@dominusnode/pi-extension 1.1.0 → 1.3.0

package/dist/toolkit.js

@@ -2,7 +2,7 @@
 /**
  * Dominus Node Pi Extension Toolkit
  *
- * Provides 26 tools for the pi-mono agent framework (github.com/badlogic/pi-mono).
+ * Provides 53 tools for the pi-mono agent framework (github.com/badlogic/pi-mono).
  * Covers proxied fetching, wallet management, agentic wallets, teams,
  * Stripe/PayPal/crypto top-up, and x402 micropayment info.
  *
@@ -65,6 +65,7 @@ exports.checkDnsRebinding = checkDnsRebinding;
 exports.stripDangerousKeys = stripDangerousKeys;
 exports.formatBytes = formatBytes;
 exports.formatCents = formatCents;
+const crypto = __importStar(require("node:crypto"));
 const http = __importStar(require("node:http"));
 const tls = __importStar(require("node:tls"));
 const dns = __importStar(require("dns/promises"));
@@ -97,7 +98,7 @@ exports.BLOCKED_HOSTNAMES = new Set([
 // ---------------------------------------------------------------------------
 /** Remove any dn_live_* or dn_test_* tokens from error messages. */
 function scrubCredentials(msg) {
-    return msg.replace(/dn_(live|test)_[A-Za-z0-9_-]+/g, "dn_$1_***REDACTED***");
+    return msg.replace(/dn_(live|test|proxy)_[A-Za-z0-9_-]+/g, "dn_$1_***REDACTED***");
 }
 function safeError(err) {
     const raw = err instanceof Error ? err.message : String(err);
@@ -109,7 +110,8 @@ function safeError(err) {
 function truncate(text, max = MAX_RESPONSE_CHARS) {
     if (text.length <= max)
         return text;
-    return text.slice(0, max) + `\n\n... [truncated, ${text.length - max} chars omitted]`;
+    return (text.slice(0, max) +
+        `\n\n... [truncated, ${text.length - max} chars omitted]`);
 }
 // ---------------------------------------------------------------------------
 // SSRF Protection
@@ -270,7 +272,9 @@ function validateTargetUrl(url) {
     if (hostname.endsWith(".localhost")) {
         throw new Error("Requests to localhost/loopback addresses are blocked");
     }
-    if (hostname.endsWith(".local") || hostname.endsWith(".internal") || hostname.endsWith(".arpa")) {
+    if (hostname.endsWith(".local") ||
+        hostname.endsWith(".internal") ||
+        hostname.endsWith(".arpa")) {
         throw new Error("Requests to internal network hostnames are blocked");
     }
     return parsed;
@@ -306,11 +310,15 @@ async function checkDnsRebinding(hostname) {
     try {
         resolvedIps.push(...(await dns.resolve4(stripped)));
     }
-    catch { /* NODATA/NXDOMAIN for A is fine */ }
+    catch {
+        /* NODATA/NXDOMAIN for A is fine */
+    }
     try {
         resolvedIps.push(...(await dns.resolve6(stripped)));
     }
-    catch { /* NODATA/NXDOMAIN for AAAA is fine */ }
+    catch {
+        /* NODATA/NXDOMAIN for AAAA is fine */
+    }
     for (const ip of resolvedIps) {
         if (isPrivateIp(ip)) {
             throw new Error(`DNS rebinding detected: hostname resolves to private IP ${ip}`);
@@ -388,7 +396,9 @@ class DominusNodeToolkit {
     constructor(options = {}) {
         this.apiKey = options.apiKey || process.env["DOMINUSNODE_API_KEY"] || "";
         // H-6: Validate baseUrl
-        const rawBase = (options.baseUrl || process.env["DOMINUSNODE_BASE_URL"] || "https://api.dominusnode.com").replace(/\/+$/, "");
+        const rawBase = (options.baseUrl ||
+            process.env["DOMINUSNODE_BASE_URL"] ||
+            "https://api.dominusnode.com").replace(/\/+$/, "");
         try {
             const parsedBase = new URL(rawBase);
             if (parsedBase.protocol !== "https:" && parsedBase.protocol !== "http:")
@@ -396,7 +406,9 @@ class DominusNodeToolkit {
             if (parsedBase.username || parsedBase.password)
                 throw new Error("embedded credentials not allowed in base URL");
             // H-1: Warn on HTTP base URL in production
-            if (parsedBase.protocol === "http:" && parsedBase.hostname !== "localhost" && parsedBase.hostname !== "127.0.0.1") {
+            if (parsedBase.protocol === "http:" &&
+                parsedBase.hostname !== "localhost" &&
+                parsedBase.hostname !== "127.0.0.1") {
                 console.warn("[DominusNode] WARNING: baseUrl uses HTTP — API key will be sent unencrypted");
             }
         }
@@ -405,21 +417,81 @@ class DominusNodeToolkit {
         }
         this.baseUrl = rawBase;
         // H-2: Validate proxyHost against private/internal IPs
-        const rawProxyHost = options.proxyHost || process.env["DOMINUSNODE_PROXY_HOST"] || "proxy.dominusnode.com";
-        if (exports.BLOCKED_HOSTNAMES.has(rawProxyHost.toLowerCase()) || isPrivateIp(rawProxyHost)) {
+        const rawProxyHost = options.proxyHost ||
+            process.env["DOMINUSNODE_PROXY_HOST"] ||
+            "proxy.dominusnode.com";
+        if (exports.BLOCKED_HOSTNAMES.has(rawProxyHost.toLowerCase()) ||
+            isPrivateIp(rawProxyHost)) {
             throw new Error("DOMINUSNODE_PROXY_HOST must not be a private or loopback address");
         }
-        if (rawProxyHost.endsWith(".localhost") || rawProxyHost.endsWith(".local") ||
-            rawProxyHost.endsWith(".internal") || rawProxyHost.endsWith(".arpa")) {
+        if (rawProxyHost.endsWith(".localhost") ||
+            rawProxyHost.endsWith(".local") ||
+            rawProxyHost.endsWith(".internal") ||
+            rawProxyHost.endsWith(".arpa")) {
             throw new Error("DOMINUSNODE_PROXY_HOST must not use internal network TLDs");
         }
         this.proxyHost = rawProxyHost;
         const portVal = Number(options.proxyPort ?? process.env["DOMINUSNODE_PROXY_PORT"] ?? 8080);
-        this.proxyPort = isNaN(portVal) || portVal < 1 || portVal > 65535 ? 8080 : portVal;
+        this.proxyPort =
+            isNaN(portVal) || portVal < 1 || portVal > 65535 ? 8080 : portVal;
         // H-2: Validate timeout option; store but use REQUEST_TIMEOUT_MS constant for requests
         const tVal = Number(options.timeout ?? 30000);
-        this.timeout = Number.isFinite(tVal) && tVal >= 1000 && tVal <= 120000 ? tVal : 30000;
-        this.agentSecret = options.agentSecret || process.env["DOMINUSNODE_AGENT_SECRET"];
+        this.timeout =
+            Number.isFinite(tVal) && tVal >= 1000 && tVal <= 120000 ? tVal : 30000;
+        this.agentSecret =
+            options.agentSecret || process.env["DOMINUSNODE_AGENT_SECRET"];
+    }
+    // -----------------------------------------------------------------------
+    // SHA-256 Proof-of-Work solver
+    // -----------------------------------------------------------------------
+    static _countLeadingZeroBits(buf) {
+        let count = 0;
+        for (const byte of buf) {
+            if (byte === 0) {
+                count += 8;
+                continue;
+            }
+            let mask = 0x80;
+            while (mask && !(byte & mask)) {
+                count++;
+                mask >>= 1;
+            }
+            break;
+        }
+        return count;
+    }
+    async _solvePoW() {
+        try {
+            const resp = await fetch(`${this.baseUrl}/api/auth/pow/challenge`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                redirect: "error",
+            });
+            if (!resp.ok)
+                return null;
+            const text = await resp.text();
+            if (text.length > 10_485_760)
+                return null;
+            const challenge = JSON.parse(text);
+            const prefix = challenge.prefix ?? "";
+            const difficulty = challenge.difficulty ?? 20;
+            const challengeId = challenge.challengeId ?? "";
+            if (!prefix || !challengeId)
+                return null;
+            for (let nonce = 0; nonce < 100_000_000; nonce++) {
+                const hash = crypto
+                    .createHash("sha256")
+                    .update(prefix + nonce.toString())
+                    .digest();
+                if (DominusNodeToolkit._countLeadingZeroBits(hash) >= difficulty) {
+                    return { challengeId, nonce: nonce.toString() };
+                }
+            }
+            return null;
+        }
+        catch {
+            return null;
+        }
     }
     // -----------------------------------------------------------------------
     // Authentication
@@ -427,7 +499,8 @@ class DominusNodeToolkit {
     async _authenticate() {
         if (!this.apiKey)
             throw new Error("Dominus Node API key is required. Set DOMINUSNODE_API_KEY env var.");
-        if (!this.apiKey.startsWith("dn_live_") && !this.apiKey.startsWith("dn_test_")) {
+        if (!this.apiKey.startsWith("dn_live_") &&
+            !this.apiKey.startsWith("dn_test_")) {
             throw new Error('DOMINUSNODE_API_KEY must start with "dn_live_" or "dn_test_".');
         }
         const authHeaders = {
@@ -461,7 +534,9 @@ class DominusNodeToolkit {
                         parts.push(value);
                     }
                 }
-                catch { /* ignore */ }
+                catch {
+                    /* ignore */
+                }
                 reader.cancel().catch(() => { });
                 errorText = Buffer.concat(parts).toString("utf-8").slice(0, 500);
             }
@@ -473,7 +548,9 @@ class DominusNodeToolkit {
             throw new Error("Auth response too large");
         const data = JSON.parse(rawText);
         stripDangerousKeys(data);
-        if (!data.token || typeof data.token !== "string" || data.token.length > 4096) {
+        if (!data.token ||
+            typeof data.token !== "string" ||
+            data.token.length > 4096) {
             throw new Error("Invalid token in auth response");
         }
         this.token = data.token;
@@ -489,8 +566,13 @@ class DominusNodeToolkit {
             return;
         }
         this._authPromise = this._authenticate()
-            .then(() => { this._authPromise = null; })
-            .catch((e) => { this._authPromise = null; throw e; });
+            .then(() => {
+            this._authPromise = null;
+        })
+            .catch((e) => {
+            this._authPromise = null;
+            throw e;
+        });
         await this._authPromise;
     }
     async _apiRequest(method, path, body) {
@@ -505,9 +587,16 @@ class DominusNodeToolkit {
             headers["X-DominusNode-Agent"] = "mcp";
             headers["X-DominusNode-Agent-Secret"] = this.agentSecret;
         }
-        const init = { method, headers, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS), redirect: "error" };
+        const init = {
+            method,
+            headers,
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+            redirect: "error",
+        };
         // M-6: Drop body on safe HTTP methods
-        if (body && !["GET", "HEAD"].includes(method) && ["POST", "PUT", "PATCH", "DELETE"].includes(method)) {
+        if (body &&
+            !["GET", "HEAD"].includes(method) &&
+            ["POST", "PUT", "PATCH", "DELETE"].includes(method)) {
             headers["Content-Type"] = "application/json";
             init.body = JSON.stringify(body);
         }
@@ -617,11 +706,18 @@ class DominusNodeToolkit {
                     reject(new Error("Proxy request timed out"));
                 }, REQUEST_TIMEOUT_MS);
                 if (parsed.protocol === "https:") {
-                    const connectHost = parsed.hostname.includes(":") ? `[${parsed.hostname}]` : parsed.hostname;
+                    const connectHost = parsed.hostname.includes(":")
+                        ? `[${parsed.hostname}]`
+                        : parsed.hostname;
                     const connectReq = http.request({
-                        hostname: this.proxyHost, port: this.proxyPort, method: "CONNECT",
+                        hostname: this.proxyHost,
+                        port: this.proxyPort,
+                        method: "CONNECT",
                         path: `${connectHost}:${parsed.port || 443}`,
-                        headers: { "Proxy-Authorization": proxyAuth, Host: `${connectHost}:${parsed.port || 443}` },
+                        headers: {
+                            "Proxy-Authorization": proxyAuth,
+                            Host: `${connectHost}:${parsed.port || 443}`,
+                        },
                     });
                     cleanupFn = () => connectReq.destroy();
                     connectReq.on("connect", (_res, sock) => {
@@ -631,7 +727,12 @@ class DominusNodeToolkit {
                             reject(new Error(`CONNECT failed: ${_res.statusCode}`));
                             return;
                         }
-                        const tlsSock = tls.connect({ host: parsed.hostname, socket: sock, servername: parsed.hostname, minVersion: "TLSv1.2" }, () => {
+                        const tlsSock = tls.connect({
+                            host: parsed.hostname,
+                            socket: sock,
+                            servername: parsed.hostname,
+                            minVersion: "TLSv1.2",
+                        }, () => {
                             const reqLine = `${methodUpper} ${parsed.pathname + parsed.search} HTTP/1.1\r\nHost: ${parsed.host}\r\nUser-Agent: dominusnode-pi/1.0.0\r\nConnection: close\r\n\r\n`;
                             tlsSock.write(reqLine);
                             const chunks = [];
@@ -657,27 +758,47 @@ class DominusNodeToolkit {
                                     return;
                                 }
                                 const hdr = raw.substring(0, hEnd);
-                                const body = raw.substring(hEnd + 4).substring(0, MAX_PROXY_RESPONSE_BYTES);
-                                const sm = hdr.split("\r\n")[0].match(/^HTTP\/\d\.\d\s+(\d+)/);
+                                const body = raw
+                                    .substring(hEnd + 4)
+                                    .substring(0, MAX_PROXY_RESPONSE_BYTES);
+                                const sm = hdr
+                                    .split("\r\n")[0]
+                                    .match(/^HTTP\/\d\.\d\s+(\d+)/);
                                 resolve({ status: sm ? parseInt(sm[1], 10) : 0, body });
                             };
                             tlsSock.on("end", fin);
                             tlsSock.on("close", fin);
-                            tlsSock.on("error", (e) => { clearTimeout(timer); reject(e); });
+                            tlsSock.on("error", (e) => {
+                                clearTimeout(timer);
+                                reject(e);
+                            });
                         });
                         // M-1: Update cleanupFn to destroy tlsSock — covers the TLS handshake window
                         cleanupFn = () => tlsSock.destroy();
-                        tlsSock.on("error", (e) => { clearTimeout(timer); reject(e); });
+                        tlsSock.on("error", (e) => {
+                            clearTimeout(timer);
+                            reject(e);
+                        });
+                    });
+                    connectReq.on("error", (e) => {
+                        clearTimeout(timer);
+                        reject(e);
                     });
-                    connectReq.on("error", (e) => { clearTimeout(timer); reject(e); });
                     connectReq.end();
                 }
                 else {
                     const reqPath = parsed.pathname + parsed.search;
                     const proxyReq = http.request({
-                        hostname: this.proxyHost, port: this.proxyPort, method: methodUpper,
+                        hostname: this.proxyHost,
+                        port: this.proxyPort,
+                        method: methodUpper,
                         path: `http://${parsed.host}${reqPath}`,
-                        headers: { "Proxy-Authorization": proxyAuth, Host: parsed.host, "User-Agent": "dominusnode-pi/1.0.0", Connection: "close" },
+                        headers: {
+                            "Proxy-Authorization": proxyAuth,
+                            Host: parsed.host,
+                            "User-Agent": "dominusnode-pi/1.0.0",
+                            Connection: "close",
+                        },
                     });
                     cleanupFn = () => proxyReq.destroy(); // H-3: destroy on timeout
                     const chunks = [];
@@ -691,10 +812,22 @@ class DominusNodeToolkit {
                             } // H-4: destroy on oversize
                             chunks.push(c);
                         });
-                        r.on("end", () => { clearTimeout(timer); const body = Buffer.concat(chunks).toString("utf-8").substring(0, MAX_PROXY_RESPONSE_BYTES); resolve({ status: r.statusCode ?? 0, body }); });
-                        r.on("error", (e) => { clearTimeout(timer); reject(e); });
+                        r.on("end", () => {
+                            clearTimeout(timer);
+                            const body = Buffer.concat(chunks)
+                                .toString("utf-8")
+                                .substring(0, MAX_PROXY_RESPONSE_BYTES);
+                            resolve({ status: r.statusCode ?? 0, body });
+                        });
+                        r.on("error", (e) => {
+                            clearTimeout(timer);
+                            reject(e);
+                        });
+                    });
+                    proxyReq.on("error", (e) => {
+                        clearTimeout(timer);
+                        reject(e);
                     });
-                    proxyReq.on("error", (e) => { clearTimeout(timer); reject(e); });
                     proxyReq.end();
                 }
             });
@@ -789,7 +922,7 @@ class DominusNodeToolkit {
             const amount = Math.floor(Number(amountCents));
             if (isNaN(amount) || amount < 1 || amount > 1000000)
                 return err("amountCents must be between 1 and 1,000,000");
-            const data = await this._req("POST", `/api/agent-wallet/${id}/fund`, { amountCents: amount });
+            const data = await this._req("POST", `/api/agent-wallet/${encodeURIComponent(id)}/fund`, { amountCents: amount });
             return ok(JSON.stringify(data, null, 2));
         }
         catch (e) {
@@ -802,7 +935,7 @@ class DominusNodeToolkit {
     async checkAgenticBalance(walletId) {
         try {
             const id = validateUuid(walletId, "walletId");
-            const data = await this._req("GET", `/api/agent-wallet/${id}`);
+            const data = await this._req("GET", `/api/agent-wallet/${encodeURIComponent(id)}`);
             return ok(JSON.stringify(data, null, 2));
         }
         catch (e) {
@@ -831,7 +964,7 @@ class DominusNodeToolkit {
             if (!Number.isFinite(rawLim))
                 return err("limit must be a finite number");
             const lim = Math.max(1, Math.min(100, Math.floor(rawLim)));
-            const data = await this._req("GET", `/api/agent-wallet/${id}/transactions?limit=${lim}`);
+            const data = await this._req("GET", `/api/agent-wallet/${encodeURIComponent(id)}/transactions?limit=${lim}`);
             return ok(JSON.stringify(data, null, 2));
         }
         catch (e) {
@@ -844,7 +977,7 @@ class DominusNodeToolkit {
     async freezeAgenticWallet(walletId) {
         try {
             const id = validateUuid(walletId, "walletId");
-            const data = await this._req("POST", `/api/agent-wallet/${id}/freeze`);
+            const data = await this._req("POST", `/api/agent-wallet/${encodeURIComponent(id)}/freeze`);
             return ok(JSON.stringify(data, null, 2));
         }
         catch (e) {
@@ -857,7 +990,7 @@ class DominusNodeToolkit {
     async unfreezeAgenticWallet(walletId) {
         try {
             const id = validateUuid(walletId, "walletId");
-            const data = await this._req("POST", `/api/agent-wallet/${id}/unfreeze`);
+            const data = await this._req("POST", `/api/agent-wallet/${encodeURIComponent(id)}/unfreeze`);
             return ok(JSON.stringify(data, null, 2));
         }
         catch (e) {
@@ -870,7 +1003,7 @@ class DominusNodeToolkit {
     async deleteAgenticWallet(walletId) {
         try {
             const id = validateUuid(walletId, "walletId");
-            const data = await this._req("DELETE", `/api/agent-wallet/${id}`);
+            const data = await this._req("DELETE", `/api/agent-wallet/${encodeURIComponent(id)}`);
             return ok(JSON.stringify(data, null, 2));
         }
         catch (e) {
@@ -888,7 +1021,10 @@ class DominusNodeToolkit {
             const max = Math.max(1, Math.min(100, Math.floor(Number(maxMembers))));
             if (isNaN(max))
                 return err("maxMembers must be a number between 1 and 100");
-            const data = await this._req("POST", "/api/teams", { name: name.trim(), maxMembers: max });
+            const data = await this._req("POST", "/api/teams", {
+                name: name.trim(),
+                maxMembers: max,
+            });
             return ok(JSON.stringify(data, null, 2));
         }
         catch (e) {
@@ -917,7 +1053,7 @@ class DominusNodeToolkit {
     async teamDetails(teamId) {
         try {
             const id = validateUuid(teamId, "teamId");
-            const data = await this._req("GET", `/api/teams/${id}`);
+            const data = await this._req("GET", `/api/teams/${encodeURIComponent(id)}`);
             return ok(JSON.stringify(data, null, 2));
         }
         catch (e) {
@@ -933,7 +1069,7 @@ class DominusNodeToolkit {
             const amount = Math.floor(Number(amountCents));
             if (isNaN(amount) || amount < 1 || amount > 1000000)
                 return err("amountCents must be between 1 and 1,000,000");
-            const data = await this._req("POST", `/api/teams/${id}/wallet/fund`, { amountCents: amount });
+            const data = await this._req("POST", `/api/teams/${encodeURIComponent(id)}/wallet/fund`, { amountCents: amount });
             return ok(JSON.stringify(data, null, 2));
         }
         catch (e) {
@@ -949,8 +1085,9 @@ class DominusNodeToolkit {
             const labelErr = validateLabel(label);
             if (labelErr)
                 return err(labelErr);
-            const data = await this._req("POST", `/api/teams/${id}/keys`, { label: label.trim() });
-            return ok(JSON.stringify(data, null, 2) + "\n\nIMPORTANT: Store this API key securely — it will not be shown again.");
+            const data = await this._req("POST", `/api/teams/${encodeURIComponent(id)}/keys`, { label: label.trim() });
+            return ok(JSON.stringify(data, null, 2) +
+                "\n\nIMPORTANT: Store this API key securely — it will not be shown again.");
         }
         catch (e) {
             return err(e);
@@ -968,7 +1105,7 @@ class DominusNodeToolkit {
             const d = Math.max(1, Math.min(365, Math.floor(rawDays)));
             const until = new Date().toISOString();
             const since = new Date(Date.now() - d * 86400000).toISOString();
-            const data = await this._req("GET", `/api/teams/${id}/usage?since=${encodeURIComponent(since)}&until=${encodeURIComponent(until)}`);
+            const data = await this._req("GET", `/api/teams/${encodeURIComponent(id)}/usage?since=${encodeURIComponent(since)}&until=${encodeURIComponent(until)}`);
             return ok(JSON.stringify(data, null, 2));
         }
         catch (e) {
@@ -996,7 +1133,7 @@ class DominusNodeToolkit {
             }
             if (!Object.keys(body).length)
                 return err("At least one of name or maxMembers must be provided");
-            const data = await this._req("PATCH", `/api/teams/${id}`, body);
+            const data = await this._req("PATCH", `/api/teams/${encodeURIComponent(id)}`, body);
             return ok(JSON.stringify(data, null, 2));
         }
         catch (e) {
@@ -1027,7 +1164,9 @@ class DominusNodeToolkit {
             const amount = Math.floor(Number(amountCents));
             if (isNaN(amount) || amount < 500 || amount > 1000000)
                 return err("amountCents must be between 500 ($5.00) and 1,000,000 ($10,000.00)");
-            const data = await this._req("POST", "/api/wallet/topup/paypal", { amountCents: amount });
+            const data = await this._req("POST", "/api/wallet/topup/paypal", {
+                amountCents: amount,
+            });
             return ok(JSON.stringify(data, null, 2));
         }
         catch (e) {
@@ -1042,7 +1181,9 @@ class DominusNodeToolkit {
             const amount = Math.floor(Number(amountCents));
             if (isNaN(amount) || amount < 500 || amount > 1000000)
                 return err("amountCents must be between 500 ($5.00) and 1,000,000 ($10,000.00)");
-            const data = await this._req("POST", "/api/wallet/topup/stripe", { amountCents: amount });
+            const data = await this._req("POST", "/api/wallet/topup/stripe", {
+                amountCents: amount,
+            });
             return ok(JSON.stringify(data, null, 2));
         }
         catch (e) {
@@ -1059,11 +1200,26 @@ class DominusNodeToolkit {
             if (!Number.isInteger(rawAmount) || rawAmount < 5 || rawAmount > 10000)
                 return err("amountUsd must be a whole number between 5 and 10,000");
             const amount = rawAmount;
-            const VALID_CURRENCIES = ["BTC", "ETH", "LTC", "XMR", "ZEC", "USDC", "SOL", "USDT", "DAI", "BNB", "LINK"];
+            const VALID_CURRENCIES = [
+                "BTC",
+                "ETH",
+                "LTC",
+                "XMR",
+                "ZEC",
+                "USDC",
+                "SOL",
+                "USDT",
+                "DAI",
+                "BNB",
+                "LINK",
+            ];
             const cur = (currency || "").toUpperCase().trim();
             if (!VALID_CURRENCIES.includes(cur))
                 return err(`currency must be one of: ${VALID_CURRENCIES.join(", ")}`);
-            const data = await this._req("POST", "/api/wallet/topup/crypto", { amountUsd: amount, currency: cur });
+            const data = await this._req("POST", "/api/wallet/topup/crypto", {
+                amountUsd: amount,
+                currency: cur,
+            });
             return ok(JSON.stringify(data, null, 2));
         }
         catch (e) {
@@ -1112,7 +1268,581 @@ class DominusNodeToolkit {
             }
             if (!Object.keys(body).length)
                 return err("At least one of dailyLimitCents or allowedDomains must be provided");
-            const data = await this._req("PATCH", `/api/agent-wallet/${id}/policy`, body);
+            const data = await this._req("PATCH", `/api/agent-wallet/${encodeURIComponent(id)}/policy`, body);
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Unauthenticated request helper (register, login, verify-email)
+    // -----------------------------------------------------------------------
+    async _rawRequest(method, path, body) {
+        const url = `${this.baseUrl}${path}`;
+        const headers = {
+            Accept: "application/json",
+            "User-Agent": "dominusnode-pi/1.0.0",
+        };
+        if (this.agentSecret) {
+            headers["X-DominusNode-Agent"] = "mcp";
+            headers["X-DominusNode-Agent-Secret"] = this.agentSecret;
+        }
+        const init = {
+            method,
+            headers,
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+            redirect: "error",
+        };
+        if (body && ["POST", "PUT", "PATCH", "DELETE"].includes(method)) {
+            headers["Content-Type"] = "application/json";
+            init.body = JSON.stringify(body);
+        }
+        let res;
+        try {
+            res = await fetch(url, init);
+        }
+        catch (e) {
+            throw new Error(`API request failed: ${safeError(e)}`);
+        }
+        let rawText = "";
+        if (res.body) {
+            const reader = res.body.getReader();
+            const chunks = [];
+            let totalBytes = 0;
+            try {
+                while (true) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    totalBytes += value.length;
+                    if (totalBytes > MAX_RESPONSE_BYTES) {
+                        reader.cancel().catch(() => { });
+                        throw new Error("API response too large");
+                    }
+                    chunks.push(value);
+                }
+            }
+            catch (e) {
+                reader.cancel().catch(() => { });
+                throw e;
+            }
+            rawText = Buffer.concat(chunks).toString("utf-8");
+        }
+        if (!res.ok) {
+            let msg = `API error ${res.status}`;
+            try {
+                const parsed = JSON.parse(rawText);
+                stripDangerousKeys(parsed);
+                const detail = parsed.error ?? parsed.message;
+                if (detail)
+                    msg = `API error ${res.status}: ${scrubCredentials(String(detail))}`;
+            }
+            catch {
+                if (rawText)
+                    msg = `API error ${res.status}: ${scrubCredentials(rawText.slice(0, 200))}`;
+            }
+            throw new Error(msg);
+        }
+        if (!rawText || !rawText.trim())
+            return {};
+        try {
+            const parsed = JSON.parse(rawText);
+            stripDangerousKeys(parsed);
+            return parsed;
+        }
+        catch {
+            throw new Error("Failed to parse API response as JSON");
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Validation helpers for account tools
+    // -----------------------------------------------------------------------
+    static EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    static validateEmail(email) {
+        const trimmed = email.trim();
+        if (!trimmed || !DominusNodeToolkit.EMAIL_RE.test(trimmed)) {
+            throw new Error("Invalid email address.");
+        }
+        if (trimmed.length > 254) {
+            throw new Error("Email address too long (max 254 characters).");
+        }
+        return trimmed;
+    }
+    static validatePassword(password) {
+        if (!password || password.length < 8) {
+            throw new Error("Password must be at least 8 characters.");
+        }
+        if (password.length > 128) {
+            throw new Error("Password must be at most 128 characters.");
+        }
+        return password;
+    }
+    // -----------------------------------------------------------------------
+    // Tool 27: getProxyStatus
+    // -----------------------------------------------------------------------
+    async getProxyStatus() {
+        try {
+            const data = await this._req("GET", "/api/proxy/status");
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 28: getTransactions
+    // -----------------------------------------------------------------------
+    async getTransactions(limit = 20) {
+        try {
+            const rawLim = Number(limit);
+            if (!Number.isFinite(rawLim))
+                return err("limit must be a finite number");
+            const lim = Math.max(1, Math.min(100, Math.floor(rawLim)));
+            const data = await this._req("GET", `/api/wallet/transactions?limit=${lim}`);
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 29: getForecast
+    // -----------------------------------------------------------------------
+    async getForecast() {
+        try {
+            const data = await this._req("GET", "/api/wallet/forecast");
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 30: checkPayment
+    // -----------------------------------------------------------------------
+    async checkPayment(invoiceId) {
+        try {
+            const id = validateUuid(invoiceId, "invoiceId");
+            const data = await this._req("GET", `/api/wallet/topup/crypto/${encodeURIComponent(id)}/status`);
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 31: getDailyUsage
+    // -----------------------------------------------------------------------
+    async getDailyUsage(days = 7) {
+        try {
+            const rawDays = Number(days);
+            if (!Number.isFinite(rawDays))
+                return err("days must be a finite number between 1 and 365");
+            const d = Math.max(1, Math.min(365, Math.floor(rawDays)));
+            const data = await this._req("GET", `/api/usage/daily?days=${d}`);
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 32: getTopHosts
+    // -----------------------------------------------------------------------
+    async getTopHosts(limit = 10) {
+        try {
+            const rawLim = Number(limit);
+            if (!Number.isFinite(rawLim))
+                return err("limit must be a finite number");
+            const lim = Math.max(1, Math.min(100, Math.floor(rawLim)));
+            const data = await this._req("GET", `/api/usage/top-hosts?limit=${lim}`);
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 33: register
+    // -----------------------------------------------------------------------
+    async register(email, password) {
+        try {
+            const safeEmail = DominusNodeToolkit.validateEmail(email);
+            const safePassword = DominusNodeToolkit.validatePassword(password);
+            // Solve PoW for CAPTCHA-free registration
+            const pow = await this._solvePoW();
+            const regBody = {
+                email: safeEmail,
+                password: safePassword,
+            };
+            if (pow)
+                regBody.pow = pow;
+            const data = await this._rawRequest("POST", "/api/auth/register", regBody);
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 34: login
+    // -----------------------------------------------------------------------
+    async login(email, password) {
+        try {
+            const safeEmail = DominusNodeToolkit.validateEmail(email);
+            const safePassword = DominusNodeToolkit.validatePassword(password);
+            const data = await this._rawRequest("POST", "/api/auth/login", {
+                email: safeEmail,
+                password: safePassword,
+            });
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 35: getAccountInfo
+    // -----------------------------------------------------------------------
+    async getAccountInfo() {
+        try {
+            const data = await this._req("GET", "/api/auth/me");
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 36: verifyEmail
+    // -----------------------------------------------------------------------
+    async verifyEmail(token) {
+        try {
+            if (!token || typeof token !== "string" || token.trim().length === 0) {
+                return err("Verification token is required.");
+            }
+            if (/[\x00-\x1f\x7f]/.test(token)) {
+                return err("Token contains invalid control characters.");
+            }
+            const data = await this._rawRequest("POST", "/api/auth/verify-email", {
+                token: token.trim(),
+            });
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 37: resendVerification
+    // -----------------------------------------------------------------------
+    async resendVerification() {
+        try {
+            const data = await this._req("POST", "/api/auth/resend-verification");
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 38: updatePassword
+    // -----------------------------------------------------------------------
+    async updatePassword(currentPassword, newPassword) {
+        try {
+            DominusNodeToolkit.validatePassword(currentPassword);
+            DominusNodeToolkit.validatePassword(newPassword);
+            const data = await this._req("POST", "/api/auth/change-password", {
+                currentPassword,
+                newPassword,
+            });
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 39: listKeys
+    // -----------------------------------------------------------------------
+    async listKeys() {
+        try {
+            const data = await this._req("GET", "/api/keys");
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 40: createKey
+    // -----------------------------------------------------------------------
+    async createKey(label) {
+        try {
+            const labelErr = validateLabel(label);
+            if (labelErr)
+                return err(labelErr);
+            const data = await this._req("POST", "/api/keys", {
+                label: label.trim(),
+            });
+            return ok(JSON.stringify(data, null, 2) +
+                "\n\nIMPORTANT: Store this API key securely — it will not be shown again.");
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 41: revokeKey
+    // -----------------------------------------------------------------------
+    async revokeKey(keyId) {
+        try {
+            const id = validateUuid(keyId, "keyId");
+            const data = await this._req("DELETE", `/api/keys/${encodeURIComponent(id)}`);
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 42: getPlan
+    // -----------------------------------------------------------------------
+    async getPlan() {
+        try {
+            const data = await this._req("GET", "/api/plans/user/plan");
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 43: listPlans
+    // -----------------------------------------------------------------------
+    async listPlans() {
+        try {
+            const data = await this._req("GET", "/api/plans");
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 44: changePlan
+    // -----------------------------------------------------------------------
+    async changePlan(planId) {
+        try {
+            const id = validateUuid(planId, "planId");
+            const data = await this._req("PUT", "/api/plans/user/plan", {
+                planId: id,
+            });
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 45: teamDelete
+    // -----------------------------------------------------------------------
+    async teamDelete(teamId) {
+        try {
+            const id = validateUuid(teamId, "teamId");
+            const data = await this._req("DELETE", `/api/teams/${encodeURIComponent(id)}`);
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 46: teamRevokeKey
+    // -----------------------------------------------------------------------
+    async teamRevokeKey(teamId, keyId) {
+        try {
+            const tid = validateUuid(teamId, "teamId");
+            const kid = validateUuid(keyId, "keyId");
+            const data = await this._req("DELETE", `/api/teams/${encodeURIComponent(tid)}/keys/${encodeURIComponent(kid)}`);
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 47: teamListKeys
+    // -----------------------------------------------------------------------
+    async teamListKeys(teamId) {
+        try {
+            const id = validateUuid(teamId, "teamId");
+            const data = await this._req("GET", `/api/teams/${encodeURIComponent(id)}/keys`);
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 48: teamListMembers
+    // -----------------------------------------------------------------------
+    async teamListMembers(teamId) {
+        try {
+            const id = validateUuid(teamId, "teamId");
+            const data = await this._req("GET", `/api/teams/${encodeURIComponent(id)}/members`);
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 49: teamAddMember
+    // -----------------------------------------------------------------------
+    async teamAddMember(teamId, userId, role = "member") {
+        try {
+            const tid = validateUuid(teamId, "teamId");
+            const uid = validateUuid(userId, "userId");
+            if (role !== "member" && role !== "admin")
+                return err("role must be 'member' or 'admin'");
+            const data = await this._req("POST", `/api/teams/${encodeURIComponent(tid)}/members`, { userId: uid, role });
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 50: teamRemoveMember
+    // -----------------------------------------------------------------------
+    async teamRemoveMember(teamId, userId) {
+        try {
+            const tid = validateUuid(teamId, "teamId");
+            const uid = validateUuid(userId, "userId");
+            const data = await this._req("DELETE", `/api/teams/${encodeURIComponent(tid)}/members/${encodeURIComponent(uid)}`);
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 51: teamInviteMember
+    // -----------------------------------------------------------------------
+    async teamInviteMember(teamId, email, role = "member") {
+        try {
+            const id = validateUuid(teamId, "teamId");
+            const safeEmail = DominusNodeToolkit.validateEmail(email);
+            if (role !== "member" && role !== "admin")
+                return err("role must be 'member' or 'admin'");
+            const data = await this._req("POST", `/api/teams/${encodeURIComponent(id)}/invites`, { email: safeEmail, role });
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 52: teamListInvites
+    // -----------------------------------------------------------------------
+    async teamListInvites(teamId) {
+        try {
+            const id = validateUuid(teamId, "teamId");
+            const data = await this._req("GET", `/api/teams/${encodeURIComponent(id)}/invites`);
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 53: teamCancelInvite
+    // -----------------------------------------------------------------------
+    async teamCancelInvite(teamId, inviteId) {
+        try {
+            const tid = validateUuid(teamId, "teamId");
+            const iid = validateUuid(inviteId, "inviteId");
+            const data = await this._req("DELETE", `/api/teams/${encodeURIComponent(tid)}/invites/${encodeURIComponent(iid)}`);
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 54 (MPP): mppInfo
+    // -----------------------------------------------------------------------
+    async mppInfo() {
+        try {
+            const data = await this._req("GET", "/api/mpp/info");
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 55 (MPP): payMpp
+    // -----------------------------------------------------------------------
+    async payMpp(amountCents, method) {
+        if (!Number.isInteger(amountCents) ||
+            amountCents < 500 ||
+            amountCents > 100_000) {
+            return err("amount_cents must be an integer between 500 and 100,000");
+        }
+        if (!["tempo", "stripe_spt", "lightning"].includes(method)) {
+            return err("method must be one of: tempo, stripe_spt, lightning");
+        }
+        try {
+            const data = await this._req("POST", "/api/mpp/topup", {
+                amountCents,
+                method,
+            });
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 56 (MPP): mppSessionOpen
+    // -----------------------------------------------------------------------
+    async mppSessionOpen(maxDepositCents, method, poolType = "dc") {
+        if (!Number.isInteger(maxDepositCents) ||
+            maxDepositCents < 500 ||
+            maxDepositCents > 100_000) {
+            return err("max_deposit_cents must be an integer between 500 and 100,000");
+        }
+        if (!["tempo", "stripe_spt", "lightning"].includes(method)) {
+            return err("method must be one of: tempo, stripe_spt, lightning");
+        }
+        if (!["dc", "residential"].includes(poolType)) {
+            return err("pool_type must be dc or residential");
+        }
+        try {
+            const data = await this._req("POST", "/api/mpp/session/open", {
+                maxDepositCents,
+                method,
+                poolType,
+            });
+            return ok(JSON.stringify(data, null, 2));
+        }
+        catch (e) {
+            return err(e);
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Tool 57 (MPP): mppSessionClose
+    // -----------------------------------------------------------------------
+    async mppSessionClose(channelId) {
+        if (!channelId)
+            return err("channel_id is required");
+        try {
+            const data = await this._req("POST", "/api/mpp/session/close", {
+                channelId,
+            });
             return ok(JSON.stringify(data, null, 2));
         }
         catch (e) {