@toon-protocol/connector 1.7.1

package/dist/http/admin-api.js

@@ -0,0 +1,1057 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CHAIN_FORMAT_REGEX = void 0;
+exports.createAdminRouter = createAdminRouter;
+exports.validateDepositRequest = validateDepositRequest;
+exports.validateSettlementConfig = validateSettlementConfig;
+exports.validateOpenChannelRequest = validateOpenChannelRequest;
+const node_crypto_1 = require("node:crypto");
+const netmask_1 = require("netmask");
+const optional_require_1 = require("../utils/optional-require");
+const shared_1 = require("@toon-protocol/shared");
+const types_1 = require("../settlement/types");
+const ilp_send_handler_1 = require("./ilp-send-handler");
+function normalizeIP(ip) {
+    if (ip.startsWith('::ffff:')) {
+        return ip.substring(7);
+    }
+    return ip;
+}
+function getClientIP(req, trustProxy) {
+    if (trustProxy) {
+        const forwardedFor = req.headers['x-forwarded-for'];
+        if (forwardedFor) {
+            const headerValue = typeof forwardedFor === 'string' ? forwardedFor : forwardedFor[0];
+            if (headerValue) {
+                const ips = headerValue.split(',');
+                const firstIP = ips[0];
+                if (firstIP) {
+                    return normalizeIP(firstIP.trim());
+                }
+            }
+        }
+    }
+    const rawIP = req.ip || req.socket.remoteAddress || 'unknown';
+    return normalizeIP(rawIP);
+}
+function isIPAllowed(ip, allowedIPs) {
+    for (const allowed of allowedIPs) {
+        try {
+            if (allowed.includes('/')) {
+                const block = new netmask_1.Netmask(allowed);
+                if (block.contains(ip)) {
+                    return true;
+                }
+            }
+            else {
+                if (ip === allowed) {
+                    return true;
+                }
+            }
+        }
+        catch (err) {
+            continue;
+        }
+    }
+    return false;
+}
+function createIPAllowlistMiddleware(allowedIPs, trustProxy, logger) {
+    const log = logger.child({ component: 'IPAllowlist' });
+    return (req, res, next) => {
+        const clientIP = getClientIP(req, trustProxy);
+        if (!isIPAllowed(clientIP, allowedIPs)) {
+            log.warn({
+                event: 'admin_api_ip_blocked',
+                ip: clientIP,
+                path: req.path,
+                allowedIPs,
+                trustProxy,
+            }, 'Admin API request blocked by IP allowlist');
+            res.status(403).json({
+                error: 'Forbidden',
+                message: 'IP address not allowed',
+            });
+            return;
+        }
+        next();
+    };
+}
+async function createAdminRouter(config) {
+    const { default: express } = await (0, optional_require_1.requireOptional)('express', 'HTTP admin/health APIs');
+    const router = express.Router();
+    const { routingTable, btpClientManager, logger, apiKey, allowedIPs, trustProxy = false, nodeId, settlementPeers, channelManager, paymentChannelSDK, accountManager, settlementMonitor, claimReceiver, packetSender, isReady, defaultSettlementTokenId, } = config;
+    const log = logger.child({ component: 'AdminAPI' });
+    router.use(express.json());
+    if (allowedIPs && allowedIPs.length > 0) {
+        router.use(createIPAllowlistMiddleware(allowedIPs, trustProxy, logger));
+    }
+    if (apiKey) {
+        const apiKeyBuffer = Buffer.from(apiKey);
+        router.use((req, res, next) => {
+            if (req.query.apiKey) {
+                log.warn({
+                    event: 'admin_api_key_in_query',
+                    ip: req.ip,
+                    path: req.path,
+                }, 'API key supplied via query parameter (rejected — use X-Api-Key header)');
+                res.status(401).json({
+                    error: 'Unauthorized',
+                    message: 'API key must be provided via X-Api-Key header, not query parameter',
+                });
+                return;
+            }
+            const providedKey = req.headers['x-api-key'];
+            const providedBuffer = Buffer.from(typeof providedKey === 'string' ? providedKey : '');
+            const isLengthMatch = providedBuffer.length === apiKeyBuffer.length;
+            const comparand = isLengthMatch ? apiKeyBuffer : providedBuffer;
+            const isMatch = (0, node_crypto_1.timingSafeEqual)(providedBuffer, comparand) && isLengthMatch;
+            if (!isMatch) {
+                log.warn({
+                    event: 'admin_api_auth_failed',
+                    ip: req.ip,
+                    path: req.path,
+                }, 'Admin API authentication failed');
+                res.status(401).json({
+                    error: 'Unauthorized',
+                    message: 'Invalid or missing API key',
+                });
+                return;
+            }
+            next();
+        });
+    }
+    router.use((req, _res, next) => {
+        log.info({
+            event: 'admin_api_request',
+            method: req.method,
+            path: req.path,
+            ip: req.ip,
+        }, `Admin API: ${req.method} ${req.path}`);
+        next();
+    });
+    router.get('/peers', (_req, res) => {
+        try {
+            const peerIds = btpClientManager.getPeerIds();
+            const peerStatus = btpClientManager.getPeerStatus();
+            const routes = routingTable.getAllRoutes();
+            const peers = peerIds.map((peerId) => {
+                const peerRoutes = routes.filter((r) => r.nextHop === peerId);
+                const ilpAddresses = peerRoutes.map((r) => r.prefix);
+                const peerResponse = {
+                    id: peerId,
+                    connected: peerStatus.get(peerId) ?? false,
+                    ilpAddresses,
+                    routeCount: peerRoutes.length,
+                };
+                if (settlementPeers) {
+                    const peerConfig = settlementPeers.get(peerId);
+                    if (peerConfig) {
+                        peerResponse.settlement = {
+                            preference: peerConfig.settlementPreference,
+                            evmAddress: peerConfig.evmAddress,
+                            tokenAddress: peerConfig.tokenAddress,
+                            tokenNetworkAddress: peerConfig.tokenNetworkAddress,
+                            chainId: peerConfig.chainId,
+                            channelId: peerConfig.channelId,
+                            initialDeposit: peerConfig.initialDeposit,
+                        };
+                    }
+                }
+                return peerResponse;
+            });
+            res.json({
+                nodeId,
+                peerCount: peers.length,
+                connectedCount: peers.filter((p) => p.connected).length,
+                peers,
+            });
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            log.error({ event: 'admin_api_error', error: errorMessage }, 'Failed to list peers');
+            res.status(500).json({ error: 'Internal server error', message: errorMessage });
+        }
+    });
+    router.post('/peers', async (req, res) => {
+        try {
+            const body = req.body;
+            if (!body.id || typeof body.id !== 'string') {
+                res.status(400).json({ error: 'Bad request', message: 'Missing or invalid peer id' });
+                return;
+            }
+            if (!body.url || typeof body.url !== 'string') {
+                res.status(400).json({ error: 'Bad request', message: 'Missing or invalid peer url' });
+                return;
+            }
+            if (body.authToken === undefined ||
+                body.authToken === null ||
+                typeof body.authToken !== 'string') {
+                res.status(400).json({
+                    error: 'Bad request',
+                    message: 'authToken must be a string (can be empty for no auth)',
+                });
+                return;
+            }
+            if (!body.url.startsWith('ws://') && !body.url.startsWith('wss://')) {
+                res.status(400).json({
+                    error: 'Bad request',
+                    message: 'URL must start with ws:// or wss://',
+                });
+                return;
+            }
+            const existingPeers = btpClientManager.getPeerIds();
+            const isUpdate = existingPeers.includes(body.id);
+            if (body.routes) {
+                for (const route of body.routes) {
+                    if (!route.prefix || typeof route.prefix !== 'string') {
+                        res.status(400).json({
+                            error: 'Bad request',
+                            message: 'Invalid route: missing prefix',
+                        });
+                        return;
+                    }
+                    if (!(0, shared_1.isValidILPAddress)(route.prefix)) {
+                        res.status(400).json({
+                            error: 'Bad request',
+                            message: `Invalid ILP address prefix: ${route.prefix}`,
+                        });
+                        return;
+                    }
+                }
+            }
+            if (body.settlement) {
+                const settlementError = validateSettlementConfig(body.settlement);
+                if (settlementError) {
+                    res.status(400).json({ error: 'Bad request', message: settlementError });
+                    return;
+                }
+            }
+            if (!isUpdate) {
+                const peer = {
+                    id: body.id,
+                    url: body.url,
+                    authToken: body.authToken,
+                    connected: false,
+                    lastSeen: new Date(),
+                };
+                await btpClientManager.addPeer(peer);
+                log.info({ event: 'admin_peer_added', peerId: body.id, url: body.url }, `Added peer: ${body.id}`);
+            }
+            else {
+                log.info({ event: 'admin_peer_reregistered', peerId: body.id }, `Re-registering peer: ${body.id}`);
+            }
+            const addedRoutes = [];
+            if (body.routes) {
+                for (const route of body.routes) {
+                    routingTable.addRoute(route.prefix, body.id, route.priority ?? 0);
+                    addedRoutes.push(route.prefix);
+                    log.info({ event: 'admin_route_added', prefix: route.prefix, nextHop: body.id }, `Added route: ${route.prefix} -> ${body.id}`);
+                }
+            }
+            if (body.settlement && settlementPeers) {
+                const s = body.settlement;
+                const ilpAddress = body.routes && body.routes.length > 0 ? body.routes[0].prefix : '';
+                const settlementTokens = [];
+                if (s.tokenAddress) {
+                    settlementTokens.push(s.tokenAddress);
+                }
+                else {
+                    if (s.evmAddress)
+                        settlementTokens.push('EVM');
+                }
+                const newConfig = {
+                    peerId: body.id,
+                    address: ilpAddress,
+                    settlementPreference: s.preference,
+                    settlementTokens,
+                    evmAddress: s.evmAddress,
+                    tokenAddress: s.tokenAddress,
+                    tokenNetworkAddress: s.tokenNetworkAddress,
+                    chainId: s.chainId,
+                    channelId: s.channelId,
+                    initialDeposit: s.initialDeposit,
+                };
+                if (isUpdate) {
+                    const existingConfig = settlementPeers.get(body.id);
+                    if (existingConfig) {
+                        const mergedConfig = { ...existingConfig };
+                        for (const [key, value] of Object.entries(newConfig)) {
+                            if (value !== undefined) {
+                                mergedConfig[key] = value;
+                            }
+                        }
+                        settlementPeers.set(body.id, mergedConfig);
+                    }
+                    else {
+                        settlementPeers.set(body.id, newConfig);
+                    }
+                    log.info({
+                        event: 'admin_settlement_config_merged',
+                        peerId: body.id,
+                        preference: s.preference,
+                    }, `Merged settlement config for peer: ${body.id}`);
+                }
+                else {
+                    settlementPeers.set(body.id, newConfig);
+                    log.info({
+                        event: 'admin_settlement_config_added',
+                        peerId: body.id,
+                        preference: s.preference,
+                    }, `Added settlement config for peer: ${body.id}`);
+                }
+            }
+            if (isUpdate) {
+                const connected = btpClientManager.isConnected(body.id);
+                res.status(200).json({
+                    success: true,
+                    peer: {
+                        id: body.id,
+                        url: body.url,
+                        connected,
+                    },
+                    routes: addedRoutes,
+                    updated: true,
+                    message: `Peer '${body.id}' updated`,
+                });
+            }
+            else {
+                await new Promise((resolve) => setTimeout(resolve, 1000));
+                const connected = btpClientManager.isConnected(body.id);
+                res.status(201).json({
+                    success: true,
+                    peer: {
+                        id: body.id,
+                        url: body.url,
+                        connected,
+                    },
+                    routes: addedRoutes,
+                    created: true,
+                    message: connected
+                        ? `Peer '${body.id}' added and connected`
+                        : `Peer '${body.id}' added (connection pending)`,
+                });
+            }
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            log.error({ event: 'admin_api_error', error: errorMessage }, 'Failed to add peer');
+            res.status(500).json({ error: 'Internal server error', message: errorMessage });
+        }
+    });
+    router.delete('/peers/:peerId', async (req, res) => {
+        try {
+            const peerId = req.params.peerId;
+            if (!peerId) {
+                res.status(400).json({ error: 'Bad request', message: 'Missing peerId parameter' });
+                return;
+            }
+            const removeRoutes = req.query.removeRoutes !== 'false';
+            const existingPeers = btpClientManager.getPeerIds();
+            if (!existingPeers.includes(peerId)) {
+                res.status(404).json({
+                    error: 'Not found',
+                    message: `Peer '${peerId}' not found`,
+                });
+                return;
+            }
+            await btpClientManager.removePeer(peerId);
+            log.info({ event: 'admin_peer_removed', peerId }, `Removed peer: ${peerId}`);
+            if (settlementPeers && settlementPeers.delete(peerId)) {
+                log.info({ event: 'admin_settlement_config_removed', peerId }, `Removed settlement config for peer: ${peerId}`);
+            }
+            const removedRoutes = [];
+            if (removeRoutes) {
+                const routes = routingTable.getAllRoutes();
+                for (const route of routes) {
+                    if (route.nextHop === peerId) {
+                        routingTable.removeRoute(route.prefix);
+                        removedRoutes.push(route.prefix);
+                        log.info({ event: 'admin_route_removed', prefix: route.prefix }, `Removed route: ${route.prefix}`);
+                    }
+                }
+            }
+            res.json({
+                success: true,
+                peerId,
+                removedRoutes,
+                message: `Peer '${peerId}' removed${removedRoutes.length > 0 ? ` with ${removedRoutes.length} routes` : ''}`,
+            });
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            log.error({ event: 'admin_api_error', error: errorMessage }, 'Failed to remove peer');
+            res.status(500).json({ error: 'Internal server error', message: errorMessage });
+        }
+    });
+    router.put('/peers/:peerId', (req, res) => {
+        try {
+            const peerId = req.params.peerId;
+            if (!peerId) {
+                res.status(400).json({ error: 'Bad request', message: 'Missing peerId parameter' });
+                return;
+            }
+            const existingPeers = btpClientManager.getPeerIds();
+            if (!existingPeers.includes(peerId)) {
+                res.status(404).json({
+                    error: 'Not found',
+                    message: 'Peer not found',
+                });
+                return;
+            }
+            const body = req.body;
+            if (body.settlement) {
+                const settlementError = validateSettlementConfig(body.settlement);
+                if (settlementError) {
+                    res.status(400).json({ error: 'Bad request', message: settlementError });
+                    return;
+                }
+            }
+            if (body.routes) {
+                for (const route of body.routes) {
+                    if (!route.prefix || typeof route.prefix !== 'string') {
+                        res.status(400).json({
+                            error: 'Bad request',
+                            message: 'Invalid route: missing prefix',
+                        });
+                        return;
+                    }
+                    if (!(0, shared_1.isValidILPAddress)(route.prefix)) {
+                        res.status(400).json({
+                            error: 'Bad request',
+                            message: `Invalid ILP address prefix: ${route.prefix}`,
+                        });
+                        return;
+                    }
+                }
+            }
+            if (body.settlement && settlementPeers) {
+                const s = body.settlement;
+                const existingConfig = settlementPeers.get(peerId);
+                const settlementTokens = [];
+                if (s.tokenAddress) {
+                    settlementTokens.push(s.tokenAddress);
+                }
+                else {
+                    if (s.evmAddress)
+                        settlementTokens.push('EVM');
+                }
+                const newConfig = {
+                    peerId,
+                    address: existingConfig?.address ?? '',
+                    settlementPreference: s.preference,
+                    settlementTokens,
+                    evmAddress: s.evmAddress,
+                    tokenAddress: s.tokenAddress,
+                    tokenNetworkAddress: s.tokenNetworkAddress,
+                    chainId: s.chainId,
+                    channelId: s.channelId,
+                    initialDeposit: s.initialDeposit,
+                };
+                if (existingConfig) {
+                    const mergedConfig = { ...existingConfig };
+                    for (const [key, value] of Object.entries(newConfig)) {
+                        if (value !== undefined) {
+                            mergedConfig[key] = value;
+                        }
+                    }
+                    settlementPeers.set(peerId, mergedConfig);
+                }
+                else {
+                    settlementPeers.set(peerId, newConfig);
+                }
+                log.info({ event: 'admin_peer_settlement_updated', peerId, preference: s.preference }, `Updated settlement config for peer: ${peerId}`);
+            }
+            if (body.routes) {
+                for (const route of body.routes) {
+                    routingTable.addRoute(route.prefix, peerId, route.priority ?? 0);
+                    log.info({ event: 'admin_route_added', prefix: route.prefix, nextHop: peerId }, `Added route: ${route.prefix} -> ${peerId}`);
+                }
+            }
+            res.status(200).json({
+                success: true,
+                peerId,
+                updated: true,
+            });
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            log.error({ event: 'admin_api_error', error: errorMessage }, 'Failed to update peer');
+            res.status(500).json({ error: 'Internal server error', message: errorMessage });
+        }
+    });
+    router.get('/routes', (_req, res) => {
+        try {
+            const routes = routingTable.getAllRoutes();
+            res.json({
+                nodeId,
+                routeCount: routes.length,
+                routes: routes.map((r) => ({
+                    prefix: r.prefix,
+                    nextHop: r.nextHop,
+                    priority: r.priority ?? 0,
+                })),
+            });
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            log.error({ event: 'admin_api_error', error: errorMessage }, 'Failed to list routes');
+            res.status(500).json({ error: 'Internal server error', message: errorMessage });
+        }
+    });
+    router.post('/routes', (req, res) => {
+        try {
+            const body = req.body;
+            if (!body.prefix || typeof body.prefix !== 'string') {
+                res.status(400).json({ error: 'Bad request', message: 'Missing or invalid prefix' });
+                return;
+            }
+            if (!body.nextHop || typeof body.nextHop !== 'string') {
+                res.status(400).json({ error: 'Bad request', message: 'Missing or invalid nextHop' });
+                return;
+            }
+            if (!(0, shared_1.isValidILPAddress)(body.prefix)) {
+                res.status(400).json({
+                    error: 'Bad request',
+                    message: `Invalid ILP address prefix: ${body.prefix}`,
+                });
+                return;
+            }
+            const existingPeers = btpClientManager.getPeerIds();
+            const peerExists = existingPeers.includes(body.nextHop);
+            const priority = body.priority ?? 0;
+            routingTable.addRoute(body.prefix, body.nextHop, priority);
+            log.info({ event: 'admin_route_added', prefix: body.prefix, nextHop: body.nextHop, priority }, `Added route: ${body.prefix} -> ${body.nextHop}`);
+            res.status(201).json({
+                success: true,
+                route: {
+                    prefix: body.prefix,
+                    nextHop: body.nextHop,
+                    priority,
+                },
+                warning: peerExists ? undefined : `Peer '${body.nextHop}' does not exist yet`,
+                message: `Route '${body.prefix}' -> '${body.nextHop}' added`,
+            });
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            log.error({ event: 'admin_api_error', error: errorMessage }, 'Failed to add route');
+            res.status(500).json({ error: 'Internal server error', message: errorMessage });
+        }
+    });
+    router.delete('/routes/:prefix(*)', (req, res) => {
+        try {
+            const rawPrefix = req.params.prefix;
+            if (!rawPrefix) {
+                res.status(400).json({ error: 'Bad request', message: 'Missing prefix parameter' });
+                return;
+            }
+            const prefix = decodeURIComponent(rawPrefix);
+            const routes = routingTable.getAllRoutes();
+            const existingRoute = routes.find((r) => r.prefix === prefix);
+            if (!existingRoute) {
+                res.status(404).json({
+                    error: 'Not found',
+                    message: `Route with prefix '${prefix}' not found`,
+                });
+                return;
+            }
+            routingTable.removeRoute(prefix);
+            log.info({ event: 'admin_route_removed', prefix }, `Removed route: ${prefix}`);
+            res.json({
+                success: true,
+                prefix,
+                message: `Route '${prefix}' removed`,
+            });
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            log.error({ event: 'admin_api_error', error: errorMessage }, 'Failed to remove route');
+            res.status(500).json({ error: 'Internal server error', message: errorMessage });
+        }
+    });
+    router.post('/channels', async (req, res) => {
+        try {
+            if (!channelManager) {
+                res.status(503).json({
+                    error: 'Service Unavailable',
+                    message: 'Settlement infrastructure not enabled',
+                });
+                return;
+            }
+            const validation = validateOpenChannelRequest(req.body);
+            if (!validation.valid) {
+                res.status(400).json({ error: 'Bad request', message: validation.error });
+                return;
+            }
+            const body = req.body;
+            const existingPeers = btpClientManager.getPeerIds();
+            if (!existingPeers.includes(body.peerId)) {
+                res.status(404).json({
+                    error: 'Not found',
+                    message: `Peer '${body.peerId}' must be registered before opening channels`,
+                });
+                return;
+            }
+            const chainPrefix = body.chain.split(':')[0];
+            if (chainPrefix === 'evm') {
+                const tokenId = body.token ?? 'AGENT';
+                const peerConfig = settlementPeers?.get(body.peerId);
+                const peerAddress = body.peerAddress || peerConfig?.evmAddress;
+                if (!peerAddress) {
+                    res.status(400).json({
+                        error: 'Bad request',
+                        message: 'Peer EVM address must be provided in request or peer registration',
+                    });
+                    return;
+                }
+                if (body.peerAddress && !/^0x[0-9a-fA-F]{40}$/.test(body.peerAddress)) {
+                    res.status(400).json({
+                        error: 'Bad request',
+                        message: 'Invalid EVM address format: must be 0x-prefixed 42-char hex',
+                    });
+                    return;
+                }
+                const addressSource = body.peerAddress ? 'request' : 'registration';
+                log.info({ peerId: body.peerId, peerAddress, source: addressSource }, `Resolved peer EVM address from ${addressSource}`);
+                const existing = channelManager.getChannelForPeer(body.peerId, tokenId);
+                if (existing && existing.status !== 'closed') {
+                    res.status(409).json({
+                        error: 'Conflict',
+                        message: `Channel already exists for peer ${body.peerId} with token ${tokenId} on chain ${body.chain}`,
+                    });
+                    return;
+                }
+                const channelId = await channelManager.ensureChannelExists(body.peerId, tokenId, {
+                    initialDeposit: BigInt(body.initialDeposit),
+                    settlementTimeout: body.settlementTimeout,
+                    chain: body.chain,
+                    peerAddress,
+                });
+                log.info({ peerId: body.peerId, chain: body.chain, channelId }, 'Channel opened via Admin API');
+                const metadata = channelManager.getChannelById(channelId);
+                if (!metadata) {
+                    res.status(500).json({
+                        error: 'Internal error',
+                        message: 'Channel created but metadata unavailable',
+                    });
+                    return;
+                }
+                res.status(201).json({
+                    channelId,
+                    chain: body.chain,
+                    status: (0, types_1.normalizeChannelStatus)(metadata.status, log),
+                    deposit: body.initialDeposit,
+                });
+            }
+            else {
+                res.status(400).json({
+                    error: 'Bad request',
+                    message: `Unsupported blockchain: ${chainPrefix}`,
+                });
+            }
+        }
+        catch (error) {
+            log.error({
+                err: error,
+                peerId: req.body.peerId,
+                chain: req.body.chain,
+            }, 'Channel open failed');
+            res.status(500).json({ error: 'Internal error', message: 'Channel open failed' });
+        }
+    });
+    router.get('/channels', async (_req, res) => {
+        try {
+            if (!channelManager) {
+                res.status(503).json({
+                    error: 'Service Unavailable',
+                    message: 'Settlement infrastructure not enabled',
+                });
+                return;
+            }
+            let channels = channelManager.getAllChannels();
+            const filterPeerId = _req.query.peerId;
+            const filterChain = _req.query.chain;
+            const filterStatus = _req.query.status;
+            if (filterPeerId) {
+                channels = channels.filter((ch) => ch.peerId === filterPeerId);
+            }
+            if (filterChain) {
+                channels = channels.filter((ch) => ch.chain === filterChain);
+            }
+            if (filterStatus) {
+                const normalizedFilter = (0, types_1.normalizeChannelStatus)(filterStatus, log);
+                channels = channels.filter((ch) => (0, types_1.normalizeChannelStatus)(ch.status, log) === normalizedFilter);
+            }
+            const summaries = channels.map((ch) => ({
+                channelId: ch.channelId,
+                peerId: ch.peerId,
+                chain: ch.chain,
+                status: (0, types_1.normalizeChannelStatus)(ch.status, log),
+                deposit: 'unknown',
+                lastActivity: ch.lastActivityAt.toISOString(),
+            }));
+            if (paymentChannelSDK) {
+                await Promise.all(summaries.map(async (summary) => {
+                    try {
+                        const ch = channels.find((c) => c.channelId === summary.channelId);
+                        if (ch) {
+                            const state = await paymentChannelSDK.getChannelState(ch.channelId, ch.tokenAddress);
+                            summary.deposit = state.myDeposit.toString();
+                        }
+                    }
+                    catch {
+                    }
+                }));
+            }
+            res.json(summaries);
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            log.error({ event: 'admin_api_error', error: errorMessage }, 'Failed to list channels');
+            res.status(500).json({ error: 'Internal server error', message: errorMessage });
+        }
+    });
+    router.get('/channels/:channelId', async (req, res) => {
+        try {
+            if (!channelManager) {
+                res.status(503).json({
+                    error: 'Service Unavailable',
+                    message: 'Settlement infrastructure not enabled',
+                });
+                return;
+            }
+            const reqChannelId = req.params.channelId;
+            const metadata = channelManager.getChannelById(reqChannelId);
+            if (!metadata) {
+                res.status(404).json({ error: 'Not found', message: 'Channel not found' });
+                return;
+            }
+            if (paymentChannelSDK && metadata.chain.startsWith('evm')) {
+                const state = await paymentChannelSDK.getChannelState(metadata.channelId, metadata.tokenAddress);
+                res.json({
+                    channelId: state.channelId,
+                    participants: state.participants,
+                    deposit: state.myDeposit.toString(),
+                    theirDeposit: state.theirDeposit.toString(),
+                    transferred: state.myTransferred.toString(),
+                    theirTransferred: state.theirTransferred.toString(),
+                    status: (0, types_1.normalizeChannelStatus)(state.status, log),
+                    nonce: state.myNonce,
+                    theirNonce: state.theirNonce,
+                    settlementTimeout: state.settlementTimeout,
+                    openedAt: state.openedAt,
+                    closedAt: state.closedAt,
+                });
+                return;
+            }
+            res.json({
+                channelId: metadata.channelId,
+                peerId: metadata.peerId,
+                chain: metadata.chain,
+                status: (0, types_1.normalizeChannelStatus)(metadata.status, log),
+                deposit: 'unknown',
+                tokenId: metadata.tokenId,
+                createdAt: metadata.createdAt.toISOString(),
+                lastActivity: metadata.lastActivityAt.toISOString(),
+            });
+        }
+        catch (error) {
+            log.error({ err: error, channelId: req.params.channelId }, 'Failed to query channel state');
+            res.status(500).json({ error: 'Internal error', message: 'Failed to query channel state' });
+        }
+    });
+    router.post('/channels/:channelId/deposit', async (req, res) => {
+        try {
+            if (!channelManager) {
+                res.status(503).json({
+                    error: 'Service Unavailable',
+                    message: 'Settlement infrastructure not enabled',
+                });
+                return;
+            }
+            const reqChannelId = req.params.channelId;
+            const metadata = channelManager.getChannelById(reqChannelId);
+            if (!metadata) {
+                res.status(404).json({ error: 'Not found', message: 'Channel not found' });
+                return;
+            }
+            const validation = validateDepositRequest(req.body);
+            if (!validation.valid) {
+                res.status(400).json({ error: 'Bad request', message: validation.error });
+                return;
+            }
+            if ((0, types_1.normalizeChannelStatus)(metadata.status, log) !== 'open') {
+                res.status(400).json({
+                    error: 'Bad request',
+                    message: 'Channel is not in open state',
+                });
+                return;
+            }
+            const { amount } = req.body;
+            const chainPrefix = metadata.chain.split(':')[0];
+            if (chainPrefix === 'evm') {
+                if (!paymentChannelSDK) {
+                    res.status(503).json({
+                        error: 'Service Unavailable',
+                        message: 'EVM settlement infrastructure not enabled',
+                    });
+                    return;
+                }
+                await paymentChannelSDK.deposit(reqChannelId, metadata.tokenAddress, BigInt(amount));
+                const state = await paymentChannelSDK.getChannelState(reqChannelId, metadata.tokenAddress);
+                metadata.lastActivityAt = new Date();
+                log.info({ channelId: reqChannelId, chain: chainPrefix, amount }, 'Deposit completed via Admin API');
+                res.json({
+                    channelId: reqChannelId,
+                    newDeposit: state.myDeposit.toString(),
+                    status: (0, types_1.normalizeChannelStatus)(metadata.status, log),
+                });
+            }
+            else {
+                res.status(400).json({
+                    error: 'Bad request',
+                    message: `Unsupported blockchain: ${chainPrefix}`,
+                });
+            }
+        }
+        catch (error) {
+            log.error({ err: error, channelId: req.params.channelId }, 'Deposit failed');
+            res.status(500).json({ error: 'Internal error', message: 'Deposit failed' });
+        }
+    });
+    router.post('/channels/:channelId/close', async (req, res) => {
+        try {
+            if (!channelManager) {
+                res.status(503).json({
+                    error: 'Service Unavailable',
+                    message: 'Settlement infrastructure not enabled',
+                });
+                return;
+            }
+            const reqChannelId = req.params.channelId;
+            const metadata = channelManager.getChannelById(reqChannelId);
+            if (!metadata) {
+                res.status(404).json({ error: 'Not found', message: 'Channel not found' });
+                return;
+            }
+            const normalizedStatus = (0, types_1.normalizeChannelStatus)(metadata.status, log);
+            if (normalizedStatus !== 'open' && normalizedStatus !== 'opening') {
+                res.status(400).json({
+                    error: 'Bad request',
+                    message: 'Channel is not in a closeable state',
+                });
+                return;
+            }
+            const chainPrefix = metadata.chain.split(':')[0];
+            if (chainPrefix === 'evm') {
+                if (!paymentChannelSDK) {
+                    res.status(503).json({
+                        error: 'Service Unavailable',
+                        message: 'EVM settlement infrastructure not enabled',
+                    });
+                    return;
+                }
+                await paymentChannelSDK.closeChannel(reqChannelId, metadata.tokenAddress);
+                metadata.status = 'closing';
+                metadata.lastActivityAt = new Date();
+                log.info({ channelId: reqChannelId, chain: chainPrefix }, 'Channel close initiated via Admin API (grace period started)');
+                res.json({
+                    channelId: reqChannelId,
+                    status: 'closing',
+                });
+            }
+            else {
+                res.status(400).json({
+                    error: 'Bad request',
+                    message: `Unsupported blockchain: ${chainPrefix}`,
+                });
+            }
+        }
+        catch (error) {
+            log.error({ err: error, channelId: req.params.channelId }, 'Channel close failed');
+            res.status(500).json({ error: 'Internal error', message: 'Channel close failed' });
+        }
+    });
+    router.get('/balances/:peerId', async (req, res) => {
+        try {
+            if (!accountManager) {
+                res.status(503).json({
+                    error: 'Service Unavailable',
+                    message: 'Account management not enabled',
+                });
+                return;
+            }
+            const peerId = req.params.peerId;
+            const tokenId = req.query.tokenId || (defaultSettlementTokenId ?? 'M2M');
+            const balance = await accountManager.getAccountBalance(peerId, tokenId);
+            const response = {
+                peerId,
+                balances: [
+                    {
+                        tokenId,
+                        debitBalance: balance.debitBalance.toString(),
+                        creditBalance: balance.creditBalance.toString(),
+                        netBalance: balance.netBalance.toString(),
+                    },
+                ],
+            };
+            log.info({ peerId, tokenId }, 'Balance queried via Admin API');
+            res.json(response);
+        }
+        catch (error) {
+            log.error({ err: error, peerId: req.params.peerId }, 'Balance query failed');
+            res.status(500).json({ error: 'Internal error', message: 'Balance query failed' });
+        }
+    });
+    router.get('/settlement/states', (_req, res) => {
+        try {
+            if (!settlementMonitor) {
+                res.status(503).json({
+                    error: 'Service Unavailable',
+                    message: 'Settlement monitoring not enabled',
+                });
+                return;
+            }
+            const allStates = settlementMonitor.getAllSettlementStates();
+            const states = [];
+            for (const [key, state] of allStates.entries()) {
+                const separatorIndex = key.lastIndexOf(':');
+                const peerId = key.substring(0, separatorIndex);
+                const tokenId = key.substring(separatorIndex + 1);
+                states.push({ peerId, tokenId, state });
+            }
+            log.info({ stateCount: states.length }, 'Settlement states queried via Admin API');
+            res.json(states);
+        }
+        catch (error) {
+            log.error({ err: error }, 'Settlement state query failed');
+            res.status(500).json({ error: 'Internal error', message: 'Settlement state query failed' });
+        }
+    });
+    router.get('/channels/:channelId/claims', async (req, res) => {
+        try {
+            if (!channelManager) {
+                res.status(503).json({
+                    error: 'Service Unavailable',
+                    message: 'Settlement infrastructure not enabled',
+                });
+                return;
+            }
+            if (!claimReceiver) {
+                res.status(503).json({
+                    error: 'Service Unavailable',
+                    message: 'Claim receiver not enabled',
+                });
+                return;
+            }
+            const channelId = req.params.channelId;
+            const metadata = channelManager.getChannelById(channelId);
+            if (!metadata) {
+                res.status(404).json({ error: 'Not found', message: 'Channel not found' });
+                return;
+            }
+            const chainPrefix = metadata.chain.split(':')[0];
+            const blockchain = chainPrefix;
+            const claim = await claimReceiver.getLatestVerifiedClaim(metadata.peerId, blockchain, channelId);
+            if (!claim) {
+                res.status(404).json({ error: 'Not found', message: 'No claims found for this channel' });
+                return;
+            }
+            log.info({ channelId, blockchain }, 'Claim queried via Admin API');
+            res.json(claim);
+        }
+        catch (error) {
+            log.error({ err: error, channelId: req.params.channelId }, 'Claim query failed');
+            res.status(500).json({ error: 'Internal error', message: 'Claim query failed' });
+        }
+    });
+    const ilpSendHandler = new ilp_send_handler_1.IlpSendHandler(packetSender ?? null, isReady ?? null, log);
+    router.post('/ilp/send', ilpSendHandler.handle.bind(ilpSendHandler));
+    return router;
+}
+exports.CHAIN_FORMAT_REGEX = /^evm:[a-zA-Z0-9]+:\d+$/;
+function validateDepositRequest(body) {
+    if (body.amount === undefined || body.amount === null) {
+        return { valid: false, error: 'Missing amount' };
+    }
+    if (typeof body.amount !== 'string') {
+        return { valid: false, error: 'amount must be a string' };
+    }
+    if (!(0, types_1.isValidNonNegativeIntegerString)(body.amount)) {
+        return { valid: false, error: 'amount must be a positive integer string' };
+    }
+    if (body.amount === '0') {
+        return { valid: false, error: 'amount must be greater than zero' };
+    }
+    return { valid: true };
+}
+function validateSettlementConfig(s) {
+    const VALID_PREFERENCES = ['evm', 'any'];
+    if (!s.preference || !VALID_PREFERENCES.includes(s.preference)) {
+        return 'settlement.preference must be one of: evm, any';
+    }
+    if (s.preference === 'evm' && !s.evmAddress) {
+        return 'settlement.evmAddress required when preference is evm';
+    }
+    if (s.preference === 'any' && !s.evmAddress) {
+        return 'settlement: evmAddress required when preference is any';
+    }
+    if (s.evmAddress && !(0, types_1.isValidEvmAddress)(s.evmAddress)) {
+        return 'settlement.evmAddress must be a valid 0x-prefixed address (42 chars)';
+    }
+    if (s.tokenAddress && !(0, types_1.isValidEvmAddress)(s.tokenAddress)) {
+        return 'settlement.tokenAddress must be a valid 0x-prefixed address (42 chars)';
+    }
+    if (s.tokenNetworkAddress && !(0, types_1.isValidEvmAddress)(s.tokenNetworkAddress)) {
+        return 'settlement.tokenNetworkAddress must be a valid 0x-prefixed address (42 chars)';
+    }
+    if (s.chainId !== undefined && (!Number.isInteger(s.chainId) || s.chainId <= 0)) {
+        return 'settlement.chainId must be a positive integer';
+    }
+    if (s.initialDeposit !== undefined && !(0, types_1.isValidNonNegativeIntegerString)(s.initialDeposit)) {
+        return 'settlement.initialDeposit must be a non-negative integer string';
+    }
+    return null;
+}
+function validateOpenChannelRequest(body) {
+    if (!body.peerId || typeof body.peerId !== 'string') {
+        return { valid: false, error: 'Missing or invalid peerId' };
+    }
+    if (!body.chain || typeof body.chain !== 'string') {
+        return { valid: false, error: 'Missing or invalid chain' };
+    }
+    if (!exports.CHAIN_FORMAT_REGEX.test(body.chain)) {
+        return {
+            valid: false,
+            error: `Invalid chain format: ${body.chain}. Expected {blockchain}:{network}:{chainId}`,
+        };
+    }
+    if (body.initialDeposit === undefined || body.initialDeposit === null) {
+        return { valid: false, error: 'Missing initialDeposit' };
+    }
+    if (typeof body.initialDeposit !== 'string') {
+        return { valid: false, error: 'initialDeposit must be a string' };
+    }
+    if (!(0, types_1.isValidNonNegativeIntegerString)(body.initialDeposit)) {
+        return { valid: false, error: 'initialDeposit must be a non-negative integer string' };
+    }
+    if (body.token !== undefined &&
+        typeof body.token === 'string' &&
+        !(0, types_1.isValidEvmAddress)(body.token)) {
+        return { valid: false, error: 'Invalid token address format' };
+    }
+    if (body.tokenNetwork !== undefined &&
+        typeof body.tokenNetwork === 'string' &&
+        !(0, types_1.isValidEvmAddress)(body.tokenNetwork)) {
+        return { valid: false, error: 'Invalid tokenNetwork address format' };
+    }
+    if (body.settlementTimeout !== undefined) {
+        if (typeof body.settlementTimeout !== 'number' ||
+            !Number.isInteger(body.settlementTimeout) ||
+            body.settlementTimeout <= 0) {
+            return { valid: false, error: 'settlementTimeout must be a positive integer' };
+        }
+    }
+    return { valid: true };
+}
+//# sourceMappingURL=admin-api.js.map