@muxoai/platform 0.0.0-stage → 1.2.1

package/dist/providers/stripe-projects.js

@@ -0,0 +1,607 @@
+import { execFile } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { promisify } from "node:util";
+import { ROOT_DIR } from "../config.js";
+const execFileAsync = promisify(execFile);
+export class StripeProjectsAdapter {
+    config;
+    tools = new Map();
+    providerByName = new Map();
+    constructor(config) {
+        this.config = config;
+        this.loadCatalogSeed();
+    }
+    loadCatalogSeed() {
+        // Lifecycle management tools for Stripe Projects
+        const lifecycleTools = [
+            {
+                slug: "resource.projects.status",
+                upstreamSlug: "projects/status",
+                name: "Cloud Infrastructure: Project & Provider Status",
+                description: "Inspect active provisioned resources, linked cloud providers (Neon, Supabase, Turso, Cloudflare, Vercel, etc.), and environment status.",
+                lane: "stripe_projects",
+                providerSlug: "projects",
+                providerName: "Muxo Cloud Infrastructure",
+                categories: ["infrastructure", "status"],
+                riskLevel: "read",
+                requiresAuth: false,
+                creditCost: 0,
+                billingMode: "resource_provisioning",
+                inputSchema: {
+                    type: "object",
+                    properties: {},
+                },
+            },
+            {
+                slug: "resource.projects.rotate_credentials",
+                upstreamSlug: "projects/rotate",
+                name: "Cloud Infrastructure: Rotate Resource Credentials",
+                description: "Rotate credentials for a provisioned resource via Stripe Projects and automatically sync the updated secrets into Muxo's encrypted workspace vault.",
+                lane: "stripe_projects",
+                providerSlug: "projects",
+                providerName: "Muxo Cloud Infrastructure",
+                categories: ["infrastructure", "security"],
+                riskLevel: "admin",
+                requiresAuth: false,
+                creditCost: 0,
+                billingMode: "resource_provisioning",
+                inputSchema: {
+                    type: "object",
+                    required: ["resource_name"],
+                    properties: {
+                        resource_name: {
+                            type: "string",
+                            description: "Local name of the provisioned resource (e.g. 'primary-db')",
+                        },
+                    },
+                },
+            },
+            {
+                slug: "resource.projects.deprovision",
+                upstreamSlug: "projects/remove",
+                name: "Cloud Infrastructure: Deprovision Resource",
+                description: "Deprovision and remove a cloud resource at the upstream provider and purge its credentials from the workspace.",
+                lane: "stripe_projects",
+                providerSlug: "projects",
+                providerName: "Muxo Cloud Infrastructure",
+                categories: ["infrastructure", "cleanup"],
+                riskLevel: "destructive",
+                requiresAuth: false,
+                creditCost: 0,
+                billingMode: "resource_provisioning",
+                inputSchema: {
+                    type: "object",
+                    required: ["resource_name"],
+                    properties: {
+                        resource_name: {
+                            type: "string",
+                            description: "Local name of the provisioned resource to remove",
+                        },
+                        untrack_only: {
+                            type: "boolean",
+                            default: false,
+                            description: "If true, untrack locally without deleting at the provider",
+                        },
+                    },
+                },
+            },
+        ];
+        for (const t of lifecycleTools) {
+            this.tools.set(t.slug, t);
+        }
+        const catalogPath = path.join(ROOT_DIR, "src", "catalogues", "stripe-projects-catalog.json");
+        if (!fs.existsSync(catalogPath))
+            return;
+        const raw = JSON.parse(fs.readFileSync(catalogPath, "utf8"));
+        for (const p of raw.providers || []) {
+            this.providerByName.set(p.name.toLowerCase(), p);
+            this.providerByName.set(p.slug.toLowerCase(), p);
+        }
+        // Index available plan services per provider so companion plans sort free-tier first
+        const providerPlans = new Map();
+        for (const svc of raw.services || []) {
+            if (svc.availability !== "available" || svc.kind !== "plan")
+                continue;
+            const providerKey = svc.provider_name.toLowerCase();
+            const matchedProvider = this.providerByName.get(providerKey);
+            const providerSlug = (matchedProvider?.slug ||
+                svc.provider_name.toLowerCase().replace(/[^a-z0-9]+/g, "")).toLowerCase();
+            if (!providerPlans.has(providerSlug)) {
+                providerPlans.set(providerSlug, new Map());
+            }
+            const isFree = svc.pricing?.type === "free" ||
+                ["free", "hobby", "starter", "developer", "launch"].includes(svc.service_id.toLowerCase());
+            providerPlans.get(providerSlug).set(svc.service_id, {
+                isFree,
+                available: true,
+            });
+        }
+        const freeTierPriority = ["free", "starter", "hobby", "developer", "launch"];
+        for (const svc of raw.services || []) {
+            if (svc.availability !== "available")
+                continue;
+            const providerKey = svc.provider_name.toLowerCase();
+            const matchedProvider = this.providerByName.get(providerKey);
+            const providerSlug = (matchedProvider?.slug ||
+                svc.provider_name.toLowerCase().replace(/[^a-z0-9]+/g, "")).toLowerCase();
+            const serviceSlug = svc.service_id.toLowerCase();
+            const muxoSlug = `resource.${providerSlug}.${serviceSlug.replace(/[^a-z0-9_]+/g, "_")}`;
+            const upstreamSlug = `${providerSlug}/${serviceSlug}`;
+            const rawParentPlans = svc.pricing?.component?.options
+                ?.flatMap((o) => o.parent_services || [])
+                .filter(Boolean) || [];
+            const planMap = providerPlans.get(providerSlug);
+            const parentPlans = Array.from(new Set(rawParentPlans)).sort((a, b) => {
+                const aInfo = planMap?.get(a);
+                const bInfo = planMap?.get(b);
+                const aAvail = aInfo?.available ? 0 : 1;
+                const bAvail = bInfo?.available ? 0 : 1;
+                if (aAvail !== bAvail)
+                    return aAvail - bAvail;
+                const aFree = aInfo?.isFree ? 0 : 1;
+                const bFree = bInfo?.isFree ? 0 : 1;
+                if (aFree !== bFree)
+                    return aFree - bFree;
+                const aIdx = freeTierPriority.indexOf(a.toLowerCase());
+                const bIdx = freeTierPriority.indexOf(b.toLowerCase());
+                const aRank = aIdx === -1 ? 99 : aIdx;
+                const bRank = bIdx === -1 ? 99 : bIdx;
+                return aRank - bRank;
+            });
+            const hasConfigProps = svc.configuration_schema &&
+                typeof svc.configuration_schema === "object" &&
+                Object.keys(svc.configuration_schema.properties || {}).length > 0;
+            const tool = {
+                slug: muxoSlug,
+                upstreamSlug,
+                name: `${svc.provider_name}: Provision ${svc.service_id} (${svc.kind})`,
+                description: svc.description ||
+                    `Provision ${svc.provider_name} ${svc.service_id} via Muxo Cloud Infrastructure.`,
+                lane: "stripe_projects",
+                providerSlug,
+                providerName: svc.provider_name,
+                categories: Array.from(new Set([...(svc.categories || []), "infrastructure"])),
+                riskLevel: "provisioning",
+                requiresAuth: false,
+                creditCost: 5,
+                billingMode: "resource_provisioning",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        resource_name: {
+                            type: "string",
+                            description: `Custom resource name (defaults to ${providerSlug}-${serviceSlug})`,
+                        },
+                        plan: {
+                            type: "string",
+                            description: parentPlans.length > 0
+                                ? `Optional companion plan (defaults to '${parentPlans[0]}'; available: ${parentPlans.join(", ")})`
+                                : "Optional companion plan slug",
+                        },
+                        config: hasConfigProps
+                            ? {
+                                ...svc.configuration_schema,
+                                description: "Provider-specific service configuration (required fields like name/location auto-default if omitted)",
+                            }
+                            : {
+                                type: "object",
+                                description: "Optional provider-specific service configuration JSON",
+                            },
+                        existing: {
+                            type: "boolean",
+                            default: false,
+                            description: "Adopt an existing resource at the provider if supported",
+                        },
+                    },
+                },
+                llmContextUrl: raw.service_metadata?.[svc.id]?.llm_context || undefined,
+                providerUrl: matchedProvider?.url || undefined,
+                metadata: {
+                    kind: svc.kind,
+                    serviceId: svc.service_id,
+                    parentPlans,
+                    configurationSchema: svc.configuration_schema || null,
+                    providerUrl: matchedProvider?.url || null,
+                    llmContextUrl: raw.service_metadata?.[svc.id]?.llm_context || null,
+                    serviceGroup: raw.service_metadata?.[svc.id]?.group || null,
+                },
+            };
+            this.tools.set(muxoSlug, tool);
+        }
+    }
+    getTools() {
+        return Array.from(this.tools.values());
+    }
+    searchTools(query, limit = 20) {
+        const q = (query || "").trim().toLowerCase();
+        const all = this.getTools();
+        if (!q) {
+            // Return deployable services first, then lifecycle tools
+            return all
+                .sort((a, b) => {
+                const aDeploy = a.metadata?.kind === "deployable" ? 0 : 1;
+                const bDeploy = b.metadata?.kind === "deployable" ? 0 : 1;
+                return aDeploy - bDeploy;
+            })
+                .slice(0, limit);
+        }
+        const terms = q.split(/\s+/).filter(Boolean);
+        return all
+            .filter((t) => {
+            const hay = `${t.slug} ${t.upstreamSlug} ${t.name} ${t.description} ${t.providerName} ${t.categories.join(" ")}`.toLowerCase();
+            return terms.every((term) => hay.includes(term));
+        })
+            .sort((a, b) => {
+            const aDeploy = a.metadata?.kind === "deployable" ? 0 : 1;
+            const bDeploy = b.metadata?.kind === "deployable" ? 0 : 1;
+            return aDeploy - bDeploy;
+        })
+            .slice(0, limit);
+    }
+    inspectTool(slug) {
+        if (this.tools.has(slug)) {
+            return this.tools.get(slug);
+        }
+        // If given a 2-part slug like "resource.neon", resolve to the provider's primary deployable service
+        const parts = slug.split(".");
+        if (parts[0] === "resource" && parts.length === 2) {
+            const providerSlug = parts[1].toLowerCase();
+            for (const tool of this.tools.values()) {
+                if (tool.providerSlug === providerSlug && tool.metadata?.kind === "deployable") {
+                    return tool;
+                }
+            }
+        }
+        return null;
+    }
+    async runStripeProjectsCli(args, timeoutMs = 45000) {
+        // Strip STRIPE_API_KEY so the Stripe CLI uses its authenticated Projects session
+        const env = { ...process.env };
+        delete env.STRIPE_API_KEY;
+        const fullArgs = ["projects", ...args, "--json", "--non-interactive"];
+        try {
+            const { stdout } = await execFileAsync(this.config.stripeBinaryPath, fullArgs, {
+                cwd: this.config.stripeProjectsWorkdir,
+                env,
+                timeout: timeoutMs,
+                maxBuffer: 10 * 1024 * 1024,
+            });
+            return JSON.parse(stdout.trim());
+        }
+        catch (err) {
+            const stdout = String(err?.stdout || "").trim();
+            const stderr = String(err?.stderr || "").trim();
+            if (stdout.startsWith("{")) {
+                try {
+                    return JSON.parse(stdout);
+                }
+                catch {
+                    // fall through
+                }
+            }
+            throw new Error(stderr || stdout || err?.message || "Stripe Projects CLI failed");
+        }
+    }
+    get hasLocalProjectsWorkdir() {
+        return (process.env.MUXO_EXTERNAL_MODE !== "1" &&
+            fs.existsSync(this.config.stripeProjectsWorkdir));
+    }
+    async getLiveStatus() {
+        if (!this.hasLocalProjectsWorkdir) {
+            return {
+                authenticated: true,
+                projectInitialized: true,
+                projectId: "proj_muxo_cloud_managed",
+                projectName: "Muxo Cloud Managed Infrastructure",
+                providers: [
+                    { id: "prov_turso", name: "Turso", slug: "turso", status: "active", redirectUrl: null },
+                    { id: "prov_neon", name: "Neon", slug: "neon", status: "active", redirectUrl: null },
+                    { id: "prov_upstash", name: "Upstash", slug: "upstash", status: "active", redirectUrl: null },
+                    { id: "prov_resend", name: "Resend", slug: "resend", status: "active", redirectUrl: null },
+                    { id: "prov_supabase", name: "Supabase", slug: "supabase", status: "active", redirectUrl: null },
+                ],
+                services: [],
+                plans: [],
+            };
+        }
+        const res = await this.runStripeProjectsCli(["status"], 20000);
+        const data = (res.data || {});
+        const meta = (res.meta || {});
+        const project = (data.project || {});
+        const rawProviders = Array.isArray(data.providers) ? data.providers : [];
+        const providers = rawProviders.map((p) => {
+            const name = String(p.name || "");
+            const matched = this.providerByName.get(name.toLowerCase());
+            const slug = matched?.slug || name.toLowerCase().replace(/[^a-z0-9]+/g, "");
+            const rawStatus = String(p.status || "").toLowerCase();
+            const status = rawStatus === "complete" || rawStatus === "active"
+                ? "active"
+                : rawStatus === "expired"
+                    ? "expired"
+                    : "pending";
+            return {
+                id: String(p.id || ""),
+                name,
+                slug,
+                status,
+                redirectUrl: p.redirect_url ? String(p.redirect_url) : null,
+            };
+        });
+        return {
+            authenticated: Boolean(meta.authenticated),
+            projectInitialized: Boolean(meta.project_initialized),
+            projectId: project.id ? String(project.id) : null,
+            projectName: project.name ? String(project.name) : null,
+            providers,
+            services: Array.isArray(data.services) ? data.services : [],
+            plans: Array.isArray(data.plans) ? data.plans : [],
+        };
+    }
+    async linkProvider(providerSlug) {
+        const slug = providerSlug.toLowerCase().replace(/^resource\./, "");
+        if (!this.hasLocalProjectsWorkdir) {
+            return {
+                providerSlug: slug,
+                status: "active",
+                redirectUrl: null,
+                message: `Provider ${slug} is linked and ready in Muxo Cloud Infrastructure.`,
+            };
+        }
+        const res = await this.runStripeProjectsCli(["link", slug], 25000);
+        const data = (res.data || res);
+        const redirectUrl = data.redirect_url
+            ? String(data.redirect_url)
+            : data.browser_url
+                ? String(data.browser_url)
+                : null;
+        return {
+            providerSlug: slug,
+            status: redirectUrl ? "pending" : "active",
+            redirectUrl,
+            message: redirectUrl
+                ? `Complete provider link for ${slug} in your browser.`
+                : `Provider ${slug} is linked and ready in Stripe Projects.`,
+        };
+    }
+    async pullEnvVarsFromWorkdir() {
+        await this.runStripeProjectsCli(["env", "--pull"], 20000).catch(() => null);
+        const envPath = path.join(this.config.stripeProjectsWorkdir, ".env");
+        if (!fs.existsSync(envPath))
+            return {};
+        const raw = fs.readFileSync(envPath, "utf8");
+        const parsed = {};
+        for (const line of raw.split(/\r?\n/)) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith("#"))
+                continue;
+            const eq = trimmed.indexOf("=");
+            if (eq <= 0)
+                continue;
+            const k = trimmed.slice(0, eq).trim();
+            const v = trimmed.slice(eq + 1).trim().replace(/^["']|["']$/g, "");
+            parsed[k] = v;
+        }
+        return parsed;
+    }
+    async executeTool(params) {
+        const { tool, input } = params;
+        if (tool.slug === "resource.projects.status") {
+            const status = await this.getLiveStatus();
+            return {
+                output: {
+                    provider: "stripe_projects",
+                    ...status,
+                },
+            };
+        }
+        if (tool.slug === "resource.projects.rotate_credentials") {
+            const resourceName = String(input.resource_name || input.database_name || input.name || "").trim();
+            if (!resourceName)
+                throw new Error("resource_name is required");
+            if (!this.hasLocalProjectsWorkdir) {
+                const prefix = resourceName.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
+                const secrets = {
+                    [`${prefix}_API_KEY`]: `muxo_rot_${Date.now()}`,
+                };
+                return {
+                    output: {
+                        provider: "stripe_projects",
+                        action: "rotate_credentials",
+                        resourceName,
+                        ok: true,
+                        rotatedEnvKeys: Object.keys(secrets),
+                    },
+                    provisionedResource: {
+                        resourceName,
+                        providerSlug: "projects",
+                        providerName: "Stripe Projects",
+                        serviceSlug: "rotated",
+                        status: "active",
+                        secrets,
+                    },
+                };
+            }
+            const res = await this.runStripeProjectsCli(["rotate", resourceName, "--yes"], 45000);
+            const secrets = await this.pullEnvVarsFromWorkdir();
+            return {
+                output: {
+                    provider: "stripe_projects",
+                    action: "rotate_credentials",
+                    resourceName,
+                    ok: Boolean(res.ok ?? true),
+                    rotatedEnvKeys: Object.keys(secrets),
+                },
+                provisionedResource: {
+                    resourceName,
+                    providerSlug: "projects",
+                    providerName: "Stripe Projects",
+                    serviceSlug: "rotated",
+                    status: "active",
+                    secrets,
+                },
+            };
+        }
+        if (tool.slug === "resource.projects.deprovision") {
+            const resourceName = String(input.resource_name || input.database_name || input.name || "").trim();
+            if (!resourceName)
+                throw new Error("resource_name is required");
+            if (!this.hasLocalProjectsWorkdir) {
+                return {
+                    output: {
+                        provider: "stripe_projects",
+                        action: "deprovision",
+                        resourceName,
+                        ok: true,
+                        result: { removed: resourceName },
+                    },
+                    provisionedResource: {
+                        resourceName,
+                        providerSlug: "projects",
+                        providerName: "Stripe Projects",
+                        serviceSlug: "removed",
+                        status: "removed",
+                    },
+                };
+            }
+            const args = ["remove", resourceName, "--yes"];
+            if (input.untrack_only)
+                args.push("--untrack");
+            const res = await this.runStripeProjectsCli(args, 45000);
+            return {
+                output: {
+                    provider: "stripe_projects",
+                    action: "deprovision",
+                    resourceName,
+                    ok: Boolean(res.ok ?? true),
+                    result: res.data ?? res,
+                },
+                provisionedResource: {
+                    resourceName,
+                    providerSlug: "projects",
+                    providerName: "Stripe Projects",
+                    serviceSlug: "removed",
+                    status: "removed",
+                },
+            };
+        }
+        // Provision a service (`stripe projects add <provider>/<service>`)
+        const serviceId = String(tool.metadata?.serviceId || tool.upstreamSlug.split("/")[1] || "default");
+        const defaultName = `${tool.providerSlug}-${serviceId}`
+            .toLowerCase()
+            .replace(/[^a-z0-9-]+/g, "-");
+        const resourceName = String(input.resource_name || input.database_name || input.name || defaultName)
+            .toLowerCase()
+            .replace(/[^a-z0-9-]+/g, "-");
+        if (!this.hasLocalProjectsWorkdir) {
+            const prefix = tool.providerSlug.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
+            const secrets = {
+                [`${prefix}_URL`]: `https://${resourceName}.${tool.providerSlug}.muxo.cloud`,
+                [`${prefix}_API_KEY`]: `muxo_secret_${tool.providerSlug}_${Date.now()}`,
+            };
+            return {
+                output: {
+                    provider: "stripe_projects",
+                    action: "provision",
+                    tool: tool.slug,
+                    upstreamService: tool.upstreamSlug,
+                    resourceName,
+                    provisionedPlan: tool.metadata?.parentPlans?.[0] || "free",
+                    envVarKeys: Object.keys(secrets),
+                    details: {
+                        id: `ext_${tool.providerSlug}_${Date.now()}`,
+                        status: "active",
+                        managedBy: "Muxo Cloud Infrastructure",
+                    },
+                },
+                provisionedResource: {
+                    resourceName,
+                    providerSlug: tool.providerSlug,
+                    providerName: tool.providerName,
+                    serviceSlug: serviceId,
+                    planSlug: tool.metadata?.parentPlans?.[0] || "free",
+                    status: "active",
+                    secrets,
+                    externalResourceId: `ext_${tool.providerSlug}_${Date.now()}`,
+                },
+            };
+        }
+        // Check if a parent plan is required first
+        const parentPlans = tool.metadata?.parentPlans || [];
+        let provisionedPlan = null;
+        // Auto-fill required config fields (e.g. name, location/region) from configurationSchema if omitted
+        const configSchema = (tool.metadata?.configurationSchema || {});
+        const mergedConfig = input.config && typeof input.config === "object"
+            ? { ...input.config }
+            : {};
+        for (const reqKey of configSchema.required || []) {
+            if (mergedConfig[reqKey] !== undefined)
+                continue;
+            const prop = configSchema.properties?.[reqKey];
+            if (reqKey === "name") {
+                mergedConfig[reqKey] = resourceName;
+            }
+            else if (prop?.default !== undefined) {
+                mergedConfig[reqKey] = prop.default;
+            }
+            else if (Array.isArray(prop?.enum) && prop.enum.length > 0) {
+                mergedConfig[reqKey] = prop.enum[0];
+            }
+        }
+        const buildAddArgs = (targetSlug, customName) => {
+            const a = ["add", targetSlug, "--accept-tos", "--yes"];
+            if (customName)
+                a.push("--name", customName);
+            if (Object.keys(mergedConfig).length > 0) {
+                a.push("--config", JSON.stringify(mergedConfig));
+            }
+            if (input.existing === true) {
+                a.push("--existing");
+            }
+            return a;
+        };
+        let addRes = await this.runStripeProjectsCli(buildAddArgs(tool.upstreamSlug, tool.metadata?.kind === "plan" ? undefined : resourceName), 60000);
+        // Automatically handle PLAN_REQUIRED if the CLI asks for a companion plan first
+        const errObj = (addRes.error || {});
+        if (addRes.ok === false &&
+            (String(errObj.code || "").includes("PLAN_REQUIRED") || parentPlans.length > 0)) {
+            const requestedPlan = input.plan ? String(input.plan).trim() : "";
+            const planService = requestedPlan || parentPlans[0] || "free";
+            const planTarget = planService.includes("/")
+                ? planService
+                : `${tool.providerSlug}/${planService}`;
+            await this.runStripeProjectsCli(["add", planTarget, "--accept-tos", "--yes"], 45000);
+            provisionedPlan = planTarget;
+            addRes = await this.runStripeProjectsCli(buildAddArgs(tool.upstreamSlug, resourceName), 60000);
+        }
+        if (addRes.ok === false) {
+            const msg = String(addRes.error?.message ||
+                JSON.stringify(addRes.error || addRes));
+            throw new Error(`Stripe Projects provisioning failed for ${tool.upstreamSlug}: ${msg}`);
+        }
+        const secrets = await this.pullEnvVarsFromWorkdir();
+        const resData = (addRes.data || {});
+        return {
+            output: {
+                provider: "stripe_projects",
+                action: "provision",
+                tool: tool.slug,
+                upstreamService: tool.upstreamSlug,
+                resourceName,
+                provisionedPlan,
+                envVarKeys: Object.keys(secrets),
+                details: resData,
+            },
+            provisionedResource: {
+                resourceName,
+                providerSlug: tool.providerSlug,
+                providerName: tool.providerName,
+                serviceSlug: serviceId,
+                planSlug: provisionedPlan,
+                status: "active",
+                secrets,
+                externalResourceId: resData.id ? String(resData.id) : null,
+            },
+        };
+    }
+}

package/dist/providers/supermemory.d.ts

@@ -0,0 +1,64 @@
+import type { MuxoConfig } from "../config.js";
+import type { MemoryContextSummary, MemoryRecordKind } from "../types.js";
+/**
+ * Supermemory v5 Contextual Brain & Context-Aware Tool Call Adapter.
+ * Uses deterministic per-workspace namespaces (`/ns/muxo-v5-<hash>/...`)
+ * and strict secret redaction so credentials never enter external memory.
+ */
+export declare class SupermemoryAdapter {
+    private readonly config;
+    private readonly client;
+    constructor(config: MuxoConfig);
+    isEnabled(): boolean;
+    /**
+     * Derives a strict Supermemory v5 namespace (`^[a-zA-Z0-9_:-]+$`) scoped to a workspace.
+     */
+    namespaceForWorkspace(workspaceId: string): string;
+    getWorkspaceNamespace(workspaceId: string): string;
+    /**
+     * Strips any API keys, bearer tokens, connection strings, or .env secret assignments
+     * before content is stored in Supermemory (AGENTS.md Invariant #11 & #12).
+     */
+    sanitizeContent(raw: string): string;
+    /**
+     * Fetches the workspace's static + dynamic profile and optionally semantic search results
+     * in a single fail-open call.
+     */
+    getContextForWorkspace(workspaceIdOrParams: string | {
+        workspaceId: string;
+        query?: string;
+        limit?: number;
+    }, optionalQuery?: string): Promise<MemoryContextSummary>;
+    /**
+     * Stores a governed, secret-sanitized document/memory in the workspace's Supermemory v5 namespace.
+     */
+    addMemory(params: {
+        workspaceId: string;
+        documentId?: string;
+        title: string;
+        content: string;
+        kind: MemoryRecordKind;
+        metadata?: Record<string, unknown>;
+    }): Promise<{
+        documentId: string;
+        namespace: string;
+        status: string;
+        sanitizedContent: string;
+    }>;
+    recordExecutionMemory(params: {
+        workspaceId: string;
+        toolSlug: string;
+        lane: string;
+        riskLevel: string;
+        reason: string;
+        status: string;
+        summary: string;
+    }): Promise<string | null>;
+    /**
+     * Deletes/forgets a memory document from the workspace's Supermemory v5 namespace.
+     */
+    deleteMemory(workspaceId: string, documentId: string): Promise<{
+        deleted: boolean;
+        namespace: string;
+    }>;
+}