@muxoai/platform 0.0.0-stage → 1.2.0

package/dist/store.js

@@ -0,0 +1,1260 @@
+import { DatabaseSync } from "node:sqlite";
+import crypto from "node:crypto";
+const DEFAULT_POLICY = {
+    mode: "enforce",
+    requireApprovalFor: ["admin", "financial", "provisioning", "destructive"],
+    allowInstantWallet: true,
+    allowProvisioning: true,
+    maxCreditsPerRun: 250,
+};
+export class MuxoStore {
+    db;
+    vaultKey;
+    constructor(dbPath, vaultKey) {
+        this.db = new DatabaseSync(dbPath);
+        this.vaultKey = vaultKey;
+        this.initSchema();
+    }
+    initSchema() {
+        this.db.exec(`
+      PRAGMA journal_mode = WAL;
+      PRAGMA foreign_keys = ON;
+
+      CREATE TABLE IF NOT EXISTS users (
+        id TEXT PRIMARY KEY,
+        email TEXT NOT NULL UNIQUE,
+        name TEXT NOT NULL,
+        password_hash TEXT NOT NULL,
+        workspace_id TEXT NOT NULL,
+        role TEXT NOT NULL DEFAULT 'owner',
+        created_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS sessions (
+        token_hash TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL,
+        workspace_id TEXT NOT NULL,
+        expires_at TEXT NOT NULL,
+        created_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS workspaces (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        slug TEXT NOT NULL UNIQUE,
+        owner_user_id TEXT NOT NULL,
+        tier TEXT NOT NULL DEFAULT 'free',
+        monthly_actions_limit INTEGER NOT NULL DEFAULT 1000,
+        monthly_actions_used INTEGER NOT NULL DEFAULT 0,
+        credits_balance INTEGER NOT NULL DEFAULT 100,
+        stripe_customer_id TEXT,
+        stripe_subscription_id TEXT,
+        projects_env_name TEXT NOT NULL,
+        policy_json TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS api_keys (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        name TEXT NOT NULL,
+        key_prefix TEXT NOT NULL,
+        key_hash TEXT NOT NULL UNIQUE,
+        environment TEXT NOT NULL DEFAULT 'live',
+        scopes_json TEXT NOT NULL,
+        last_used_at TEXT,
+        revoked_at TEXT,
+        created_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS connections (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        lane TEXT NOT NULL,
+        provider_slug TEXT NOT NULL,
+        provider_name TEXT NOT NULL,
+        status TEXT NOT NULL,
+        external_account_id TEXT,
+        redirect_url TEXT,
+        metadata_json TEXT NOT NULL DEFAULT '{}',
+        updated_at TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        UNIQUE(workspace_id, lane, provider_slug)
+      );
+
+      CREATE TABLE IF NOT EXISTS resources (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        resource_name TEXT NOT NULL,
+        provider_slug TEXT NOT NULL,
+        provider_name TEXT NOT NULL,
+        service_slug TEXT NOT NULL,
+        plan_slug TEXT,
+        status TEXT NOT NULL,
+        env_var_keys_json TEXT NOT NULL DEFAULT '[]',
+        encrypted_secrets_hex TEXT,
+        external_resource_id TEXT,
+        metadata_json TEXT NOT NULL DEFAULT '{}',
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(workspace_id, resource_name)
+      );
+
+      CREATE TABLE IF NOT EXISTS plans (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        actor_id TEXT NOT NULL,
+        tool_slug TEXT NOT NULL,
+        upstream_slug TEXT NOT NULL,
+        lane TEXT NOT NULL,
+        risk_level TEXT NOT NULL,
+        input_json TEXT NOT NULL,
+        reason TEXT NOT NULL,
+        credit_cost INTEGER NOT NULL DEFAULT 0,
+        approval_status TEXT NOT NULL,
+        approved_by TEXT,
+        approved_at TEXT,
+        run_id TEXT,
+        decision_record_json TEXT,
+        memory_context_json TEXT,
+        created_at TEXT NOT NULL,
+        expires_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS runs (
+        id TEXT PRIMARY KEY,
+        plan_id TEXT NOT NULL,
+        workspace_id TEXT NOT NULL,
+        actor_id TEXT NOT NULL,
+        tool_slug TEXT NOT NULL,
+        lane TEXT NOT NULL,
+        risk_level TEXT NOT NULL,
+        status TEXT NOT NULL,
+        input_json TEXT NOT NULL,
+        output_json TEXT,
+        error TEXT,
+        actions_metered INTEGER NOT NULL DEFAULT 0,
+        credits_metered INTEGER NOT NULL DEFAULT 0,
+        duration_ms INTEGER,
+        receipt_id TEXT,
+        started_at TEXT NOT NULL,
+        completed_at TEXT
+      );
+
+      CREATE TABLE IF NOT EXISTS receipts (
+        id TEXT PRIMARY KEY,
+        run_id TEXT NOT NULL UNIQUE,
+        plan_id TEXT NOT NULL,
+        workspace_id TEXT NOT NULL,
+        actor_id TEXT NOT NULL,
+        tool_slug TEXT NOT NULL,
+        lane TEXT NOT NULL,
+        risk_level TEXT NOT NULL,
+        status TEXT NOT NULL,
+        actions_metered INTEGER NOT NULL,
+        credits_metered INTEGER NOT NULL,
+        input_hash TEXT NOT NULL,
+        output_hash TEXT NOT NULL,
+        prev_receipt_hash TEXT NOT NULL,
+        receipt_hash TEXT NOT NULL,
+        signature TEXT NOT NULL,
+        decision_record_json TEXT,
+        issued_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS memories (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        namespace TEXT NOT NULL,
+        document_id TEXT NOT NULL,
+        title TEXT NOT NULL,
+        content TEXT NOT NULL,
+        kind TEXT NOT NULL,
+        metadata_json TEXT NOT NULL DEFAULT '{}',
+        created_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS agent_claims (
+        claim_slug TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        target_email TEXT NOT NULL,
+        status TEXT NOT NULL DEFAULT 'invited',
+        claimed_at TEXT,
+        expires_at TEXT NOT NULL,
+        created_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS ledger_entries (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        kind TEXT NOT NULL,
+        actions_delta INTEGER NOT NULL DEFAULT 0,
+        credits_delta INTEGER NOT NULL DEFAULT 0,
+        balance_after INTEGER NOT NULL DEFAULT 0,
+        reference_id TEXT,
+        description TEXT NOT NULL,
+        created_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS processed_stripe_events (
+        event_id TEXT PRIMARY KEY,
+        processed_at TEXT NOT NULL
+      );
+    `);
+        // Backwards-compatible column migrations for existing databases
+        for (const stmt of [
+            "ALTER TABLE plans ADD COLUMN decision_record_json TEXT",
+            "ALTER TABLE plans ADD COLUMN memory_context_json TEXT",
+            "ALTER TABLE receipts ADD COLUMN decision_record_json TEXT",
+        ]) {
+            try {
+                this.db.exec(stmt);
+            }
+            catch {
+                // Column already exists
+            }
+        }
+    }
+    // --- Encryption Vault (AES-256-GCM) ---
+    encryptSecrets(workspaceId, secrets) {
+        const iv = crypto.randomBytes(12);
+        const aad = Buffer.from(`muxo-vault:${workspaceId}`, "utf8");
+        const cipher = crypto.createCipheriv("aes-256-gcm", this.vaultKey, iv);
+        cipher.setAAD(aad);
+        const plaintext = Buffer.from(JSON.stringify(secrets), "utf8");
+        const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return `${iv.toString("hex")}:${tag.toString("hex")}:${encrypted.toString("hex")}`;
+    }
+    decryptSecrets(workspaceId, payloadHex) {
+        if (!payloadHex)
+            return {};
+        const parts = payloadHex.split(":");
+        if (parts.length !== 3)
+            return {};
+        const [ivHex, tagHex, dataHex] = parts;
+        const iv = Buffer.from(ivHex, "hex");
+        const tag = Buffer.from(tagHex, "hex");
+        const encrypted = Buffer.from(dataHex, "hex");
+        const aad = Buffer.from(`muxo-vault:${workspaceId}`, "utf8");
+        const decipher = crypto.createDecipheriv("aes-256-gcm", this.vaultKey, iv);
+        decipher.setAAD(aad);
+        decipher.setAuthTag(tag);
+        const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+        return JSON.parse(decrypted.toString("utf8"));
+    }
+    // --- Bootstrap / Auth ---
+    ensureDefaultWorkspace() {
+        const existing = this.db
+            .prepare("SELECT id FROM workspaces ORDER BY created_at ASC LIMIT 1")
+            .get();
+        if (existing) {
+            const workspace = this.getWorkspace(existing.id);
+            const user = this.getUser(workspace.ownerUserId);
+            return { user, workspace };
+        }
+        const created = this.registerUser({
+            email: "founder@muxo.ai",
+            name: "Muxo Founder",
+            password: "muxo-demo-password",
+            workspaceName: "Muxo Default Workspace",
+        });
+        const apiKeyRes = this.createApiKey({
+            workspaceId: created.workspace.id,
+            name: "Default CLI & MCP Key",
+            environment: "live",
+        });
+        return {
+            user: created.user,
+            workspace: created.workspace,
+            defaultApiKey: apiKeyRes.secretKey,
+        };
+    }
+    hashPassword(password) {
+        const salt = "muxo-pw-salt-v1";
+        return crypto.scryptSync(password, salt, 32).toString("hex");
+    }
+    hashToken(token) {
+        return crypto.createHash("sha256").update(token).digest("hex");
+    }
+    registerUser(params) {
+        const now = new Date().toISOString();
+        const userId = `usr_${crypto.randomBytes(8).toString("hex")}`;
+        const workspaceId = `ws_${crypto.randomBytes(8).toString("hex")}`;
+        const slugBase = (params.workspaceName || params.name || "workspace")
+            .toLowerCase()
+            .replace(/[^a-z0-9]+/g, "-")
+            .replace(/^-|-$/g, "");
+        const slug = `${slugBase || "ws"}-${crypto.randomBytes(3).toString("hex")}`;
+        const projectsEnvName = `muxo_${workspaceId.slice(3, 11)}`;
+        const starterCredits = 250; // Initial trial credits for instant tools & exploration
+        this.db
+            .prepare(`INSERT INTO users (id, email, name, password_hash, workspace_id, role, created_at)
+         VALUES (?, ?, ?, ?, ?, 'owner', ?)`)
+            .run(userId, params.email.toLowerCase().trim(), params.name.trim(), this.hashPassword(params.password), workspaceId, now);
+        this.db
+            .prepare(`INSERT INTO workspaces (
+          id, name, slug, owner_user_id, tier,
+          monthly_actions_limit, monthly_actions_used, credits_balance,
+          stripe_customer_id, stripe_subscription_id, projects_env_name,
+          policy_json, created_at, updated_at
+        ) VALUES (?, ?, ?, ?, 'free', 1000, 0, ?, NULL, NULL, ?, ?, ?, ?)`)
+            .run(workspaceId, params.workspaceName?.trim() || `${params.name.trim()}'s Workspace`, slug, userId, starterCredits, projectsEnvName, JSON.stringify(DEFAULT_POLICY), now, now);
+        this.addLedgerEntry({
+            workspaceId,
+            kind: "plan_grant",
+            actionsDelta: 1000,
+            creditsDelta: starterCredits,
+            balanceAfter: starterCredits,
+            referenceId: workspaceId,
+            description: "Free Plan initial monthly allowance (1,000 actions + 250 trial credits)",
+        });
+        const sessionToken = this.createSession(userId, workspaceId);
+        return {
+            user: this.getUser(userId),
+            workspace: this.getWorkspace(workspaceId),
+            sessionToken,
+        };
+    }
+    loginUser(email, password) {
+        const row = this.db
+            .prepare("SELECT * FROM users WHERE email = ?")
+            .get(email.toLowerCase().trim());
+        if (!row)
+            return null;
+        if (row.password_hash !== this.hashPassword(password))
+            return null;
+        const user = this.mapUser(row);
+        const workspace = this.getWorkspace(user.workspaceId);
+        const sessionToken = this.createSession(user.id, workspace.id);
+        return { user, workspace, sessionToken };
+    }
+    createSession(userId, workspaceId) {
+        const rawToken = `mxs_${crypto.randomBytes(24).toString("hex")}`;
+        const now = new Date();
+        const expires = new Date(now.getTime() + 30 * 24 * 3600 * 1000);
+        this.db
+            .prepare(`INSERT INTO sessions (token_hash, user_id, workspace_id, expires_at, created_at)
+         VALUES (?, ?, ?, ?, ?)`)
+            .run(this.hashToken(rawToken), userId, workspaceId, expires.toISOString(), now.toISOString());
+        return rawToken;
+    }
+    resolveAuthToken(token) {
+        const trimmed = token.trim();
+        if (!trimmed)
+            return null;
+        if (trimmed.startsWith("mk_live_") || trimmed.startsWith("mk_test_")) {
+            const hash = this.hashToken(trimmed);
+            const row = this.db
+                .prepare("SELECT * FROM api_keys WHERE key_hash = ? AND revoked_at IS NULL")
+                .get(hash);
+            if (!row)
+                return null;
+            const now = new Date().toISOString();
+            this.db
+                .prepare("UPDATE api_keys SET last_used_at = ? WHERE id = ?")
+                .run(now, String(row.id));
+            const workspace = this.getWorkspace(String(row.workspace_id));
+            if (!workspace)
+                return null;
+            const user = this.getUser(workspace.ownerUserId);
+            if (!user)
+                return null;
+            return {
+                user,
+                workspace,
+                authType: "api_key",
+                actorId: `key:${String(row.id)}`,
+            };
+        }
+        const hash = this.hashToken(trimmed);
+        const sessionRow = this.db
+            .prepare("SELECT * FROM sessions WHERE token_hash = ?")
+            .get(hash);
+        if (!sessionRow)
+            return null;
+        if (new Date(String(sessionRow.expires_at)).getTime() < Date.now()) {
+            return null;
+        }
+        const user = this.getUser(String(sessionRow.user_id));
+        const workspace = this.getWorkspace(String(sessionRow.workspace_id));
+        if (!user || !workspace)
+            return null;
+        return {
+            user,
+            workspace,
+            authType: "session",
+            actorId: user.id,
+        };
+    }
+    getUser(userId) {
+        const row = this.db
+            .prepare("SELECT * FROM users WHERE id = ?")
+            .get(userId);
+        return row ? this.mapUser(row) : null;
+    }
+    getWorkspace(workspaceId) {
+        const row = this.db
+            .prepare("SELECT * FROM workspaces WHERE id = ?")
+            .get(workspaceId);
+        return row ? this.mapWorkspace(row) : null;
+    }
+    updateWorkspacePolicy(workspaceId, policy) {
+        const ws = this.getWorkspace(workspaceId);
+        if (!ws)
+            throw new Error(`Workspace ${workspaceId} not found`);
+        const merged = {
+            ...ws.policy,
+            ...policy,
+        };
+        const now = new Date().toISOString();
+        this.db
+            .prepare("UPDATE workspaces SET policy_json = ?, updated_at = ? WHERE id = ?")
+            .run(JSON.stringify(merged), now, workspaceId);
+        return this.getWorkspace(workspaceId);
+    }
+    // --- API Keys ---
+    createApiKey(params) {
+        const env = params.environment || "live";
+        const id = `key_${crypto.randomBytes(6).toString("hex")}`;
+        const rawSecret = `mk_${env}_${id.slice(4)}_${crypto.randomBytes(16).toString("hex")}`;
+        const keyPrefix = `${rawSecret.slice(0, 16)}...${rawSecret.slice(-4)}`;
+        const scopes = params.scopes || ["tools:read", "tools:execute", "resources:provision"];
+        const now = new Date().toISOString();
+        this.db
+            .prepare(`INSERT INTO api_keys (
+          id, workspace_id, name, key_prefix, key_hash, environment, scopes_json, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(id, params.workspaceId, params.name, keyPrefix, this.hashToken(rawSecret), env, JSON.stringify(scopes), now);
+        return {
+            record: {
+                id,
+                workspaceId: params.workspaceId,
+                name: params.name,
+                keyPrefix,
+                environment: env,
+                scopes,
+                lastUsedAt: null,
+                revokedAt: null,
+                createdAt: now,
+            },
+            secretKey: rawSecret,
+        };
+    }
+    listApiKeys(workspaceId) {
+        const rows = this.db
+            .prepare("SELECT * FROM api_keys WHERE workspace_id = ? ORDER BY created_at DESC")
+            .all(workspaceId);
+        return rows.map((r) => ({
+            id: String(r.id),
+            workspaceId: String(r.workspace_id),
+            name: String(r.name),
+            keyPrefix: String(r.key_prefix),
+            environment: String(r.environment),
+            scopes: JSON.parse(String(r.scopes_json || "[]")),
+            lastUsedAt: r.last_used_at ? String(r.last_used_at) : null,
+            revokedAt: r.revoked_at ? String(r.revoked_at) : null,
+            createdAt: String(r.created_at),
+        }));
+    }
+    revokeApiKey(workspaceId, keyId) {
+        const now = new Date().toISOString();
+        const res = this.db
+            .prepare("UPDATE api_keys SET revoked_at = ? WHERE id = ? AND workspace_id = ?")
+            .run(now, keyId, workspaceId);
+        return res.changes > 0;
+    }
+    // --- Connections ---
+    upsertConnection(params) {
+        const now = new Date().toISOString();
+        const existing = this.db
+            .prepare("SELECT id FROM connections WHERE workspace_id = ? AND lane = ? AND provider_slug = ?")
+            .get(params.workspaceId, params.lane, params.providerSlug);
+        const id = existing?.id || `conn_${crypto.randomBytes(8).toString("hex")}`;
+        this.db
+            .prepare(`INSERT INTO connections (
+          id, workspace_id, lane, provider_slug, provider_name, status,
+          external_account_id, redirect_url, metadata_json, updated_at, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(workspace_id, lane, provider_slug) DO UPDATE SET
+          provider_name = excluded.provider_name,
+          status = excluded.status,
+          external_account_id = COALESCE(excluded.external_account_id, connections.external_account_id),
+          redirect_url = CASE
+            WHEN excluded.status = 'active' THEN NULL
+            ELSE COALESCE(excluded.redirect_url, connections.redirect_url)
+          END,
+          metadata_json = excluded.metadata_json,
+          updated_at = excluded.updated_at`)
+            .run(id, params.workspaceId, params.lane, params.providerSlug, params.providerName, params.status, params.externalAccountId ?? null, params.redirectUrl ?? null, JSON.stringify(params.metadata || {}), now, now);
+        return this.getConnection(id);
+    }
+    getConnection(id) {
+        const row = this.db
+            .prepare("SELECT * FROM connections WHERE id = ?")
+            .get(id);
+        return row ? this.mapConnection(row) : null;
+    }
+    listConnections(workspaceId) {
+        const rows = this.db
+            .prepare("SELECT * FROM connections WHERE workspace_id = ? ORDER BY updated_at DESC")
+            .all(workspaceId);
+        return rows.map((r) => this.mapConnection(r));
+    }
+    // --- Provisioned Resources (Stripe Projects Vault) ---
+    upsertResource(params) {
+        const now = new Date().toISOString();
+        const existing = this.db
+            .prepare("SELECT id, env_var_keys_json, encrypted_secrets_hex FROM resources WHERE workspace_id = ? AND resource_name = ?")
+            .get(params.workspaceId, params.resourceName);
+        const id = existing?.id || `res_${crypto.randomBytes(8).toString("hex")}`;
+        let envVarKeys = existing
+            ? JSON.parse(existing.env_var_keys_json || "[]")
+            : [];
+        let encryptedHex = existing?.encrypted_secrets_hex || null;
+        if (params.secrets && Object.keys(params.secrets).length > 0) {
+            const mergedSecrets = {
+                ...this.decryptSecrets(params.workspaceId, encryptedHex),
+                ...params.secrets,
+            };
+            envVarKeys = Object.keys(mergedSecrets).sort();
+            encryptedHex = this.encryptSecrets(params.workspaceId, mergedSecrets);
+        }
+        this.db
+            .prepare(`INSERT INTO resources (
+          id, workspace_id, resource_name, provider_slug, provider_name,
+          service_slug, plan_slug, status, env_var_keys_json,
+          encrypted_secrets_hex, external_resource_id, metadata_json,
+          created_at, updated_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(workspace_id, resource_name) DO UPDATE SET
+          status = excluded.status,
+          service_slug = excluded.service_slug,
+          plan_slug = COALESCE(excluded.plan_slug, resources.plan_slug),
+          env_var_keys_json = excluded.env_var_keys_json,
+          encrypted_secrets_hex = COALESCE(excluded.encrypted_secrets_hex, resources.encrypted_secrets_hex),
+          external_resource_id = COALESCE(excluded.external_resource_id, resources.external_resource_id),
+          metadata_json = excluded.metadata_json,
+          updated_at = excluded.updated_at`)
+            .run(id, params.workspaceId, params.resourceName, params.providerSlug, params.providerName, params.serviceSlug, params.planSlug ?? null, params.status, JSON.stringify(envVarKeys), encryptedHex, params.externalResourceId ?? null, JSON.stringify(params.metadata || {}), now, now);
+        return this.getResource(params.workspaceId, params.resourceName);
+    }
+    getResource(workspaceId, resourceNameOrId) {
+        const row = this.db
+            .prepare("SELECT * FROM resources WHERE workspace_id = ? AND (resource_name = ? OR id = ?)")
+            .get(workspaceId, resourceNameOrId, resourceNameOrId);
+        return row ? this.mapResource(row) : null;
+    }
+    listResources(workspaceId) {
+        const rows = this.db
+            .prepare("SELECT * FROM resources WHERE workspace_id = ? ORDER BY updated_at DESC")
+            .all(workspaceId);
+        return rows.map((r) => this.mapResource(r));
+    }
+    getDecryptedWorkspaceEnv(workspaceId) {
+        const rows = this.db
+            .prepare("SELECT encrypted_secrets_hex FROM resources WHERE workspace_id = ? AND status = 'active'")
+            .all(workspaceId);
+        const merged = {};
+        for (const row of rows) {
+            Object.assign(merged, this.decryptSecrets(workspaceId, row.encrypted_secrets_hex));
+        }
+        return merged;
+    }
+    // --- Plans ---
+    createPlan(params) {
+        const id = `plan_${crypto.randomBytes(8).toString("hex")}`;
+        const now = new Date();
+        const expires = new Date(now.getTime() + 60 * 60 * 1000);
+        this.db
+            .prepare(`INSERT INTO plans (
+          id, workspace_id, actor_id, tool_slug, upstream_slug, lane, risk_level,
+          input_json, reason, credit_cost, approval_status, approved_by, approved_at,
+          run_id, decision_record_json, memory_context_json, created_at, expires_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?)`)
+            .run(id, params.workspaceId, params.actorId, params.toolSlug, params.upstreamSlug, params.lane, params.riskLevel, JSON.stringify(params.input || {}), params.reason, params.creditCost, params.approvalStatus, params.approvalStatus === "auto_approved" ? "policy:auto" : null, params.approvalStatus === "auto_approved" ? now.toISOString() : null, params.decisionRecord ? JSON.stringify(params.decisionRecord) : null, params.memoryContext ? JSON.stringify(params.memoryContext) : null, now.toISOString(), expires.toISOString());
+        return this.getPlan(params.workspaceId, id);
+    }
+    getPlan(workspaceId, planId) {
+        const row = this.db
+            .prepare("SELECT * FROM plans WHERE id = ? AND workspace_id = ?")
+            .get(planId, workspaceId);
+        return row ? this.mapPlan(row) : null;
+    }
+    listPlans(workspaceId, limit = 50) {
+        const rows = this.db
+            .prepare("SELECT * FROM plans WHERE workspace_id = ? ORDER BY created_at DESC LIMIT ?")
+            .all(workspaceId, limit);
+        return rows.map((r) => this.mapPlan(r));
+    }
+    updatePlanApproval(params) {
+        const now = new Date().toISOString();
+        this.db
+            .prepare(`UPDATE plans
+         SET approval_status = ?, approved_by = ?, approved_at = ?
+         WHERE id = ? AND workspace_id = ?`)
+            .run(params.approvalStatus, params.approvedBy, now, params.planId, params.workspaceId);
+        return this.getPlan(params.workspaceId, params.planId);
+    }
+    // --- Runs & Cryptographic Receipts ---
+    createRun(plan, actorId) {
+        const id = `run_${crypto.randomBytes(8).toString("hex")}`;
+        const now = new Date().toISOString();
+        this.db
+            .prepare(`INSERT INTO runs (
+          id, plan_id, workspace_id, actor_id, tool_slug, lane, risk_level,
+          status, input_json, output_json, error, actions_metered, credits_metered,
+          duration_ms, receipt_id, started_at, completed_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, 'running', ?, NULL, NULL, 0, 0, NULL, NULL, ?, NULL)`)
+            .run(id, plan.id, plan.workspaceId, actorId, plan.toolSlug, plan.lane, plan.riskLevel, JSON.stringify(plan.input), now);
+        this.db
+            .prepare("UPDATE plans SET run_id = ?, approval_status = 'executed' WHERE id = ?")
+            .run(id, plan.id);
+        return this.getRun(plan.workspaceId, id);
+    }
+    finalizeRun(params) {
+        const run = this.getRun(params.workspaceId, params.runId);
+        if (!run)
+            throw new Error(`Run ${params.runId} not found`);
+        const now = new Date().toISOString();
+        if (params.actionsMetered > 0 || params.creditsMetered > 0) {
+            const ws = this.getWorkspace(params.workspaceId);
+            const newActionsUsed = ws.monthlyActionsUsed + params.actionsMetered;
+            const newCreditsBalance = Math.max(0, ws.creditsBalance - params.creditsMetered);
+            this.db
+                .prepare(`UPDATE workspaces
+           SET monthly_actions_used = ?, credits_balance = ?, updated_at = ?
+           WHERE id = ?`)
+                .run(newActionsUsed, newCreditsBalance, now, params.workspaceId);
+            const settlement = this.computeSupplierSettlement(run.lane, run.toolSlug, params.creditsMetered, "settled_by_muxo_master_wallet");
+            this.addLedgerEntry({
+                workspaceId: params.workspaceId,
+                kind: "run_deduction",
+                actionsDelta: -params.actionsMetered,
+                creditsDelta: -params.creditsMetered,
+                balanceAfter: newCreditsBalance,
+                referenceId: run.id,
+                description: `Executed ${run.toolSlug} (${run.lane}) — User paid Muxo ${params.creditsMetered} credits ($${(settlement.userRetailChargeCents / 100).toFixed(2)}) -> Muxo paid ${settlement.supplierName} ($${(settlement.supplierWholesalePayableCents / 100).toFixed(2)})`,
+            });
+        }
+        const receipt = this.issueReceipt({
+            run,
+            status: params.status,
+            output: params.output ?? null,
+            actionsMetered: params.actionsMetered,
+            creditsMetered: params.creditsMetered,
+            decisionRecord: params.decisionRecord ?? null,
+            issuedAt: now,
+        });
+        this.db
+            .prepare(`UPDATE runs
+         SET status = ?, output_json = ?, error = ?, actions_metered = ?,
+             credits_metered = ?, duration_ms = ?, receipt_id = ?, completed_at = ?
+         WHERE id = ? AND workspace_id = ?`)
+            .run(params.status, params.output ? JSON.stringify(params.output) : null, params.error ?? null, params.actionsMetered, params.creditsMetered, params.durationMs, receipt.id, now, params.runId, params.workspaceId);
+        return {
+            run: this.getRun(params.workspaceId, params.runId),
+            receipt,
+        };
+    }
+    issueReceipt(params) {
+        const id = `rcpt_${crypto.randomBytes(8).toString("hex")}`;
+        const lastReceipt = this.db
+            .prepare("SELECT receipt_hash FROM receipts WHERE workspace_id = ? ORDER BY issued_at DESC LIMIT 1")
+            .get(params.run.workspaceId);
+        const prevReceiptHash = lastReceipt?.receipt_hash || "genesis_0000000000000000";
+        const inputHash = crypto
+            .createHash("sha256")
+            .update(JSON.stringify(params.run.input || {}))
+            .digest("hex");
+        const outputHash = crypto
+            .createHash("sha256")
+            .update(JSON.stringify(params.output || {}))
+            .digest("hex");
+        const canonicalPayload = [
+            id,
+            params.run.id,
+            params.run.planId,
+            params.run.workspaceId,
+            params.run.actorId,
+            params.run.toolSlug,
+            params.run.lane,
+            params.run.riskLevel,
+            params.status,
+            String(params.actionsMetered),
+            String(params.creditsMetered),
+            inputHash,
+            outputHash,
+            prevReceiptHash,
+            params.issuedAt,
+        ].join("|");
+        const receiptHash = crypto.createHash("sha256").update(canonicalPayload).digest("hex");
+        const signature = crypto
+            .createHmac("sha256", this.vaultKey)
+            .update(receiptHash)
+            .digest("hex");
+        this.db
+            .prepare(`INSERT INTO receipts (
+          id, run_id, plan_id, workspace_id, actor_id, tool_slug, lane, risk_level,
+          status, actions_metered, credits_metered, input_hash, output_hash,
+          prev_receipt_hash, receipt_hash, signature, decision_record_json, issued_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(id, params.run.id, params.run.planId, params.run.workspaceId, params.run.actorId, params.run.toolSlug, params.run.lane, params.run.riskLevel, params.status, params.actionsMetered, params.creditsMetered, inputHash, outputHash, prevReceiptHash, receiptHash, signature, params.decisionRecord ? JSON.stringify(params.decisionRecord) : null, params.issuedAt);
+        return this.getReceipt(params.run.workspaceId, id);
+    }
+    verifyReceipt(receipt) {
+        const canonicalPayload = [
+            receipt.id,
+            receipt.runId,
+            receipt.planId,
+            receipt.workspaceId,
+            receipt.actorId,
+            receipt.toolSlug,
+            receipt.lane,
+            receipt.riskLevel,
+            receipt.status,
+            String(receipt.actionsMetered),
+            String(receipt.creditsMetered),
+            receipt.inputHash,
+            receipt.outputHash,
+            receipt.prevReceiptHash,
+            receipt.issuedAt,
+        ].join("|");
+        const expectedHash = crypto.createHash("sha256").update(canonicalPayload).digest("hex");
+        if (expectedHash !== receipt.receiptHash)
+            return false;
+        const expectedSig = crypto
+            .createHmac("sha256", this.vaultKey)
+            .update(expectedHash)
+            .digest("hex");
+        return expectedSig === receipt.signature;
+    }
+    getRun(workspaceId, runId) {
+        const row = this.db
+            .prepare("SELECT * FROM runs WHERE id = ? AND workspace_id = ?")
+            .get(runId, workspaceId);
+        return row ? this.mapRun(row) : null;
+    }
+    listRuns(workspaceId, limit = 50) {
+        const rows = this.db
+            .prepare("SELECT * FROM runs WHERE workspace_id = ? ORDER BY started_at DESC LIMIT ?")
+            .all(workspaceId, limit);
+        return rows.map((r) => this.mapRun(r));
+    }
+    getReceipt(workspaceId, receiptIdOrRunId) {
+        const row = this.db
+            .prepare("SELECT * FROM receipts WHERE workspace_id = ? AND (id = ? OR run_id = ?)")
+            .get(workspaceId, receiptIdOrRunId, receiptIdOrRunId);
+        return row ? this.mapReceipt(row) : null;
+    }
+    listReceipts(workspaceId, limit = 50) {
+        const rows = this.db
+            .prepare("SELECT * FROM receipts WHERE workspace_id = ? ORDER BY issued_at DESC LIMIT ?")
+            .all(workspaceId, limit);
+        return rows.map((r) => this.mapReceipt(r));
+    }
+    // --- Billing & Credit Ledger ---
+    markStripeEventProcessed(eventId) {
+        const existing = this.db
+            .prepare("SELECT event_id FROM processed_stripe_events WHERE event_id = ?")
+            .get(eventId);
+        if (existing)
+            return false;
+        this.db
+            .prepare("INSERT INTO processed_stripe_events (event_id, processed_at) VALUES (?, ?)")
+            .run(eventId, new Date().toISOString());
+        return true;
+    }
+    upgradeWorkspaceToStarter(params) {
+        if (!this.markStripeEventProcessed(`upgrade:${params.referenceId}`)) {
+            return this.getWorkspace(params.workspaceId);
+        }
+        const ws = this.getWorkspace(params.workspaceId);
+        if (!ws)
+            throw new Error(`Workspace ${params.workspaceId} not found`);
+        const now = new Date().toISOString();
+        const newCredits = ws.creditsBalance + 1000;
+        this.db
+            .prepare(`UPDATE workspaces
+         SET tier = 'starter',
+             monthly_actions_limit = 5000,
+             credits_balance = ?,
+             stripe_customer_id = COALESCE(?, stripe_customer_id),
+             stripe_subscription_id = COALESCE(?, stripe_subscription_id),
+             updated_at = ?
+         WHERE id = ?`)
+            .run(newCredits, params.stripeCustomerId ?? null, params.stripeSubscriptionId ?? null, now, params.workspaceId);
+        this.addLedgerEntry({
+            workspaceId: params.workspaceId,
+            kind: "subscription_upgrade",
+            actionsDelta: 4000,
+            creditsDelta: 1000,
+            balanceAfter: newCredits,
+            referenceId: params.referenceId,
+            description: "Upgraded to Starter Plan ($29/mo — 5,000 actions/mo + 1,000 credits)",
+        });
+        return this.getWorkspace(params.workspaceId);
+    }
+    addWorkspaceCredits(params) {
+        if (!this.markStripeEventProcessed(`credits:${params.referenceId}`)) {
+            return this.getWorkspace(params.workspaceId);
+        }
+        const ws = this.getWorkspace(params.workspaceId);
+        if (!ws)
+            throw new Error(`Workspace ${params.workspaceId} not found`);
+        const now = new Date().toISOString();
+        const newCredits = ws.creditsBalance + params.credits;
+        this.db
+            .prepare("UPDATE workspaces SET credits_balance = ?, updated_at = ? WHERE id = ?")
+            .run(newCredits, now, params.workspaceId);
+        this.addLedgerEntry({
+            workspaceId: params.workspaceId,
+            kind: "credit_topup",
+            actionsDelta: 0,
+            creditsDelta: params.credits,
+            balanceAfter: newCredits,
+            referenceId: params.referenceId,
+            description: params.description,
+        });
+        return this.getWorkspace(params.workspaceId);
+    }
+    addLedgerEntry(params) {
+        const id = `led_${crypto.randomBytes(8).toString("hex")}`;
+        const now = new Date().toISOString();
+        this.db
+            .prepare(`INSERT INTO ledger_entries (
+          id, workspace_id, kind, actions_delta, credits_delta,
+          balance_after, reference_id, description, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(id, params.workspaceId, params.kind, params.actionsDelta, params.creditsDelta, params.balanceAfter, params.referenceId, params.description, now);
+        return {
+            id,
+            workspaceId: params.workspaceId,
+            kind: params.kind,
+            actionsDelta: params.actionsDelta,
+            creditsDelta: params.creditsDelta,
+            balanceAfter: params.balanceAfter,
+            referenceId: params.referenceId,
+            description: params.description,
+            createdAt: now,
+        };
+    }
+    computeSupplierSettlement(lane, toolSlug, creditCost, settlementStatus = "settled_by_muxo_master_wallet") {
+        const userChargeCredits = Math.max(0, Number(creditCost || 0));
+        const userRetailChargeCents = Math.round(userChargeCredits * 100) / 100;
+        const supplierWholesalePayableCents = Math.round(userRetailChargeCents * 0.6 * 100) / 100;
+        const muxoNetMarginCents = Math.round((userRetailChargeCents - supplierWholesalePayableCents) * 100) / 100;
+        const upstreamProvider = toolSlug.split(".")[1] || lane;
+        const supplierMeta = {
+            composio_instant: {
+                supplierName: "Composio Instant Wholesale Wallet",
+                masterAccountRef: "muxo_master_composio_wallet",
+            },
+            composio_sdk: {
+                supplierName: "Composio Managed OAuth Gateway",
+                masterAccountRef: "muxo_master_composio_sdk_account",
+            },
+            stripe_projects: {
+                supplierName: "Stripe Projects Master Infrastructure Account",
+                masterAccountRef: "muxo_master_stripe_projects_account",
+            },
+        };
+        const meta = supplierMeta[lane] || supplierMeta.composio_instant;
+        return {
+            fundingMode: "muxo_funded",
+            supplier: lane,
+            supplierName: meta.supplierName,
+            upstreamProvider,
+            userChargeCredits,
+            userRetailChargeCents,
+            supplierWholesalePayableCents,
+            muxoNetMarginCents,
+            settlementStatus,
+            masterAccountRef: meta.masterAccountRef,
+        };
+    }
+    getSupplierSettlementSummary(workspaceId) {
+        const ws = this.getWorkspace(workspaceId);
+        const ledger = this.listLedgerEntries(workspaceId, 500);
+        const runs = this.listRuns(workspaceId, 500).filter((r) => r.status === "succeeded");
+        const totalCreditsPurchasedOrGranted = ledger
+            .filter((e) => e.creditsDelta > 0)
+            .reduce((acc, e) => acc + e.creditsDelta, 0);
+        const bySupplier = {
+            composio_instant: {
+                runsCount: 0,
+                creditsConsumed: 0,
+                userRetailSpendCents: 0,
+                supplierWholesalePaidCents: 0,
+                muxoNetMarginCents: 0,
+            },
+            composio_sdk: {
+                runsCount: 0,
+                creditsConsumed: 0,
+                userRetailSpendCents: 0,
+                supplierWholesalePaidCents: 0,
+                muxoNetMarginCents: 0,
+            },
+            stripe_projects: {
+                runsCount: 0,
+                creditsConsumed: 0,
+                userRetailSpendCents: 0,
+                supplierWholesalePaidCents: 0,
+                muxoNetMarginCents: 0,
+            },
+        };
+        let totalCreditsConsumed = 0;
+        let totalUserRetailSpendCents = 0;
+        let totalSupplierWholesalePaidCents = 0;
+        let totalMuxoNetMarginCents = 0;
+        for (const run of runs) {
+            const s = this.computeSupplierSettlement(run.lane, run.toolSlug, run.creditsMetered, "settled_by_muxo_master_wallet");
+            const bucket = bySupplier[run.lane] || bySupplier.composio_instant;
+            bucket.runsCount += 1;
+            bucket.creditsConsumed += s.userChargeCredits;
+            bucket.userRetailSpendCents =
+                Math.round((bucket.userRetailSpendCents + s.userRetailChargeCents) * 100) / 100;
+            bucket.supplierWholesalePaidCents =
+                Math.round((bucket.supplierWholesalePaidCents + s.supplierWholesalePayableCents) * 100) / 100;
+            bucket.muxoNetMarginCents =
+                Math.round((bucket.muxoNetMarginCents + s.muxoNetMarginCents) * 100) / 100;
+            totalCreditsConsumed += s.userChargeCredits;
+            totalUserRetailSpendCents =
+                Math.round((totalUserRetailSpendCents + s.userRetailChargeCents) * 100) / 100;
+            totalSupplierWholesalePaidCents =
+                Math.round((totalSupplierWholesalePaidCents + s.supplierWholesalePayableCents) * 100) / 100;
+            totalMuxoNetMarginCents =
+                Math.round((totalMuxoNetMarginCents + s.muxoNetMarginCents) * 100) / 100;
+        }
+        return {
+            workspaceId,
+            fundingModel: "user_pays_muxo_muxo_pays_suppliers",
+            creditPriceCents: 1,
+            totalCreditsPurchasedOrGranted,
+            totalCreditsConsumed,
+            currentCreditsBalance: ws?.creditsBalance ?? 0,
+            totalUserRetailSpendCents,
+            totalSupplierWholesalePaidCents,
+            totalMuxoNetMarginCents,
+            bySupplier,
+        };
+    }
+    listLedgerEntries(workspaceId, limit = 50) {
+        const rows = this.db
+            .prepare("SELECT * FROM ledger_entries WHERE workspace_id = ? ORDER BY created_at DESC LIMIT ?")
+            .all(workspaceId, limit);
+        return rows.map((r) => {
+            const kind = String(r.kind);
+            const refId = r.reference_id ? String(r.reference_id) : null;
+            const creditsDelta = Number(r.credits_delta);
+            let supplierSettlement = null;
+            if (kind === "run_deduction" && refId) {
+                const run = this.getRun(workspaceId, refId);
+                if (run) {
+                    supplierSettlement = this.computeSupplierSettlement(run.lane, run.toolSlug, Math.abs(creditsDelta), "settled_by_muxo_master_wallet");
+                }
+            }
+            return {
+                id: String(r.id),
+                workspaceId: String(r.workspace_id),
+                kind,
+                actionsDelta: Number(r.actions_delta),
+                creditsDelta,
+                balanceAfter: Number(r.balance_after),
+                referenceId: refId,
+                description: String(r.description),
+                supplierSettlement,
+                createdAt: String(r.created_at),
+            };
+        });
+    }
+    // --- Supermemory Local Index ---
+    saveMemoryRecord(params) {
+        const id = `mem_${crypto.randomBytes(8).toString("hex")}`;
+        const now = new Date().toISOString();
+        this.db
+            .prepare(`INSERT INTO memories (
+          id, workspace_id, namespace, document_id, title, content, kind, metadata_json, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(id, params.workspaceId, params.namespace, params.documentId, params.title, params.content, params.kind, JSON.stringify(params.metadata || {}), now);
+        return {
+            id,
+            workspaceId: params.workspaceId,
+            namespace: params.namespace,
+            documentId: params.documentId,
+            title: params.title,
+            content: params.content,
+            kind: params.kind,
+            metadata: params.metadata || {},
+            createdAt: now,
+        };
+    }
+    listMemoryRecords(workspaceId, limit = 30) {
+        const rows = this.db
+            .prepare("SELECT * FROM memories WHERE workspace_id = ? ORDER BY created_at DESC LIMIT ?")
+            .all(workspaceId, limit);
+        return rows.map((r) => ({
+            id: String(r.id),
+            workspaceId: String(r.workspace_id),
+            namespace: String(r.namespace),
+            documentId: String(r.document_id),
+            title: String(r.title),
+            content: String(r.content),
+            kind: String(r.kind),
+            metadata: JSON.parse(String(r.metadata_json || "{}")),
+            createdAt: String(r.created_at),
+        }));
+    }
+    deleteMemoryRecord(workspaceId, idOrDocId) {
+        const row = this.db
+            .prepare("SELECT * FROM memories WHERE workspace_id = ? AND (id = ? OR document_id = ?)")
+            .get(workspaceId, idOrDocId, idOrDocId);
+        if (!row)
+            return null;
+        this.db
+            .prepare("DELETE FROM memories WHERE id = ? AND workspace_id = ?")
+            .run(String(row.id), workspaceId);
+        return {
+            id: String(row.id),
+            workspaceId: String(row.workspace_id),
+            namespace: String(row.namespace),
+            documentId: String(row.document_id),
+            title: String(row.title),
+            content: String(row.content),
+            kind: String(row.kind),
+            metadata: JSON.parse(String(row.metadata_json || "{}")),
+            createdAt: String(row.created_at),
+        };
+    }
+    // --- Autonomous Agent Onboarding (agents.composio.dev pattern) ---
+    createAutonomousAgentSignup(params) {
+        const suffix = crypto.randomBytes(4).toString("hex");
+        const agentName = (params?.agentName || `Autonomous Agent ${suffix}`).trim();
+        const email = `agent+${suffix}@agents.muxo.ai`;
+        const password = crypto.randomBytes(16).toString("hex");
+        const created = this.registerUser({
+            email,
+            name: agentName,
+            password,
+            workspaceName: `${agentName} Workspace`,
+        });
+        const keyRes = this.createApiKey({
+            workspaceId: created.workspace.id,
+            name: params?.harness
+                ? `${params.harness} Autonomous Key`
+                : "Autonomous Agent Key",
+            environment: "live",
+        });
+        return {
+            user: created.user,
+            workspace: created.workspace,
+            apiKey: keyRes.secretKey,
+            apiKeyRecord: keyRes.record,
+        };
+    }
+    getLatestClaimForWorkspace(workspaceId) {
+        const row = this.db
+            .prepare(`SELECT * FROM agent_claims
+         WHERE workspace_id = ?
+         ORDER BY created_at DESC
+         LIMIT 1`)
+            .get(workspaceId);
+        if (!row)
+            return null;
+        return {
+            claimSlug: String(row.claim_slug),
+            targetEmail: String(row.target_email),
+            status: String(row.status),
+            claimedAt: row.claimed_at ? String(row.claimed_at) : null,
+            expiresAt: String(row.expires_at),
+        };
+    }
+    createAgentClaim(params) {
+        const claimSlug = crypto.randomBytes(9).toString("base64url");
+        const now = new Date();
+        const expires = new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000);
+        this.db
+            .prepare(`INSERT INTO agent_claims (
+          claim_slug, workspace_id, target_email, status, claimed_at, expires_at, created_at
+        ) VALUES (?, ?, ?, 'invited', NULL, ?, ?)`)
+            .run(claimSlug, params.workspaceId, params.email.trim().toLowerCase(), expires.toISOString(), now.toISOString());
+        return {
+            claimSlug,
+            claimUrl: `${params.baseUrl.replace(/\/$/, "")}/claim/${claimSlug}`,
+            targetEmail: params.email.trim().toLowerCase(),
+            status: "invited",
+            expiresAt: expires.toISOString(),
+        };
+    }
+    redeemAgentClaim(claimSlug) {
+        const row = this.db
+            .prepare("SELECT * FROM agent_claims WHERE claim_slug = ?")
+            .get(claimSlug);
+        if (!row)
+            return null;
+        const now = new Date().toISOString();
+        const workspaceId = String(row.workspace_id);
+        const targetEmail = String(row.target_email);
+        this.db
+            .prepare("UPDATE agent_claims SET status = 'claimed', claimed_at = ? WHERE claim_slug = ?")
+            .run(now, claimSlug);
+        const workspace = this.getWorkspace(workspaceId);
+        if (!workspace)
+            return null;
+        return {
+            claimSlug,
+            workspace,
+            targetEmail,
+            status: "claimed",
+            claimedAt: now,
+        };
+    }
+    // --- Row Mappers ---
+    mapUser(row) {
+        return {
+            id: String(row.id),
+            email: String(row.email),
+            name: String(row.name),
+            workspaceId: String(row.workspace_id),
+            role: String(row.role),
+            createdAt: String(row.created_at),
+        };
+    }
+    mapWorkspace(row) {
+        return {
+            id: String(row.id),
+            name: String(row.name),
+            slug: String(row.slug),
+            ownerUserId: String(row.owner_user_id),
+            tier: String(row.tier),
+            monthlyActionsLimit: Number(row.monthly_actions_limit),
+            monthlyActionsUsed: Number(row.monthly_actions_used),
+            creditsBalance: Number(row.credits_balance),
+            stripeCustomerId: row.stripe_customer_id ? String(row.stripe_customer_id) : null,
+            stripeSubscriptionId: row.stripe_subscription_id
+                ? String(row.stripe_subscription_id)
+                : null,
+            projectsEnvName: String(row.projects_env_name),
+            policy: JSON.parse(String(row.policy_json || "{}")),
+            createdAt: String(row.created_at),
+            updatedAt: String(row.updated_at),
+        };
+    }
+    mapConnection(row) {
+        return {
+            id: String(row.id),
+            workspaceId: String(row.workspace_id),
+            lane: String(row.lane),
+            providerSlug: String(row.provider_slug),
+            providerName: String(row.provider_name),
+            status: String(row.status),
+            externalAccountId: row.external_account_id ? String(row.external_account_id) : null,
+            redirectUrl: row.redirect_url ? String(row.redirect_url) : null,
+            metadata: JSON.parse(String(row.metadata_json || "{}")),
+            updatedAt: String(row.updated_at),
+            createdAt: String(row.created_at),
+        };
+    }
+    mapResource(row) {
+        return {
+            id: String(row.id),
+            workspaceId: String(row.workspace_id),
+            resourceName: String(row.resource_name),
+            providerSlug: String(row.provider_slug),
+            providerName: String(row.provider_name),
+            serviceSlug: String(row.service_slug),
+            planSlug: row.plan_slug ? String(row.plan_slug) : null,
+            status: String(row.status),
+            envVarKeys: JSON.parse(String(row.env_var_keys_json || "[]")),
+            externalResourceId: row.external_resource_id
+                ? String(row.external_resource_id)
+                : null,
+            metadata: JSON.parse(String(row.metadata_json || "{}")),
+            createdAt: String(row.created_at),
+            updatedAt: String(row.updated_at),
+        };
+    }
+    mapPlan(row) {
+        const lane = String(row.lane);
+        const toolSlug = String(row.tool_slug);
+        const creditCost = Number(row.credit_cost);
+        const approvalStatus = String(row.approval_status);
+        return {
+            id: String(row.id),
+            workspaceId: String(row.workspace_id),
+            actorId: String(row.actor_id),
+            toolSlug,
+            upstreamSlug: String(row.upstream_slug),
+            lane,
+            riskLevel: String(row.risk_level),
+            input: JSON.parse(String(row.input_json || "{}")),
+            reason: String(row.reason),
+            creditCost,
+            approvalStatus,
+            approvedBy: row.approved_by ? String(row.approved_by) : null,
+            approvedAt: row.approved_at ? String(row.approved_at) : null,
+            runId: row.run_id ? String(row.run_id) : null,
+            decisionRecord: row.decision_record_json
+                ? JSON.parse(String(row.decision_record_json))
+                : null,
+            memoryContext: row.memory_context_json
+                ? JSON.parse(String(row.memory_context_json))
+                : null,
+            supplierSettlement: this.computeSupplierSettlement(lane, toolSlug, creditCost, approvalStatus === "executed"
+                ? "settled_by_muxo_master_wallet"
+                : "planned_muxo_master_wallet"),
+            createdAt: String(row.created_at),
+            expiresAt: String(row.expires_at),
+        };
+    }
+    mapRun(row) {
+        return {
+            id: String(row.id),
+            planId: String(row.plan_id),
+            workspaceId: String(row.workspace_id),
+            actorId: String(row.actor_id),
+            toolSlug: String(row.tool_slug),
+            lane: String(row.lane),
+            riskLevel: String(row.risk_level),
+            status: String(row.status),
+            input: JSON.parse(String(row.input_json || "{}")),
+            output: row.output_json ? JSON.parse(String(row.output_json)) : null,
+            error: row.error ? String(row.error) : null,
+            actionsMetered: Number(row.actions_metered),
+            creditsMetered: Number(row.credits_metered),
+            durationMs: row.duration_ms !== null ? Number(row.duration_ms) : null,
+            receiptId: row.receipt_id ? String(row.receipt_id) : null,
+            startedAt: String(row.started_at),
+            completedAt: row.completed_at ? String(row.completed_at) : null,
+        };
+    }
+    mapReceipt(row) {
+        const lane = String(row.lane);
+        const toolSlug = String(row.tool_slug);
+        const creditsMetered = Number(row.credits_metered);
+        return {
+            id: String(row.id),
+            runId: String(row.run_id),
+            planId: String(row.plan_id),
+            workspaceId: String(row.workspace_id),
+            actorId: String(row.actor_id),
+            toolSlug,
+            lane,
+            riskLevel: String(row.risk_level),
+            status: String(row.status),
+            actionsMetered: Number(row.actions_metered),
+            creditsMetered,
+            inputHash: String(row.input_hash),
+            outputHash: String(row.output_hash),
+            prevReceiptHash: String(row.prev_receipt_hash),
+            receiptHash: String(row.receipt_hash),
+            signature: String(row.signature),
+            decisionRecord: row.decision_record_json
+                ? JSON.parse(String(row.decision_record_json))
+                : null,
+            supplierSettlement: this.computeSupplierSettlement(lane, toolSlug, creditsMetered, "settled_by_muxo_master_wallet"),
+            issuedAt: String(row.issued_at),
+        };
+    }
+}