@muxoai/platform 1.2.2 → 1.3.0

package/dist/store.d.ts

@@ -1,5 +1,10 @@
 import { DatabaseSync } from "node:sqlite";
-import type { ActionPlan, ApiKeyRecord, ConnectionRecord, ExecutionReceipt, ExecutionRun, GovernanceDecisionRecord, GovernancePolicy, LedgerEntry, MemoryContextSummary, ProviderLane, ProvisionedResource, RiskLevel, SupplierSettlement, SupplierSettlementSummary, User, Workspace, WorkspaceMemoryRecord } from "./types.js";
+import type { ActionPlan, ApiKeyRecord, ByokKeyRecord, ConnectionRecord, ExecutionReceipt, ExecutionRun, GovernanceDecisionRecord, GovernancePolicy, LedgerEntry, MemoryContextSummary, ProviderLane, ProvisionedResource, RiskLevel, SupplierSettlement, SupplierSettlementSummary, User, Workspace, WorkspaceMemoryRecord } from "./types.js";
+export declare const BYOK_PROVIDER_CATALOG: Record<string, {
+    category: "llm" | "supplier";
+    envVarName: string;
+    label: string;
+}>;
 export declare class MuxoStore {
     readonly db: DatabaseSync;
     private readonly vaultKey;
@@ -77,6 +82,16 @@ export declare class MuxoStore {
     getResource(workspaceId: string, resourceNameOrId: string): ProvisionedResource | null;
     listResources(workspaceId: string): ProvisionedResource[];
     getDecryptedWorkspaceEnv(workspaceId: string): Record<string, string>;
+    normalizeByokProvider(providerInput: string): {
+        provider: string;
+        category: "llm" | "supplier";
+        envVarName: string;
+    };
+    setByokKey(workspaceId: string, providerInput: string, secretKey: string): ByokKeyRecord;
+    getByokKey(workspaceId: string, providerInput: string): string | null;
+    deleteByokKey(workspaceId: string, providerInput: string): boolean;
+    listByokKeys(workspaceId: string): ByokKeyRecord[];
+    hasByokForLane(workspaceId: string, lane: ProviderLane, toolSlug?: string): boolean;
     createPlan(params: {
         workspaceId: string;
         actorId: string;
@@ -126,6 +141,7 @@ export declare class MuxoStore {
         stripeCustomerId?: string | null;
         stripeSubscriptionId?: string | null;
         referenceId: string;
+        bonusCredits?: number;
     }): Workspace;
     addWorkspaceCredits(params: {
         workspaceId: string;
@@ -142,7 +158,7 @@ export declare class MuxoStore {
         referenceId: string | null;
         description: string;
     }): LedgerEntry;
-    computeSupplierSettlement(lane: ProviderLane, toolSlug: string, creditCost: number, settlementStatus?: "settled_by_muxo_master_wallet" | "planned_muxo_master_wallet"): SupplierSettlement;
+    computeSupplierSettlement(lane: ProviderLane, toolSlug: string, creditCost: number, settlementStatus?: "settled_by_muxo_master_wallet" | "planned_muxo_master_wallet" | "settled_by_customer_byok" | "planned_customer_byok", workspaceId?: string): SupplierSettlement;
     getSupplierSettlementSummary(workspaceId: string): SupplierSettlementSummary;
     listLedgerEntries(workspaceId: string, limit?: number): LedgerEntry[];
     saveMemoryRecord(params: {

package/dist/store.js

@@ -1,5 +1,16 @@
 import { DatabaseSync } from "node:sqlite";
 import crypto from "node:crypto";
+export const BYOK_PROVIDER_CATALOG = {
+    openai: { category: "llm", envVarName: "OPENAI_API_KEY", label: "OpenAI (GPT-4o / o3-mini)" },
+    anthropic: { category: "llm", envVarName: "ANTHROPIC_API_KEY", label: "Anthropic (Claude 3.7 Sonnet)" },
+    gemini: { category: "llm", envVarName: "GEMINI_API_KEY", label: "Google Gemini" },
+    openrouter: { category: "llm", envVarName: "OPENROUTER_API_KEY", label: "OpenRouter (Universal LLM)" },
+    composio: { category: "supplier", envVarName: "COMPOSIO_API_KEY", label: "Composio SDK & Instant" },
+    stripe: { category: "supplier", envVarName: "STRIPE_SECRET_KEY", label: "Stripe Projects & Billing" },
+    supermemory: { category: "supplier", envVarName: "SUPERMEMORY_API_KEY", label: "Supermemory v5 Knowledge Graph" },
+    firecrawl: { category: "supplier", envVarName: "FIRECRAWL_API_KEY", label: "Firecrawl Web Scrape & Crawl" },
+    exa: { category: "supplier", envVarName: "EXA_API_KEY", label: "Exa Semantic Web Search" },
+};
 const DEFAULT_POLICY = {
     mode: "enforce",
     requireApprovalFor: ["admin", "financial", "provisioning", "destructive"],
@@ -201,6 +212,17 @@ export class MuxoStore {
         event_id TEXT PRIMARY KEY,
         processed_at TEXT NOT NULL
       );
+
+      CREATE TABLE IF NOT EXISTS byok_keys (
+        workspace_id TEXT NOT NULL,
+        provider TEXT NOT NULL,
+        category TEXT NOT NULL,
+        env_var_name TEXT NOT NULL,
+        key_preview TEXT NOT NULL,
+        encrypted_secret_hex TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY (workspace_id, provider)
+      );
     `);
         // Backwards-compatible column migrations for existing databases
         for (const stmt of [
@@ -560,8 +582,146 @@ export class MuxoStore {
         for (const row of rows) {
             Object.assign(merged, this.decryptSecrets(workspaceId, row.encrypted_secrets_hex));
         }
+        const byokRows = this.db
+            .prepare("SELECT encrypted_secret_hex FROM byok_keys WHERE workspace_id = ?")
+            .all(workspaceId);
+        for (const row of byokRows) {
+            Object.assign(merged, this.decryptSecrets(workspaceId, row.encrypted_secret_hex));
+        }
         return merged;
     }
+    // --- BYOK (Bring Your Own Key) Encrypted Vault ---
+    normalizeByokProvider(providerInput) {
+        const raw = providerInput.trim().toLowerCase();
+        for (const [slug, meta] of Object.entries(BYOK_PROVIDER_CATALOG)) {
+            if (raw === slug || raw === meta.envVarName.toLowerCase()) {
+                return { provider: slug, category: meta.category, envVarName: meta.envVarName };
+            }
+        }
+        const clean = raw.replace(/[^a-z0-9_]/g, "");
+        const envVarName = raw.endsWith("_key") || raw.endsWith("_token")
+            ? raw.toUpperCase()
+            : `${clean.toUpperCase()}_API_KEY`;
+        return {
+            provider: clean || "custom",
+            category: "supplier",
+            envVarName,
+        };
+    }
+    setByokKey(workspaceId, providerInput, secretKey) {
+        const trimmed = secretKey.trim();
+        if (!trimmed) {
+            throw new Error("BYOK secretKey must not be empty");
+        }
+        const { provider, category, envVarName } = this.normalizeByokProvider(providerInput);
+        const now = new Date().toISOString();
+        const keyPreview = trimmed.length <= 8
+            ? `${trimmed.slice(0, 2)}***`
+            : `${trimmed.slice(0, 6)}...${trimmed.slice(-4)}`;
+        const encryptedHex = this.encryptSecrets(workspaceId, { [envVarName]: trimmed });
+        this.db
+            .prepare(`INSERT INTO byok_keys (
+          workspace_id, provider, category, env_var_name, key_preview, encrypted_secret_hex, updated_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(workspace_id, provider) DO UPDATE SET
+          category = excluded.category,
+          env_var_name = excluded.env_var_name,
+          key_preview = excluded.key_preview,
+          encrypted_secret_hex = excluded.encrypted_secret_hex,
+          updated_at = excluded.updated_at`)
+            .run(workspaceId, provider, category, envVarName, keyPreview, encryptedHex, now);
+        return {
+            provider,
+            providerSlug: provider,
+            category,
+            envVarName,
+            keyPreview,
+            configured: true,
+            updatedAt: now,
+        };
+    }
+    getByokKey(workspaceId, providerInput) {
+        const { provider, envVarName } = this.normalizeByokProvider(providerInput);
+        const row = this.db
+            .prepare("SELECT encrypted_secret_hex FROM byok_keys WHERE workspace_id = ? AND provider = ?")
+            .get(workspaceId, provider);
+        if (!row)
+            return null;
+        const dec = this.decryptSecrets(workspaceId, row.encrypted_secret_hex);
+        return dec[envVarName] || Object.values(dec)[0] || null;
+    }
+    deleteByokKey(workspaceId, providerInput) {
+        const { provider } = this.normalizeByokProvider(providerInput);
+        const res = this.db
+            .prepare("DELETE FROM byok_keys WHERE workspace_id = ? AND provider = ?")
+            .run(workspaceId, provider);
+        return Number(res.changes || 0) > 0;
+    }
+    listByokKeys(workspaceId) {
+        const rows = this.db
+            .prepare("SELECT provider, category, env_var_name, key_preview, updated_at FROM byok_keys WHERE workspace_id = ? ORDER BY updated_at DESC")
+            .all(workspaceId);
+        const configuredMap = new Map();
+        for (const r of rows) {
+            const p = String(r.provider);
+            configuredMap.set(p, {
+                provider: p,
+                providerSlug: p,
+                category: String(r.category),
+                envVarName: String(r.env_var_name),
+                keyPreview: String(r.key_preview),
+                configured: true,
+                updatedAt: String(r.updated_at),
+            });
+        }
+        const result = [];
+        for (const [slug, meta] of Object.entries(BYOK_PROVIDER_CATALOG)) {
+            const existing = configuredMap.get(slug);
+            if (existing) {
+                result.push(existing);
+                configuredMap.delete(slug);
+            }
+            else {
+                result.push({
+                    provider: slug,
+                    providerSlug: slug,
+                    category: meta.category,
+                    envVarName: meta.envVarName,
+                    keyPreview: "",
+                    configured: false,
+                    updatedAt: "",
+                });
+            }
+        }
+        for (const extra of configuredMap.values()) {
+            result.push(extra);
+        }
+        return result;
+    }
+    hasByokForLane(workspaceId, lane, toolSlug) {
+        const slug = (toolSlug || "").toLowerCase();
+        if (slug.startsWith("billing."))
+            return false;
+        if (lane === "composio_sdk") {
+            return Boolean(this.getByokKey(workspaceId, "composio"));
+        }
+        if (lane === "composio_instant") {
+            if (this.getByokKey(workspaceId, "composio"))
+                return true;
+            if ((slug.includes("scrape") || slug.includes("crawl") || slug.includes("seo")) &&
+                this.getByokKey(workspaceId, "firecrawl")) {
+                return true;
+            }
+            if (slug.includes("search") && this.getByokKey(workspaceId, "exa")) {
+                return true;
+            }
+            return false;
+        }
+        if (lane === "stripe_projects") {
+            return Boolean(this.getByokKey(workspaceId, "stripe"));
+        }
+        return false;
+    }
     // --- Plans ---
     createPlan(params) {
         const id = `plan_${crypto.randomBytes(8).toString("hex")}`;
@@ -774,7 +934,8 @@ export class MuxoStore {
         if (!ws)
             throw new Error(`Workspace ${params.workspaceId} not found`);
         const now = new Date().toISOString();
-        const newCredits = ws.creditsBalance + 1000;
+        const bonus = params.bonusCredits !== undefined ? Number(params.bonusCredits) : 1000;
+        const newCredits = ws.creditsBalance + bonus;
         this.db
             .prepare(`UPDATE workspaces
          SET tier = 'starter',
@@ -789,10 +950,10 @@ export class MuxoStore {
             workspaceId: params.workspaceId,
             kind: "subscription_upgrade",
             actionsDelta: 4000,
-            creditsDelta: 1000,
+            creditsDelta: bonus,
             balanceAfter: newCredits,
             referenceId: params.referenceId,
-            description: "Upgraded to Starter Plan ($29/mo — 5,000 actions/mo + 1,000 credits)",
+            description: `Upgraded to Starter Plan ($29/mo — 5,000 actions/mo + ${bonus} credits)`,
         });
         return this.getWorkspace(params.workspaceId);
     }
@@ -840,12 +1001,33 @@ export class MuxoStore {
             createdAt: now,
         };
     }
-    computeSupplierSettlement(lane, toolSlug, creditCost, settlementStatus = "settled_by_muxo_master_wallet") {
+    computeSupplierSettlement(lane, toolSlug, creditCost, settlementStatus = "settled_by_muxo_master_wallet", workspaceId) {
+        const useByok = settlementStatus === "settled_by_customer_byok" ||
+            settlementStatus === "planned_customer_byok" ||
+            (workspaceId ? this.hasByokForLane(workspaceId, lane, toolSlug) : false);
+        const upstreamProvider = toolSlug.split(".")[1] || lane;
+        if (useByok) {
+            const isPlanned = settlementStatus === "planned_muxo_master_wallet" ||
+                settlementStatus === "planned_customer_byok";
+            return {
+                fundingMode: "byok",
+                supplier: lane,
+                supplierName: "Customer BYOK Upstream Key (0% Muxo Markup)",
+                upstreamProvider,
+                userChargeCredits: 0,
+                userRetailChargeCents: 0,
+                supplierWholesalePayableCents: 0,
+                muxoNetMarginCents: 0,
+                settlementStatus: isPlanned
+                    ? "planned_customer_byok"
+                    : "settled_by_customer_byok",
+                masterAccountRef: "customer_byok_vault",
+            };
+        }
         const userChargeCredits = Math.max(0, Number(creditCost || 0));
         const userRetailChargeCents = Math.round(userChargeCredits * 100) / 100;
         const supplierWholesalePayableCents = Math.round(userRetailChargeCents * 0.6 * 100) / 100;
         const muxoNetMarginCents = Math.round((userRetailChargeCents - supplierWholesalePayableCents) * 100) / 100;
-        const upstreamProvider = toolSlug.split(".")[1] || lane;
         const supplierMeta = {
             composio_instant: {
                 supplierName: "Composio Instant Wholesale Wallet",
@@ -878,6 +1060,9 @@ export class MuxoStore {
         const ws = this.getWorkspace(workspaceId);
         const ledger = this.listLedgerEntries(workspaceId, 500);
         const runs = this.listRuns(workspaceId, 500).filter((r) => r.status === "succeeded");
+        const byokProviders = this.listByokKeys(workspaceId)
+            .filter((k) => k.configured)
+            .map((k) => k.provider);
         const totalCreditsPurchasedOrGranted = ledger
             .filter((e) => e.creditsDelta > 0)
             .reduce((acc, e) => acc + e.creditsDelta, 0);
@@ -909,7 +1094,9 @@ export class MuxoStore {
         let totalSupplierWholesalePaidCents = 0;
         let totalMuxoNetMarginCents = 0;
         for (const run of runs) {
-            const s = this.computeSupplierSettlement(run.lane, run.toolSlug, run.creditsMetered, "settled_by_muxo_master_wallet");
+            const s = this.computeSupplierSettlement(run.lane, run.toolSlug, run.creditsMetered, run.creditsMetered === 0 && this.hasByokForLane(workspaceId, run.lane, run.toolSlug)
+                ? "settled_by_customer_byok"
+                : "settled_by_muxo_master_wallet", workspaceId);
             const bucket = bySupplier[run.lane] || bySupplier.composio_instant;
             bucket.runsCount += 1;
             bucket.creditsConsumed += s.userChargeCredits;
@@ -930,6 +1117,8 @@ export class MuxoStore {
         return {
             workspaceId,
             fundingModel: "user_pays_muxo_muxo_pays_suppliers",
+            activeFundingMode: byokProviders.length > 0 ? "byok_hybrid" : "muxo_funded",
+            byokProviders,
             creditPriceCents: 1,
             totalCreditsPurchasedOrGranted,
             totalCreditsConsumed,
@@ -1203,7 +1392,7 @@ export class MuxoStore {
                 : null,
             supplierSettlement: this.computeSupplierSettlement(lane, toolSlug, creditCost, approvalStatus === "executed"
                 ? "settled_by_muxo_master_wallet"
-                : "planned_muxo_master_wallet"),
+                : "planned_muxo_master_wallet", String(row.workspace_id)),
             createdAt: String(row.created_at),
             expiresAt: String(row.expires_at),
         };
@@ -1253,7 +1442,7 @@ export class MuxoStore {
             decisionRecord: row.decision_record_json
                 ? JSON.parse(String(row.decision_record_json))
                 : null,
-            supplierSettlement: this.computeSupplierSettlement(lane, toolSlug, creditsMetered, "settled_by_muxo_master_wallet"),
+            supplierSettlement: this.computeSupplierSettlement(lane, toolSlug, creditsMetered, "settled_by_muxo_master_wallet", String(row.workspace_id)),
             issuedAt: String(row.issued_at),
         };
     }

package/dist/types.d.ts

@@ -62,6 +62,7 @@ export interface MuxoTool {
     providerUrl?: string;
     metadata?: Record<string, unknown>;
 }
+export type ToolDescriptor = MuxoTool;
 export interface ConnectionRecord {
     id: string;
     workspaceId: string;
@@ -168,8 +169,17 @@ export interface WorkspaceMemoryRecord {
     metadata: Record<string, unknown>;
     createdAt: string;
 }
+export interface ByokKeyRecord {
+    provider: string;
+    providerSlug?: string;
+    category: "llm" | "supplier";
+    envVarName: string;
+    keyPreview: string;
+    configured: boolean;
+    updatedAt: string;
+}
 export interface SupplierSettlement {
-    fundingMode: "muxo_funded";
+    fundingMode: "muxo_funded" | "byok";
     supplier: ProviderLane;
     supplierName: string;
     upstreamProvider: string;
@@ -177,12 +187,14 @@ export interface SupplierSettlement {
     userRetailChargeCents: number;
     supplierWholesalePayableCents: number;
     muxoNetMarginCents: number;
-    settlementStatus: "settled_by_muxo_master_wallet" | "planned_muxo_master_wallet";
+    settlementStatus: "settled_by_muxo_master_wallet" | "planned_muxo_master_wallet" | "settled_by_customer_byok" | "planned_customer_byok";
     masterAccountRef: string;
 }
 export interface SupplierSettlementSummary {
     workspaceId: string;
     fundingModel: "user_pays_muxo_muxo_pays_suppliers";
+    activeFundingMode?: "muxo_funded" | "byok_hybrid";
+    byokProviders?: string[];
     creditPriceCents: number;
     totalCreditsPurchasedOrGranted: number;
     totalCreditsConsumed: number;