@dominusnode/flowise-tools 1.0.0

package/dist/toolkit.js

@@ -0,0 +1,1668 @@
+"use strict";
+/**
+ * DomiNode Flowise Toolkit
+ *
+ * Provides 24 LangChain-compatible DynamicStructuredTool instances for use
+ * inside Flowise AI workflows. Covers proxied fetching, wallet management,
+ * agentic wallets, teams, PayPal top-up, and x402 micropayment info.
+ *
+ * Security:
+ *  - Full SSRF protection (private IP blocking, DNS rebinding, Teredo/6to4,
+ *    IPv4-mapped/compatible IPv6, hex/octal/decimal normalization, zone ID
+ *    stripping, .localhost/.local/.internal/.arpa TLD blocking, embedded
+ *    credential blocking)
+ *  - OFAC sanctioned country validation (CU, IR, KP, RU, SY)
+ *  - Credential scrubbing in all error outputs
+ *  - Prototype pollution prevention on all parsed JSON (recursive)
+ *  - HTTP method restriction (GET/HEAD/OPTIONS only for proxied fetch)
+ *  - 10 MB response cap, 4000 char truncation, 30 s timeout
+ *  - Redirect following disabled to prevent open redirect abuse
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DominusNodeToolkit = exports.BLOCKED_HOSTNAMES = exports.SANCTIONED_COUNTRIES = void 0;
+exports.scrubCredentials = scrubCredentials;
+exports.truncate = truncate;
+exports.normalizeIpv4 = normalizeIpv4;
+exports.isPrivateIp = isPrivateIp;
+exports.validateTargetUrl = validateTargetUrl;
+exports.validateCountry = validateCountry;
+exports.validateUuid = validateUuid;
+exports.checkDnsRebinding = checkDnsRebinding;
+exports.stripDangerousKeys = stripDangerousKeys;
+exports.formatBytes = formatBytes;
+exports.formatCents = formatCents;
+// @ts-ignore
+const tools_1 = require("@langchain/core/tools");
+const zod_1 = require("zod");
+const http = __importStar(require("node:http"));
+const tls = __importStar(require("node:tls"));
+const dns = __importStar(require("dns/promises"));
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+const MAX_RESPONSE_CHARS = 4000;
+const REQUEST_TIMEOUT_MS = 30000;
+const MAX_RESPONSE_BYTES = 10 * 1024 * 1024; // 10 MB hard cap
+const MAX_PROXY_RESPONSE_BYTES = 1048576; // 1 MB for proxied fetch
+/** OFAC sanctioned countries -- must never be used as geo-targeting destinations. */
+exports.SANCTIONED_COUNTRIES = new Set(["CU", "IR", "KP", "RU", "SY"]);
+/** ISO 3166-1 alpha-2 country code pattern. */
+const COUNTRY_CODE_RE = /^[A-Z]{2}$/;
+/** UUID v4 pattern for wallet/team IDs. */
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+// ---------------------------------------------------------------------------
+// Credential scrubbing
+// ---------------------------------------------------------------------------
+/** Remove any dn_live_* or dn_test_* tokens from error messages. */
+function scrubCredentials(msg) {
+    return msg.replace(/dn_(live|test)_[A-Za-z0-9_-]+/g, "dn_$1_***REDACTED***");
+}
+function safeError(err) {
+    const raw = err instanceof Error ? err.message : String(err);
+    return scrubCredentials(raw);
+}
+// ---------------------------------------------------------------------------
+// Response truncation
+// ---------------------------------------------------------------------------
+function truncate(text, max = MAX_RESPONSE_CHARS) {
+    if (text.length <= max)
+        return text;
+    return text.slice(0, max) + `\n\n... [truncated, ${text.length - max} chars omitted]`;
+}
+// ---------------------------------------------------------------------------
+// SSRF Protection
+// ---------------------------------------------------------------------------
+exports.BLOCKED_HOSTNAMES = new Set([
+    "localhost",
+    "localhost.localdomain",
+    "ip6-localhost",
+    "ip6-loopback",
+    "[::1]",
+    "[::ffff:127.0.0.1]",
+    "0.0.0.0",
+    "[::]",
+]);
+/**
+ * Normalize non-standard IPv4 representations to dotted-decimal.
+ * Handles: decimal integers (2130706433), hex (0x7f000001), octal octets (0177.0.0.1).
+ */
+function normalizeIpv4(hostname) {
+    // Single decimal integer
+    if (/^\d+$/.test(hostname)) {
+        const n = parseInt(hostname, 10);
+        if (n >= 0 && n <= 0xffffffff) {
+            return `${(n >>> 24) & 0xff}.${(n >>> 16) & 0xff}.${(n >>> 8) & 0xff}.${n & 0xff}`;
+        }
+    }
+    // Hex notation
+    if (/^0x[0-9a-fA-F]+$/i.test(hostname)) {
+        const n = parseInt(hostname, 16);
+        if (n >= 0 && n <= 0xffffffff) {
+            return `${(n >>> 24) & 0xff}.${(n >>> 16) & 0xff}.${(n >>> 8) & 0xff}.${n & 0xff}`;
+        }
+    }
+    // Octal / mixed-radix octets
+    const parts = hostname.split(".");
+    if (parts.length === 4) {
+        const octets = [];
+        for (const part of parts) {
+            let val;
+            if (/^0x[0-9a-fA-F]+$/i.test(part)) {
+                val = parseInt(part, 16);
+            }
+            else if (/^0\d+$/.test(part)) {
+                val = parseInt(part, 8);
+            }
+            else if (/^\d+$/.test(part)) {
+                val = parseInt(part, 10);
+            }
+            else {
+                return null;
+            }
+            if (isNaN(val) || val < 0 || val > 255)
+                return null;
+            octets.push(val);
+        }
+        return octets.join(".");
+    }
+    return null;
+}
+function isPrivateIp(hostname) {
+    let ip = hostname.replace(/^\[|\]$/g, "");
+    // Strip IPv6 zone ID
+    const zoneIdx = ip.indexOf("%");
+    if (zoneIdx !== -1) {
+        ip = ip.substring(0, zoneIdx);
+    }
+    const normalized = normalizeIpv4(ip);
+    const checkIp = normalized ?? ip;
+    // IPv4 private ranges
+    const ipv4Match = checkIp.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (ipv4Match) {
+        const a = Number(ipv4Match[1]);
+        const b = Number(ipv4Match[2]);
+        if (a === 0)
+            return true;
+        if (a === 10)
+            return true;
+        if (a === 127)
+            return true;
+        if (a === 169 && b === 254)
+            return true;
+        if (a === 172 && b >= 16 && b <= 31)
+            return true;
+        if (a === 192 && b === 168)
+            return true;
+        if (a === 100 && b >= 64 && b <= 127)
+            return true;
+        if (a >= 224)
+            return true;
+        return false;
+    }
+    // IPv6 private ranges
+    const ipLower = ip.toLowerCase();
+    if (ipLower === "::1")
+        return true;
+    if (ipLower === "::")
+        return true;
+    if (ipLower.startsWith("fc") || ipLower.startsWith("fd"))
+        return true;
+    if (ipLower.startsWith("fe80"))
+        return true;
+    if (ipLower.startsWith("::ffff:")) {
+        const embedded = ipLower.slice(7);
+        if (embedded.includes(".")) {
+            return isPrivateIp(embedded);
+        }
+        const hexParts = embedded.split(":");
+        if (hexParts.length === 2) {
+            const hi = parseInt(hexParts[0], 16);
+            const lo = parseInt(hexParts[1], 16);
+            if (!isNaN(hi) && !isNaN(lo)) {
+                const reconstructed = `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
+                return isPrivateIp(reconstructed);
+            }
+        }
+        return isPrivateIp(embedded);
+    }
+    // IPv4-compatible IPv6 (::x.x.x.x) -- deprecated but still parsed
+    if (ipLower.startsWith("::") && !ipLower.startsWith("::ffff:")) {
+        const rest = ipLower.slice(2);
+        if (rest && rest.includes("."))
+            return isPrivateIp(rest);
+        const hexParts = rest.split(":");
+        if (hexParts.length === 2 && hexParts[0] && hexParts[1]) {
+            const hi = parseInt(hexParts[0], 16);
+            const lo = parseInt(hexParts[1], 16);
+            if (!isNaN(hi) && !isNaN(lo)) {
+                const reconstructed = `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
+                return isPrivateIp(reconstructed);
+            }
+        }
+    }
+    // Teredo (2001:0000::/32) -- block unconditionally
+    if (ipLower.startsWith("2001:0000:") || ipLower.startsWith("2001:0:"))
+        return true;
+    // 6to4 (2002::/16) -- block unconditionally
+    if (ipLower.startsWith("2002:"))
+        return true;
+    // IPv6 multicast (ff00::/8)
+    if (ipLower.startsWith("ff"))
+        return true;
+    return false;
+}
+/**
+ * Validate a URL for safety before proxying.
+ * Blocks: private IPs, localhost, .local/.internal/.arpa, embedded credentials, non-http(s).
+ */
+function validateTargetUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error(`Invalid URL: ${scrubCredentials(url)}`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new Error(`Only http: and https: protocols are supported, got ${parsed.protocol}`);
+    }
+    // Block embedded credentials (user:pass@host)
+    if (parsed.username || parsed.password) {
+        throw new Error("URLs with embedded credentials are not allowed");
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    if (exports.BLOCKED_HOSTNAMES.has(hostname)) {
+        throw new Error("Requests to localhost/loopback addresses are blocked");
+    }
+    if (isPrivateIp(hostname)) {
+        throw new Error("Requests to private/internal IP addresses are blocked");
+    }
+    // Block .localhost TLD (RFC 6761)
+    if (hostname.endsWith(".localhost")) {
+        throw new Error("Requests to localhost/loopback addresses are blocked");
+    }
+    // Block internal network TLDs
+    if (hostname.endsWith(".local") ||
+        hostname.endsWith(".internal") ||
+        hostname.endsWith(".arpa")) {
+        throw new Error("Requests to internal network hostnames are blocked");
+    }
+    return parsed;
+}
+/**
+ * Validate a country code: must be 2 uppercase letters and not OFAC sanctioned.
+ */
+function validateCountry(country) {
+    if (!country)
+        return undefined;
+    const upper = country.toUpperCase().trim();
+    if (!COUNTRY_CODE_RE.test(upper)) {
+        throw new Error(`Invalid country code: "${country}". Must be a 2-letter ISO 3166-1 code.`);
+    }
+    if (exports.SANCTIONED_COUNTRIES.has(upper)) {
+        throw new Error(`Country "${upper}" is OFAC sanctioned and cannot be used as a proxy target.`);
+    }
+    return upper;
+}
+/**
+ * Validate a UUID string.
+ */
+function validateUuid(id, label) {
+    const trimmed = id.trim();
+    if (!UUID_RE.test(trimmed)) {
+        throw new Error(`Invalid ${label}: must be a valid UUID.`);
+    }
+    return trimmed;
+}
+// ---------------------------------------------------------------------------
+// DNS rebinding protection
+// ---------------------------------------------------------------------------
+/**
+ * Resolve a hostname via DNS and verify none of the resolved IPs are private.
+ * Skips check if the hostname is already an IP literal.
+ */
+async function checkDnsRebinding(hostname) {
+    // If hostname is already an IP literal (v4 or bracketed v6), skip DNS resolution
+    const stripped = hostname.replace(/^\[|\]$/g, "");
+    if (/^(\d{1,3}\.){3}\d{1,3}$/.test(stripped) || stripped.includes(":")) {
+        return;
+    }
+    const resolvedIps = [];
+    try {
+        const ipv4s = await dns.resolve4(hostname);
+        resolvedIps.push(...ipv4s);
+    }
+    catch {
+        // NODATA or NXDOMAIN for A records is fine, continue to AAAA
+    }
+    try {
+        const ipv6s = await dns.resolve6(hostname);
+        resolvedIps.push(...ipv6s);
+    }
+    catch {
+        // NODATA or NXDOMAIN for AAAA records is fine
+    }
+    for (const ip of resolvedIps) {
+        if (isPrivateIp(ip)) {
+            throw new Error(`DNS rebinding detected: hostname resolves to private IP ${ip}`);
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Prototype pollution prevention (recursive)
+// ---------------------------------------------------------------------------
+const DANGEROUS_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+function stripDangerousKeys(obj, depth = 0) {
+    if (depth > 50 || !obj || typeof obj !== "object")
+        return;
+    if (Array.isArray(obj)) {
+        for (const item of obj)
+            stripDangerousKeys(item, depth + 1);
+        return;
+    }
+    const record = obj;
+    for (const key of Object.keys(record)) {
+        if (DANGEROUS_KEYS.has(key)) {
+            delete record[key];
+        }
+        else if (record[key] && typeof record[key] === "object") {
+            stripDangerousKeys(record[key], depth + 1);
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Formatting helpers
+// ---------------------------------------------------------------------------
+function formatBytes(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    if (bytes < 1024 * 1024)
+        return `${(bytes / 1024).toFixed(1)} KB`;
+    if (bytes < 1024 * 1024 * 1024)
+        return `${(bytes / (1024 * 1024)).toFixed(2)} MB`;
+    return `${(bytes / (1024 * 1024 * 1024)).toFixed(3)} GB`;
+}
+function formatCents(cents) {
+    return `$${(cents / 100).toFixed(2)}`;
+}
+// ---------------------------------------------------------------------------
+// DominusNodeToolkit
+// ---------------------------------------------------------------------------
+class DominusNodeToolkit {
+    constructor(options = {}) {
+        this.token = null;
+        this.tokenExpiresAt = 0;
+        this.apiKey = options.apiKey || process.env.DOMINUSNODE_API_KEY || "";
+        this.baseUrl = (options.baseUrl || process.env.DOMINUSNODE_BASE_URL || "https://api.dominusnode.com").replace(/\/+$/, "");
+        this.proxyHost = options.proxyHost || process.env.DOMINUSNODE_PROXY_HOST || "proxy.dominusnode.com";
+        const portVal = Number(options.proxyPort || process.env.DOMINUSNODE_PROXY_PORT || 8080);
+        this.proxyPort = isNaN(portVal) || portVal < 1 || portVal > 65535 ? 8080 : portVal;
+        this.timeout = options.timeout || 30000;
+    }
+    // -----------------------------------------------------------------------
+    // Authentication
+    // -----------------------------------------------------------------------
+    async _authenticate() {
+        if (!this.apiKey) {
+            throw new Error("DomiNode API key is required. Pass apiKey in options or set DOMINUSNODE_API_KEY env var.");
+        }
+        if (!this.apiKey.startsWith("dn_live_") && !this.apiKey.startsWith("dn_test_")) {
+            throw new Error('DOMINUSNODE_API_KEY must start with "dn_live_" or "dn_test_".');
+        }
+        const res = await fetch(`${this.baseUrl}/api/auth/verify-key`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "User-Agent": "dominusnode-flowise/1.0.0",
+            },
+            body: JSON.stringify({ apiKey: this.apiKey }),
+            redirect: "error",
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            throw new Error(`Auth failed (${res.status}): ${scrubCredentials(text.slice(0, 500))}`);
+        }
+        const data = (await res.json());
+        stripDangerousKeys(data);
+        this.token = data.token;
+        // JWT expires in 15 min, refresh at 14 min for safety
+        this.tokenExpiresAt = Date.now() + 14 * 60 * 1000;
+        return this.token;
+    }
+    async _ensureAuth() {
+        if (!this.token || Date.now() >= this.tokenExpiresAt) {
+            await this._authenticate();
+        }
+    }
+    // -----------------------------------------------------------------------
+    // API request helpers
+    // -----------------------------------------------------------------------
+    async _apiRequest(method, path, body) {
+        await this._ensureAuth();
+        const url = `${this.baseUrl}${path}`;
+        const headers = {
+            Authorization: `Bearer ${this.token}`,
+            Accept: "application/json",
+            "User-Agent": "dominusnode-flowise/1.0.0",
+        };
+        const init = {
+            method,
+            headers,
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+            redirect: "error",
+        };
+        if (body && (method === "POST" || method === "PUT" || method === "PATCH")) {
+            headers["Content-Type"] = "application/json";
+            init.body = JSON.stringify(body);
+        }
+        let res;
+        try {
+            res = await fetch(url, init);
+        }
+        catch (err) {
+            throw new Error(`API request failed: ${safeError(err)}`);
+        }
+        let rawText;
+        try {
+            rawText = await res.text();
+        }
+        catch {
+            rawText = "";
+        }
+        if (new TextEncoder().encode(rawText).length > MAX_RESPONSE_BYTES) {
+            throw new Error("API response too large");
+        }
+        if (!res.ok) {
+            let errorMsg = `API error ${res.status}`;
+            if (rawText) {
+                try {
+                    const parsed = JSON.parse(rawText);
+                    stripDangerousKeys(parsed);
+                    if (parsed.error) {
+                        errorMsg = `API error ${res.status}: ${scrubCredentials(String(parsed.error))}`;
+                    }
+                    else if (parsed.message) {
+                        errorMsg = `API error ${res.status}: ${scrubCredentials(String(parsed.message))}`;
+                    }
+                }
+                catch {
+                    errorMsg = `API error ${res.status}: ${scrubCredentials(rawText.slice(0, 200))}`;
+                }
+            }
+            throw new Error(errorMsg);
+        }
+        if (!rawText || rawText.trim().length === 0) {
+            return {};
+        }
+        try {
+            const parsed = JSON.parse(rawText);
+            stripDangerousKeys(parsed);
+            return parsed;
+        }
+        catch {
+            throw new Error("Failed to parse API response as JSON");
+        }
+    }
+    async _requestWithRetry(method, path, body) {
+        try {
+            return await this._apiRequest(method, path, body);
+        }
+        catch (err) {
+            if (err instanceof Error && err.message.includes("401")) {
+                this.token = null;
+                this.tokenExpiresAt = 0;
+                return await this._apiRequest(method, path, body);
+            }
+            throw err;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 1: proxiedFetch
+    // -----------------------------------------------------------------------
+    async proxiedFetch(url, method = "GET", country, proxyType = "dc") {
+        try {
+            if (!url)
+                return "Error: url parameter is required.";
+            const parsedUrl = validateTargetUrl(url);
+            await checkDnsRebinding(parsedUrl.hostname);
+            const validCountry = validateCountry(country);
+            const methodUpper = (method || "GET").toUpperCase();
+            const ALLOWED_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+            if (!ALLOWED_METHODS.has(methodUpper)) {
+                return `Error: HTTP method "${methodUpper}" is not allowed. Only GET, HEAD, and OPTIONS are permitted.`;
+            }
+            if (proxyType !== "dc" && proxyType !== "residential" && proxyType !== "auto") {
+                return "Error: proxyType must be 'dc', 'residential', or 'auto'.";
+            }
+            const apiKey = this.apiKey;
+            if (!apiKey)
+                return "Error: API key is required for proxied fetch.";
+            const parts = [];
+            if (proxyType && proxyType !== "auto")
+                parts.push(proxyType);
+            if (validCountry)
+                parts.push(`country-${validCountry.toUpperCase()}`);
+            const username = parts.length > 0 ? parts.join("-") : "auto";
+            const proxyAuth = "Basic " + Buffer.from(`${username}:${apiKey}`).toString("base64");
+            const parsed = new URL(url);
+            const result = await new Promise((resolve, reject) => {
+                const timer = setTimeout(() => reject(new Error("Proxy request timed out")), REQUEST_TIMEOUT_MS);
+                if (parsed.protocol === "https:") {
+                    const connectHost = parsed.hostname.includes(":")
+                        ? `[${parsed.hostname}]`
+                        : parsed.hostname;
+                    const connectReq = http.request({
+                        hostname: this.proxyHost,
+                        port: this.proxyPort,
+                        method: "CONNECT",
+                        path: `${connectHost}:${parsed.port || 443}`,
+                        headers: {
+                            "Proxy-Authorization": proxyAuth,
+                            Host: `${connectHost}:${parsed.port || 443}`,
+                        },
+                    });
+                    connectReq.on("connect", (_res, sock) => {
+                        if (_res.statusCode !== 200) {
+                            clearTimeout(timer);
+                            sock.destroy();
+                            reject(new Error(`CONNECT failed: ${_res.statusCode}`));
+                            return;
+                        }
+                        const tlsSock = tls.connect({
+                            host: parsed.hostname,
+                            socket: sock,
+                            servername: parsed.hostname,
+                            minVersion: "TLSv1.2",
+                        }, () => {
+                            const reqLine = `${methodUpper} ${parsed.pathname + parsed.search} HTTP/1.1\r\n` +
+                                `Host: ${parsed.host}\r\n` +
+                                `User-Agent: dominusnode-flowise/1.0.0\r\n` +
+                                `Connection: close\r\n\r\n`;
+                            tlsSock.write(reqLine);
+                            const chunks = [];
+                            let bytes = 0;
+                            tlsSock.on("data", (c) => {
+                                bytes += c.length;
+                                if (bytes <= MAX_PROXY_RESPONSE_BYTES + 16384)
+                                    chunks.push(c);
+                            });
+                            let done = false;
+                            const fin = () => {
+                                if (done)
+                                    return;
+                                done = true;
+                                clearTimeout(timer);
+                                const raw = Buffer.concat(chunks).toString("utf-8");
+                                const hEnd = raw.indexOf("\r\n\r\n");
+                                if (hEnd === -1) {
+                                    reject(new Error("Malformed response"));
+                                    return;
+                                }
+                                const hdr = raw.substring(0, hEnd);
+                                const respBody = raw.substring(hEnd + 4).substring(0, MAX_PROXY_RESPONSE_BYTES);
+                                const sm = hdr.split("\r\n")[0].match(/^HTTP\/\d\.\d\s+(\d+)/);
+                                const hdrs = {};
+                                for (const l of hdr.split("\r\n").slice(1)) {
+                                    const ci = l.indexOf(":");
+                                    if (ci > 0)
+                                        hdrs[l.substring(0, ci).trim().toLowerCase()] = l.substring(ci + 1).trim();
+                                }
+                                resolve({
+                                    status: sm ? parseInt(sm[1], 10) : 0,
+                                    headers: hdrs,
+                                    body: respBody,
+                                });
+                            };
+                            tlsSock.on("end", fin);
+                            tlsSock.on("close", fin);
+                            tlsSock.on("error", (e) => {
+                                clearTimeout(timer);
+                                reject(e);
+                            });
+                        });
+                        tlsSock.on("error", (e) => {
+                            clearTimeout(timer);
+                            reject(e);
+                        });
+                    });
+                    connectReq.on("error", (e) => {
+                        clearTimeout(timer);
+                        reject(e);
+                    });
+                    connectReq.end();
+                }
+                else {
+                    // HTTP (non-TLS)
+                    const req = http.request({
+                        hostname: this.proxyHost,
+                        port: this.proxyPort,
+                        method: methodUpper,
+                        path: url,
+                        headers: {
+                            "Proxy-Authorization": proxyAuth,
+                            Host: parsed.host ?? "",
+                        },
+                    }, (res) => {
+                        const chunks = [];
+                        let bytes = 0;
+                        res.on("data", (c) => {
+                            bytes += c.length;
+                            if (bytes <= MAX_PROXY_RESPONSE_BYTES)
+                                chunks.push(c);
+                        });
+                        let done = false;
+                        const fin = () => {
+                            if (done)
+                                return;
+                            done = true;
+                            clearTimeout(timer);
+                            const respBody = Buffer.concat(chunks).toString("utf-8").substring(0, MAX_PROXY_RESPONSE_BYTES);
+                            const hdrs = {};
+                            for (const [k, v] of Object.entries(res.headers)) {
+                                if (v)
+                                    hdrs[k] = Array.isArray(v) ? v.join(", ") : v;
+                            }
+                            resolve({ status: res.statusCode ?? 0, headers: hdrs, body: respBody });
+                        };
+                        res.on("end", fin);
+                        res.on("close", fin);
+                        res.on("error", (e) => {
+                            clearTimeout(timer);
+                            reject(e);
+                        });
+                    });
+                    req.on("error", (e) => {
+                        clearTimeout(timer);
+                        reject(e);
+                    });
+                    req.end();
+                }
+            });
+            const lines = [
+                `HTTP ${result.status}`,
+                `Pool: ${proxyType} | Country: ${validCountry ?? "auto"}`,
+                "",
+            ];
+            if (result.headers) {
+                const showHeaders = ["content-type", "content-length", "server", "x-cache", "cache-control"];
+                for (const h of showHeaders) {
+                    if (result.headers[h]) {
+                        lines.push(`${h}: ${result.headers[h]}`);
+                    }
+                }
+                lines.push("");
+            }
+            if (result.body) {
+                lines.push(truncate(result.body));
+            }
+            return scrubCredentials(truncate(lines.join("\n")));
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 2: checkBalance
+    // -----------------------------------------------------------------------
+    async checkBalance() {
+        try {
+            const data = await this._requestWithRetry("GET", "/api/wallet");
+            const balanceCents = data.balanceCents ?? 0;
+            const balanceUsd = data.balanceUsd ?? balanceCents / 100;
+            const dcGbRemaining = (balanceCents / 300).toFixed(2);
+            const resGbRemaining = (balanceCents / 500).toFixed(2);
+            return [
+                `Wallet Balance: $${balanceUsd.toFixed(2)}`,
+                "",
+                "Estimated remaining bandwidth:",
+                `  Datacenter ($3/GB): ~${dcGbRemaining} GB`,
+                `  Residential ($5/GB): ~${resGbRemaining} GB`,
+                "",
+                "Use check_usage to see recent consumption.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 3: checkUsage
+    // -----------------------------------------------------------------------
+    async checkUsage(days = 30) {
+        try {
+            const d = Math.min(Math.max(Math.floor(days), 1), 365);
+            const since = new Date(Date.now() - d * 24 * 60 * 60 * 1000).toISOString();
+            const until = new Date().toISOString();
+            const data = await this._requestWithRetry("GET", `/api/usage?since=${encodeURIComponent(since)}&until=${encodeURIComponent(until)}`);
+            const s = data.summary;
+            return [
+                `Usage Summary (last ${d} days):`,
+                `  Total Bandwidth: ${formatBytes(s.totalBytes)}`,
+                `  Total Cost: $${s.totalCostUsd.toFixed(2)}`,
+                `  Total Requests: ${s.requestCount}`,
+                "",
+                "Use check_balance to see remaining funds.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 4: getProxyConfig
+    // -----------------------------------------------------------------------
+    async getProxyConfig() {
+        try {
+            const data = await this._requestWithRetry("GET", "/api/proxy/config");
+            const lines = [
+                "DomiNode Proxy Configuration",
+                "",
+                `Proxy Host: ${data.proxyHost ?? "proxy.dominusnode.com"}`,
+                `HTTP Proxy Port: ${data.httpProxyPort ?? 8080}`,
+                `SOCKS5 Proxy Port: ${data.socks5ProxyPort ?? 1080}`,
+                "",
+                "Available Pools:",
+            ];
+            if (data.pools) {
+                for (const pool of data.pools) {
+                    lines.push(`  ${pool.name} (${pool.type}): ${formatCents(pool.pricePerGbCents)}/GB`);
+                    if (pool.countries && pool.countries.length > 0) {
+                        lines.push(`    Countries: ${pool.countries.slice(0, 20).join(", ")}${pool.countries.length > 20 ? "..." : ""}`);
+                    }
+                }
+            }
+            else {
+                lines.push("  Datacenter (dc): $3.00/GB");
+                lines.push("  Residential (residential): $5.00/GB");
+            }
+            lines.push("");
+            lines.push("Blocked countries (OFAC): CU, IR, KP, RU, SY");
+            return lines.join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 5: listSessions
+    // -----------------------------------------------------------------------
+    async listSessions() {
+        try {
+            const data = await this._requestWithRetry("GET", "/api/sessions/active");
+            const sessions = data.sessions ?? [];
+            if (sessions.length === 0) {
+                return "No active proxy sessions.";
+            }
+            const lines = [`Active Sessions (${sessions.length}):`, ""];
+            for (const s of sessions) {
+                const target = s.targetHost ? ` | Target: ${s.targetHost}` : "";
+                const bw = s.bytesIn !== undefined || s.bytesOut !== undefined
+                    ? ` | In: ${formatBytes(s.bytesIn ?? 0)} / Out: ${formatBytes(s.bytesOut ?? 0)}`
+                    : "";
+                lines.push(`  ${s.id.substring(0, 8)}... | ${s.status} | Since: ${s.startedAt}${target}${bw}`);
+            }
+            return truncate(lines.join("\n"));
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 6: createAgenticWallet
+    // -----------------------------------------------------------------------
+    async createAgenticWallet(label, spendingLimitCents = 10000, dailyLimitCents, allowedDomains) {
+        try {
+            if (!label || label.trim().length === 0 || label.length > 100) {
+                return "Error: label is required and must be 1-100 characters.";
+            }
+            if (/[\x00-\x1f\x7f]/.test(label)) {
+                return "Error: label contains invalid control characters.";
+            }
+            const limitCents = Math.min(Math.max(Math.floor(spendingLimitCents), 0), 1000000);
+            const body = {
+                label: label.trim(),
+                spendingLimitCents: limitCents,
+            };
+            if (dailyLimitCents !== undefined && dailyLimitCents !== null) {
+                if (!Number.isInteger(dailyLimitCents) || dailyLimitCents < 1 || dailyLimitCents > 1000000) {
+                    return "Error: daily_limit_cents must be an integer between 1 and 1,000,000.";
+                }
+                body.dailyLimitCents = dailyLimitCents;
+            }
+            if (allowedDomains !== undefined && allowedDomains !== null) {
+                if (!Array.isArray(allowedDomains) || allowedDomains.length > 100) {
+                    return "Error: allowed_domains must be an array of at most 100 entries.";
+                }
+                for (const d of allowedDomains) {
+                    if (typeof d !== "string" || d.length > 253) {
+                        return `Error: invalid domain "${d}". Must be a string of at most 253 characters.`;
+                    }
+                }
+                body.allowedDomains = allowedDomains;
+            }
+            const data = await this._requestWithRetry("POST", "/api/agent-wallet", body);
+            const lines = [
+                "Agentic Wallet Created",
+                "",
+                `Wallet ID: ${data.id}`,
+                `Label: ${data.label}`,
+                `Balance: ${formatCents(data.balanceCents)}`,
+                `Spending Limit: ${data.spendingLimitCents > 0 ? `${formatCents(data.spendingLimitCents)} per transaction` : "No limit"}`,
+            ];
+            if (data.dailyLimitCents != null) {
+                lines.push(`Daily Limit: ${formatCents(data.dailyLimitCents)}`);
+            }
+            if (data.allowedDomains && data.allowedDomains.length > 0) {
+                lines.push(`Allowed Domains: ${data.allowedDomains.join(", ")}`);
+            }
+            lines.push(`Status: ${data.status}`, "", "Next: Use fund_agentic_wallet to add funds from your main wallet.");
+            return lines.join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 6b: updateWalletPolicy
+    // -----------------------------------------------------------------------
+    async updateWalletPolicy(walletId, dailyLimitCents, allowedDomains) {
+        try {
+            const wid = validateUuid(walletId, "wallet_id");
+            const body = {};
+            if (dailyLimitCents !== undefined) {
+                if (dailyLimitCents === null) {
+                    body.dailyLimitCents = null;
+                }
+                else {
+                    if (!Number.isInteger(dailyLimitCents) || dailyLimitCents < 1 || dailyLimitCents > 1000000) {
+                        return "Error: daily_limit_cents must be an integer between 1 and 1,000,000, or null to remove.";
+                    }
+                    body.dailyLimitCents = dailyLimitCents;
+                }
+            }
+            if (allowedDomains !== undefined) {
+                if (allowedDomains === null) {
+                    body.allowedDomains = null;
+                }
+                else {
+                    if (!Array.isArray(allowedDomains) || allowedDomains.length > 100) {
+                        return "Error: allowed_domains must be an array of at most 100 entries, or null to remove.";
+                    }
+                    for (const d of allowedDomains) {
+                        if (typeof d !== "string" || d.length > 253) {
+                            return `Error: invalid domain "${d}". Must be a string of at most 253 characters.`;
+                        }
+                    }
+                    body.allowedDomains = allowedDomains;
+                }
+            }
+            if (Object.keys(body).length === 0) {
+                return "Error: at least one of daily_limit_cents or allowed_domains must be provided.";
+            }
+            const data = await this._requestWithRetry("PATCH", `/api/agent-wallet/${encodeURIComponent(wid)}/policy`, body);
+            const lines = [
+                "Wallet Policy Updated",
+                "",
+                `Wallet ID: ${data.id}`,
+                `Label: ${data.label}`,
+            ];
+            if (data.dailyLimitCents != null) {
+                lines.push(`Daily Limit: ${formatCents(data.dailyLimitCents)}`);
+            }
+            else {
+                lines.push("Daily Limit: None");
+            }
+            if (data.allowedDomains && data.allowedDomains.length > 0) {
+                lines.push(`Allowed Domains: ${data.allowedDomains.join(", ")}`);
+            }
+            else {
+                lines.push("Allowed Domains: None (unrestricted)");
+            }
+            lines.push(`Status: ${data.status}`);
+            return lines.join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 7: fundAgenticWallet
+    // -----------------------------------------------------------------------
+    async fundAgenticWallet(walletId, amountCents) {
+        try {
+            const wid = validateUuid(walletId, "wallet_id");
+            if (!Number.isInteger(amountCents) || amountCents < 100 || amountCents > 1000000) {
+                return "Error: amount_cents must be an integer between 100 ($1) and 1000000 ($10,000).";
+            }
+            const data = await this._requestWithRetry("POST", `/api/agent-wallet/${encodeURIComponent(wid)}/fund`, {
+                amountCents,
+            });
+            const tx = data.transaction;
+            return [
+                "Wallet Funded Successfully",
+                "",
+                `Transaction ID: ${tx.id}`,
+                `Amount: ${formatCents(tx.amountCents)}`,
+                `Type: ${tx.type}`,
+                "",
+                "Funds transferred from main wallet. Use check_agentic_balance to verify.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 8: agenticWalletBalance
+    // -----------------------------------------------------------------------
+    async agenticWalletBalance(walletId) {
+        try {
+            const wid = validateUuid(walletId, "wallet_id");
+            const data = await this._requestWithRetry("GET", `/api/agent-wallet/${encodeURIComponent(wid)}`);
+            return [
+                `Agentic Wallet: ${data.label}`,
+                "",
+                `Wallet ID: ${data.id}`,
+                `Balance: ${formatCents(data.balanceCents)}`,
+                `Spending Limit: ${data.spendingLimitCents > 0 ? `${formatCents(data.spendingLimitCents)} per tx` : "No limit"}`,
+                `Status: ${data.status}`,
+                `Created: ${data.createdAt}`,
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 9: listAgenticWallets
+    // -----------------------------------------------------------------------
+    async listAgenticWallets() {
+        try {
+            const data = await this._requestWithRetry("GET", "/api/agent-wallet");
+            const wallets = data.wallets ?? [];
+            if (wallets.length === 0) {
+                return "No agentic wallets found. Use create_agentic_wallet to create one.";
+            }
+            const lines = [`Agentic Wallets (${wallets.length})`, ""];
+            for (const w of wallets) {
+                const limit = w.spendingLimitCents > 0 ? `${formatCents(w.spendingLimitCents)}/tx` : "none";
+                lines.push(`  ${w.label} (${w.id.slice(0, 8)}...)`);
+                lines.push(`    Balance: ${formatCents(w.balanceCents)} | Limit: ${limit} | Status: ${w.status}`);
+                lines.push("");
+            }
+            return truncate(lines.join("\n"));
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 10: agenticTransactions
+    // -----------------------------------------------------------------------
+    async agenticTransactions(walletId, limit = 20) {
+        try {
+            const wid = validateUuid(walletId, "wallet_id");
+            const lim = Math.min(Math.max(Math.floor(limit), 1), 100);
+            const data = await this._requestWithRetry("GET", `/api/agent-wallet/${encodeURIComponent(wid)}/transactions?limit=${lim}`);
+            const txs = data.transactions ?? [];
+            if (txs.length === 0) {
+                return "No transactions found for this wallet.";
+            }
+            const lines = [`Wallet Transactions (${txs.length})`, ""];
+            for (const tx of txs) {
+                const sign = tx.type === "fund" || tx.type === "refund" ? "+" : "-";
+                const session = tx.sessionId ? ` | Session: ${tx.sessionId.slice(0, 8)}` : "";
+                lines.push(`  ${sign}${formatCents(tx.amountCents)} [${tx.type}] ${tx.description}`);
+                lines.push(`    ${tx.createdAt}${session}`);
+            }
+            return truncate(lines.join("\n"));
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 11: freezeAgenticWallet
+    // -----------------------------------------------------------------------
+    async freezeAgenticWallet(walletId) {
+        try {
+            const wid = validateUuid(walletId, "wallet_id");
+            const data = await this._requestWithRetry("POST", `/api/agent-wallet/${encodeURIComponent(wid)}/freeze`);
+            return [
+                "Agentic Wallet Frozen",
+                "",
+                `Wallet ID: ${data.id}`,
+                `Label: ${data.label}`,
+                `Balance: ${formatCents(data.balanceCents)}`,
+                `Status: ${data.status}`,
+                "",
+                "Spending is paused. Use unfreeze_agentic_wallet to re-enable.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 12: unfreezeAgenticWallet
+    // -----------------------------------------------------------------------
+    async unfreezeAgenticWallet(walletId) {
+        try {
+            const wid = validateUuid(walletId, "wallet_id");
+            const data = await this._requestWithRetry("POST", `/api/agent-wallet/${encodeURIComponent(wid)}/unfreeze`);
+            return [
+                "Agentic Wallet Unfrozen",
+                "",
+                `Wallet ID: ${data.id}`,
+                `Label: ${data.label}`,
+                `Balance: ${formatCents(data.balanceCents)}`,
+                `Status: ${data.status}`,
+                "",
+                "The wallet is now active and spending is re-enabled.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 13: deleteAgenticWallet
+    // -----------------------------------------------------------------------
+    async deleteAgenticWallet(walletId) {
+        try {
+            const wid = validateUuid(walletId, "wallet_id");
+            await this._requestWithRetry("DELETE", `/api/agent-wallet/${encodeURIComponent(wid)}`);
+            return [
+                "Agentic Wallet Deleted",
+                "",
+                `Wallet ID: ${wid}`,
+                "",
+                "Any remaining balance has been refunded to your main wallet.",
+                "Use check_balance to verify the refund.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 14: createTeam
+    // -----------------------------------------------------------------------
+    async createTeam(name, maxMembers) {
+        try {
+            if (!name || name.trim().length === 0 || name.length > 100) {
+                return "Error: name is required and must be 1-100 characters.";
+            }
+            if (/[\x00-\x1f\x7f]/.test(name)) {
+                return "Error: team name contains invalid control characters.";
+            }
+            const body = { name: name.trim() };
+            if (maxMembers !== undefined) {
+                if (!Number.isInteger(maxMembers) || maxMembers < 1 || maxMembers > 100) {
+                    return "Error: max_members must be an integer between 1 and 100.";
+                }
+                body.maxMembers = maxMembers;
+            }
+            const data = await this._requestWithRetry("POST", "/api/teams", body);
+            return [
+                "Team Created",
+                "",
+                `Team ID: ${data.id}`,
+                `Name: ${data.name}`,
+                `Max Members: ${data.maxMembers ?? "Unlimited"}`,
+                `Balance: ${formatCents(data.balanceCents ?? 0)}`,
+                `Created: ${data.createdAt}`,
+                "",
+                "Next: Use team_fund to add funds, then team_create_key for a shared API key.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 15: listTeams
+    // -----------------------------------------------------------------------
+    async listTeams() {
+        try {
+            const data = await this._requestWithRetry("GET", "/api/teams");
+            const teams = data.teams ?? [];
+            if (teams.length === 0) {
+                return "No teams found. Use create_team to create one.";
+            }
+            const lines = [`Teams (${teams.length})`, ""];
+            for (const t of teams) {
+                const memberInfo = t.memberCount !== undefined ? ` | Members: ${t.memberCount}` : "";
+                lines.push(`  ${t.name} (${t.id.slice(0, 8)}...)`);
+                lines.push(`    Role: ${t.role} | Balance: ${formatCents(t.balanceCents)}${memberInfo}`);
+                lines.push("");
+            }
+            return truncate(lines.join("\n"));
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 16: teamDetails
+    // -----------------------------------------------------------------------
+    async teamDetails(teamId) {
+        try {
+            const tid = validateUuid(teamId, "team_id");
+            const data = await this._requestWithRetry("GET", `/api/teams/${encodeURIComponent(tid)}`);
+            const lines = [
+                `Team: ${data.name}`,
+                "",
+                `Team ID: ${data.id}`,
+                `Owner: ${data.ownerId}`,
+                `Status: ${data.status}`,
+                `Your Role: ${data.role}`,
+                `Balance: ${formatCents(data.balanceCents)}`,
+                `Max Members: ${data.maxMembers ?? "Unlimited"}`,
+                `Created: ${data.createdAt}`,
+            ];
+            const members = data.members ?? [];
+            if (members.length > 0) {
+                lines.push("", `Members (${members.length}):`);
+                for (const m of members) {
+                    lines.push(`  ${m.email} -- ${m.role} (joined ${m.joinedAt})`);
+                }
+            }
+            return truncate(lines.join("\n"));
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 17: teamFund
+    // -----------------------------------------------------------------------
+    async teamFund(teamId, amountCents) {
+        try {
+            const tid = validateUuid(teamId, "team_id");
+            if (!Number.isInteger(amountCents) || amountCents < 100 || amountCents > 1000000) {
+                return "Error: amount_cents must be an integer between 100 ($1) and 1000000 ($10,000).";
+            }
+            const data = await this._requestWithRetry("POST", `/api/teams/${encodeURIComponent(tid)}/wallet/fund`, {
+                amountCents,
+            });
+            const tx = data.transaction;
+            return [
+                "Team Funded Successfully",
+                "",
+                `Transaction ID: ${tx.id}`,
+                `Amount: ${formatCents(tx.amountCents)}`,
+                `Type: ${tx.type}`,
+                "",
+                "Funds transferred from your personal wallet.",
+                "Use team_details to check the new team balance.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 18: teamCreateKey
+    // -----------------------------------------------------------------------
+    async teamCreateKey(teamId, label) {
+        try {
+            const tid = validateUuid(teamId, "team_id");
+            if (!label || label.trim().length === 0 || label.length > 100) {
+                return "Error: label is required and must be 1-100 characters.";
+            }
+            if (/[\x00-\x1f\x7f]/.test(label)) {
+                return "Error: label contains invalid control characters.";
+            }
+            const data = await this._requestWithRetry("POST", `/api/teams/${encodeURIComponent(tid)}/keys`, {
+                label: label.trim(),
+            });
+            return [
+                "Team API Key Created",
+                "",
+                `Key ID: ${data.id}`,
+                `API Key: ${data.key}`,
+                `Prefix: ${data.prefix}`,
+                `Label: ${data.label}`,
+                `Team ID: ${tid}`,
+                `Created: ${data.createdAt}`,
+                "",
+                "IMPORTANT: Save this API key now -- it will not be shown again.",
+                "Usage is billed against the team wallet.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 19: teamUsage
+    // -----------------------------------------------------------------------
+    async teamUsage(teamId, limit = 20) {
+        try {
+            const tid = validateUuid(teamId, "team_id");
+            const lim = Math.min(Math.max(Math.floor(limit), 1), 100);
+            const data = await this._requestWithRetry("GET", `/api/teams/${encodeURIComponent(tid)}/wallet/transactions?limit=${lim}`);
+            const txs = data.transactions ?? [];
+            if (txs.length === 0) {
+                return "No transactions found for this team. Use team_fund to add funds.";
+            }
+            const lines = [`Team Transactions (${txs.length})`, ""];
+            for (const tx of txs) {
+                const sign = tx.type === "fund" || tx.type === "refund" ? "+" : "-";
+                lines.push(`  ${sign}${formatCents(tx.amountCents)} [${tx.type}] ${tx.description}`);
+                lines.push(`    ${tx.createdAt} | Wallet: ${tx.walletId.slice(0, 8)}...`);
+            }
+            return truncate(lines.join("\n"));
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 20: updateTeam
+    // -----------------------------------------------------------------------
+    async updateTeam(teamId, name, maxMembers) {
+        try {
+            const tid = validateUuid(teamId, "team_id");
+            const body = {};
+            if (name !== undefined) {
+                if (!name || name.trim().length === 0 || name.length > 100) {
+                    return "Error: name must be 1-100 characters.";
+                }
+                if (/[\x00-\x1f\x7f]/.test(name)) {
+                    return "Error: team name contains invalid control characters.";
+                }
+                body.name = name.trim();
+            }
+            if (maxMembers !== undefined) {
+                if (!Number.isInteger(maxMembers) || maxMembers < 1 || maxMembers > 100) {
+                    return "Error: max_members must be an integer between 1 and 100.";
+                }
+                body.maxMembers = maxMembers;
+            }
+            if (Object.keys(body).length === 0) {
+                return "Error: At least one of name or max_members must be provided.";
+            }
+            const data = await this._requestWithRetry("PATCH", `/api/teams/${encodeURIComponent(tid)}`, body);
+            return [
+                "Team Updated",
+                "",
+                `Team ID: ${data.id}`,
+                `Name: ${data.name}`,
+                `Max Members: ${data.maxMembers ?? "Unlimited"}`,
+                `Status: ${data.status}`,
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 21: updateTeamMemberRole
+    // -----------------------------------------------------------------------
+    async updateTeamMemberRole(teamId, userId, role) {
+        try {
+            const tid = validateUuid(teamId, "team_id");
+            const uid = validateUuid(userId, "user_id");
+            if (role !== "member" && role !== "admin") {
+                return "Error: role must be 'member' or 'admin'.";
+            }
+            const data = await this._requestWithRetry("PATCH", `/api/teams/${encodeURIComponent(tid)}/members/${encodeURIComponent(uid)}`, {
+                role,
+            });
+            return [
+                "Team Member Role Updated",
+                "",
+                `Team ID: ${data.teamId ?? tid}`,
+                `User ID: ${data.userId ?? uid}`,
+                `New Role: ${data.role ?? role}`,
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 22: topupPaypal
+    // -----------------------------------------------------------------------
+    async topupPaypal(amountCents) {
+        try {
+            if (!Number.isInteger(amountCents) || amountCents < 500 || amountCents > 100000) {
+                return "Error: amount_cents must be an integer between 500 ($5) and 100000 ($1,000).";
+            }
+            const data = await this._requestWithRetry("POST", "/api/wallet/topup/paypal", { amountCents });
+            return [
+                "PayPal Top-Up Order Created",
+                "",
+                `Order ID: ${data.orderId}`,
+                `Amount: ${formatCents(data.amountCents)}`,
+                `Approval URL: ${data.approvalUrl}`,
+                "",
+                "Open the approval URL in a browser to complete payment.",
+                "Once approved, the funds will be credited to your wallet automatically.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 23: x402Info
+    // -----------------------------------------------------------------------
+    async x402Info() {
+        try {
+            const data = await this._requestWithRetry("GET", "/api/x402/info");
+            return JSON.stringify(data, null, 2);
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // getTools() -- returns LangChain DynamicStructuredTool[] for Flowise
+    // -----------------------------------------------------------------------
+    getTools() {
+        return [
+            // 1. proxied_fetch
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_proxied_fetch",
+                description: "Fetch a URL through DomiNode's rotating proxy network. Supports geo-targeting " +
+                    "by country. Returns status code, headers, and response body (truncated).",
+                schema: zod_1.z.object({
+                    url: zod_1.z.string().describe("The target URL to fetch (http or https)"),
+                    method: zod_1.z.enum(["GET", "HEAD", "OPTIONS"]).default("GET").describe("HTTP method"),
+                    country: zod_1.z.string().optional().describe("ISO 3166-1 alpha-2 country code for geo-targeting (e.g., US, GB, DE)"),
+                    proxyType: zod_1.z.enum(["dc", "residential"]).default("dc").describe("Proxy pool: dc ($3/GB) or residential ($5/GB)"),
+                }),
+                func: async ({ url, method, country, proxyType }) => {
+                    return this.proxiedFetch(url, method, country, proxyType);
+                },
+            }),
+            // 2. check_balance
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_check_balance",
+                description: "Check your DomiNode wallet balance and estimated remaining bandwidth at current pricing.",
+                schema: zod_1.z.object({}),
+                func: async () => {
+                    return this.checkBalance();
+                },
+            }),
+            // 3. check_usage
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_check_usage",
+                description: "View bandwidth usage statistics for a specified time period. Shows total bytes, cost, and request count.",
+                schema: zod_1.z.object({
+                    days: zod_1.z.number().min(1).max(365).default(30).describe("Number of days to look back (1-365)"),
+                }),
+                func: async ({ days }) => {
+                    return this.checkUsage(days);
+                },
+            }),
+            // 4. get_proxy_config
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_get_proxy_config",
+                description: "Get available proxy pools, pricing, supported countries, and endpoint configuration.",
+                schema: zod_1.z.object({}),
+                func: async () => {
+                    return this.getProxyConfig();
+                },
+            }),
+            // 5. list_sessions
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_list_sessions",
+                description: "List all active proxy sessions showing target hosts, bandwidth used, and status.",
+                schema: zod_1.z.object({}),
+                func: async () => {
+                    return this.listSessions();
+                },
+            }),
+            // 6. create_agentic_wallet
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_create_agentic_wallet",
+                description: "Create a server-side custodial agentic wallet for autonomous proxy billing. " +
+                    "Set a spending limit per transaction for safety. Optionally set a daily budget cap and domain allowlist.",
+                schema: zod_1.z.object({
+                    label: zod_1.z.string().min(1).max(100).describe('Label for this wallet (e.g., "scraper-bot")'),
+                    spendingLimitCents: zod_1.z
+                        .number()
+                        .int()
+                        .min(0)
+                        .max(1000000)
+                        .default(10000)
+                        .describe("Max spend per transaction in cents (0 = no limit, default $100)"),
+                    dailyLimitCents: zod_1.z
+                        .number()
+                        .int()
+                        .positive()
+                        .max(1000000)
+                        .optional()
+                        .describe("Optional daily budget cap in cents (max 1,000,000 = $10,000)"),
+                    allowedDomains: zod_1.z
+                        .array(zod_1.z.string().max(253))
+                        .max(100)
+                        .optional()
+                        .describe("Optional list of allowed domains for proxy access (max 100 entries)"),
+                }),
+                func: async ({ label, spendingLimitCents, dailyLimitCents, allowedDomains }) => {
+                    return this.createAgenticWallet(label, spendingLimitCents, dailyLimitCents, allowedDomains);
+                },
+            }),
+            // 7. fund_agentic_wallet
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_fund_agentic_wallet",
+                description: "Transfer funds from your main wallet to an agentic wallet. Min $1, max $10,000.",
+                schema: zod_1.z.object({
+                    walletId: zod_1.z.string().uuid().describe("Agentic wallet ID (UUID)"),
+                    amountCents: zod_1.z.number().int().min(100).max(1000000).describe("Amount in cents to transfer"),
+                }),
+                func: async ({ walletId, amountCents }) => {
+                    return this.fundAgenticWallet(walletId, amountCents);
+                },
+            }),
+            // 8. agentic_wallet_balance
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_agentic_wallet_balance",
+                description: "Check the balance and details of an agentic wallet.",
+                schema: zod_1.z.object({
+                    walletId: zod_1.z.string().uuid().describe("Agentic wallet ID (UUID)"),
+                }),
+                func: async ({ walletId }) => {
+                    return this.agenticWalletBalance(walletId);
+                },
+            }),
+            // 9. list_agentic_wallets
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_list_agentic_wallets",
+                description: "List all your agentic wallets with balances and status.",
+                schema: zod_1.z.object({}),
+                func: async () => {
+                    return this.listAgenticWallets();
+                },
+            }),
+            // 10. agentic_transactions
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_agentic_transactions",
+                description: "Get transaction history for an agentic wallet.",
+                schema: zod_1.z.object({
+                    walletId: zod_1.z.string().uuid().describe("Agentic wallet ID (UUID)"),
+                    limit: zod_1.z.number().int().min(1).max(100).default(20).describe("Number of transactions to return"),
+                }),
+                func: async ({ walletId, limit }) => {
+                    return this.agenticTransactions(walletId, limit);
+                },
+            }),
+            // 11. freeze_agentic_wallet
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_freeze_agentic_wallet",
+                description: "Freeze an agentic wallet to prevent spending. Balance is preserved until unfrozen.",
+                schema: zod_1.z.object({
+                    walletId: zod_1.z.string().uuid().describe("Agentic wallet ID (UUID)"),
+                }),
+                func: async ({ walletId }) => {
+                    return this.freezeAgenticWallet(walletId);
+                },
+            }),
+            // 12. unfreeze_agentic_wallet
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_unfreeze_agentic_wallet",
+                description: "Unfreeze a previously frozen agentic wallet to re-enable spending.",
+                schema: zod_1.z.object({
+                    walletId: zod_1.z.string().uuid().describe("Agentic wallet ID (UUID)"),
+                }),
+                func: async ({ walletId }) => {
+                    return this.unfreezeAgenticWallet(walletId);
+                },
+            }),
+            // 13. delete_agentic_wallet
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_delete_agentic_wallet",
+                description: "Delete an agentic wallet. Must be unfrozen first. Remaining balance refunded to main wallet.",
+                schema: zod_1.z.object({
+                    walletId: zod_1.z.string().uuid().describe("Agentic wallet ID (UUID)"),
+                }),
+                func: async ({ walletId }) => {
+                    return this.deleteAgenticWallet(walletId);
+                },
+            }),
+            // 13b. update_wallet_policy
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_update_wallet_policy",
+                description: "Update spending policy for an agentic wallet. Set or remove daily budget caps and domain restrictions.",
+                schema: zod_1.z.object({
+                    walletId: zod_1.z.string().uuid().describe("Agentic wallet ID (UUID)"),
+                    dailyLimitCents: zod_1.z
+                        .number()
+                        .int()
+                        .positive()
+                        .max(1000000)
+                        .nullable()
+                        .optional()
+                        .describe("Daily budget cap in cents (max 1,000,000). Set null to remove."),
+                    allowedDomains: zod_1.z
+                        .array(zod_1.z.string().max(253))
+                        .max(100)
+                        .nullable()
+                        .optional()
+                        .describe("List of allowed domains (max 100). Set null to remove restriction."),
+                }),
+                func: async ({ walletId, dailyLimitCents, allowedDomains }) => {
+                    return this.updateWalletPolicy(walletId, dailyLimitCents, allowedDomains);
+                },
+            }),
+            // 14. create_team
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_create_team",
+                description: "Create a new team with shared wallet billing. Teams let multiple users share proxy access.",
+                schema: zod_1.z.object({
+                    name: zod_1.z.string().min(1).max(100).describe("Team name (1-100 characters)"),
+                    maxMembers: zod_1.z.number().int().min(1).max(100).optional().describe("Maximum team members (1-100, optional)"),
+                }),
+                func: async ({ name, maxMembers }) => {
+                    return this.createTeam(name, maxMembers);
+                },
+            }),
+            // 15. list_teams
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_list_teams",
+                description: "List all teams you belong to, with your role and team balance.",
+                schema: zod_1.z.object({}),
+                func: async () => {
+                    return this.listTeams();
+                },
+            }),
+            // 16. team_details
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_team_details",
+                description: "Get detailed info about a team including balance, members, settings, and your role.",
+                schema: zod_1.z.object({
+                    teamId: zod_1.z.string().uuid().describe("Team ID (UUID)"),
+                }),
+                func: async ({ teamId }) => {
+                    return this.teamDetails(teamId);
+                },
+            }),
+            // 17. team_fund
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_team_fund",
+                description: "Transfer funds from your personal wallet to a team wallet. Min $1, max $10,000.",
+                schema: zod_1.z.object({
+                    teamId: zod_1.z.string().uuid().describe("Team ID (UUID)"),
+                    amountCents: zod_1.z.number().int().min(100).max(1000000).describe("Amount in cents to transfer"),
+                }),
+                func: async ({ teamId, amountCents }) => {
+                    return this.teamFund(teamId, amountCents);
+                },
+            }),
+            // 18. team_create_key
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_team_create_key",
+                description: "Create a shared API key for a team. Usage is billed against the team wallet. " +
+                    "The key is shown only once.",
+                schema: zod_1.z.object({
+                    teamId: zod_1.z.string().uuid().describe("Team ID (UUID)"),
+                    label: zod_1.z.string().min(1).max(100).describe('Label for the API key (e.g., "production")'),
+                }),
+                func: async ({ teamId, label }) => {
+                    return this.teamCreateKey(teamId, label);
+                },
+            }),
+            // 19. team_usage
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_team_usage",
+                description: "Get the team wallet transaction history (funding, usage charges, refunds).",
+                schema: zod_1.z.object({
+                    teamId: zod_1.z.string().uuid().describe("Team ID (UUID)"),
+                    limit: zod_1.z.number().int().min(1).max(100).default(20).describe("Number of transactions to return"),
+                }),
+                func: async ({ teamId, limit }) => {
+                    return this.teamUsage(teamId, limit);
+                },
+            }),
+            // 20. update_team
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_update_team",
+                description: "Update a team's settings (name and/or max member count). Owners and admins only.",
+                schema: zod_1.z.object({
+                    teamId: zod_1.z.string().uuid().describe("Team ID (UUID)"),
+                    name: zod_1.z.string().min(1).max(100).optional().describe("New team name"),
+                    maxMembers: zod_1.z.number().int().min(1).max(100).optional().describe("New max member count"),
+                }),
+                func: async ({ teamId, name, maxMembers }) => {
+                    return this.updateTeam(teamId, name, maxMembers);
+                },
+            }),
+            // 21. update_team_member_role
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_update_team_member_role",
+                description: "Update a team member's role (member or admin). Owners and admins only.",
+                schema: zod_1.z.object({
+                    teamId: zod_1.z.string().uuid().describe("Team ID (UUID)"),
+                    userId: zod_1.z.string().uuid().describe("User ID (UUID) of the member"),
+                    role: zod_1.z.enum(["member", "admin"]).describe("New role for the member"),
+                }),
+                func: async ({ teamId, userId, role }) => {
+                    return this.updateTeamMemberRole(teamId, userId, role);
+                },
+            }),
+            // 22. topup_paypal
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_topup_paypal",
+                description: "Top up your DomiNode wallet via PayPal. Creates a PayPal order and returns an " +
+                    "approval URL. Minimum $5, maximum $1,000.",
+                schema: zod_1.z.object({
+                    amountCents: zod_1.z.number().int().min(500).max(100000).describe("Amount in cents to top up (min 500 = $5)"),
+                }),
+                func: async ({ amountCents }) => {
+                    return this.topupPaypal(amountCents);
+                },
+            }),
+            // 24. x402_info
+            new tools_1.DynamicStructuredTool({
+                name: "dominusnode_x402_info",
+                description: "Get x402 micropayment protocol information including supported facilitators, " +
+                    "pricing, and payment options for AI agent micropayments.",
+                schema: zod_1.z.object({}),
+                func: async () => {
+                    return this.x402Info();
+                },
+            }),
+        ];
+    }
+}
+exports.DominusNodeToolkit = DominusNodeToolkit;
+//# sourceMappingURL=toolkit.js.map