@muxoai/platform 1.3.0 → 1.3.2

package/dist/engine.d.ts

@@ -78,6 +78,7 @@ export declare class MuxoEngine {
         toolSlug: string;
         input?: Record<string, unknown>;
         reason?: string;
+        fundingMode?: "muxo_funded" | "byok";
     }): Promise<{
         plan: ActionPlan;
         tool: MuxoTool;
@@ -95,30 +96,50 @@ export declare class MuxoEngine {
     }>;
     getPlan(ctx: ExecutionContext, planId: string): ActionPlan;
     approvePlan(ctx: ExecutionContext, planId: string, decision?: "approved" | "rejected"): ActionPlan;
+    private enrichMemoryContext;
     getRunContext(ctx: ExecutionContext, query?: string): Promise<Record<string, unknown>>;
     getMemoryOverview(ctx: ExecutionContext, query?: string): Promise<{
         enabled: boolean;
         namespace: string;
+        fundingSource: string;
         context: MemoryContextSummary;
         recentMemories: WorkspaceMemoryRecord[];
         memories: WorkspaceMemoryRecord[];
+        temporalFacts: ReturnType<MuxoStore["listTemporalFacts"]>;
+        historicalFacts: ReturnType<MuxoStore["listTemporalFacts"]>;
     }>;
     addWorkspaceMemory(ctx: ExecutionContext, params: {
         title: string;
         content: string;
         kind?: WorkspaceMemoryRecord["kind"];
         metadata?: Record<string, unknown>;
+        subject?: string;
+        predicate?: string;
+        object?: string;
     }): Promise<WorkspaceMemoryRecord>;
     deleteWorkspaceMemory(ctx: ExecutionContext, idOrDocId: string): Promise<{
         deleted: boolean;
         record: WorkspaceMemoryRecord | null;
     }>;
+    forgetWorkspaceMemoryMatching(ctx: ExecutionContext, query: string): Promise<{
+        query: string;
+        deletedLocalCount: number;
+        invalidatedFactsCount: number;
+        deletedRemoteIds: string[];
+        deletedMemories: WorkspaceMemoryRecord[];
+        invalidatedFacts: ReturnType<MuxoStore["listTemporalFacts"]>;
+    }>;
+    activateWorkspaceKillSwitch(ctx: ExecutionContext, params: {
+        reason: string;
+        action?: "terminate" | "quarantine" | "suspend";
+    }): Promise<Record<string, unknown>>;
+    resumeWorkspaceKillSwitch(ctx: ExecutionContext): Record<string, unknown>;
     executePlanForRisk(ctx: ExecutionContext, planId: string, expectedRisk: RiskLevel): Promise<{
         run: ExecutionRun;
         receipt: ExecutionReceipt;
     }>;
     getRun(ctx: ExecutionContext, runId: string): ExecutionRun;
-    cancelRun(ctx: ExecutionContext, runId: string): {
+    cancelRun(ctx: ExecutionContext, runId: string, reason?: string): {
         run: ExecutionRun;
         receipt: ExecutionReceipt | null;
     };

package/dist/engine.js

@@ -3,7 +3,7 @@ import { ComposioInstantAdapter } from "./providers/composio-instant.js";
 import { ComposioSdkAdapter } from "./providers/composio-sdk.js";
 import { MicrosoftGovernanceAdapter } from "./providers/microsoft-governance.js";
 import { StripeBillingAdapter } from "./providers/stripe-billing.js";
-import { StripeProjectsAdapter } from "./providers/stripe-projects.js";
+import { StripeProjectsAdapter, isPaidCloudProvisioning, } from "./providers/stripe-projects.js";
 import { SupermemoryAdapter } from "./providers/supermemory.js";
 export class MuxoEngine {
     config;
@@ -26,10 +26,14 @@ export class MuxoEngine {
     }
     // 1. get_profile
     getProfile(ctx) {
+        const nickname = (ctx.user.email || "").split("@")[0] ||
+            ctx.user.name.toLowerCase().replace(/\s+/g, ".") ||
+            ctx.user.id;
         return {
             id: ctx.user.id,
             name: ctx.user.name,
             email: ctx.user.email,
+            nickname,
             user: ctx.user,
             actorId: ctx.actorId,
             authType: ctx.authType,
@@ -392,8 +396,14 @@ export class MuxoEngine {
             resolvedInput = nl.input;
             resolvedReason = params.reason || nl.reason || nlSource;
         }
-        const byokActive = this.store.hasByokForLane(ws.id, tool.lane, tool.slug);
-        const effectiveCreditCost = byokActive ? 0 : tool.creditCost;
+        const byokActive = params.fundingMode === "muxo_funded"
+            ? false
+            : this.store.hasByokForLane(ws.id, tool.lane, tool.slug);
+        const isPaidResourcePlan = isPaidCloudProvisioning(tool, resolvedInput);
+        const baseCreditCost = isPaidResourcePlan
+            ? Math.max(tool.creditCost, 25)
+            : tool.creditCost;
+        const effectiveCreditCost = byokActive ? 0 : baseCreditCost;
         if (ws.monthlyActionsUsed >= ws.monthlyActionsLimit) {
             throw new Error(`Monthly action limit reached (${ws.monthlyActionsUsed}/${ws.monthlyActionsLimit}). Upgrade to Starter ($29/mo) to unlock 5,000 actions/mo.`);
         }
@@ -417,7 +427,8 @@ export class MuxoEngine {
         }
         // 2. Recall Supermemory v5 contextual brain for this workspace + tool intent
         const memoryQuery = `${tool.slug} ${tool.name} ${resolvedReason}`.trim();
-        const memoryContext = await this.supermemory.getContextForWorkspace(ws.id, memoryQuery);
+        const supermemoryByok = this.store.getByokKey(ws.id, "supermemory");
+        const memoryContext = await this.enrichMemoryContext(ws.id, await this.supermemory.getContextForWorkspace(ws.id, memoryQuery, supermemoryByok), memoryQuery);
         const requiresHumanApproval = decisionRecord.verdict === "escalate" ||
             (ws.policy.mode === "enforce" &&
                 ws.policy.requireApprovalFor.includes(tool.riskLevel));
@@ -506,6 +517,91 @@ export class MuxoEngine {
             approvedBy: ctx.user.email,
         });
     }
+    async enrichMemoryContext(workspaceId, ctx, query) {
+        const localRecords = this.store.listMemoryRecords(workspaceId, 8);
+        const temporalFacts = this.store.listTemporalFacts(workspaceId, {
+            includeHistorical: false,
+            query,
+            limit: 15,
+        });
+        const recalled = ctx.recalledMemories.length > 0
+            ? ctx.recalledMemories
+            : localRecords.slice(0, 5).map((r) => ({
+                documentId: r.documentId,
+                title: r.title,
+                snippet: r.content.slice(0, 240),
+                similarity: 1,
+                createdAt: r.createdAt,
+            }));
+        const staticFacts = ctx.staticFacts.length > 0
+            ? ctx.staticFacts
+            : localRecords
+                .filter((r) => r.kind === "fact" || r.kind === "preference")
+                .slice(0, 5)
+                .map((r) => `${r.title}: ${r.content.slice(0, 140)}`);
+        const dynamicContext = ctx.dynamicContext.length > 0
+            ? ctx.dynamicContext
+            : temporalFacts.slice(0, 6).map((f) => `${f.subject} ${f.predicate} ${f.object}`);
+        const combinedText = [
+            ...staticFacts,
+            ...dynamicContext,
+            ...recalled.map((m) => `${m.title}: ${m.snippet}`),
+        ].join("\n");
+        const poisonScan = this.governance.scanMemoryContent({
+            workspaceId,
+            sessionId: ctx.namespace,
+            role: "system",
+            content: combinedText,
+            recordInDetector: false,
+        });
+        const promptLines = [
+            `[Supermemory Brain — Namespace: ${ctx.namespace}]`,
+        ];
+        if (staticFacts.length > 0) {
+            promptLines.push(`Static Facts: ${staticFacts.join(" | ")}`);
+        }
+        if (dynamicContext.length > 0) {
+            promptLines.push(`Dynamic Context: ${dynamicContext.join(" | ")}`);
+        }
+        if (temporalFacts.length > 0) {
+            promptLines.push(`Bi-Temporal Lineage (${temporalFacts.length} active): ${temporalFacts
+                .slice(0, 5)
+                .map((f) => `${f.subject} -[${f.predicate}]-> ${f.object}`)
+                .join(" | ")}`);
+        }
+        if (recalled.length > 0) {
+            promptLines.push(`Recalled Memories: ${recalled.map((m) => `${m.title}: ${m.snippet}`).join(" | ")}`);
+        }
+        const mdLines = [`## Workspace Brain (${ctx.namespace})`];
+        if (staticFacts.length > 0) {
+            mdLines.push("### Static Facts", ...staticFacts.map((f) => `- ${f}`));
+        }
+        if (temporalFacts.length > 0) {
+            mdLines.push("### Bi-Temporal Resource & Fact Lineage (Active)", ...temporalFacts
+                .slice(0, 8)
+                .map((f) => `- **${f.subject}** \`${f.predicate}\` **${f.object}** _(validFrom: ${f.validFrom})_ — ${f.summary}`));
+        }
+        return {
+            ...ctx,
+            staticFacts,
+            dynamicContext,
+            recalledMemories: recalled,
+            relevantMemories: recalled,
+            formattedPromptContext: promptLines.join("\n"),
+            profileMarkdown: ctx.profileMarkdown || mdLines.join("\n"),
+            profile: {
+                ...ctx.profile,
+                static: staticFacts,
+                dynamic: dynamicContext,
+            },
+            temporalFacts,
+            contextPoisoningScan: {
+                safe: poisonScan.safe,
+                riskLevel: poisonScan.riskLevel,
+                findingsCount: poisonScan.findingsCount,
+            },
+        };
+    }
     // 9. get_run_context
     async getRunContext(ctx, query) {
         const ws = this.store.getWorkspace(ctx.workspace.id);
@@ -516,7 +612,8 @@ export class MuxoEngine {
             redactedEnv[k] =
                 v.length > 8 ? `${v.slice(0, 4)}••••${v.slice(-3)}` : "••••••••";
         }
-        const memoryContext = await this.supermemory.getContextForWorkspace(ws.id, query);
+        const supermemoryByok = this.store.getByokKey(ws.id, "supermemory");
+        const memoryContext = await this.enrichMemoryContext(ws.id, await this.supermemory.getContextForWorkspace(ws.id, query, supermemoryByok), query);
         return {
             workspaceId: ws.id,
             workspaceSlug: ws.slug,
@@ -527,33 +624,62 @@ export class MuxoEngine {
             provisionedResources: resources.filter((r) => r.status === "active"),
             environmentVariablesRedacted: redactedEnv,
             supermemoryBrain: memoryContext,
+            temporalFacts: memoryContext.temporalFacts || [],
             governance: this.governance.getStatus(ws),
+            trustScore: this.governance.getWorkspaceTrustScore(ws.id),
             envPullHint: "Run `muxo env pull` or call GET /api/v1/resources/env to write decrypted credentials to your local .env file.",
         };
     }
     // Supermemory Workspace Brain Operations
     async getMemoryOverview(ctx, query) {
-        const context = await this.supermemory.getContextForWorkspace(ctx.workspace.id, query);
+        const supermemoryByok = this.store.getByokKey(ctx.workspace.id, "supermemory");
+        const context = await this.enrichMemoryContext(ctx.workspace.id, await this.supermemory.getContextForWorkspace(ctx.workspace.id, query, supermemoryByok), query);
         const recentMemories = this.store.listMemoryRecords(ctx.workspace.id, 25);
+        const allFacts = this.store.listTemporalFacts(ctx.workspace.id, {
+            includeHistorical: true,
+            query,
+            limit: 50,
+        });
         return {
             enabled: context.enabled,
             namespace: context.namespace,
+            fundingSource: context.fundingSource || "local_fallback",
             context,
             recentMemories,
             memories: recentMemories,
+            temporalFacts: allFacts.filter((f) => f.validTo === null),
+            historicalFacts: allFacts.filter((f) => f.validTo !== null),
         };
     }
     async addWorkspaceMemory(ctx, params) {
+        const ws = this.store.getWorkspace(ctx.workspace.id);
         const kind = params.kind || "fact";
+        // Microsoft Agent Governance OWASP ASI-06 ContextPoisoningDetector guard on memory ingestion
+        const poisonScan = this.governance.scanMemoryContent({
+            workspaceId: ws.id,
+            sessionId: this.supermemory.getWorkspaceNamespace(ws.id),
+            role: "user",
+            content: `${params.title}\n${params.content}`,
+            recordInDetector: true,
+        });
+        if (!poisonScan.safe && ws.policy.mode === "enforce") {
+            this.governance.recordAgentOutcome(ws.id, false, 0.1);
+            throw new Error(`Blocked by Microsoft ContextPoisoningDetector (OWASP ASI-06, risk=${poisonScan.riskLevel}): ${poisonScan.findings
+                .map((f) => `${f.patternName} (${f.description})`)
+                .join("; ")}`);
+        }
+        const supermemoryByok = this.store.getByokKey(ws.id, "supermemory");
         const remote = await this.supermemory.addMemory({
-            workspaceId: ctx.workspace.id,
+            workspaceId: ws.id,
             title: params.title,
             content: params.content,
             kind,
             metadata: params.metadata,
+            apiKeyOverride: supermemoryByok,
+            dreaming: "instant",
         });
-        return this.store.saveMemoryRecord({
-            workspaceId: ctx.workspace.id,
+        const record = this.store.saveMemoryRecord({
+            workspaceId: ws.id,
             namespace: remote.namespace,
             documentId: remote.documentId,
             title: params.title,
@@ -562,18 +688,103 @@ export class MuxoEngine {
             metadata: {
                 ...(params.metadata || {}),
                 supermemoryStatus: remote.status,
+                fundingSource: remote.fundingSource,
+                contextPoisoningScan: {
+                    safe: poisonScan.safe,
+                    riskLevel: poisonScan.riskLevel,
+                    findingsCount: poisonScan.findingsCount,
+                },
             },
         });
+        // Record bi-temporal entity/relationship lineage (auto-superseding prior facts for same subject+predicate)
+        const normalizedTitlePred = params.title
+            .trim()
+            .toUpperCase()
+            .replace(/[^A-Z0-9]+/g, "_")
+            .replace(/^_|_$/g, "")
+            .slice(0, 48);
+        const subject = params.subject ||
+            (typeof params.metadata?.subject === "string"
+                ? params.metadata.subject
+                : `workspace:${ws.slug}`);
+        const predicate = params.predicate ||
+            (typeof params.metadata?.predicate === "string"
+                ? params.metadata.predicate
+                : normalizedTitlePred || kind.toUpperCase());
+        const object = params.object ||
+            (typeof params.metadata?.object === "string"
+                ? params.metadata.object
+                : remote.sanitizedContent.slice(0, 160));
+        this.store.upsertTemporalFact({
+            workspaceId: ws.id,
+            subject,
+            predicate,
+            object,
+            summary: `${params.title}: ${remote.sanitizedContent.slice(0, 240)}`,
+            confidence: 0.95,
+            sourceKind: kind,
+            sourceReferenceId: record.id,
+            metadata: params.metadata || {},
+        });
+        return record;
     }
     async deleteWorkspaceMemory(ctx, idOrDocId) {
         const local = this.store.deleteMemoryRecord(ctx.workspace.id, idOrDocId);
         const docId = local?.documentId || idOrDocId;
-        const remote = await this.supermemory.deleteMemory(ctx.workspace.id, docId);
+        const supermemoryByok = this.store.getByokKey(ctx.workspace.id, "supermemory");
+        const remote = await this.supermemory.deleteMemory(ctx.workspace.id, docId, supermemoryByok);
         return {
             deleted: Boolean(local || remote.deleted),
             record: local,
         };
     }
+    async forgetWorkspaceMemoryMatching(ctx, query) {
+        const localPruned = this.store.forgetMatchingMemoryRecords(ctx.workspace.id, query);
+        const supermemoryByok = this.store.getByokKey(ctx.workspace.id, "supermemory");
+        const remotePruned = await this.supermemory.forgetMatching({
+            workspaceId: ctx.workspace.id,
+            query,
+            apiKeyOverride: supermemoryByok,
+        });
+        return {
+            query,
+            deletedLocalCount: localPruned.deletedMemories.length,
+            invalidatedFactsCount: localPruned.invalidatedFacts.length,
+            deletedRemoteIds: remotePruned.deletedRemoteIds,
+            deletedMemories: localPruned.deletedMemories,
+            invalidatedFacts: localPruned.invalidatedFacts,
+        };
+    }
+    async activateWorkspaceKillSwitch(ctx, params) {
+        const ws = this.store.getWorkspace(ctx.workspace.id);
+        const result = await this.governance.activateKillSwitch(ws.id, params.reason, params.action || "quarantine");
+        const updatedWs = this.store.updateWorkspacePolicy(ws.id, {
+            ...ws.policy,
+            killSwitchActive: true,
+            killSwitchReason: params.reason,
+        });
+        return {
+            activated: true,
+            killSwitch: result,
+            policy: updatedWs.policy,
+            trustScore: this.governance.getWorkspaceTrustScore(ws.id),
+        };
+    }
+    resumeWorkspaceKillSwitch(ctx) {
+        const ws = this.store.getWorkspace(ctx.workspace.id);
+        const resumed = this.governance.resumeKillSwitch(ws.id);
+        const updatedWs = this.store.updateWorkspacePolicy(ws.id, {
+            ...ws.policy,
+            killSwitchActive: false,
+            killSwitchReason: null,
+        });
+        return {
+            ...resumed,
+            resumed: true,
+            policy: updatedWs.policy,
+            trustScore: this.governance.getWorkspaceTrustScore(ws.id),
+        };
+    }
     // 10-15. execute_<risk_level>
     async executePlanForRisk(ctx, planId, expectedRisk) {
         const plan = this.getPlan(ctx, planId);
@@ -596,6 +807,23 @@ export class MuxoEngine {
         }
         const ws = this.store.getWorkspace(ctx.workspace.id);
         const tool = await this.inspectTool(plan.toolSlug);
+        const explicitFunding = plan.supplierSettlement?.fundingMode;
+        const byokActive = explicitFunding === "byok"
+            ? true
+            : explicitFunding === "muxo_funded"
+                ? false
+                : this.store.hasByokForLane(ws.id, tool.lane, tool.slug);
+        const effectiveCreditCost = byokActive
+            ? 0
+            : plan.creditCost > 0
+                ? plan.creditCost
+                : tool.creditCost;
+        if (ws.monthlyActionsUsed >= ws.monthlyActionsLimit) {
+            throw new Error(`Monthly action limit reached (${ws.monthlyActionsUsed}/${ws.monthlyActionsLimit}). Upgrade to Starter ($29/mo) to unlock 5,000 actions/mo.`);
+        }
+        if (effectiveCreditCost > ws.creditsBalance) {
+            throw new Error(`Insufficient workspace credits to execute plan '${plan.id}' for ${tool.slug} (requires ${effectiveCreditCost}, available ${ws.creditsBalance}). Top up credits or configure a BYOK key.`);
+        }
         const execDecisionRecord = this.governance.evaluateExecution({
             workspace: ws,
             actorId: ctx.actorId,
@@ -639,25 +867,45 @@ export class MuxoEngine {
                 });
             }
             else if (plan.lane === "composio_instant") {
+                const composioByok = byokActive
+                    ? this.store.getByokKey(ctx.workspace.id, "composio")
+                    : null;
+                const exaByok = byokActive
+                    ? this.store.getByokKey(ctx.workspace.id, "exa")
+                    : null;
+                const firecrawlByok = byokActive
+                    ? this.store.getByokKey(ctx.workspace.id, "firecrawl")
+                    : null;
                 output = await this.composioInstant.executeTool({
                     workspaceId: ctx.workspace.id,
                     tool,
                     input: plan.input,
+                    composioApiKey: composioByok,
+                    exaApiKey: exaByok,
+                    firecrawlApiKey: firecrawlByok,
                 });
             }
             else if (plan.lane === "composio_sdk") {
+                const composioByok = byokActive
+                    ? this.store.getByokKey(ctx.workspace.id, "composio")
+                    : null;
                 output = await this.composioSdk.executeTool({
                     workspaceId: ctx.workspace.id,
                     tool,
                     input: plan.input,
                     connectedAccountId: activeConnId,
+                    composioApiKey: composioByok,
                 });
             }
             else if (plan.lane === "stripe_projects") {
+                const stripeByok = byokActive
+                    ? this.store.getByokKey(ctx.workspace.id, "stripe")
+                    : null;
                 const projResult = await this.stripeProjects.executeTool({
                     workspaceId: ctx.workspace.id,
                     tool,
                     input: plan.input,
+                    stripeApiKey: stripeByok,
                 });
                 output = projResult.output;
                 if (projResult.provisionedResource) {
@@ -671,19 +919,38 @@ export class MuxoEngine {
                 throw new Error(`Unsupported execution lane: ${plan.lane}`);
             }
             const durationMs = Date.now() - startedMs;
+            this.governance.recordAgentOutcome(ctx.workspace.id, true, 0.05);
             const finalized = this.store.finalizeRun({
                 workspaceId: ctx.workspace.id,
                 runId: run.id,
                 status: "succeeded",
                 output,
                 actionsMetered: 1,
-                creditsMetered: plan.creditCost,
+                creditsMetered: effectiveCreditCost,
                 durationMs,
                 decisionRecord: execDecisionRecord,
             });
+            this.store.upsertTemporalFact({
+                workspaceId: ctx.workspace.id,
+                subject: `tool:${plan.toolSlug}`,
+                predicate: "LAST_EXECUTION",
+                object: `succeeded:${finalized.run.id}`,
+                summary: `Executed ${plan.toolSlug} (${plan.lane}, risk=${plan.riskLevel}) -> succeeded [receipt=${finalized.receipt.id}]`,
+                confidence: 1.0,
+                sourceKind: "execution_outcome",
+                sourceReferenceId: finalized.run.id,
+                metadata: {
+                    runId: finalized.run.id,
+                    receiptId: finalized.receipt.id,
+                    toolSlug: plan.toolSlug,
+                    lane: plan.lane,
+                    riskLevel: plan.riskLevel,
+                },
+            });
             // Record secret-redacted post-run memory in Supermemory for stateful actions
             if (plan.riskLevel !== "read") {
                 const summary = `Executed ${plan.toolSlug} (${plan.lane}, risk=${plan.riskLevel}) for reason "${plan.reason}" -> status=succeeded (receipt=${finalized.receipt.id}).`;
+                const supermemoryByok = this.store.getByokKey(ctx.workspace.id, "supermemory");
                 this.supermemory
                     .recordExecutionMemory({
                     workspaceId: ctx.workspace.id,
@@ -693,6 +960,7 @@ export class MuxoEngine {
                     reason: plan.reason,
                     status: "succeeded",
                     summary,
+                    apiKeyOverride: supermemoryByok,
                 })
                     .then((docId) => {
                     if (docId) {
@@ -717,6 +985,7 @@ export class MuxoEngine {
         }
         catch (err) {
             const durationMs = Date.now() - startedMs;
+            this.governance.recordAgentOutcome(ctx.workspace.id, false, 0.08);
             const errorMessage = String(err?.message || err || "Execution failed");
             return this.store.finalizeRun({
                 workspaceId: ctx.workspace.id,
@@ -739,7 +1008,7 @@ export class MuxoEngine {
         return run;
     }
     // 17. cancel_run
-    cancelRun(ctx, runId) {
+    cancelRun(ctx, runId, reason) {
         const run = this.getRun(ctx, runId);
         if (run.status === "succeeded" || run.status === "failed" || run.status === "cancelled") {
             return {
@@ -751,8 +1020,8 @@ export class MuxoEngine {
             workspaceId: ctx.workspace.id,
             runId: run.id,
             status: "cancelled",
-            output: { cancelledBy: ctx.actorId },
-            error: "Cancelled by operator",
+            output: { cancelledBy: ctx.actorId, ...(reason ? { reason } : {}) },
+            error: reason || "Cancelled by operator",
             actionsMetered: 0,
             creditsMetered: 0,
             durationMs: Date.now() - new Date(run.startedAt).getTime(),
@@ -817,6 +1086,7 @@ export class MuxoEngine {
             toolSlug: resolution.tool.slug,
             input: resolution.input,
             reason: params.prompt,
+            fundingMode: params.fundingMode,
         });
         if (planned.authHandoff?.required) {
             return {

package/dist/mcp.d.ts

@@ -4,12 +4,17 @@ export interface McpToolAnnotations {
     destructiveHint: boolean;
     openWorldHint: boolean;
 }
+export interface McpToolSecurityScheme {
+    type: "noauth" | "oauth2";
+    scopes?: string[];
+}
 export interface McpToolDefinition {
     name: string;
     title: string;
     description: string;
     inputSchema: Record<string, unknown>;
     outputSchema?: Record<string, unknown>;
+    securitySchemes?: McpToolSecurityScheme[];
     annotations: McpToolAnnotations;
     _meta?: Record<string, unknown>;
 }
@@ -17,7 +22,7 @@ export interface McpToolDefinition {
  * Concise server instructions (<512 chars) per OpenAI Plugin MCP Server specification:
  * https://developers.openai.com/plugins/build/mcp-server
  */
-export declare const MUXO_MCP_SERVER_INSTRUCTIONS = "Muxo governs SaaS actions (Composio app.*), Instant tools (instant.*), Cloud Infrastructure (Stripe Projects resource.*), Supermemory v5 recall, and Microsoft Agent Governance Ed25519 receipts. Workflow: 1) search_tools & inspect_tool. 2) plan_action to get a plan_*. 3) If authHandoff.required is true, show redirectUrl and call wait_for_connection. 4) Execute via the matching risk tool (execute_read/write/admin/financial/provisioning/destructive). 5) Verify via get_receipt.";
+export declare const MUXO_MCP_SERVER_INSTRUCTIONS = "Muxo governs SaaS actions (Connected Apps: app.*), Instant tools (instant.*), Cloud Infrastructure (resource.*), Workspace Memory recall, and verifiable audit records. Workflow: 1) search_tools & inspect_tool. 2) plan_action to get a plan_*. 3) If authHandoff.required is true, show redirectUrl and call wait_for_connection. 4) Execute via the matching risk tool (execute_read/write/admin/financial/provisioning/destructive). 5) Verify via get_receipt.";
 export declare const MUXO_MCP_TOOLS: McpToolDefinition[];
 /**
  * OpenAI Company Knowledge standard `search` and `fetch` tool definitions