathname + targetUrl.search} HTTP/1.1\r\nHost: ${targetUrl.host}\r\nUser-Agent: dominusnode-vercel-ai/1.0.0\r\n${customHeaderLines}Connection: close\r\n\r\n`;
                                 tlsSock.write(reqLine);
                                 const chunks = [];
                                 let bytes = 0;
-                                tlsSock.on("data", (c) => { bytes += c.length; if (bytes <= MAX_RESP + 16384)
-                                    chunks.push(c); });
+                                tlsSock.on("data", (c) => {
+                                    bytes += c.length;
+                                    if (bytes <= MAX_RESP + 16384)
+                                        chunks.push(c);
+                                });
                                 let done = false;
                                 const fin = () => {
                                     if (done)
@@ -346,55 +452,96 @@ export function createProxiedFetchTool(client, apiKey) {
                                     }
                                     const hdr = raw.substring(0, hEnd);
                                     const body = raw.substring(hEnd + 4).substring(0, MAX_RESP);
-                                    const sm = hdr.split("\r\n")[0].match(/^HTTP\/\d\.\d\s+(\d+)\s*(.*)/);
+                                    const sm = hdr
+                                        .split("\r\n")[0]
+                                        .match(/^HTTP\/\d\.\d\s+(\d+)\s*(.*)/);
                                     const hdrs = {};
                                     for (const l of hdr.split("\r\n").slice(1)) {
                                         const ci = l.indexOf(":");
                                         if (ci > 0)
-                                            hdrs[l.substring(0, ci).trim().toLowerCase()] = l.substring(ci + 1).trim();
+                                            hdrs[l.substring(0, ci).trim().toLowerCase()] = l
+                                                .substring(ci + 1)
+                                                .trim();
                                     }
                                     stripDangerousKeys(hdrs);
-                                    resolve({ status: sm ? parseInt(sm[1], 10) : 0, statusText: sm ? sm[2] ?? "" : "", headers: hdrs, body });
+                                    resolve({
+                                        status: sm ? parseInt(sm[1], 10) : 0,
+                                        statusText: sm ? (sm[2] ?? "") : "",
+                                        headers: hdrs,
+                                        body,
+                                    });
                                 };
                                 tlsSock.on("end", fin);
                                 tlsSock.on("close", fin);
-                                tlsSock.on("error", (e) => { clearTimeout(timer); reject(e); });
+                                tlsSock.on("error", (e) => {
+                                    clearTimeout(timer);
+                                    reject(e);
+                                });
+                            });
+                            tlsSock.on("error", (e) => {
+                                clearTimeout(timer);
+                                reject(e);
                             });
-                            tlsSock.on("error", (e) => { clearTimeout(timer); reject(e); });
                         });
-                        connectReq.on("error", (e) => { clearTimeout(timer); reject(e); });
+                        connectReq.on("error", (e) => {
+                            clearTimeout(timer);
+                            reject(e);
+                        });
                         connectReq.end();
                     }
                     else {
                         // HTTP: route through proxy with full URL as request path
                         const req = http.request({
-                            hostname: proxyHost, port: proxyPort, method, path: targetUrl.toString(),
-                            headers: { "Proxy-Authorization": proxyAuth, Host: targetUrl.host ?? "", ...safeHeaders },
+                            hostname: proxyHost,
+                            port: proxyPort,
+                            method,
+                            path: targetUrl.toString(),
+                            headers: {
+                                "Proxy-Authorization": proxyAuth,
+                                Host: targetUrl.host ?? "",
+                                ...safeHeaders,
+                            },
                         }, (res) => {
                             const chunks = [];
                             let bytes = 0;
-                            res.on("data", (c) => { bytes += c.length; if (bytes <= MAX_RESP)
-                                chunks.push(c); });
+                            res.on("data", (c) => {
+                                bytes += c.length;
+                                if (bytes <= MAX_RESP)
+                                    chunks.push(c);
+                            });
                             let done = false;
                             const fin = () => {
                                 if (done)
                                     return;
                                 done = true;
                                 clearTimeout(timer);
-                                const body = Buffer.concat(chunks).toString("utf-8").substring(0, MAX_RESP);
+                                const body = Buffer.concat(chunks)
+                                    .toString("utf-8")
+                                    .substring(0, MAX_RESP);
                                 const hdrs = {};
                                 for (const [k, v] of Object.entries(res.headers)) {
                                     if (v)
                                         hdrs[k] = Array.isArray(v) ? v.join(", ") : v;
                                 }
                                 stripDangerousKeys(hdrs);
-                                resolve({ status: res.statusCode ?? 0, statusText: res.statusMessage ?? "", headers: hdrs, body });
+                                resolve({
+                                    status: res.statusCode ?? 0,
+                                    statusText: res.statusMessage ?? "",
+                                    headers: hdrs,
+                                    body,
+                                });
                             };
                             res.on("end", fin);
                             res.on("close", fin);
-                            res.on("error", (e) => { clearTimeout(timer); reject(e); });
+                            res.on("error", (e) => {
+                                clearTimeout(timer);
+                                reject(e);
+                            });
+                        });
+                        req.on("error", (e) => {
+                            clearTimeout(timer);
+                            reject(e);
                         });
-                        req.on("error", (e) => { clearTimeout(timer); reject(e); });
                         req.end();
                     }
                 });
@@ -535,7 +682,9 @@ export function createGetProxyConfigTool(client) {
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : "Unknown error";
-                return { error: `Failed to get proxy config: ${sanitizeError(message)}` };
+                return {
+                    error: `Failed to get proxy config: ${sanitizeError(message)}`,
+                };
             }
         },
     });
@@ -585,7 +734,9 @@ export function createTopupPaypalTool(client) {
         }),
         execute: async ({ amount_cents }) => {
             try {
-                const result = await client.wallet.topupPaypal({ amountCents: amount_cents });
+                const result = await client.wallet.topupPaypal({
+                    amountCents: amount_cents,
+                });
                 return {
                     orderId: result.orderId,
                     approvalUrl: result.approvalUrl,
@@ -594,7 +745,9 @@ export function createTopupPaypalTool(client) {
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : "Unknown error";
-                return { error: `Failed to create PayPal top-up: ${sanitizeError(message)}` };
+                return {
+                    error: `Failed to create PayPal top-up: ${sanitizeError(message)}`,
+                };
             }
         },
     });
@@ -617,7 +770,9 @@ export function createTopupStripeTool(client) {
         }),
         execute: async ({ amount_cents }) => {
             try {
-                const result = await client.wallet.topupStripe({ amountCents: amount_cents });
+                const result = await client.wallet.topupStripe({
+                    amountCents: amount_cents,
+                });
                 return {
                     sessionId: result.sessionId,
                     url: result.url,
@@ -626,7 +781,9 @@ export function createTopupStripeTool(client) {
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : "Unknown error";
-                return { error: `Failed to create Stripe checkout: ${sanitizeError(message)}` };
+                return {
+                    error: `Failed to create Stripe checkout: ${sanitizeError(message)}`,
+                };
             }
         },
     });
@@ -645,12 +802,27 @@ export function createTopupCryptoTool(client) {
                 .max(1000)
                 .describe("Amount in USD to top up (min $5, max $1,000)"),
             currency: z
-                .enum(["BTC", "ETH", "LTC", "XMR", "ZEC", "USDC", "SOL", "USDT", "DAI", "BNB", "LINK"])
+                .enum([
+                "BTC",
+                "ETH",
+                "LTC",
+                "XMR",
+                "ZEC",
+                "USDC",
+                "SOL",
+                "USDT",
+                "DAI",
+                "BNB",
+                "LINK",
+            ])
                 .describe("Cryptocurrency to pay with"),
         }),
-        execute: async ({ amount_usd, currency }) => {
+        execute: async ({ amount_usd, currency, }) => {
             try {
-                const result = await client.wallet.topupCrypto({ amountUsd: amount_usd, currency: currency.toLowerCase() });
+                const result = await client.wallet.topupCrypto({
+                    amountUsd: amount_usd,
+                    currency: currency.toLowerCase(),
+                });
                 return {
                     invoiceId: result.invoiceId,
                     invoiceUrl: result.invoiceUrl,
@@ -660,7 +832,9 @@ export function createTopupCryptoTool(client) {
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : "Unknown error";
-                return { error: `Failed to create crypto invoice: ${sanitizeError(message)}` };
+                return {
+                    error: `Failed to create crypto invoice: ${sanitizeError(message)}`,
+                };
             }
         },
     });
@@ -698,7 +872,7 @@ async function apiRequest(client, method, path, body, agentSecret) {
     const apiKey = client.apiKey || "";
     const url = `${baseUrl}${path}`;
     const headers = {
-        "Authorization": `Bearer ${apiKey}`,
+        Authorization: `Bearer ${apiKey}`,
         "Content-Type": "application/json",
     };
     if (agentSecret) {
@@ -733,18 +907,40 @@ export function createCreateAgenticWalletTool(client, agentSecret) {
         description: "Create a new agentic sub-wallet with a spending limit. " +
             "Agentic wallets are custodial sub-wallets for AI agents with per-transaction spending caps.",
         parameters: z.object({
-            label: z.string().min(1).max(100).describe("Human-readable label for the wallet"),
-            spending_limit_cents: z.number().int().min(1).max(2147483647).describe("Per-transaction spending limit in cents"),
-            daily_limit_cents: z.number().int().min(1).max(1000000).optional().describe("Optional daily spending limit in cents"),
-            allowed_domains: z.array(z.string().max(253).regex(DOMAIN_RE)).max(100).optional().describe("Optional list of allowed domains"),
+            label: z
+                .string()
+                .min(1)
+                .max(100)
+                .describe("Human-readable label for the wallet"),
+            spending_limit_cents: z
+                .number()
+                .int()
+                .min(1)
+                .max(2147483647)
+                .describe("Per-transaction spending limit in cents"),
+            daily_limit_cents: z
+                .number()
+                .int()
+                .min(1)
+                .max(1000000)
+                .optional()
+                .describe("Optional daily spending limit in cents"),
+            allowed_domains: z
+                .array(z.string().max(253).regex(DOMAIN_RE))
+                .max(100)
+                .optional()
+                .describe("Optional list of allowed domains"),
         }),
-        execute: async ({ label, spending_limit_cents, daily_limit_cents, allowed_domains }) => {
+        execute: async ({ label, spending_limit_cents, daily_limit_cents, allowed_domains, }) => {
             // Validate no control chars in label
             if (/[\x00-\x1F\x7F]/.test(label)) {
                 return { error: "label contains invalid control characters" };
             }
             try {
-                const body = { label, spendingLimitCents: spending_limit_cents };
+                const body = {
+                    label,
+                    spendingLimitCents: spending_limit_cents,
+                };
                 if (daily_limit_cents !== undefined)
                     body.dailyLimitCents = daily_limit_cents;
                 if (allowed_domains !== undefined)
@@ -753,7 +949,9 @@ export function createCreateAgenticWalletTool(client, agentSecret) {
                 return result;
             }
             catch (err) {
-                return { error: `Failed to create agentic wallet: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}` };
+                return {
+                    error: `Failed to create agentic wallet: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
             }
         },
     });
@@ -765,15 +963,25 @@ export function createFundAgenticWalletTool(client, agentSecret) {
     return tool({
         description: "Transfer funds from the main wallet to an agentic sub-wallet.",
         parameters: z.object({
-            wallet_id: z.string().regex(UUID_RE, "Must be a valid UUID").describe("UUID of the agentic wallet"),
-            amount_cents: z.number().int().min(1).max(2147483647).describe("Amount in cents to transfer"),
+            wallet_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the agentic wallet"),
+            amount_cents: z
+                .number()
+                .int()
+                .min(1)
+                .max(2147483647)
+                .describe("Amount in cents to transfer"),
         }),
-        execute: async ({ wallet_id, amount_cents }) => {
+        execute: async ({ wallet_id, amount_cents, }) => {
             try {
                 return await apiRequest(client, "POST", `/api/agent-wallet/${encodeURIComponent(wallet_id)}/fund`, { amountCents: amount_cents }, agentSecret);
             }
             catch (err) {
-                return { error: `Failed to fund wallet: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}` };
+                return {
+                    error: `Failed to fund wallet: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
             }
         },
     });
@@ -785,14 +993,19 @@ export function createAgenticWalletBalanceTool(client, agentSecret) {
     return tool({
         description: "Check the balance and details of an agentic sub-wallet.",
         parameters: z.object({
-            wallet_id: z.string().regex(UUID_RE, "Must be a valid UUID").describe("UUID of the agentic wallet"),
+            wallet_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the agentic wallet"),
         }),
         execute: async ({ wallet_id }) => {
             try {
                 return await apiRequest(client, "GET", `/api/agent-wallet/${encodeURIComponent(wallet_id)}`, undefined, agentSecret);
             }
             catch (err) {
-                return { error: `Failed to get wallet balance: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}` };
+                return {
+                    error: `Failed to get wallet balance: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
             }
         },
     });
@@ -809,7 +1022,9 @@ export function createListAgenticWalletsTool(client, agentSecret) {
                 return await apiRequest(client, "GET", "/api/agent-wallet", undefined, agentSecret);
             }
             catch (err) {
-                return { error: `Failed to list wallets: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}` };
+                return {
+                    error: `Failed to list wallets: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
             }
         },
     });
@@ -821,16 +1036,27 @@ export function createAgenticTransactionsTool(client, agentSecret) {
     return tool({
         description: "List recent transactions for an agentic sub-wallet.",
         parameters: z.object({
-            wallet_id: z.string().regex(UUID_RE, "Must be a valid UUID").describe("UUID of the agentic wallet"),
-            limit: z.number().int().min(1).max(100).optional().describe("Maximum transactions to return (1-100)"),
+            wallet_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the agentic wallet"),
+            limit: z
+                .number()
+                .int()
+                .min(1)
+                .max(100)
+                .optional()
+                .describe("Maximum transactions to return (1-100)"),
         }),
-        execute: async ({ wallet_id, limit }) => {
+        execute: async ({ wallet_id, limit, }) => {
             try {
                 const qs = limit ? `?limit=${limit}` : "";
                 return await apiRequest(client, "GET", `/api/agent-wallet/${encodeURIComponent(wallet_id)}/transactions${qs}`, undefined, agentSecret);
             }
             catch (err) {
-                return { error: `Failed to get transactions: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}` };
+                return {
+                    error: `Failed to get transactions: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
             }
         },
     });
@@ -842,14 +1068,19 @@ export function createFreezeAgenticWalletTool(client, agentSecret) {
     return tool({
         description: "Freeze an agentic sub-wallet to prevent further spending.",
         parameters: z.object({
-            wallet_id: z.string().regex(UUID_RE, "Must be a valid UUID").describe("UUID of the agentic wallet"),
+            wallet_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the agentic wallet"),
         }),
         execute: async ({ wallet_id }) => {
             try {
                 return await apiRequest(client, "POST", `/api/agent-wallet/${encodeURIComponent(wallet_id)}/freeze`, undefined, agentSecret);
             }
             catch (err) {
-                return { error: `Failed to freeze wallet: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}` };
+                return {
+                    error: `Failed to freeze wallet: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
             }
         },
     });
@@ -861,14 +1092,19 @@ export function createUnfreezeAgenticWalletTool(client, agentSecret) {
     return tool({
         description: "Unfreeze a previously frozen agentic sub-wallet to re-enable spending.",
         parameters: z.object({
-            wallet_id: z.string().regex(UUID_RE, "Must be a valid UUID").describe("UUID of the agentic wallet"),
+            wallet_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the agentic wallet"),
         }),
         execute: async ({ wallet_id }) => {
             try {
                 return await apiRequest(client, "POST", `/api/agent-wallet/${encodeURIComponent(wallet_id)}/unfreeze`, undefined, agentSecret);
             }
             catch (err) {
-                return { error: `Failed to unfreeze wallet: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}` };
+                return {
+                    error: `Failed to unfreeze wallet: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
             }
         },
     });
@@ -881,14 +1117,19 @@ export function createDeleteAgenticWalletTool(client, agentSecret) {
     return tool({
         description: "Delete an agentic sub-wallet. Must be active (not frozen). Remaining balance returns to main wallet.",
         parameters: z.object({
-            wallet_id: z.string().regex(UUID_RE, "Must be a valid UUID").describe("UUID of the agentic wallet"),
+            wallet_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the agentic wallet"),
         }),
         execute: async ({ wallet_id }) => {
             try {
                 return await apiRequest(client, "DELETE", `/api/agent-wallet/${encodeURIComponent(wallet_id)}`, undefined, agentSecret);
             }
             catch (err) {
-                return { error: `Failed to delete wallet: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}` };
+                return {
+                    error: `Failed to delete wallet: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
             }
         },
     });
@@ -900,28 +1141,1276 @@ export function createUpdateWalletPolicyTool(client, agentSecret) {
     return tool({
         description: "Update the policy (daily limit, allowed domains) of an agentic sub-wallet.",
         parameters: z.object({
-            wallet_id: z.string().regex(UUID_RE, "Must be a valid UUID").describe("UUID of the agentic wallet"),
-            daily_limit_cents: z.number().int().min(1).max(1000000).optional().describe("New daily spending limit in cents"),
-            allowed_domains: z.array(z.string().max(253).regex(DOMAIN_RE)).max(100).optional().describe("New allowed domains list"),
+            wallet_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the agentic wallet"),
+            daily_limit_cents: z
+                .number()
+                .int()
+                .min(1)
+                .max(1000000)
+                .optional()
+                .describe("New daily spending limit in cents"),
+            allowed_domains: z
+                .array(z.string().max(253).regex(DOMAIN_RE))
+                .max(100)
+                .optional()
+                .describe("New allowed domains list"),
         }),
-        execute: async ({ wallet_id, daily_limit_cents, allowed_domains }) => {
+        execute: async ({ wallet_id, daily_limit_cents, allowed_domains, }) => {
             const body = {};
             if (daily_limit_cents !== undefined)
                 body.dailyLimitCents = daily_limit_cents;
             if (allowed_domains !== undefined)
                 body.allowedDomains = allowed_domains;
             if (Object.keys(body).length === 0) {
-                return { error: "At least one of daily_limit_cents or allowed_domains must be provided" };
+                return {
+                    error: "At least one of daily_limit_cents or allowed_domains must be provided",
+                };
             }
             try {
                 return await apiRequest(client, "PATCH", `/api/agent-wallet/${encodeURIComponent(wallet_id)}/policy`, body, agentSecret);
             }
             catch (err) {
-                return { error: `Failed to update policy: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}` };
+                return {
+                    error: `Failed to update policy: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+// ---------------------------------------------------------------------------
+// Account lifecycle tools
+// ---------------------------------------------------------------------------
+/**
+ * Creates a tool to register a new DomiNode account.
+ */
+export function createRegisterTool(agentSecret) {
+    return tool({
+        description: "Register a new Dominus Node account. Returns user info and JWT tokens. " +
+            "After registering, use verifyEmail or rely on MCP agent auto-verification.",
+        parameters: z.object({
+            email: z.string().email().describe("Email address for the new account"),
+            password: z
+                .string()
+                .min(8)
+                .max(128)
+                .describe("Password (min 8 characters)"),
+        }),
+        execute: async ({ email, password, }) => {
+            try {
+                const baseUrl = process.env.DOMINUSNODE_BASE_URL || "https://api.dominusnode.com";
+                const headers = {
+                    "Content-Type": "application/json",
+                };
+                if (agentSecret) {
+                    headers["X-DominusNode-Agent"] = "mcp";
+                    headers["X-DominusNode-Agent-Secret"] = agentSecret;
+                }
+                // Solve PoW for CAPTCHA-free registration
+                const pow = await solvePoW(baseUrl);
+                const regBody = { email, password };
+                if (pow)
+                    regBody.pow = pow;
+                const resp = await fetch(`${baseUrl}/api/auth/register`, {
+                    method: "POST",
+                    headers,
+                    body: JSON.stringify(regBody),
+                    redirect: "error",
+                });
+                if (!resp.ok) {
+                    const text = await resp.text().catch(() => "");
+                    throw new Error(`Registration failed (${resp.status}): ${text.slice(0, 200)}`);
+                }
+                const data = JSON.parse(await resp.text());
+                stripDangerousKeys(data);
+                return {
+                    userId: data.user?.id,
+                    email: data.user?.email,
+                    message: "Account created. Verify email to unlock financial features.",
+                };
+            }
+            catch (err) {
+                return {
+                    error: `Failed to register: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to log into an existing DomiNode account.
+ */
+export function createLoginTool(agentSecret) {
+    return tool({
+        description: "Log into an existing Dominus Node account. Returns JWT access and refresh tokens.",
+        parameters: z.object({
+            email: z.string().email().describe("Account email address"),
+            password: z.string().min(1).describe("Account password"),
+        }),
+        execute: async ({ email, password, }) => {
+            try {
+                const baseUrl = process.env.DOMINUSNODE_BASE_URL || "https://api.dominusnode.com";
+                const headers = {
+                    "Content-Type": "application/json",
+                };
+                if (agentSecret) {
+                    headers["X-DominusNode-Agent"] = "mcp";
+                    headers["X-DominusNode-Agent-Secret"] = agentSecret;
+                }
+                const resp = await fetch(`${baseUrl}/api/auth/login`, {
+                    method: "POST",
+                    headers,
+                    body: JSON.stringify({ email, password }),
+                    redirect: "error",
+                });
+                if (!resp.ok) {
+                    const text = await resp.text().catch(() => "");
+                    throw new Error(`Login failed (${resp.status}): ${sanitizeError(text.slice(0, 200))}`);
+                }
+                const data = JSON.parse(await resp.text());
+                stripDangerousKeys(data);
+                if (data.mfaRequired) {
+                    return {
+                        mfaRequired: true,
+                        challengeToken: data.challengeToken,
+                        message: "MFA verification required",
+                    };
+                }
+                return {
+                    accessToken: data.accessToken ? "[REDACTED]" : undefined,
+                    message: "Login successful",
+                };
+            }
+            catch (err) {
+                return {
+                    error: `Failed to login: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to get the current authenticated account information.
+ */
+export function createGetAccountInfoTool(client, agentSecret) {
+    return tool({
+        description: "Get the current authenticated Dominus Node account information including email, plan, and verification status.",
+        parameters: z.object({}),
+        execute: async () => {
+            try {
+                const result = await apiRequest(client, "GET", "/api/auth/me", undefined, agentSecret);
+                const user = result.user;
+                return {
+                    id: user?.id,
+                    email: user?.email,
+                    plan: user?.plan,
+                    emailVerified: user?.emailVerified,
+                    status: user?.status,
+                    createdAt: user?.createdAt,
+                };
+            }
+            catch (err) {
+                return {
+                    error: `Failed to get account info: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to verify an email address with a token.
+ */
+export function createVerifyEmailTool(agentSecret) {
+    return tool({
+        description: "Verify email address using the verification token sent to email. MCP agents are auto-verified.",
+        parameters: z.object({
+            token: z
+                .string()
+                .min(1)
+                .describe("Email verification token from the verification email"),
+        }),
+        execute: async ({ token }) => {
+            try {
+                const baseUrl = process.env.DOMINUSNODE_BASE_URL || "https://api.dominusnode.com";
+                const headers = {
+                    "Content-Type": "application/json",
+                };
+                if (agentSecret) {
+                    headers["X-DominusNode-Agent"] = "mcp";
+                    headers["X-DominusNode-Agent-Secret"] = agentSecret;
+                }
+                const resp = await fetch(`${baseUrl}/api/auth/verify-email`, {
+                    method: "POST",
+                    headers,
+                    body: JSON.stringify({ token }),
+                    redirect: "error",
+                });
+                if (!resp.ok) {
+                    const text = await resp.text().catch(() => "");
+                    throw new Error(`Verification failed (${resp.status}): ${text.slice(0, 200)}`);
+                }
+                return { success: true, message: "Email verified successfully" };
+            }
+            catch (err) {
+                return {
+                    error: `Failed to verify email: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to resend the email verification token.
+ */
+export function createResendVerificationTool(client, agentSecret) {
+    return tool({
+        description: "Resend the email verification token to the account's email address.",
+        parameters: z.object({}),
+        execute: async () => {
+            try {
+                await apiRequest(client, "POST", "/api/auth/resend-verification", undefined, agentSecret);
+                return { success: true, message: "Verification email sent" };
+            }
+            catch (err) {
+                return {
+                    error: `Failed to resend verification: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to change the account password.
+ */
+export function createUpdatePasswordTool(client, agentSecret) {
+    return tool({
+        description: "Change the password for the current Dominus Node account.",
+        parameters: z.object({
+            current_password: z.string().min(1).describe("Current password"),
+            new_password: z
+                .string()
+                .min(8)
+                .max(128)
+                .describe("New password (min 8 characters)"),
+        }),
+        execute: async ({ current_password, new_password, }) => {
+            try {
+                await apiRequest(client, "POST", "/api/auth/change-password", {
+                    currentPassword: current_password,
+                    newPassword: new_password,
+                }, agentSecret);
+                return { success: true, message: "Password updated" };
+            }
+            catch (err) {
+                return {
+                    error: `Failed to update password: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+// ---------------------------------------------------------------------------
+// API key management tools
+// ---------------------------------------------------------------------------
+/**
+ * Creates a tool to list all API keys for the current account.
+ */
+export function createListKeysTool(client, agentSecret) {
+    return tool({
+        description: "List all API keys for the current Dominus Node account. Shows key ID, label, prefix, and creation date.",
+        parameters: z.object({}),
+        execute: async () => {
+            try {
+                return await apiRequest(client, "GET", "/api/keys", undefined, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to list keys: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to create a new API key.
+ */
+export function createCreateKeyTool(client, agentSecret) {
+    return tool({
+        description: "Create a new Dominus Node API key. The full key is shown only once — store it securely. " +
+            "WARNING: API keys are secret credentials. Never log or share them.",
+        parameters: z.object({
+            label: z
+                .string()
+                .min(1)
+                .max(100)
+                .optional()
+                .describe("Human-readable label for the key"),
+        }),
+        execute: async ({ label }) => {
+            if (label && /[\x00-\x1F\x7F]/.test(label)) {
+                return { error: "label contains invalid control characters" };
+            }
+            try {
+                const body = {};
+                if (label)
+                    body.label = label;
+                return await apiRequest(client, "POST", "/api/keys", body, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to create key: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to revoke (delete) an API key.
+ */
+export function createRevokeKeyTool(client, agentSecret) {
+    return tool({
+        description: "Revoke (permanently delete) a Dominus Node API key. This cannot be undone.",
+        parameters: z.object({
+            key_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the API key to revoke"),
+        }),
+        execute: async ({ key_id }) => {
+            try {
+                await apiRequest(client, "DELETE", `/api/keys/${encodeURIComponent(key_id)}`, undefined, agentSecret);
+                return { success: true, message: "API key revoked" };
+            }
+            catch (err) {
+                return {
+                    error: `Failed to revoke key: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+// ---------------------------------------------------------------------------
+// Wallet extended tools
+// ---------------------------------------------------------------------------
+/**
+ * Creates a tool to get wallet transaction history.
+ */
+export function createGetTransactionsTool(client, agentSecret) {
+    return tool({
+        description: "Get wallet transaction history showing top-ups, usage charges, and transfers.",
+        parameters: z.object({
+            limit: z
+                .number()
+                .int()
+                .min(1)
+                .max(100)
+                .optional()
+                .describe("Maximum transactions to return (default 50)"),
+            offset: z
+                .number()
+                .int()
+                .min(0)
+                .optional()
+                .describe("Offset for pagination"),
+        }),
+        execute: async ({ limit, offset }) => {
+            try {
+                const params = new URLSearchParams();
+                if (limit !== undefined)
+                    params.set("limit", String(limit));
+                if (offset !== undefined)
+                    params.set("offset", String(offset));
+                const qs = params.toString() ? `?${params.toString()}` : "";
+                return await apiRequest(client, "GET", `/api/wallet/transactions${qs}`, undefined, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to get transactions: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to get wallet balance forecast.
+ */
+export function createGetForecastTool(client, agentSecret) {
+    return tool({
+        description: "Get a wallet balance forecast based on recent usage patterns. Shows estimated days until balance depletion.",
+        parameters: z.object({}),
+        execute: async () => {
+            try {
+                return await apiRequest(client, "GET", "/api/wallet/forecast", undefined, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to get forecast: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to check the status of a crypto payment invoice.
+ */
+export function createCheckPaymentTool(client, agentSecret) {
+    return tool({
+        description: "Check the status of a cryptocurrency payment invoice. Use after creating a crypto top-up.",
+        parameters: z.object({
+            invoice_id: z
+                .string()
+                .min(1)
+                .describe("The invoice ID from the crypto top-up creation"),
+        }),
+        execute: async ({ invoice_id }) => {
+            try {
+                return await apiRequest(client, "GET", `/api/wallet/crypto/status/${encodeURIComponent(invoice_id)}`, undefined, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to check payment: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+// ---------------------------------------------------------------------------
+// Usage extended tools
+// ---------------------------------------------------------------------------
+/**
+ * Creates a tool to get daily usage breakdown.
+ */
+export function createGetDailyUsageTool(client, agentSecret) {
+    return tool({
+        description: "Get daily proxy usage breakdown showing bytes, cost, and request count per day.",
+        parameters: z.object({
+            since: z
+                .string()
+                .optional()
+                .describe("Start date (ISO 8601). Defaults to 30 days ago."),
+            until: z
+                .string()
+                .optional()
+                .describe("End date (ISO 8601). Defaults to now."),
+        }),
+        execute: async ({ since, until }) => {
+            try {
+                const params = new URLSearchParams();
+                if (since)
+                    params.set("since", since);
+                if (until)
+                    params.set("until", until);
+                const qs = params.toString() ? `?${params.toString()}` : "";
+                return await apiRequest(client, "GET", `/api/usage/daily${qs}`, undefined, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to get daily usage: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to get the top accessed hosts through the proxy.
+ */
+export function createGetTopHostsTool(client, agentSecret) {
+    return tool({
+        description: "Get the top accessed hosts (domains) through the proxy, ranked by total bytes transferred.",
+        parameters: z.object({
+            since: z
+                .string()
+                .optional()
+                .describe("Start date (ISO 8601). Defaults to 30 days ago."),
+            until: z
+                .string()
+                .optional()
+                .describe("End date (ISO 8601). Defaults to now."),
+            limit: z
+                .number()
+                .int()
+                .min(1)
+                .max(100)
+                .optional()
+                .describe("Max hosts to return (default 10)"),
+        }),
+        execute: async ({ since, until, limit, }) => {
+            try {
+                const params = new URLSearchParams();
+                if (since)
+                    params.set("since", since);
+                if (until)
+                    params.set("until", until);
+                if (limit !== undefined)
+                    params.set("limit", String(limit));
+                const qs = params.toString() ? `?${params.toString()}` : "";
+                return await apiRequest(client, "GET", `/api/usage/top-hosts${qs}`, undefined, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to get top hosts: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+// ---------------------------------------------------------------------------
+// Plan management tools
+// ---------------------------------------------------------------------------
+/**
+ * Creates a tool to get the current user's plan.
+ */
+export function createGetPlanTool(client, agentSecret) {
+    return tool({
+        description: "Get the current user's plan details including bandwidth limits, pricing tier, and features.",
+        parameters: z.object({}),
+        execute: async () => {
+            try {
+                return await apiRequest(client, "GET", "/api/plans/user/plan", undefined, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to get plan: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to list all available plans.
+ */
+export function createListPlansTool(client, agentSecret) {
+    return tool({
+        description: "List all available Dominus Node plans with pricing, bandwidth limits, and features.",
+        parameters: z.object({}),
+        execute: async () => {
+            try {
+                return await apiRequest(client, "GET", "/api/plans", undefined, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to list plans: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to change the current user's plan.
+ */
+export function createChangePlanTool(client, agentSecret) {
+    return tool({
+        description: "Change the current user's plan. Requires email verification.",
+        parameters: z.object({
+            plan_id: z.string().min(1).describe("ID of the plan to switch to"),
+        }),
+        execute: async ({ plan_id }) => {
+            try {
+                return await apiRequest(client, "PUT", "/api/plans/user/plan", { planId: plan_id }, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to change plan: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+// ---------------------------------------------------------------------------
+// Proxy extended tools
+// ---------------------------------------------------------------------------
+/**
+ * Creates a tool to get proxy health/status information.
+ */
+export function createGetProxyStatusTool(client, agentSecret) {
+    return tool({
+        description: "Get proxy health and status information including uptime, active connections, and provider status.",
+        parameters: z.object({}),
+        execute: async () => {
+            try {
+                return await apiRequest(client, "GET", "/api/proxy/status", undefined, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to get proxy status: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+// ---------------------------------------------------------------------------
+// Team management tools (full suite — 17 tools)
+// ---------------------------------------------------------------------------
+/**
+ * Creates a tool to create a new team.
+ */
+export function createCreateTeamTool(client, agentSecret) {
+    return tool({
+        description: "Create a new Dominus Node team with a shared wallet for collaborative proxy usage.",
+        parameters: z.object({
+            name: z.string().min(1).max(100).describe("Team name"),
+            max_members: z
+                .number()
+                .int()
+                .min(2)
+                .max(100)
+                .optional()
+                .describe("Maximum team members (default 10)"),
+        }),
+        execute: async ({ name, max_members, }) => {
+            if (/[\x00-\x1F\x7F]/.test(name)) {
+                return { error: "name contains invalid control characters" };
+            }
+            try {
+                const body = { name };
+                if (max_members !== undefined)
+                    body.maxMembers = max_members;
+                return await apiRequest(client, "POST", "/api/teams", body, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to create team: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to list all teams the user belongs to.
+ */
+export function createListTeamsTool(client, agentSecret) {
+    return tool({
+        description: "List all teams the current user belongs to (as owner, admin, or member).",
+        parameters: z.object({}),
+        execute: async () => {
+            try {
+                return await apiRequest(client, "GET", "/api/teams", undefined, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to list teams: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to get detailed information about a team.
+ */
+export function createTeamDetailsTool(client, agentSecret) {
+    return tool({
+        description: "Get detailed information about a team including wallet balance, members count, and settings.",
+        parameters: z.object({
+            team_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the team"),
+        }),
+        execute: async ({ team_id }) => {
+            try {
+                return await apiRequest(client, "GET", `/api/teams/${encodeURIComponent(team_id)}`, undefined, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to get team details: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to update team settings.
+ */
+export function createUpdateTeamTool(client, agentSecret) {
+    return tool({
+        description: "Update team settings such as name or max members. Requires owner or admin role.",
+        parameters: z.object({
+            team_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the team"),
+            name: z.string().min(1).max(100).optional().describe("New team name"),
+            max_members: z
+                .number()
+                .int()
+                .min(2)
+                .max(100)
+                .optional()
+                .describe("New max members limit"),
+        }),
+        execute: async ({ team_id, name, max_members, }) => {
+            if (name && /[\x00-\x1F\x7F]/.test(name)) {
+                return { error: "name contains invalid control characters" };
+            }
+            const body = {};
+            if (name !== undefined)
+                body.name = name;
+            if (max_members !== undefined)
+                body.maxMembers = max_members;
+            if (Object.keys(body).length === 0) {
+                return {
+                    error: "At least one field (name or max_members) must be provided",
+                };
+            }
+            try {
+                return await apiRequest(client, "PATCH", `/api/teams/${encodeURIComponent(team_id)}`, body, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to update team: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to delete a team. Requires owner role.
+ */
+export function createTeamDeleteTool(client, agentSecret) {
+    return tool({
+        description: "Delete a team permanently. Requires owner role. Remaining team wallet balance is NOT refunded.",
+        parameters: z.object({
+            team_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the team to delete"),
+        }),
+        execute: async ({ team_id }) => {
+            try {
+                await apiRequest(client, "DELETE", `/api/teams/${encodeURIComponent(team_id)}`, undefined, agentSecret);
+                return { success: true, message: "Team deleted" };
+            }
+            catch (err) {
+                return {
+                    error: `Failed to delete team: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to fund a team wallet from the user's personal wallet.
+ */
+export function createTeamFundTool(client, agentSecret) {
+    return tool({
+        description: "Fund a team wallet by transferring from your personal wallet. Requires owner or admin role.",
+        parameters: z.object({
+            team_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the team"),
+            amount_cents: z
+                .number()
+                .int()
+                .min(1)
+                .max(2147483647)
+                .describe("Amount in cents to transfer"),
+        }),
+        execute: async ({ team_id, amount_cents, }) => {
+            try {
+                return await apiRequest(client, "POST", `/api/teams/${encodeURIComponent(team_id)}/wallet/fund`, { amountCents: amount_cents }, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to fund team: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to create a team API key.
+ */
+export function createTeamCreateKeyTool(client, agentSecret) {
+    return tool({
+        description: "Create an API key for a team. Team keys bill to the team wallet. Requires owner or admin role.",
+        parameters: z.object({
+            team_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the team"),
+            label: z
+                .string()
+                .min(1)
+                .max(100)
+                .optional()
+                .describe("Label for the team API key"),
+        }),
+        execute: async ({ team_id, label, }) => {
+            if (label && /[\x00-\x1F\x7F]/.test(label)) {
+                return { error: "label contains invalid control characters" };
+            }
+            try {
+                const body = {};
+                if (label)
+                    body.label = label;
+                return await apiRequest(client, "POST", `/api/teams/${encodeURIComponent(team_id)}/keys`, body, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to create team key: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to revoke a team API key.
+ */
+export function createTeamRevokeKeyTool(client, agentSecret) {
+    return tool({
+        description: "Revoke (delete) a team API key. Requires owner or admin role.",
+        parameters: z.object({
+            team_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the team"),
+            key_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the team key to revoke"),
+        }),
+        execute: async ({ team_id, key_id, }) => {
+            try {
+                await apiRequest(client, "DELETE", `/api/teams/${encodeURIComponent(team_id)}/keys/${encodeURIComponent(key_id)}`, undefined, agentSecret);
+                return { success: true, message: "Team key revoked" };
+            }
+            catch (err) {
+                return {
+                    error: `Failed to revoke team key: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to list all API keys for a team.
+ */
+export function createTeamListKeysTool(client, agentSecret) {
+    return tool({
+        description: "List all API keys for a team. Shows key ID, label, prefix, and creation date.",
+        parameters: z.object({
+            team_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the team"),
+        }),
+        execute: async ({ team_id }) => {
+            try {
+                return await apiRequest(client, "GET", `/api/teams/${encodeURIComponent(team_id)}/keys`, undefined, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to list team keys: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to get team usage statistics.
+ */
+export function createTeamUsageTool(client, agentSecret) {
+    return tool({
+        description: "Get proxy usage statistics for a team including total bytes, cost, and per-member breakdown.",
+        parameters: z.object({
+            team_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the team"),
+        }),
+        execute: async ({ team_id }) => {
+            try {
+                return await apiRequest(client, "GET", `/api/teams/${encodeURIComponent(team_id)}/usage`, undefined, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to get team usage: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to list all members of a team.
+ */
+export function createTeamListMembersTool(client, agentSecret) {
+    return tool({
+        description: "List all members of a team with their roles (owner/admin/member) and join dates.",
+        parameters: z.object({
+            team_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the team"),
+        }),
+        execute: async ({ team_id }) => {
+            try {
+                return await apiRequest(client, "GET", `/api/teams/${encodeURIComponent(team_id)}/members`, undefined, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to list team members: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to add a member directly to a team (by user ID or email).
+ */
+export function createTeamAddMemberTool(client, agentSecret) {
+    return tool({
+        description: "Add a member directly to a team by email. Requires owner or admin role.",
+        parameters: z.object({
+            team_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the team"),
+            email: z.string().email().describe("Email of the user to add"),
+            role: z
+                .enum(["admin", "member"])
+                .optional()
+                .describe("Role to assign (default: member)"),
+        }),
+        execute: async ({ team_id, email, role, }) => {
+            try {
+                const body = { email };
+                if (role)
+                    body.role = role;
+                return await apiRequest(client, "POST", `/api/teams/${encodeURIComponent(team_id)}/members`, body, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to add member: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to remove a member from a team.
+ */
+export function createTeamRemoveMemberTool(client, agentSecret) {
+    return tool({
+        description: "Remove a member from a team. Requires owner or admin role. Cannot remove the owner.",
+        parameters: z.object({
+            team_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the team"),
+            user_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the member to remove"),
+        }),
+        execute: async ({ team_id, user_id, }) => {
+            try {
+                await apiRequest(client, "DELETE", `/api/teams/${encodeURIComponent(team_id)}/members/${encodeURIComponent(user_id)}`, undefined, agentSecret);
+                return { success: true, message: "Member removed" };
+            }
+            catch (err) {
+                return {
+                    error: `Failed to remove member: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to update a team member's role.
+ */
+export function createUpdateTeamMemberRoleTool(client, agentSecret) {
+    return tool({
+        description: "Update a team member's role (admin or member). Requires owner role.",
+        parameters: z.object({
+            team_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the team"),
+            user_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the member"),
+            role: z.enum(["admin", "member"]).describe("New role for the member"),
+        }),
+        execute: async ({ team_id, user_id, role, }) => {
+            try {
+                return await apiRequest(client, "PATCH", `/api/teams/${encodeURIComponent(team_id)}/members/${encodeURIComponent(user_id)}`, { role }, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to update member role: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to invite a member to a team via email.
+ */
+export function createTeamInviteMemberTool(client, agentSecret) {
+    return tool({
+        description: "Invite a user to join a team via email. They receive an invitation link. Requires owner or admin role.",
+        parameters: z.object({
+            team_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the team"),
+            email: z.string().email().describe("Email address to invite"),
+            role: z
+                .enum(["admin", "member"])
+                .optional()
+                .describe("Role to assign when they accept (default: member)"),
+        }),
+        execute: async ({ team_id, email, role, }) => {
+            try {
+                const body = { email };
+                if (role)
+                    body.role = role;
+                return await apiRequest(client, "POST", `/api/teams/${encodeURIComponent(team_id)}/invites`, body, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to invite member: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to list pending team invitations.
+ */
+export function createTeamListInvitesTool(client, agentSecret) {
+    return tool({
+        description: "List all pending invitations for a team.",
+        parameters: z.object({
+            team_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the team"),
+        }),
+        execute: async ({ team_id }) => {
+            try {
+                return await apiRequest(client, "GET", `/api/teams/${encodeURIComponent(team_id)}/invites`, undefined, agentSecret);
+            }
+            catch (err) {
+                return {
+                    error: `Failed to list invites: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to cancel a pending team invitation.
+ */
+export function createTeamCancelInviteTool(client, agentSecret) {
+    return tool({
+        description: "Cancel a pending team invitation. Requires owner or admin role.",
+        parameters: z.object({
+            team_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the team"),
+            invite_id: z
+                .string()
+                .regex(UUID_RE, "Must be a valid UUID")
+                .describe("UUID of the invitation to cancel"),
+        }),
+        execute: async ({ team_id, invite_id, }) => {
+            try {
+                await apiRequest(client, "DELETE", `/api/teams/${encodeURIComponent(team_id)}/invites/${encodeURIComponent(invite_id)}`, undefined, agentSecret);
+                return { success: true, message: "Invitation cancelled" };
+            }
+            catch (err) {
+                return {
+                    error: `Failed to cancel invite: ${sanitizeError(err instanceof Error ? err.message : "Unknown error")}`,
+                };
+            }
+        },
+    });
+}
+// ---------------------------------------------------------------------------
+// MPP (Machine Payment Protocol) tools
+// ---------------------------------------------------------------------------
+/**
+ * Creates a tool to get MPP protocol info (no auth required).
+ */
+export function createMppInfoTool(client, agentSecret) {
+    return tool({
+        description: "Get Machine Payment Protocol (MPP) information including enabled status, " +
+            "supported payment methods, pricing, and session limits. No authentication required. " +
+            "MPP enables keyless proxy access -- AI agents can use the proxy WITHOUT any API key " +
+            "by calling mpp_challenge first, then using the returned credential as proxy auth.",
+        parameters: z.object({}),
+        execute: async () => {
+            try {
+                const result = await apiRequest(client, "GET", "/api/mpp/info", undefined, agentSecret);
+                return result;
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : "Unknown error";
+                return { error: `Failed to get MPP info: ${sanitizeError(message)}` };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to get an MPP challenge for keyless proxy access (no auth required).
+ */
+export function createMppChallengeTool(client, agentSecret) {
+    return tool({
+        description: "Get an MPP challenge for keyless proxy access. No authentication required. " +
+            "Returns a credential that can be used to access the proxy WITHOUT any API key -- " +
+            "just pay per request via MPP. Specify 'dc' for datacenter ($3/GB) or " +
+            "'residential' ($5/GB) proxy pool.",
+        parameters: z.object({
+            pool_type: z
+                .enum(["dc", "residential"])
+                .describe("Proxy pool type: 'dc' for datacenter ($3/GB) or 'residential' ($5/GB)"),
+        }),
+        execute: async ({ pool_type }) => {
+            try {
+                const baseUrl = client.baseUrl ||
+                    process.env.DOMINUSNODE_BASE_URL ||
+                    "https://api.dominusnode.com";
+                const headers = {
+                    "Content-Type": "application/json",
+                };
+                if (agentSecret) {
+                    headers["X-DominusNode-Agent"] = "mcp";
+                    headers["X-DominusNode-Agent-Secret"] = agentSecret;
+                }
+                const resp = await fetch(`${baseUrl}/api/mpp/challenge`, {
+                    method: "POST",
+                    headers,
+                    body: JSON.stringify({ poolType: pool_type }),
+                    redirect: "error",
+                });
+                if (!resp.ok) {
+                    const text = await resp.text().catch(() => "");
+                    throw new Error(`MPP challenge failed (${resp.status}): ${text.slice(0, 200)}`);
+                }
+                const text = await resp.text();
+                if (text.length > MAX_RESPONSE_BODY_BYTES) {
+                    throw new Error("Response body exceeds size limit");
+                }
+                const data = JSON.parse(text);
+                stripDangerousKeys(data);
+                return data;
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : "Unknown error";
+                return {
+                    error: `Failed to get MPP challenge: ${sanitizeError(message)}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to top up wallet via MPP.
+ */
+export function createPayMppTool(client, agentSecret) {
+    return tool({
+        description: "Top up your Dominus Node wallet via Machine Payment Protocol (MPP). " +
+            "Supports tempo, stripe_spt, and lightning payment methods.",
+        parameters: z.object({
+            amount_cents: z
+                .number()
+                .int()
+                .min(500)
+                .max(100000)
+                .describe("Amount in cents to top up (min 500 = $5, max 100000 = $1,000)"),
+            method: z
+                .enum(["tempo", "stripe_spt", "lightning"])
+                .describe("MPP payment method: tempo, stripe_spt, or lightning"),
+        }),
+        execute: async ({ amount_cents, method, }) => {
+            try {
+                const result = await apiRequest(client, "POST", "/api/mpp/topup", {
+                    amountCents: amount_cents,
+                    method,
+                }, agentSecret);
+                return result;
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : "Unknown error";
+                return { error: `Failed to top up via MPP: ${sanitizeError(message)}` };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to open an MPP pay-as-you-go session.
+ */
+export function createMppSessionOpenTool(client, agentSecret) {
+    return tool({
+        description: "Open a pay-as-you-go MPP session. Returns a channelId for metered proxy usage. " +
+            "Deposit is held and refunded on close minus usage.",
+        parameters: z.object({
+            max_deposit_cents: z
+                .number()
+                .int()
+                .min(500)
+                .max(100000)
+                .describe("Maximum deposit in cents for the session (min 500, max 100000)"),
+            method: z
+                .enum(["tempo", "stripe_spt", "lightning"])
+                .describe("MPP payment method: tempo, stripe_spt, or lightning"),
+            pool_type: z
+                .enum(["dc", "residential"])
+                .default("dc")
+                .describe("Proxy pool type: dc ($3/GB) or residential ($5/GB)"),
+        }),
+        execute: async ({ max_deposit_cents, method, pool_type, }) => {
+            try {
+                const result = await apiRequest(client, "POST", "/api/mpp/session/open", {
+                    maxDepositCents: max_deposit_cents,
+                    method,
+                    poolType: pool_type,
+                }, agentSecret);
+                return result;
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : "Unknown error";
+                return {
+                    error: `Failed to open MPP session: ${sanitizeError(message)}`,
+                };
+            }
+        },
+    });
+}
+/**
+ * Creates a tool to close an MPP pay-as-you-go session.
+ */
+export function createMppSessionCloseTool(client, agentSecret) {
+    return tool({
+        description: "Close an MPP pay-as-you-go session. Returns the amount spent and refunded.",
+        parameters: z.object({
+            channel_id: z
+                .string()
+                .min(1)
+                .describe("The channelId returned from mpp_session_open"),
+        }),
+        execute: async ({ channel_id }) => {
+            try {
+                const result = await apiRequest(client, "POST", "/api/mpp/session/close", {
+                    channelId: channel_id,
+                }, agentSecret);
+                return result;
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : "Unknown error";
+                return {
+                    error: `Failed to close MPP session: ${sanitizeError(message)}`,
+                };
             }
         },
     });
 }
 // Re-export validation helpers for testing
-export { validateUrl, isPrivateIp, truncateBody, filterHeaders, apiRequest, UUID_RE, DOMAIN_RE };
+export { validateUrl, isPrivateIp, truncateBody, filterHeaders, apiRequest, UUID_RE, DOMAIN_RE, };
 //# sourceMappingURL=tools.js.map