@dominusnode/openclaw-plugin 1.1.0 → 1.3.0

package/dist/plugin.js

@@ -1,7 +1,7 @@
 /**
  * Dominus Node OpenClaw Plugin
  *
- * Implements 26 tools for interacting with Dominus Node's rotating proxy service
+ * Implements 53 tools for interacting with Dominus Node's rotating proxy service
  * directly from OpenClaw AI coding sessions.
  *
  * Uses native fetch (no external dependencies). Runs via jiti runtime.
@@ -12,10 +12,63 @@
  *  - Response truncation at 4000 chars for LLM context efficiency
  *  - OFAC sanctioned country validation
  */
+import * as crypto from "node:crypto";
 import * as http from "node:http";
 import * as tls from "node:tls";
 import * as dns from "dns/promises";
 // ---------------------------------------------------------------------------
+// SHA-256 Proof-of-Work solver
+// ---------------------------------------------------------------------------
+function countLeadingZeroBits(buf) {
+    let count = 0;
+    for (const byte of buf) {
+        if (byte === 0) {
+            count += 8;
+            continue;
+        }
+        let mask = 0x80;
+        while (mask && !(byte & mask)) {
+            count++;
+            mask >>= 1;
+        }
+        break;
+    }
+    return count;
+}
+async function solvePoW(solveBaseUrl) {
+    try {
+        const resp = await fetch(`${solveBaseUrl}/api/auth/pow/challenge`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            redirect: "error",
+        });
+        if (!resp.ok)
+            return null;
+        const text = await resp.text();
+        if (text.length > 10_485_760)
+            return null;
+        const challenge = JSON.parse(text);
+        const prefix = challenge.prefix ?? "";
+        const difficulty = challenge.difficulty ?? 20;
+        const challengeId = challenge.challengeId ?? "";
+        if (!prefix || !challengeId)
+            return null;
+        for (let nonce = 0; nonce < 100_000_000; nonce++) {
+            const hash = crypto
+                .createHash("sha256")
+                .update(prefix + nonce.toString())
+                .digest();
+            if (countLeadingZeroBits(hash) >= difficulty) {
+                return { challengeId, nonce: nonce.toString() };
+            }
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
 // Configuration
 // ---------------------------------------------------------------------------
 const MAX_RESPONSE_CHARS = 4000;
@@ -69,7 +122,7 @@ function getAgentSecret() {
 // ---------------------------------------------------------------------------
 /** Remove any dn_live_* or dn_test_* tokens from error messages. */
 function scrubCredentials(msg) {
-    return msg.replace(/dn_(live|test)_[A-Za-z0-9_-]+/g, "dn_$1_***REDACTED***");
+    return msg.replace(/dn_(live|test|proxy)_[A-Za-z0-9_-]+/g, "dn_$1_***REDACTED***");
 }
 function safeError(err) {
     const raw = err instanceof Error ? err.message : String(err);
@@ -81,7 +134,8 @@ function safeError(err) {
 function truncate(text, max = MAX_RESPONSE_CHARS) {
     if (text.length <= max)
         return text;
-    return text.slice(0, max) + `\n\n... [truncated, ${text.length - max} chars omitted]`;
+    return (text.slice(0, max) +
+        `\n\n... [truncated, ${text.length - max} chars omitted]`);
 }
 // ---------------------------------------------------------------------------
 // SSRF Protection
@@ -352,7 +406,9 @@ let jwtExpiresAt = 0;
 let cachedApiKeyPrefix = null;
 async function ensureAuth(apiKey, baseUrl) {
     const keyPrefix = apiKey.slice(0, 16);
-    if (cachedJwt && Date.now() < jwtExpiresAt && cachedApiKeyPrefix === keyPrefix)
+    if (cachedJwt &&
+        Date.now() < jwtExpiresAt &&
+        cachedApiKeyPrefix === keyPrefix)
         return cachedJwt;
     const authHeaders = {
         "Content-Type": "application/json",
@@ -373,7 +429,7 @@ async function ensureAuth(apiKey, baseUrl) {
         const text = await res.text().catch(() => "");
         throw new Error(`Auth failed (${res.status}): ${scrubCredentials(text.slice(0, 500))}`);
     }
-    const data = await res.json();
+    const data = (await res.json());
     cachedApiKeyPrefix = keyPrefix;
     cachedJwt = data.token;
     // JWT expires in 15 min, refresh at 14 min for safety
@@ -386,8 +442,8 @@ async function apiRequest(method, path, body) {
     const url = `${baseUrl}${path}`;
     const jwt = await ensureAuth(apiKey, baseUrl);
     const headers = {
-        "Authorization": `Bearer ${jwt}`,
-        "Accept": "application/json",
+        Authorization: `Bearer ${jwt}`,
+        Accept: "application/json",
         "User-Agent": "dominusnode-openclaw-plugin/1.0.0",
     };
     const agentSecret = getAgentSecret();
@@ -466,6 +522,83 @@ async function apiDelete(path) {
 async function apiPatch(path, body) {
     return apiRequest("PATCH", path, body);
 }
+async function apiPut(path, body) {
+    return apiRequest("PUT", path, body);
+}
+/**
+ * Make an unauthenticated API request (for register, login, verify-email).
+ * Does NOT call ensureAuth(). Includes agent headers if available.
+ */
+async function unauthenticatedRequest(method, path, body) {
+    const baseUrl = getBaseUrl();
+    const url = `${baseUrl}${path}`;
+    const headers = {
+        Accept: "application/json",
+        "User-Agent": "dominusnode-openclaw-plugin/1.0.0",
+    };
+    const agentSecret = getAgentSecret();
+    if (agentSecret) {
+        headers["X-DominusNode-Agent"] = "mcp";
+        headers["X-DominusNode-Agent-Secret"] = agentSecret;
+    }
+    const init = {
+        method,
+        headers,
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        redirect: "error",
+    };
+    if (body && (method === "POST" || method === "PUT" || method === "PATCH")) {
+        headers["Content-Type"] = "application/json";
+        init.body = JSON.stringify(body);
+    }
+    let res;
+    try {
+        res = await fetch(url, init);
+    }
+    catch (err) {
+        throw new Error(`API request failed: ${safeError(err)}`);
+    }
+    let rawText;
+    try {
+        rawText = await res.text();
+    }
+    catch {
+        rawText = "";
+    }
+    if (new TextEncoder().encode(rawText).length > MAX_RESPONSE_BYTES) {
+        throw new Error("API response too large");
+    }
+    if (!res.ok) {
+        let errorMsg = `API error ${res.status}`;
+        if (rawText) {
+            try {
+                const parsed = JSON.parse(rawText);
+                stripDangerousKeys(parsed);
+                if (parsed.error) {
+                    errorMsg = `API error ${res.status}: ${scrubCredentials(String(parsed.error))}`;
+                }
+                else if (parsed.message) {
+                    errorMsg = `API error ${res.status}: ${scrubCredentials(String(parsed.message))}`;
+                }
+            }
+            catch {
+                errorMsg = `API error ${res.status}: ${scrubCredentials(rawText.slice(0, 200))}`;
+            }
+        }
+        throw new Error(errorMsg);
+    }
+    if (!rawText || rawText.trim().length === 0) {
+        return {};
+    }
+    try {
+        const parsed = JSON.parse(rawText);
+        stripDangerousKeys(parsed);
+        return parsed;
+    }
+    catch {
+        throw new Error("Failed to parse API response as JSON");
+    }
+}
 // ---------------------------------------------------------------------------
 // Formatting helpers
 // ---------------------------------------------------------------------------
@@ -535,9 +668,19 @@ const proxiedFetchTool = {
             }
             const proxyType = String(args.pool ?? "dc");
             // Validate and collect custom headers
-            const STRIPPED_HEADERS = new Set(["host", "connection", "content-length", "transfer-encoding", "proxy-authorization", "authorization", "user-agent"]);
+            const STRIPPED_HEADERS = new Set([
+                "host",
+                "connection",
+                "content-length",
+                "transfer-encoding",
+                "proxy-authorization",
+                "authorization",
+                "user-agent",
+            ]);
             const customHeaders = {};
-            if (args.headers && typeof args.headers === "object" && !Array.isArray(args.headers)) {
+            if (args.headers &&
+                typeof args.headers === "object" &&
+                !Array.isArray(args.headers)) {
                 for (const [k, v] of Object.entries(args.headers)) {
                     const key = String(k);
                     const val = String(v ?? "");
@@ -562,15 +705,24 @@ const proxiedFetchTool = {
             const parsed = new URL(url);
             const MAX_RESP = 1_048_576; // 1MB
             // Build custom header lines for raw HTTP request
-            const customHeaderLines = Object.entries(customHeaders).map(([k, v]) => `${k}: ${v}\r\n`).join("");
+            const customHeaderLines = Object.entries(customHeaders)
+                .map(([k, v]) => `${k}: ${v}\r\n`)
+                .join("");
             const result = await new Promise((resolve, reject) => {
                 const timer = setTimeout(() => reject(new Error("Proxy request timed out")), 30_000);
                 if (parsed.protocol === "https:") {
-                    const connectHost = parsed.hostname.includes(":") ? `[${parsed.hostname}]` : parsed.hostname;
+                    const connectHost = parsed.hostname.includes(":")
+                        ? `[${parsed.hostname}]`
+                        : parsed.hostname;
                     const connectReq = http.request({
-                        hostname: proxyHost, port: proxyPort, method: "CONNECT",
+                        hostname: proxyHost,
+                        port: proxyPort,
+                        method: "CONNECT",
                         path: `${connectHost}:${parsed.port || 443}`,
-                        headers: { "Proxy-Authorization": proxyAuth, Host: `${connectHost}:${parsed.port || 443}` },
+                        headers: {
+                            "Proxy-Authorization": proxyAuth,
+                            Host: `${connectHost}:${parsed.port || 443}`,
+                        },
                     });
                     connectReq.on("connect", (_res, sock) => {
                         if (_res.statusCode !== 200) {
@@ -579,13 +731,21 @@ const proxiedFetchTool = {
                             reject(new Error(`CONNECT failed: ${_res.statusCode}`));
                             return;
                         }
-                        const tlsSock = tls.connect({ host: parsed.hostname, socket: sock, servername: parsed.hostname, minVersion: "TLSv1.2" }, () => {
+                        const tlsSock = tls.connect({
+                            host: parsed.hostname,
+                            socket: sock,
+                            servername: parsed.hostname,
+                            minVersion: "TLSv1.2",
+                        }, () => {
                             const reqLine = `${method} ${parsed.pathname + parsed.search} HTTP/1.1\r\nHost: ${parsed.host}\r\nUser-Agent: dominusnode-openclaw/1.0.0\r\n${customHeaderLines}Connection: close\r\n\r\n`;
                             tlsSock.write(reqLine);
                             const chunks = [];
                             let bytes = 0;
-                            tlsSock.on("data", (c) => { bytes += c.length; if (bytes <= MAX_RESP + 16384)
-                                chunks.push(c); });
+                            tlsSock.on("data", (c) => {
+                                bytes += c.length;
+                                if (bytes <= MAX_RESP + 16384)
+                                    chunks.push(c);
+                            });
                             let done = false;
                             const fin = () => {
                                 if (done)
@@ -600,40 +760,69 @@ const proxiedFetchTool = {
                                 }
                                 const hdr = raw.substring(0, hEnd);
                                 const body = raw.substring(hEnd + 4).substring(0, MAX_RESP);
-                                const sm = hdr.split("\r\n")[0].match(/^HTTP\/\d\.\d\s+(\d+)/);
+                                const sm = hdr
+                                    .split("\r\n")[0]
+                                    .match(/^HTTP\/\d\.\d\s+(\d+)/);
                                 const hdrs = {};
                                 for (const l of hdr.split("\r\n").slice(1)) {
                                     const ci = l.indexOf(":");
                                     if (ci > 0)
-                                        hdrs[l.substring(0, ci).trim().toLowerCase()] = l.substring(ci + 1).trim();
+                                        hdrs[l.substring(0, ci).trim().toLowerCase()] = l
+                                            .substring(ci + 1)
+                                            .trim();
                                 }
-                                resolve({ status: sm ? parseInt(sm[1], 10) : 0, headers: hdrs, body });
+                                resolve({
+                                    status: sm ? parseInt(sm[1], 10) : 0,
+                                    headers: hdrs,
+                                    body,
+                                });
                             };
                             tlsSock.on("end", fin);
                             tlsSock.on("close", fin);
-                            tlsSock.on("error", (e) => { clearTimeout(timer); reject(e); });
+                            tlsSock.on("error", (e) => {
+                                clearTimeout(timer);
+                                reject(e);
+                            });
+                        });
+                        tlsSock.on("error", (e) => {
+                            clearTimeout(timer);
+                            reject(e);
                         });
-                        tlsSock.on("error", (e) => { clearTimeout(timer); reject(e); });
                     });
-                    connectReq.on("error", (e) => { clearTimeout(timer); reject(e); });
+                    connectReq.on("error", (e) => {
+                        clearTimeout(timer);
+                        reject(e);
+                    });
                     connectReq.end();
                 }
                 else {
                     const req = http.request({
-                        hostname: proxyHost, port: proxyPort, method, path: url,
-                        headers: { "Proxy-Authorization": proxyAuth, Host: parsed.host ?? "", ...customHeaders },
+                        hostname: proxyHost,
+                        port: proxyPort,
+                        method,
+                        path: url,
+                        headers: {
+                            "Proxy-Authorization": proxyAuth,
+                            Host: parsed.host ?? "",
+                            ...customHeaders,
+                        },
                     }, (res) => {
                         const chunks = [];
                         let bytes = 0;
-                        res.on("data", (c) => { bytes += c.length; if (bytes <= MAX_RESP)
-                            chunks.push(c); });
+                        res.on("data", (c) => {
+                            bytes += c.length;
+                            if (bytes <= MAX_RESP)
+                                chunks.push(c);
+                        });
                         let done = false;
                         const fin = () => {
                             if (done)
                                 return;
                             done = true;
                             clearTimeout(timer);
-                            const body = Buffer.concat(chunks).toString("utf-8").substring(0, MAX_RESP);
+                            const body = Buffer.concat(chunks)
+                                .toString("utf-8")
+                                .substring(0, MAX_RESP);
                             const hdrs = {};
                             for (const [k, v] of Object.entries(res.headers)) {
                                 if (v)
@@ -643,9 +832,15 @@ const proxiedFetchTool = {
                         };
                         res.on("end", fin);
                         res.on("close", fin);
-                        res.on("error", (e) => { clearTimeout(timer); reject(e); });
+                        res.on("error", (e) => {
+                            clearTimeout(timer);
+                            reject(e);
+                        });
+                    });
+                    req.on("error", (e) => {
+                        clearTimeout(timer);
+                        reject(e);
                     });
-                    req.on("error", (e) => { clearTimeout(timer); reject(e); });
                     req.end();
                 }
             });
@@ -656,7 +851,13 @@ const proxiedFetchTool = {
             ];
             // Include relevant response headers
             if (result.headers) {
-                const showHeaders = ["content-type", "content-length", "server", "x-cache", "cache-control"];
+                const showHeaders = [
+                    "content-type",
+                    "content-length",
+                    "server",
+                    "x-cache",
+                    "cache-control",
+                ];
                 for (const h of showHeaders) {
                     if (result.headers[h]) {
                         lines.push(`${h}: ${result.headers[h]}`);
@@ -843,9 +1044,12 @@ const createAgenticWalletTool = {
                 spendingLimitCents,
             };
             // Validate optional daily_limit_cents
-            if (args.daily_limit_cents !== undefined && args.daily_limit_cents !== null) {
+            if (args.daily_limit_cents !== undefined &&
+                args.daily_limit_cents !== null) {
                 const dailyLimit = Number(args.daily_limit_cents);
-                if (!Number.isInteger(dailyLimit) || dailyLimit < 1 || dailyLimit > 1000000) {
+                if (!Number.isInteger(dailyLimit) ||
+                    dailyLimit < 1 ||
+                    dailyLimit > 1000000) {
                     return "Error: daily_limit_cents must be a positive integer between 1 and 1000000.";
                 }
                 body.dailyLimitCents = dailyLimit;
@@ -912,7 +1116,9 @@ const fundAgenticWalletTool = {
         try {
             const walletId = validateUuid(String(args.wallet_id ?? ""), "wallet_id");
             const amountCents = Number(args.amount_cents ?? 0);
-            if (!Number.isInteger(amountCents) || amountCents < 100 || amountCents > 1000000) {
+            if (!Number.isInteger(amountCents) ||
+                amountCents < 100 ||
+                amountCents > 1000000) {
                 return "Error: amount_cents must be an integer between 100 ($1) and 1000000 ($10,000).";
             }
             const data = await apiPost(`/api/agent-wallet/${encodeURIComponent(walletId)}/fund`, {
@@ -1022,7 +1228,9 @@ const agenticTransactionsTool = {
             const lines = [`Wallet Transactions (${txs.length})`, ""];
             for (const tx of txs) {
                 const sign = tx.type === "fund" || tx.type === "refund" ? "+" : "-";
-                const session = tx.sessionId ? ` | Session: ${tx.sessionId.slice(0, 8)}` : "";
+                const session = tx.sessionId
+                    ? ` | Session: ${tx.sessionId.slice(0, 8)}`
+                    : "";
                 lines.push(`  ${sign}${formatCents(tx.amountCents)} [${tx.type}] ${tx.description}`);
                 lines.push(`    ${tx.createdAt}${session}`);
             }
@@ -1061,7 +1269,9 @@ const createTeamTool = {
             const body = { name };
             if (args.max_members !== undefined) {
                 const maxMembers = Number(args.max_members);
-                if (!Number.isInteger(maxMembers) || maxMembers < 1 || maxMembers > 100) {
+                if (!Number.isInteger(maxMembers) ||
+                    maxMembers < 1 ||
+                    maxMembers > 100) {
                     return "Error: max_members must be an integer between 1 and 100.";
                 }
                 body.maxMembers = maxMembers;
@@ -1173,7 +1383,9 @@ const teamFundTool = {
         try {
             const teamId = validateUuid(String(args.team_id ?? ""), "team_id");
             const amountCents = Number(args.amount_cents ?? 0);
-            if (!Number.isInteger(amountCents) || amountCents < 100 || amountCents > 1000000) {
+            if (!Number.isInteger(amountCents) ||
+                amountCents < 100 ||
+                amountCents > 1000000) {
                 return "Error: amount_cents must be an integer between 100 ($1) and 1000000 ($10,000).";
             }
             const data = await apiPost(`/api/teams/${encodeURIComponent(teamId)}/wallet/fund`, {
@@ -1413,7 +1625,9 @@ const updateTeamTool = {
             }
             if (args.max_members !== undefined) {
                 const maxMembers = Number(args.max_members);
-                if (!Number.isInteger(maxMembers) || maxMembers < 1 || maxMembers > 100) {
+                if (!Number.isInteger(maxMembers) ||
+                    maxMembers < 1 ||
+                    maxMembers > 100) {
                     return "Error: max_members must be an integer between 1 and 100.";
                 }
                 body.maxMembers = maxMembers;
@@ -1451,7 +1665,9 @@ const topupPaypalTool = {
     execute: async (args) => {
         try {
             const amountCents = Number(args.amount_cents ?? 0);
-            if (!Number.isInteger(amountCents) || amountCents < 500 || amountCents > 100000) {
+            if (!Number.isInteger(amountCents) ||
+                amountCents < 500 ||
+                amountCents > 100000) {
                 return "Error: amount_cents must be an integer between 500 ($5) and 100000 ($1,000).";
             }
             const data = await apiPost("/api/wallet/topup/paypal", { amountCents });
@@ -1486,7 +1702,9 @@ const topupStripeTool = {
     execute: async (args) => {
         try {
             const amountCents = Number(args.amount_cents ?? 0);
-            if (!Number.isInteger(amountCents) || amountCents < 500 || amountCents > 100000) {
+            if (!Number.isInteger(amountCents) ||
+                amountCents < 500 ||
+                amountCents > 100000) {
                 return "Error: amount_cents must be an integer between 500 ($5) and 100000 ($1,000).";
             }
             const data = await apiPost("/api/wallet/topup/stripe", { amountCents });
@@ -1508,7 +1726,17 @@ const topupStripeTool = {
 };
 // 23. topup_crypto
 const VALID_CRYPTO_CURRENCIES = new Set([
-    "BTC", "ETH", "LTC", "XMR", "ZEC", "USDC", "SOL", "USDT", "DAI", "BNB", "LINK",
+    "BTC",
+    "ETH",
+    "LTC",
+    "XMR",
+    "ZEC",
+    "USDC",
+    "SOL",
+    "USDT",
+    "DAI",
+    "BNB",
+    "LINK",
 ]);
 const topupCryptoTool = {
     name: "topup_crypto",
@@ -1525,20 +1753,38 @@ const topupCryptoTool = {
             type: "string",
             description: "Cryptocurrency to pay with",
             required: true,
-            enum: ["BTC", "ETH", "LTC", "XMR", "ZEC", "USDC", "SOL", "USDT", "DAI", "BNB", "LINK"],
+            enum: [
+                "BTC",
+                "ETH",
+                "LTC",
+                "XMR",
+                "ZEC",
+                "USDC",
+                "SOL",
+                "USDT",
+                "DAI",
+                "BNB",
+                "LINK",
+            ],
         },
     },
     execute: async (args) => {
         try {
             const amountUsd = Number(args.amount_usd ?? 0);
-            if (typeof amountUsd !== "number" || !Number.isFinite(amountUsd) || amountUsd < 5 || amountUsd > 1000) {
+            if (typeof amountUsd !== "number" ||
+                !Number.isFinite(amountUsd) ||
+                amountUsd < 5 ||
+                amountUsd > 1000) {
                 return "Error: amount_usd must be a number between 5 and 1000.";
             }
             const currency = String(args.currency ?? "").toUpperCase();
             if (!VALID_CRYPTO_CURRENCIES.has(currency)) {
                 return `Error: currency must be one of: ${[...VALID_CRYPTO_CURRENCIES].join(", ")}.`;
             }
-            const data = await apiPost("/api/wallet/topup/crypto", { amountUsd, currency: currency.toLowerCase() });
+            const data = await apiPost("/api/wallet/topup/crypto", {
+                amountUsd,
+                currency: currency.toLowerCase(),
+            });
             return [
                 "Crypto Payment Invoice Created",
                 "",
@@ -1650,7 +1896,9 @@ const updateWalletPolicyTool = {
                 }
                 else {
                     const dailyLimit = Number(args.daily_limit_cents);
-                    if (!Number.isInteger(dailyLimit) || dailyLimit < 1 || dailyLimit > 1000000) {
+                    if (!Number.isInteger(dailyLimit) ||
+                        dailyLimit < 1 ||
+                        dailyLimit > 1000000) {
                         return "Error: daily_limit_cents must be a positive integer between 1 and 1000000, or null to clear.";
                     }
                     body.dailyLimitCents = dailyLimit;
@@ -1699,36 +1947,1173 @@ const updateWalletPolicyTool = {
         }
     },
 };
-// ---------------------------------------------------------------------------
-// Plugin export — the tools array that OpenClaw discovers
-// ---------------------------------------------------------------------------
-export const tools = [
-    proxiedFetchTool,
-    checkBalanceTool,
-    checkUsageTool,
-    getProxyConfigTool,
-    listSessionsTool,
-    createAgenticWalletTool,
-    fundAgenticWalletTool,
-    checkAgenticBalanceTool,
-    listAgenticWalletsTool,
-    agenticTransactionsTool,
-    freezeAgenticWalletTool,
-    unfreezeAgenticWalletTool,
-    deleteAgenticWalletTool,
-    createTeamTool,
-    listTeamsTool,
-    teamDetailsTool,
-    teamFundTool,
-    teamCreateKeyTool,
-    teamUsageTool,
-    updateTeamTool,
-    updateTeamMemberRoleTool,
-    topupPaypalTool,
-    topupStripeTool,
-    topupCryptoTool,
-    x402InfoTool,
-    updateWalletPolicyTool,
+// 27. get_proxy_status
+const getProxyStatusTool = {
+    name: "get_proxy_status",
+    description: "Get the current status of the proxy gateway including uptime, active connections, and pool health.",
+    parameters: {},
+    execute: async () => {
+        try {
+            const data = await apiGet("/api/proxy/status");
+            const lines = [
+                "Proxy Gateway Status",
+                "",
+                `Status: ${data.status ?? "unknown"}`,
+                `Uptime: ${data.uptime != null ? `${Math.floor(data.uptime / 3600)}h ${Math.floor((data.uptime % 3600) / 60)}m` : "unknown"}`,
+                `Active Connections: ${data.activeConnections ?? 0}`,
+            ];
+            const pools = data.pools ?? [];
+            if (pools.length > 0) {
+                lines.push("", "Pool Health:");
+                for (const p of pools) {
+                    lines.push(`  ${p.name}: ${p.healthy ? "healthy" : "unhealthy"} (${p.activeIps} IPs)`);
+                }
+            }
+            return lines.join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 28. get_transactions
+const getTransactionsTool = {
+    name: "get_transactions",
+    description: "Get your main wallet transaction history including top-ups, usage charges, and refunds.",
+    parameters: {
+        limit: {
+            type: "number",
+            description: "Number of transactions to return (1-100, default 20)",
+            required: false,
+            default: 20,
+        },
+    },
+    execute: async (args) => {
+        try {
+            const limit = Math.min(Math.max(Number(args.limit ?? 20), 1), 100);
+            const data = await apiGet(`/api/wallet/transactions?limit=${limit}`);
+            const txs = data.transactions ?? [];
+            if (txs.length === 0) {
+                return "No wallet transactions found.";
+            }
+            const lines = [`Wallet Transactions (${txs.length})`, ""];
+            for (const tx of txs) {
+                const sign = tx.type === "topup" || tx.type === "refund" || tx.type === "fund"
+                    ? "+"
+                    : "-";
+                lines.push(`  ${sign}${formatCents(Math.abs(tx.amountCents))} [${tx.type}] ${tx.description}`);
+                lines.push(`    ${tx.createdAt}`);
+            }
+            return truncate(lines.join("\n"));
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 29. get_forecast
+const getForecastTool = {
+    name: "get_forecast",
+    description: "Get a spending forecast based on recent usage patterns. Shows projected balance depletion date and daily burn rate.",
+    parameters: {},
+    execute: async () => {
+        try {
+            const data = await apiGet("/api/wallet/forecast");
+            const lines = [
+                "Spending Forecast",
+                "",
+                `Current Balance: ${formatCents(data.currentBalanceCents ?? 0)}`,
+                `Daily Burn Rate: ${formatCents(data.dailyBurnCents ?? 0)}/day`,
+                `Avg Daily Bandwidth: ${formatBytes(data.avgDailyBytes ?? 0)}`,
+                `Estimated Days Remaining: ${data.estimatedDaysRemaining ?? "N/A"}`,
+                `Projected Depletion: ${data.projectedDepletionDate ?? "N/A"}`,
+                "",
+                "Use topup_stripe, topup_paypal, or topup_crypto to add funds.",
+            ];
+            return lines.join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 30. check_payment
+const checkPaymentTool = {
+    name: "check_payment",
+    description: "Check the status of a crypto payment invoice. Use the invoice ID returned by topup_crypto.",
+    parameters: {
+        invoice_id: {
+            type: "string",
+            description: "Crypto invoice ID to check",
+            required: true,
+        },
+    },
+    execute: async (args) => {
+        try {
+            const invoiceId = String(args.invoice_id ?? "").trim();
+            if (!invoiceId || invoiceId.length === 0 || invoiceId.length > 200) {
+                return "Error: invoice_id is required (max 200 characters).";
+            }
+            if (/[\x00-\x1f\x7f]/.test(invoiceId)) {
+                return "Error: invoice_id contains invalid control characters.";
+            }
+            const data = await apiGet(`/api/wallet/topup/crypto/${encodeURIComponent(invoiceId)}/status`);
+            const lines = [
+                "Crypto Payment Status",
+                "",
+                `Invoice ID: ${data.invoiceId ?? invoiceId}`,
+                `Status: ${data.status}`,
+                `Amount: $${data.amountUsd}`,
+                `Currency: ${data.payCurrency?.toUpperCase() ?? "N/A"}`,
+            ];
+            if (data.paidAmount != null) {
+                lines.push(`Paid: ${data.paidAmount} ${data.payCurrency?.toUpperCase() ?? ""}`);
+            }
+            lines.push(`Created: ${data.createdAt}`, `Updated: ${data.updatedAt}`);
+            return lines.join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 31. get_daily_usage
+const getDailyUsageTool = {
+    name: "get_daily_usage",
+    description: "Get daily bandwidth usage breakdown for the specified number of days. Shows per-day bytes, cost, and request count.",
+    parameters: {
+        days: {
+            type: "number",
+            description: "Number of days to look back (1-90, default 7)",
+            required: false,
+            default: 7,
+        },
+    },
+    execute: async (args) => {
+        try {
+            const days = Math.min(Math.max(Number(args.days ?? 7), 1), 90);
+            const data = await apiGet(`/api/usage/daily?days=${days}`);
+            const daily = data.daily ?? [];
+            if (daily.length === 0) {
+                return `No daily usage data found for the last ${days} days.`;
+            }
+            const lines = [`Daily Usage (last ${days} days)`, ""];
+            for (const d of daily) {
+                lines.push(`  ${d.date}: ${formatBytes(d.totalBytes)} | ${formatCents(d.totalCostCents)} | ${d.requestCount} reqs`);
+            }
+            return truncate(lines.join("\n"));
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 32. get_top_hosts
+const getTopHostsTool = {
+    name: "get_top_hosts",
+    description: "Get the top hosts by bandwidth usage. Shows which domains consume the most proxy bandwidth.",
+    parameters: {
+        limit: {
+            type: "number",
+            description: "Number of top hosts to return (1-100, default 10)",
+            required: false,
+            default: 10,
+        },
+    },
+    execute: async (args) => {
+        try {
+            const limit = Math.min(Math.max(Number(args.limit ?? 10), 1), 100);
+            const data = await apiGet(`/api/usage/top-hosts?limit=${limit}`);
+            const hosts = data.hosts ?? [];
+            if (hosts.length === 0) {
+                return "No host usage data found.";
+            }
+            const lines = [`Top Hosts by Bandwidth (${hosts.length})`, ""];
+            for (let i = 0; i < hosts.length; i++) {
+                const h = hosts[i];
+                lines.push(`  ${i + 1}. ${h.host}: ${formatBytes(h.totalBytes)} | ${h.requestCount} reqs | Last: ${h.lastSeen}`);
+            }
+            return truncate(lines.join("\n"));
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 33. register
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const registerTool = {
+    name: "register",
+    description: "Register a new Dominus Node account. Returns user info and instructions for email verification. " +
+        "This is an unauthenticated endpoint -- no API key required.",
+    parameters: {
+        email: {
+            type: "string",
+            description: "Email address for the new account",
+            required: true,
+        },
+        password: {
+            type: "string",
+            description: "Password for the new account (8-128 characters)",
+            required: true,
+        },
+    },
+    execute: async (args) => {
+        try {
+            const email = String(args.email ?? "").trim();
+            if (!email || !EMAIL_RE.test(email)) {
+                return "Error: A valid email address is required.";
+            }
+            if (email.length > 254) {
+                return "Error: Email address is too long (max 254 characters).";
+            }
+            const password = String(args.password ?? "");
+            if (password.length < 8 || password.length > 128) {
+                return "Error: Password must be 8-128 characters.";
+            }
+            // Solve PoW for CAPTCHA-free registration
+            const pow = await solvePoW(getBaseUrl());
+            const regBody = { email, password };
+            if (pow)
+                regBody.pow = pow;
+            const data = await unauthenticatedRequest("POST", "/api/auth/register", regBody);
+            return [
+                "Account Registered",
+                "",
+                `User ID: ${data.id}`,
+                `Email: ${data.email}`,
+                `Email Verified: ${data.emailVerified ? "Yes" : "No"}`,
+                `Created: ${data.createdAt}`,
+                "",
+                "Next steps:",
+                "  1. Check your email for a verification code",
+                "  2. Use verify_email to verify your email address",
+                "  3. Set DOMINUSNODE_API_KEY to start using the proxy",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 34. login
+const loginTool = {
+    name: "login",
+    description: "Log in to a Dominus Node account and receive access/refresh tokens. " +
+        "This is an unauthenticated endpoint -- no API key required.",
+    parameters: {
+        email: {
+            type: "string",
+            description: "Account email address",
+            required: true,
+        },
+        password: {
+            type: "string",
+            description: "Account password (8-128 characters)",
+            required: true,
+        },
+    },
+    execute: async (args) => {
+        try {
+            const email = String(args.email ?? "").trim();
+            if (!email || !EMAIL_RE.test(email)) {
+                return "Error: A valid email address is required.";
+            }
+            if (email.length > 254) {
+                return "Error: Email address is too long (max 254 characters).";
+            }
+            const password = String(args.password ?? "");
+            if (password.length < 8 || password.length > 128) {
+                return "Error: Password must be 8-128 characters.";
+            }
+            const data = await unauthenticatedRequest("POST", "/api/auth/login", { email, password });
+            if (data.mfaRequired) {
+                return [
+                    "MFA Required",
+                    "",
+                    "This account has multi-factor authentication enabled.",
+                    "Please complete MFA verification to continue.",
+                ].join("\n");
+            }
+            return [
+                "Login Successful",
+                "",
+                `Access Token: ${scrubCredentials(data.accessToken ?? "")}`,
+                `Refresh Token: ${scrubCredentials(data.refreshToken ?? "")}`,
+                `Expires In: ${data.expiresIn ?? 900} seconds`,
+                "",
+                "Use these tokens for authenticated API requests.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 35. get_account_info
+const getAccountInfoTool = {
+    name: "get_account_info",
+    description: "Get your Dominus Node account information including email, plan, verification status, and creation date.",
+    parameters: {},
+    execute: async () => {
+        try {
+            const data = await apiGet("/api/auth/me");
+            return [
+                "Account Info",
+                "",
+                `User ID: ${data.id}`,
+                `Email: ${data.email}`,
+                `Email Verified: ${data.emailVerified ? "Yes" : "No"}`,
+                `Plan: ${data.plan}`,
+                `Status: ${data.status}`,
+                `MFA Enabled: ${data.mfaEnabled ? "Yes" : "No"}`,
+                `Created: ${data.createdAt}`,
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 36. verify_email
+const verifyEmailTool = {
+    name: "verify_email",
+    description: "Verify your email address using the code sent during registration. " +
+        "This is an unauthenticated endpoint -- no API key required.",
+    parameters: {
+        email: {
+            type: "string",
+            description: "Email address to verify",
+            required: true,
+        },
+        code: {
+            type: "string",
+            description: "Verification code from email",
+            required: true,
+        },
+    },
+    execute: async (args) => {
+        try {
+            const email = String(args.email ?? "").trim();
+            if (!email || !EMAIL_RE.test(email)) {
+                return "Error: A valid email address is required.";
+            }
+            if (email.length > 254) {
+                return "Error: Email address is too long (max 254 characters).";
+            }
+            const code = String(args.code ?? "").trim();
+            if (!code || code.length === 0 || code.length > 100) {
+                return "Error: Verification code is required (max 100 characters).";
+            }
+            if (/[\x00-\x1f\x7f]/.test(code)) {
+                return "Error: Verification code contains invalid control characters.";
+            }
+            await unauthenticatedRequest("POST", "/api/auth/verify-email", {
+                email,
+                code,
+            });
+            return [
+                "Email Verified Successfully",
+                "",
+                `Email: ${email}`,
+                "",
+                "Your account is now fully activated. You can start using the proxy.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 37. resend_verification
+const resendVerificationTool = {
+    name: "resend_verification",
+    description: "Resend the email verification code. Requires authentication.",
+    parameters: {},
+    execute: async () => {
+        try {
+            await apiPost("/api/auth/resend-verification");
+            return [
+                "Verification Email Resent",
+                "",
+                "A new verification code has been sent to your registered email address.",
+                "Use verify_email with the new code to complete verification.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 38. update_password
+const updatePasswordTool = {
+    name: "update_password",
+    description: "Change your account password. Requires your current password for verification.",
+    parameters: {
+        current_password: {
+            type: "string",
+            description: "Your current password (8-128 characters)",
+            required: true,
+        },
+        new_password: {
+            type: "string",
+            description: "Your new password (8-128 characters)",
+            required: true,
+        },
+    },
+    execute: async (args) => {
+        try {
+            const currentPassword = String(args.current_password ?? "");
+            if (currentPassword.length < 8 || currentPassword.length > 128) {
+                return "Error: Current password must be 8-128 characters.";
+            }
+            const newPassword = String(args.new_password ?? "");
+            if (newPassword.length < 8 || newPassword.length > 128) {
+                return "Error: New password must be 8-128 characters.";
+            }
+            await apiPost("/api/auth/change-password", {
+                currentPassword,
+                newPassword,
+            });
+            return [
+                "Password Updated Successfully",
+                "",
+                "Your password has been changed.",
+                "All existing sessions remain valid.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 39. list_keys
+const listKeysTool = {
+    name: "list_keys",
+    description: "List all your personal API keys. Shows key prefix, label, status, and creation date.",
+    parameters: {},
+    execute: async () => {
+        try {
+            const data = await apiGet("/api/keys");
+            const keys = data.keys ?? [];
+            if (keys.length === 0) {
+                return "No API keys found. Use create_key to create one.";
+            }
+            const lines = [`API Keys (${keys.length})`, ""];
+            for (const k of keys) {
+                const lastUsed = k.lastUsedAt ? ` | Last used: ${k.lastUsedAt}` : "";
+                lines.push(`  ${k.prefix}... | ${k.label} | ${k.status}${lastUsed}`);
+                lines.push(`    ID: ${k.id} | Created: ${k.createdAt}`);
+                lines.push("");
+            }
+            return truncate(lines.join("\n"));
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 40. create_key
+const createKeyTool = {
+    name: "create_key",
+    description: "Create a new personal API key. The full key is shown only once -- save it immediately.",
+    parameters: {
+        label: {
+            type: "string",
+            description: 'Label for the API key (e.g., "production", "dev")',
+            required: true,
+        },
+    },
+    execute: async (args) => {
+        try {
+            const label = String(args.label ?? "").trim();
+            if (!label || label.length === 0 || label.length > 100) {
+                return "Error: label is required and must be 1-100 characters.";
+            }
+            if (/[\x00-\x1f\x7f]/.test(label)) {
+                return "Error: label contains invalid control characters.";
+            }
+            const data = await apiPost("/api/keys", { label });
+            return [
+                "API Key Created",
+                "",
+                `Key ID: ${data.id}`,
+                `API Key: ${data.key}`,
+                `Prefix: ${data.prefix}`,
+                `Label: ${data.label}`,
+                `Created: ${data.createdAt}`,
+                "",
+                "IMPORTANT: Save this API key now -- it will not be shown again.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 41. revoke_key
+const revokeKeyTool = {
+    name: "revoke_key",
+    description: "Revoke (delete) a personal API key. This immediately invalidates the key.",
+    parameters: {
+        key_id: {
+            type: "string",
+            description: "API key ID (UUID) to revoke",
+            required: true,
+        },
+    },
+    execute: async (args) => {
+        try {
+            const keyId = validateUuid(String(args.key_id ?? ""), "key_id");
+            await apiDelete(`/api/keys/${encodeURIComponent(keyId)}`);
+            return [
+                "API Key Revoked",
+                "",
+                `Key ID: ${keyId}`,
+                "",
+                "The key has been permanently revoked and can no longer be used.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 42. get_plan
+const getPlanTool = {
+    name: "get_plan",
+    description: "Get your current plan details including limits, pricing, and features.",
+    parameters: {},
+    execute: async () => {
+        try {
+            const data = await apiGet("/api/plans/user/plan");
+            const lines = [
+                "Current Plan",
+                "",
+                `Plan: ${data.displayName ?? data.plan}`,
+                `Bandwidth Limit: ${data.bandwidthLimitBytes != null ? formatBytes(data.bandwidthLimitBytes) : "Unlimited"}`,
+                `Rate Limit: ${data.requestsPerMinute} req/min`,
+                `Max API Keys: ${data.maxApiKeys}`,
+                `Max Agentic Wallets: ${data.maxAgenticWallets}`,
+                `Max Teams: ${data.maxTeams}`,
+            ];
+            const features = data.features ?? [];
+            if (features.length > 0) {
+                lines.push("", "Features:");
+                for (const f of features) {
+                    lines.push(`  - ${f}`);
+                }
+            }
+            lines.push("", "Use list_plans to see available plan options.");
+            return lines.join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 43. list_plans
+const listPlansTool = {
+    name: "list_plans",
+    description: "List all available plans with pricing, limits, and features.",
+    parameters: {},
+    execute: async () => {
+        try {
+            const data = await apiGet("/api/plans");
+            const plans = data.plans ?? [];
+            if (plans.length === 0) {
+                return "No plans available.";
+            }
+            const lines = [`Available Plans (${plans.length})`, ""];
+            for (const p of plans) {
+                lines.push(`  ${p.displayName ?? p.name} ($${(p.priceMonthly / 100).toFixed(2)}/mo)`);
+                lines.push(`    Bandwidth: ${p.bandwidthLimitBytes != null ? formatBytes(p.bandwidthLimitBytes) : "Unlimited"} | Rate: ${p.requestsPerMinute} req/min | Keys: ${p.maxApiKeys}`);
+                if (p.features && p.features.length > 0) {
+                    lines.push(`    Features: ${p.features.join(", ")}`);
+                }
+                lines.push("");
+            }
+            lines.push("Use change_plan to switch plans.");
+            return truncate(lines.join("\n"));
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 44. change_plan
+const changePlanTool = {
+    name: "change_plan",
+    description: "Change your account plan. Use list_plans to see available options first.",
+    parameters: {
+        plan: {
+            type: "string",
+            description: "Plan name/ID to switch to",
+            required: true,
+        },
+    },
+    execute: async (args) => {
+        try {
+            const plan = String(args.plan ?? "").trim();
+            if (!plan || plan.length === 0 || plan.length > 100) {
+                return "Error: plan is required and must be 1-100 characters.";
+            }
+            if (/[\x00-\x1f\x7f]/.test(plan)) {
+                return "Error: plan name contains invalid control characters.";
+            }
+            const data = await apiPut("/api/plans/user/plan", { plan });
+            return [
+                "Plan Changed Successfully",
+                "",
+                `New Plan: ${data.displayName ?? data.plan}`,
+                `Effective: ${data.effectiveAt ?? "immediately"}`,
+                "",
+                "Use get_plan to view your updated plan details.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 45. team_delete
+const teamDeleteTool = {
+    name: "team_delete",
+    description: "Delete a team. Only the team owner can delete a team. Any remaining team balance is refunded.",
+    parameters: {
+        team_id: {
+            type: "string",
+            description: "Team ID (UUID) to delete",
+            required: true,
+        },
+    },
+    execute: async (args) => {
+        try {
+            const teamId = validateUuid(String(args.team_id ?? ""), "team_id");
+            await apiDelete(`/api/teams/${encodeURIComponent(teamId)}`);
+            return [
+                "Team Deleted",
+                "",
+                `Team ID: ${teamId}`,
+                "",
+                "The team has been permanently deleted.",
+                "Any remaining balance has been refunded to the owner's wallet.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 46. team_revoke_key
+const teamRevokeKeyTool = {
+    name: "team_revoke_key",
+    description: "Revoke a shared API key for a team. Only owners and admins can revoke keys.",
+    parameters: {
+        team_id: {
+            type: "string",
+            description: "Team ID (UUID)",
+            required: true,
+        },
+        key_id: {
+            type: "string",
+            description: "API key ID (UUID) to revoke",
+            required: true,
+        },
+    },
+    execute: async (args) => {
+        try {
+            const teamId = validateUuid(String(args.team_id ?? ""), "team_id");
+            const keyId = validateUuid(String(args.key_id ?? ""), "key_id");
+            await apiDelete(`/api/teams/${encodeURIComponent(teamId)}/keys/${encodeURIComponent(keyId)}`);
+            return [
+                "Team API Key Revoked",
+                "",
+                `Team ID: ${teamId}`,
+                `Key ID: ${keyId}`,
+                "",
+                "The key has been permanently revoked and can no longer be used.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 47. team_list_keys
+const teamListKeysTool = {
+    name: "team_list_keys",
+    description: "List all API keys for a team. Shows key prefix, label, status, and creation date.",
+    parameters: {
+        team_id: {
+            type: "string",
+            description: "Team ID (UUID)",
+            required: true,
+        },
+    },
+    execute: async (args) => {
+        try {
+            const teamId = validateUuid(String(args.team_id ?? ""), "team_id");
+            const data = await apiGet(`/api/teams/${encodeURIComponent(teamId)}/keys`);
+            const keys = data.keys ?? [];
+            if (keys.length === 0) {
+                return "No API keys found for this team. Use team_create_key to create one.";
+            }
+            const lines = [`Team API Keys (${keys.length})`, ""];
+            for (const k of keys) {
+                const lastUsed = k.lastUsedAt ? ` | Last used: ${k.lastUsedAt}` : "";
+                lines.push(`  ${k.prefix}... | ${k.label} | ${k.status}${lastUsed}`);
+                lines.push(`    ID: ${k.id} | Created: ${k.createdAt}`);
+                lines.push("");
+            }
+            return truncate(lines.join("\n"));
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 48. team_list_members
+const teamListMembersTool = {
+    name: "team_list_members",
+    description: "List all members of a team with their roles and join dates.",
+    parameters: {
+        team_id: {
+            type: "string",
+            description: "Team ID (UUID)",
+            required: true,
+        },
+    },
+    execute: async (args) => {
+        try {
+            const teamId = validateUuid(String(args.team_id ?? ""), "team_id");
+            const data = await apiGet(`/api/teams/${encodeURIComponent(teamId)}/members`);
+            const members = data.members ?? [];
+            if (members.length === 0) {
+                return "No members found in this team.";
+            }
+            const lines = [`Team Members (${members.length})`, ""];
+            for (const m of members) {
+                lines.push(`  ${m.email} | ${m.role} | Joined: ${m.joinedAt}`);
+                lines.push(`    User ID: ${m.userId}`);
+                lines.push("");
+            }
+            return truncate(lines.join("\n"));
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 49. team_add_member
+const teamAddMemberTool = {
+    name: "team_add_member",
+    description: "Add a member directly to a team by user ID. Only owners and admins can add members.",
+    parameters: {
+        team_id: {
+            type: "string",
+            description: "Team ID (UUID)",
+            required: true,
+        },
+        user_id: {
+            type: "string",
+            description: "User ID (UUID) of the person to add",
+            required: true,
+        },
+        role: {
+            type: "string",
+            description: "Role for the new member",
+            required: false,
+            enum: ["member", "admin"],
+            default: "member",
+        },
+    },
+    execute: async (args) => {
+        try {
+            const teamId = validateUuid(String(args.team_id ?? ""), "team_id");
+            const userId = validateUuid(String(args.user_id ?? ""), "user_id");
+            const role = String(args.role ?? "member").trim();
+            if (role !== "member" && role !== "admin") {
+                return "Error: role must be 'member' or 'admin'.";
+            }
+            const data = await apiPost(`/api/teams/${encodeURIComponent(teamId)}/members`, {
+                userId,
+                role,
+            });
+            return [
+                "Team Member Added",
+                "",
+                `Team ID: ${data.teamId ?? teamId}`,
+                `User ID: ${data.userId ?? userId}`,
+                `Role: ${data.role ?? role}`,
+                `Joined: ${data.joinedAt ?? "now"}`,
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 50. team_remove_member
+const teamRemoveMemberTool = {
+    name: "team_remove_member",
+    description: "Remove a member from a team. Only owners and admins can remove members.",
+    parameters: {
+        team_id: {
+            type: "string",
+            description: "Team ID (UUID)",
+            required: true,
+        },
+        user_id: {
+            type: "string",
+            description: "User ID (UUID) of the member to remove",
+            required: true,
+        },
+    },
+    execute: async (args) => {
+        try {
+            const teamId = validateUuid(String(args.team_id ?? ""), "team_id");
+            const userId = validateUuid(String(args.user_id ?? ""), "user_id");
+            await apiDelete(`/api/teams/${encodeURIComponent(teamId)}/members/${encodeURIComponent(userId)}`);
+            return [
+                "Team Member Removed",
+                "",
+                `Team ID: ${teamId}`,
+                `User ID: ${userId}`,
+                "",
+                "The member has been removed from the team.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 51. team_invite_member
+const teamInviteMemberTool = {
+    name: "team_invite_member",
+    description: "Send an invitation to join a team by email. The invitee receives an email with a link to accept.",
+    parameters: {
+        team_id: {
+            type: "string",
+            description: "Team ID (UUID)",
+            required: true,
+        },
+        email: {
+            type: "string",
+            description: "Email address of the person to invite",
+            required: true,
+        },
+        role: {
+            type: "string",
+            description: "Role for the invited member",
+            required: false,
+            enum: ["member", "admin"],
+            default: "member",
+        },
+    },
+    execute: async (args) => {
+        try {
+            const teamId = validateUuid(String(args.team_id ?? ""), "team_id");
+            const email = String(args.email ?? "").trim();
+            if (!email || !EMAIL_RE.test(email)) {
+                return "Error: A valid email address is required.";
+            }
+            if (email.length > 254) {
+                return "Error: Email address is too long (max 254 characters).";
+            }
+            const role = String(args.role ?? "member").trim();
+            if (role !== "member" && role !== "admin") {
+                return "Error: role must be 'member' or 'admin'.";
+            }
+            const data = await apiPost(`/api/teams/${encodeURIComponent(teamId)}/invites`, {
+                email,
+                role,
+            });
+            return [
+                "Team Invitation Sent",
+                "",
+                `Invite ID: ${data.id}`,
+                `Team ID: ${data.teamId ?? teamId}`,
+                `Email: ${data.email ?? email}`,
+                `Role: ${data.role ?? role}`,
+                `Status: ${data.status ?? "pending"}`,
+                `Expires: ${data.expiresAt}`,
+                "",
+                "The invitee will receive an email with instructions to accept.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 52. team_list_invites
+const teamListInvitesTool = {
+    name: "team_list_invites",
+    description: "List all pending invitations for a team.",
+    parameters: {
+        team_id: {
+            type: "string",
+            description: "Team ID (UUID)",
+            required: true,
+        },
+    },
+    execute: async (args) => {
+        try {
+            const teamId = validateUuid(String(args.team_id ?? ""), "team_id");
+            const data = await apiGet(`/api/teams/${encodeURIComponent(teamId)}/invites`);
+            const invites = data.invites ?? [];
+            if (invites.length === 0) {
+                return "No pending invitations for this team.";
+            }
+            const lines = [`Team Invitations (${invites.length})`, ""];
+            for (const inv of invites) {
+                lines.push(`  ${inv.email} | ${inv.role} | ${inv.status}`);
+                lines.push(`    ID: ${inv.id} | Expires: ${inv.expiresAt}`);
+                lines.push("");
+            }
+            return truncate(lines.join("\n"));
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// 53. team_cancel_invite
+const teamCancelInviteTool = {
+    name: "team_cancel_invite",
+    description: "Cancel a pending team invitation. Only owners and admins can cancel invites.",
+    parameters: {
+        team_id: {
+            type: "string",
+            description: "Team ID (UUID)",
+            required: true,
+        },
+        invite_id: {
+            type: "string",
+            description: "Invite ID (UUID) to cancel",
+            required: true,
+        },
+    },
+    execute: async (args) => {
+        try {
+            const teamId = validateUuid(String(args.team_id ?? ""), "team_id");
+            const inviteId = validateUuid(String(args.invite_id ?? ""), "invite_id");
+            await apiDelete(`/api/teams/${encodeURIComponent(teamId)}/invites/${encodeURIComponent(inviteId)}`);
+            return [
+                "Team Invitation Cancelled",
+                "",
+                `Team ID: ${teamId}`,
+                `Invite ID: ${inviteId}`,
+                "",
+                "The invitation has been cancelled.",
+            ].join("\n");
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// ---------------------------------------------------------------------------
+// MPP (Machine Payment Protocol) tools
+// ---------------------------------------------------------------------------
+const mppInfoTool = {
+    name: "mpp_info",
+    description: "Get Machine Payment Protocol (MPP) information including enabled status, " +
+        "supported payment methods, pricing, and session limits.",
+    parameters: {},
+    execute: async () => {
+        try {
+            const data = await apiGet("/api/mpp/info");
+            return JSON.stringify(data, null, 2);
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+const payMppTool = {
+    name: "pay_mpp",
+    description: "Top up wallet via Machine Payment Protocol (MPP). " +
+        "Supports tempo, stripe_spt, and lightning payment methods.",
+    parameters: {
+        amount_cents: {
+            type: "number",
+            description: "Amount in cents to top up (min 500 = $5, max 100000 = $1,000)",
+            required: true,
+        },
+        method: {
+            type: "string",
+            description: "MPP payment method",
+            required: true,
+            enum: ["tempo", "stripe_spt", "lightning"],
+        },
+    },
+    execute: async (args) => {
+        const amountCents = Number(args.amount_cents);
+        const method = String(args.method ?? "");
+        if (!Number.isInteger(amountCents) ||
+            amountCents < 500 ||
+            amountCents > 100_000) {
+            return "Error: amount_cents must be an integer between 500 and 100,000";
+        }
+        if (!["tempo", "stripe_spt", "lightning"].includes(method)) {
+            return "Error: method must be one of: tempo, stripe_spt, lightning";
+        }
+        try {
+            const data = await apiPost("/api/mpp/topup", {
+                amountCents,
+                method,
+            });
+            return JSON.stringify(data, null, 2);
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+const mppSessionOpenTool = {
+    name: "mpp_session_open",
+    description: "Open a pay-as-you-go MPP session. Returns a channelId for metered proxy usage.",
+    parameters: {
+        max_deposit_cents: {
+            type: "number",
+            description: "Maximum deposit in cents (min 500, max 100000)",
+            required: true,
+        },
+        method: {
+            type: "string",
+            description: "MPP payment method",
+            required: true,
+            enum: ["tempo", "stripe_spt", "lightning"],
+        },
+        pool_type: {
+            type: "string",
+            description: "Proxy pool type: dc ($3/GB) or residential ($5/GB)",
+            default: "dc",
+            enum: ["dc", "residential"],
+        },
+    },
+    execute: async (args) => {
+        const maxDepositCents = Number(args.max_deposit_cents);
+        const method = String(args.method ?? "");
+        const poolType = String(args.pool_type ?? "dc");
+        if (!Number.isInteger(maxDepositCents) ||
+            maxDepositCents < 500 ||
+            maxDepositCents > 100_000) {
+            return "Error: max_deposit_cents must be an integer between 500 and 100,000";
+        }
+        if (!["tempo", "stripe_spt", "lightning"].includes(method)) {
+            return "Error: method must be one of: tempo, stripe_spt, lightning";
+        }
+        if (!["dc", "residential"].includes(poolType)) {
+            return "Error: pool_type must be dc or residential";
+        }
+        try {
+            const data = await apiPost("/api/mpp/session/open", { maxDepositCents, method, poolType });
+            return JSON.stringify(data, null, 2);
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+const mppSessionCloseTool = {
+    name: "mpp_session_close",
+    description: "Close an MPP pay-as-you-go session. Returns the amount spent and refunded.",
+    parameters: {
+        channel_id: {
+            type: "string",
+            description: "The channelId returned from mpp_session_open",
+            required: true,
+        },
+    },
+    execute: async (args) => {
+        const channelId = String(args.channel_id ?? "");
+        if (!channelId) {
+            return "Error: channel_id is required";
+        }
+        try {
+            const data = await apiPost("/api/mpp/session/close", { channelId });
+            return JSON.stringify(data, null, 2);
+        }
+        catch (err) {
+            return `Error: ${safeError(err)}`;
+        }
+    },
+};
+// ---------------------------------------------------------------------------
+// Plugin export — the tools array that OpenClaw discovers
+// ---------------------------------------------------------------------------
+export const tools = [
+    // Proxy (3)
+    proxiedFetchTool,
+    getProxyConfigTool,
+    getProxyStatusTool,
+    // Sessions (1)
+    listSessionsTool,
+    // Wallet (8)
+    checkBalanceTool,
+    getTransactionsTool,
+    getForecastTool,
+    topupPaypalTool,
+    topupStripeTool,
+    topupCryptoTool,
+    checkPaymentTool,
+    x402InfoTool,
+    // Usage (3)
+    checkUsageTool,
+    getDailyUsageTool,
+    getTopHostsTool,
+    // Account (6)
+    registerTool,
+    loginTool,
+    getAccountInfoTool,
+    verifyEmailTool,
+    resendVerificationTool,
+    updatePasswordTool,
+    // API Keys (3)
+    listKeysTool,
+    createKeyTool,
+    revokeKeyTool,
+    // Plans (3)
+    getPlanTool,
+    listPlansTool,
+    changePlanTool,
+    // Agentic Wallets (9)
+    createAgenticWalletTool,
+    fundAgenticWalletTool,
+    checkAgenticBalanceTool,
+    listAgenticWalletsTool,
+    agenticTransactionsTool,
+    freezeAgenticWalletTool,
+    unfreezeAgenticWalletTool,
+    deleteAgenticWalletTool,
+    updateWalletPolicyTool,
+    // Teams (17)
+    createTeamTool,
+    listTeamsTool,
+    teamDetailsTool,
+    updateTeamTool,
+    teamDeleteTool,
+    teamFundTool,
+    teamCreateKeyTool,
+    teamRevokeKeyTool,
+    teamListKeysTool,
+    teamUsageTool,
+    teamListMembersTool,
+    teamAddMemberTool,
+    teamRemoveMemberTool,
+    updateTeamMemberRoleTool,
+    teamInviteMemberTool,
+    teamListInvitesTool,
+    teamCancelInviteTool,
+    // MPP (4)
+    mppInfoTool,
+    payMppTool,
+    mppSessionOpenTool,
+    mppSessionCloseTool,
 ];
 /**
  * Plugin metadata for OpenClaw discovery.