@muxoai/platform 1.3.1 → 1.3.2

package/README.md

@@ -1,6 +1,6 @@
 # Muxo (`@muxoai/platform` / `@muxoai/cli` / `@muxoai/sdk`)
 
-Muxo (`v1.3.1`) is the unified execution, cloud infrastructure provisioning, contextual memory, and cryptographic governance platform for AI agents and applications. Customers and their agents interact exclusively with **Muxo** — either via structured tool slugs or free-form **Natural Language** (`muxo do`, `POST /api/v1/do`, `client.do()`, and MCP `plan_action`).
+Muxo (`v1.3.2`) is the unified execution, cloud infrastructure provisioning, contextual memory, and cryptographic governance platform for AI agents and applications. Customers and their agents interact exclusively with **Muxo** — either via structured tool slugs or free-form **Natural Language** (`muxo do`, `POST /api/v1/do`, `client.do()`, and MCP `plan_action`).
 
 See [`ARCHITECTURE.md`](./ARCHITECTURE.md) for the complete internal engineering blueprint, open-source ecosystem Keep/Adopt/Drop matrix, and 4-pillar architecture.
 
@@ -46,8 +46,16 @@ muxo billing upgrade
 muxo link gmail --wait
 muxo provision turso --input '{"database_name":"my-agent-db"}' --approve
 muxo env pull --out .env.muxo
-```
 
+# 8. Check your setup, memory, and safety controls
+muxo harness                                   # API, MCP, auth, kill switch, audit chain, catalog (exit 1 on failure)
+muxo memory facts                              # Facts with history; add --current for current facts only
+muxo memory forget "old staging database"      # Delete matching memories and retire their facts
+muxo governance scan "text to check"           # Prompt-injection check before storing or forwarding text
+muxo governance pause "incident review"        # Kill switch: stop all agent actions in the workspace
+muxo governance resume
+muxo governance policy --ring 2 --block-destructive-sql true --require-approval financial,destructive
+```
 ## Official Plugins, Marketplaces & MCP Setup (`https://api.muxo.ai/mcp`)
 
 Muxo ships a portable OpenAI Plugin (`plugins/muxo/plugin.json` & `plugins/muxo/mcp.json`), Claude Code Plugin (`plugins/muxo/.claude-plugin/plugin.json`), and Streamable HTTP MCP Server:

package/dist/clerk.d.ts

@@ -0,0 +1,33 @@
+export interface ClerkConfig {
+    publishableKey: string;
+    frontendApi: string;
+    authorizedParties: string[];
+    jwtKey?: string;
+    secretKey?: string;
+}
+export interface ClerkSession {
+    userId: string;
+    sessionId: string;
+    email?: string;
+    emailVerified?: boolean;
+}
+export interface ClerkProfile {
+    email: string | null;
+    emailVerified: boolean;
+    name: string | null;
+}
+export interface ClerkEnv {
+    CLERK_PUBLISHABLE_KEY?: string;
+    CLERK_SECRET_KEY?: string;
+    CLERK_JWT_KEY?: string;
+    CLERK_AUTHORIZED_PARTIES?: string;
+}
+/** Derives the Clerk Frontend API origin encoded in a publishable key (pk_live_/pk_test_). */
+export declare function clerkFrontendApi(publishableKey: string): string | null;
+export declare function readClerkConfig(env: ClerkEnv, fallbackAuthorizedParty?: string): ClerkConfig | null;
+export declare function looksLikeJwt(token: string): boolean;
+/** Verifies a Clerk session JWT (RS256) and returns the session identity, or null if invalid. */
+export declare function verifyClerkSessionToken(token: string, config: ClerkConfig, nowSeconds?: number): Promise<ClerkSession | null>;
+/** Reads the primary email and name for a Clerk user through the Backend API. */
+export declare function fetchClerkProfile(userId: string, secretKey: string): Promise<ClerkProfile | null>;
+export declare function clerkBrowserScriptUrl(frontendApi: string): string;

package/dist/clerk.js

@@ -0,0 +1,198 @@
+const RS256 = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
+const JWKS_TTL_MS = 10 * 60 * 1000;
+const JWKS_RETRY_MS = 30 * 1000;
+const CLOCK_SKEW_SECONDS = 5;
+function base64UrlToBytes(input) {
+    const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = normalized + "=".repeat((4 - (normalized.length % 4)) % 4);
+    const binary = atob(padded);
+    const bytes = new Uint8Array(new ArrayBuffer(binary.length));
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return bytes;
+}
+function decodeJsonSegment(segment) {
+    try {
+        const parsed = JSON.parse(new TextDecoder().decode(base64UrlToBytes(segment)));
+        return parsed && typeof parsed === "object" ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Derives the Clerk Frontend API origin encoded in a publishable key (pk_live_/pk_test_). */
+export function clerkFrontendApi(publishableKey) {
+    const match = /^pk_(?:live|test)_([A-Za-z0-9+/=_-]{4,512})$/.exec(publishableKey.trim());
+    if (!match)
+        return null;
+    let decoded;
+    try {
+        decoded = new TextDecoder().decode(base64UrlToBytes(match[1]));
+    }
+    catch {
+        return null;
+    }
+    if (!decoded.endsWith("$"))
+        return null;
+    const host = decoded.slice(0, -1);
+    if (!/^(?=.{4,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(host))
+        return null;
+    return `https://${host.toLowerCase()}`;
+}
+export function readClerkConfig(env, fallbackAuthorizedParty) {
+    const publishableKey = (env.CLERK_PUBLISHABLE_KEY || "").trim();
+    if (!publishableKey)
+        return null;
+    const frontendApi = clerkFrontendApi(publishableKey);
+    if (!frontendApi)
+        return null;
+    const configured = (env.CLERK_AUTHORIZED_PARTIES || "")
+        .split(",")
+        .map((s) => s.trim().replace(/\/+$/, ""))
+        .filter(Boolean);
+    const authorizedParties = configured.length
+        ? configured
+        : fallbackAuthorizedParty
+            ? [fallbackAuthorizedParty.replace(/\/+$/, "")]
+            : [];
+    return {
+        publishableKey,
+        frontendApi,
+        authorizedParties,
+        jwtKey: (env.CLERK_JWT_KEY || "").trim() || undefined,
+        secretKey: (env.CLERK_SECRET_KEY || "").trim() || undefined,
+    };
+}
+export function looksLikeJwt(token) {
+    return /^eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(token);
+}
+async function importPemKey(pem) {
+    const body = pem
+        .replace(/\\n/g, "\n")
+        .replace(/-----BEGIN PUBLIC KEY-----/, "")
+        .replace(/-----END PUBLIC KEY-----/, "")
+        .replace(/\s+/g, "");
+    return crypto.subtle.importKey("spki", base64UrlToBytes(body), RS256, false, ["verify"]);
+}
+// Only public verification keys are cached; never tokens or user data.
+const jwksCache = new Map();
+const pemCache = new Map();
+async function loadJwks(frontendApi) {
+    const res = await fetch(`${frontendApi}/.well-known/jwks.json`, {
+        headers: { Accept: "application/json" },
+        redirect: "manual",
+    });
+    if (res.status !== 200)
+        throw new Error(`Clerk JWKS unavailable (HTTP ${res.status})`);
+    const doc = (await res.json());
+    const keys = new Map();
+    for (const jwk of doc.keys || []) {
+        if (jwk.kty !== "RSA" || typeof jwk.kid !== "string")
+            continue;
+        if (jwk.use && jwk.use !== "sig")
+            continue;
+        const key = await crypto.subtle.importKey("jwk", { kty: "RSA", n: String(jwk.n), e: String(jwk.e), alg: "RS256", ext: true }, RS256, false, ["verify"]);
+        keys.set(jwk.kid, key);
+    }
+    return keys;
+}
+async function verificationKey(config, kid) {
+    if (config.jwtKey) {
+        let key = pemCache.get(config.jwtKey);
+        if (!key) {
+            key = await importPemKey(config.jwtKey);
+            pemCache.set(config.jwtKey, key);
+        }
+        return key;
+    }
+    if (!kid)
+        return null;
+    const now = Date.now();
+    const cached = jwksCache.get(config.frontendApi);
+    const fresh = cached && now - cached.fetchedAt < JWKS_TTL_MS;
+    if (cached?.keys.has(kid) && fresh)
+        return cached.keys.get(kid);
+    // Refetch for unknown kids (key rotation), but not more than once per retry window.
+    if (!cached || !fresh || now - cached.fetchedAt > JWKS_RETRY_MS) {
+        const keys = await loadJwks(config.frontendApi);
+        jwksCache.set(config.frontendApi, { keys, fetchedAt: now });
+        return keys.get(kid) || null;
+    }
+    return cached.keys.get(kid) || null;
+}
+/** Verifies a Clerk session JWT (RS256) and returns the session identity, or null if invalid. */
+export async function verifyClerkSessionToken(token, config, nowSeconds = Math.floor(Date.now() / 1000)) {
+    if (!looksLikeJwt(token) || token.length > 16_384)
+        return null;
+    const [headerPart, payloadPart, signaturePart] = token.split(".");
+    const header = decodeJsonSegment(headerPart);
+    const payload = decodeJsonSegment(payloadPart);
+    if (!header || !payload || header.alg !== "RS256")
+        return null;
+    let key;
+    try {
+        key = await verificationKey(config, typeof header.kid === "string" ? header.kid : undefined);
+    }
+    catch {
+        return null;
+    }
+    if (!key)
+        return null;
+    let valid = false;
+    try {
+        valid = await crypto.subtle.verify(RS256, key, base64UrlToBytes(signaturePart), new TextEncoder().encode(`${headerPart}.${payloadPart}`));
+    }
+    catch {
+        return null;
+    }
+    if (!valid)
+        return null;
+    if (payload.iss !== config.frontendApi)
+        return null;
+    if (typeof payload.exp !== "number" || payload.exp + CLOCK_SKEW_SECONDS < nowSeconds)
+        return null;
+    if (typeof payload.nbf === "number" && payload.nbf - CLOCK_SKEW_SECONDS > nowSeconds)
+        return null;
+    if (typeof payload.iat === "number" && payload.iat - CLOCK_SKEW_SECONDS > nowSeconds)
+        return null;
+    if (typeof payload.azp === "string" &&
+        config.authorizedParties.length > 0 &&
+        !config.authorizedParties.includes(payload.azp.replace(/\/+$/, ""))) {
+        return null;
+    }
+    if (payload.sts !== undefined && payload.sts !== "active")
+        return null;
+    if (typeof payload.sub !== "string" || !/^user_[A-Za-z0-9]{1,128}$/.test(payload.sub))
+        return null;
+    return {
+        userId: payload.sub,
+        sessionId: typeof payload.sid === "string" ? payload.sid : "",
+        email: typeof payload.email === "string" ? payload.email.toLowerCase() : undefined,
+        emailVerified: payload.email_verified === true,
+    };
+}
+/** Reads the primary email and name for a Clerk user through the Backend API. */
+export async function fetchClerkProfile(userId, secretKey) {
+    try {
+        const res = await fetch(`https://api.clerk.com/v1/users/${encodeURIComponent(userId)}`, {
+            headers: { Authorization: `Bearer ${secretKey}`, Accept: "application/json" },
+        });
+        if (!res.ok)
+            return null;
+        const user = (await res.json());
+        const addresses = user.email_addresses || [];
+        const primary = addresses.find((e) => e.id === user.primary_email_address_id) || addresses[0];
+        const name = [user.first_name, user.last_name].filter(Boolean).join(" ").trim() || user.username || null;
+        return {
+            email: primary?.email_address ? primary.email_address.toLowerCase() : null,
+            emailVerified: primary?.verification?.status === "verified",
+            name,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function clerkBrowserScriptUrl(frontendApi) {
+    return `${frontendApi}/npm/@clerk/clerk-js@5/dist/clerk.browser.js`;
+}