@muxoai/platform 1.3.3 → 1.4.1

package/dist/server.js

@@ -5,10 +5,15 @@ import path from "node:path";
 import { getConfig, ROOT_DIR } from "./config.js";
 import { MuxoEngine } from "./engine.js";
 import { getMuxoMcpSkills, handleJsonRpcMcpRequest, MUXO_MCP_SERVER_INSTRUCTIONS, MUXO_MCP_TOOLS, } from "./mcp.js";
+import { APPROVED_PLAN_STATUSES, MuxoToolError, clampWaitSeconds, errorPayloadFrom, isPublicMcpRequest, workspaceAgentDid, } from "./mcp-schema.js";
 import { MuxoStore } from "./store.js";
-import { sanitizePolicyPatch } from "./policy.js";
+import { managedProviderConnectionList, managedProviderConnectionRequest, managedProviderConnectionUnlink, managedResource, managedResourceAction, } from "./provisioning-managed.js";
+import { DEFAULT_WORKSPACE_POLICY, describePolicyInPlainEnglish, sanitizePolicyPatch, } from "./policy.js";
+import { parseNaturalLanguageMemoryInstruction } from "./providers/supermemory.js";
 import { MUXO_VERSION } from "./version.js";
-import { isConsolePath, renderConsoleHtml, renderLandingHtml } from "./ui/console-html.js";
+import { isConsolePath, renderApprovalPageHtml, renderConsoleHtml, renderLandingHtml, renderOAuthConsentHtml, } from "./ui/console-html.js";
+import { fetchClerkProfile, looksLikeJwt, readClerkConfig, verifyClerkSessionToken, } from "./clerk.js";
+import { DEFAULT_OAUTH_SCOPE, OAUTH_ACCESS_TOKEN_TTL_SECONDS, OAUTH_CODE_TTL_MS, oauthConnectionKeyName, oauthRedirectOrigin, oauthSecretToken, parseAuthorizeRequest, parseOAuthFormBody, verifyPkce, } from "./oauth.js";
 function renderSkillMarkdown(baseUrl) {
     return `---
 name: muxo
@@ -89,9 +94,32 @@ ${MUXO_MCP_TOOLS.map((t, i) => `${i + 1}. \`${t.name}\` — ${t.description}`).j
 1. **Discover**: Call \`search_tools\` with a keyword or lane filter.
 2. **Inspect**: Call \`inspect_tool\` to read the tool's \`inputSchema\`, \`riskLevel\`, and \`creditCost\`.
 3. **Plan**: Call \`plan_action({ tool_slug, input, reason })\` to receive a \`plan_*\` ID.
-   - If the tool is an unconnected \`app.<provider>.*\` action, \`plan_action\` automatically attaches \`authHandoff.redirectUrl\`. Show that URL to the user, then call \`wait_for_connection({ provider })\` until \`status === "active"\`.
+   - If the tool is an unconnected \`app.<provider>.*\` action, \`plan_action\` automatically attaches \`authHandoff.redirectUrl\` and a structured \`humanHandoff\` block. Show \`humanHandoff.url\` to the user, then call \`wait_for_connection({ provider })\` until \`status === "active"\`.
+   - If the plan's \`approvalStatus\` is \`pending_approval\`, \`plan_action\` attaches a \`humanHandoff\` of kind \`approval\` whose \`url\` (\`${baseUrl}/approve/<plan_id>\`) opens a one-click **Review & approve** page for the workspace owner. Send that link to the user and stop until they confirm.
+   - Always follow \`llmGuidance.nextToolCalls\` for the exact next tool call sequence.
 4. **Execute**: Call the matching risk lane tool (\`execute_read\`, \`execute_write\`, \`execute_admin\`, \`execute_financial\`, \`execute_provisioning\`, or \`execute_destructive\`) with \`{ plan_id }\`.
 5. **Verify Receipt**: Every run issues an HMAC-SHA256 chained cryptographic receipt (\`rcpt_*\`) verifiable via \`get_receipt\`.
+
+## Plain-English & Conditional Guardrails (LLM & MCP Harness Native)
+
+Users and LLM harnesses can set safety rules in natural language or structured parameter rules; Muxo compiles and enforces them across all tool calls:
+
+- "Only allow sending emails to @muxo.ai" → conditional recipient domain guardrail (\`must_end_with: @muxo.ai\`)
+- "Require approval for Stripe refunds over $50, auto-approve under $50" → conditional threshold guardrail (\`max_number: 50\`, \`unit: "usd"\`, \`action: "require_approval"\`, \`elseAction: "auto_approve"\`)
+- "Only post Slack messages to #ops-alerts or #deployments" → channel allowlist guardrail
+- "Never spend more than 25 credits per run" → workspace per-run credit cap
+
+Set or inspect them via MCP \`get_run_context({ action: "set_guardrail", prompt: "...", parameter_rules: [...] })\`, \`POST /api/v1/do\` (\`{ "prompt": "..." }\`), \`POST /api/v1/guardrails\` (\`{ "prompt": "...", "parameterRules": [...] }\`), or list them with \`GET /api/v1/guardrails\`. Responses always include \`plainEnglishGuardrails\` so humans and agents can read the active rules.
+
+## Active Supermemory (teach Muxo once, auto-fill forever)
+
+Teach preferences in plain English and Muxo auto-fills matching tool inputs on every future plan:
+
+- "Hey Muxo, remember our default GitHub repo is acme/api and default region is us-east-1"
+- "Hey Muxo, forget our staging redis"
+- "What do you remember?"
+
+\`plan_action\` recalls workspace memory before governance checks and reports \`memoryContext.autoFilledInput\` plus \`activeDefaults\` so callers can see exactly which parameters were filled from memory.
 `;
 }
 async function readBody(req) {
@@ -135,17 +163,68 @@ export function createMuxoServer(customConfig) {
         client_id_issued_at: Math.floor(Date.now() / 1000),
     });
     const oauthCodes = new Map();
-    const resolveContext = (req) => {
-        const authHeader = String(req.headers.authorization || "").trim();
-        if (authHeader.toLowerCase().startsWith("bearer ")) {
-            const token = authHeader.slice(7).trim();
-            const resolved = store.resolveAuthToken(token);
-            if (resolved)
-                return resolved;
+    const clerkEnv = config.clerkEnv ?? {};
+    const clerkConfig = () => readClerkConfig(clerkEnv, config.baseUrl);
+    const ownerEmails = () => String(clerkEnv.MUXO_OWNER_EMAILS || "")
+        .split(",")
+        .map((s) => s.trim().toLowerCase())
+        .filter(Boolean);
+    const bearerTokenOf = (req) => {
+        const header = String(req.headers.authorization || "").trim();
+        return /^bearer\s+/i.test(header) ? header.replace(/^bearer\s+/i, "").trim() : null;
+    };
+    /**
+     * Resolves the caller from a workspace API key, a console session token, or a Clerk session
+     * JWT. A bearer token that resolves to nothing is "invalid" and must never fall back to a
+     * default workspace.
+     */
+    const authenticate = async (req) => {
+        const token = bearerTokenOf(req);
+        if (token === null)
+            return { kind: "anonymous" };
+        if (!token)
+            return { kind: "invalid" };
+        const wsOverride = String(req.headers["x-muxo-workspace-id"] || "").trim() || null;
+        const resolved = store.resolveAuthToken(token, wsOverride);
+        if (resolved)
+            return { kind: "ok", ctx: resolved, via: resolved.authType };
+        const clerk = looksLikeJwt(token) ? clerkConfig() : null;
+        if (!clerk)
+            return { kind: "invalid" };
+        const session = await verifyClerkSessionToken(token, clerk);
+        if (!session)
+            return { kind: "invalid" };
+        let user = store.getClerkLinkedUser(session.userId);
+        if (!user) {
+            const profile = clerk.secretKey ? await fetchClerkProfile(session.userId, clerk.secretKey) : null;
+            const identity = {
+                email: profile?.email || session.email || null,
+                emailVerified: profile ? profile.emailVerified : Boolean(session.emailVerified),
+                name: profile?.name || null,
+            };
+            const joinsPrimary = Boolean(identity.email && identity.emailVerified && ownerEmails().includes(identity.email.toLowerCase()));
+            user = store.provisionClerkUser(session.userId, identity, joinsPrimary ? bootstrap.workspace.id : null);
         }
-        // Default local console session fallback to the primary workspace
-        const ws = store.getWorkspace(bootstrap.workspace.id);
-        const user = store.getUser(ws.ownerUserId);
+        const targetWsId = wsOverride && store.userCanAccessWorkspace(user.id, wsOverride) ? wsOverride : user.workspaceId;
+        const workspace = store.getWorkspace(targetWsId) || store.getWorkspace(user.workspaceId);
+        if (!workspace)
+            return { kind: "invalid" };
+        return {
+            kind: "ok",
+            ctx: { user: { ...user, workspaceId: workspace.id }, workspace, actorId: user.id, authType: "session" },
+            via: "clerk",
+            clerkUserId: session.userId,
+            clerkSessionEmail: session.email && session.emailVerified ? session.email : null,
+        };
+    };
+    /** Without Clerk, a local server serves anonymous callers from its primary workspace. */
+    const localFallbackContext = (req) => {
+        const wsOverride = String(req.headers["x-muxo-workspace-id"] || "").trim() || null;
+        const fallbackWsId = wsOverride && store.userCanAccessWorkspace(bootstrap.user.id, wsOverride)
+            ? wsOverride
+            : bootstrap.user.workspaceId || bootstrap.workspace.id;
+        const ws = store.getWorkspace(fallbackWsId) || store.getWorkspace(bootstrap.workspace.id);
+        const user = store.getUser(ws.ownerUserId) || bootstrap.user;
         return {
             user,
             workspace: ws,
@@ -153,11 +232,95 @@ export function createMuxoServer(customConfig) {
             authType: "session",
         };
     };
+    const anonymousContext = () => {
+        const epoch = new Date(0).toISOString();
+        return {
+            user: { id: "usr_anonymous", email: "", name: "Anonymous", workspaceId: "ws_public", role: "member", createdAt: epoch },
+            workspace: {
+                id: "ws_public",
+                name: "Public catalog",
+                slug: "public",
+                ownerUserId: "usr_anonymous",
+                tier: "free",
+                monthlyActionsLimit: 0,
+                monthlyActionsUsed: 0,
+                creditsBalance: 0,
+                stripeCustomerId: null,
+                stripeSubscriptionId: null,
+                projectsEnvName: "muxo-public",
+                policy: { ...DEFAULT_WORKSPACE_POLICY },
+                createdAt: epoch,
+                updatedAt: epoch,
+            },
+            actorId: "usr_anonymous",
+            authType: "session",
+        };
+    };
+    const requestOriginOf = (req) => {
+        const proto = String(req.headers["x-forwarded-proto"] || "http").split(",")[0].trim();
+        return req.headers.host ? `${proto}://${req.headers.host}` : config.baseUrl;
+    };
+    const sendAuthRequired = (req, res, pathname, message) => {
+        const origin = requestOriginOf(req);
+        const resourceMetadata = pathname === "/mcp"
+            ? `${origin}/.well-known/oauth-protected-resource/mcp`
+            : `${origin}/.well-known/oauth-protected-resource`;
+        sendJson(res, 401, {
+            ok: false,
+            code: "auth_required",
+            error: message ||
+                `Sign in required. Send a Muxo API key (Authorization: Bearer mk_live_...) or sign in at ${origin}/login.`,
+        }, { "WWW-Authenticate": `Bearer resource_metadata="${resourceMetadata}"` });
+    };
+    /** Emails the signed-in person has verified; agent API keys never count as a person. */
+    const verifiedEmailsOf = async (auth) => {
+        if (auth.kind !== "ok")
+            return [];
+        if (auth.via === "session")
+            return auth.ctx.user.email ? [auth.ctx.user.email.toLowerCase()] : [];
+        if (auth.via !== "clerk")
+            return [];
+        const secretKey = clerkConfig()?.secretKey;
+        if (secretKey && auth.clerkUserId) {
+            const profile = await fetchClerkProfile(auth.clerkUserId, secretKey);
+            if (profile)
+                return profile.verifiedEmails;
+        }
+        return auth.clerkSessionEmail ? [auth.clerkSessionEmail.toLowerCase()] : [];
+    };
+    const signedInPerson = (auth) => auth.kind === "ok" && auth.via !== "api_key";
+    /**
+     * Resolves the caller of a protected route, or answers 401 and returns null. Public routes
+     * accept anonymous callers with an empty catalog context once Clerk sign-in is configured.
+     */
+    const requireContext = async (req, res, pathname, publicRoute = false) => {
+        const auth = await authenticate(req);
+        if (auth.kind === "ok")
+            return { ctx: auth.ctx, auth };
+        if (auth.kind === "invalid") {
+            sendAuthRequired(req, res, pathname);
+            return null;
+        }
+        if (clerkConfig()) {
+            if (publicRoute)
+                return { ctx: anonymousContext(), auth };
+            sendAuthRequired(req, res, pathname);
+            return null;
+        }
+        return { ctx: localFallbackContext(req), auth };
+    };
+    const consentPageHeaders = {
+        "Content-Type": "text/html; charset=utf-8",
+        "Cache-Control": "no-store",
+        "Content-Security-Policy": "frame-ancestors 'none'",
+        "X-Frame-Options": "DENY",
+        "Referrer-Policy": "no-referrer",
+    };
     const server = http.createServer(async (req, res) => {
         if (req.method === "OPTIONS") {
             res.writeHead(204, {
                 "Access-Control-Allow-Origin": "*",
-                "Access-Control-Allow-Headers": "Content-Type, Authorization",
+                "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Muxo-Workspace-Id",
                 "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
             });
             res.end();
@@ -202,6 +365,20 @@ export function createMuxoServer(customConfig) {
                 });
                 return;
             }
+            if (pathname === "/.well-known/jwks.json" && req.method === "GET") {
+                sendJson(res, 200, {
+                    keys: [
+                        {
+                            kty: "OKP",
+                            crv: "Ed25519",
+                            use: "sig",
+                            alg: "EdDSA",
+                            kid: "muxo-governance-ed25519-v1",
+                        },
+                    ],
+                });
+                return;
+            }
             if ((pathname === "/.well-known/oauth-protected-resource" ||
                 pathname === "/.well-known/oauth-protected-resource/mcp") &&
                 req.method === "GET") {
@@ -216,7 +393,7 @@ export function createMuxoServer(customConfig) {
                     resource,
                     authorization_servers: [requestOrigin],
                     bearer_methods_supported: ["header"],
-                    scopes_supported: ["muxo:mcp", "muxo:read", "muxo:execute", "muxo:provision"],
+                    scopes_supported: ["mcp:tools", "muxo:mcp", "muxo:read", "muxo:execute", "muxo:provision"],
                     resource_documentation: `${config.docsUrl}/quickstart`,
                     mcp_endpoint: `${requestOrigin}/mcp`,
                 });
@@ -238,6 +415,7 @@ export function createMuxoServer(customConfig) {
                     userinfo_endpoint: `${requestOrigin}/oauth/userinfo`,
                     jwks_uri: `${requestOrigin}/.well-known/jwks.json`,
                     scopes_supported: [
+                        "mcp:tools",
                         "muxo:mcp",
                         "muxo:read",
                         "muxo:execute",
@@ -247,11 +425,7 @@ export function createMuxoServer(customConfig) {
                         "email",
                     ],
                     response_types_supported: ["code"],
-                    grant_types_supported: [
-                        "authorization_code",
-                        "refresh_token",
-                        "client_credentials",
-                    ],
+                    grant_types_supported: ["authorization_code", "refresh_token"],
                     token_endpoint_auth_methods_supported: [
                         "none",
                         "client_secret_post",
@@ -301,149 +475,185 @@ export function createMuxoServer(customConfig) {
                 sendJson(res, 201, clientRecord);
                 return;
             }
-            if (pathname === "/oauth/authorize" &&
-                (req.method === "GET" || req.method === "POST")) {
-                const bodyParams = req.method === "POST"
-                    ? new URLSearchParams(await readBody(req))
-                    : url.searchParams;
-                const clientId = bodyParams.get("client_id") ||
-                    url.searchParams.get("client_id") ||
-                    "muxo-openai-plugin";
-                const redirectUri = bodyParams.get("redirect_uri") ||
-                    url.searchParams.get("redirect_uri") ||
-                    "http://127.0.0.1:3118/oauth/callback";
-                const stateParam = bodyParams.get("state") || url.searchParams.get("state") || "";
-                const scope = bodyParams.get("scope") ||
-                    url.searchParams.get("scope") ||
-                    "muxo:mcp muxo:read muxo:execute muxo:provision";
-                const codeChallenge = bodyParams.get("code_challenge") ||
-                    url.searchParams.get("code_challenge") ||
-                    undefined;
-                const codeChallengeMethod = bodyParams.get("code_challenge_method") ||
-                    url.searchParams.get("code_challenge_method") ||
-                    "S256";
-                const code = `muxo_auth_code_${crypto.randomBytes(16).toString("hex")}`;
-                const issuedKey = bootstrap.defaultApiKey ||
-                    store.createApiKey({
-                        workspaceId: bootstrap.workspace.id,
-                        name: `OAuth Client (${clientId})`,
-                        environment: "live",
-                    }).secretKey;
-                oauthCodes.set(code, {
-                    code,
-                    clientId,
-                    redirectUri,
-                    scope,
-                    codeChallenge,
-                    codeChallengeMethod,
-                    workspaceId: bootstrap.workspace.id,
-                    apiKey: issuedKey,
-                    expiresAt: Date.now() + 10 * 60 * 1000,
-                });
-                const proto = String(req.headers["x-forwarded-proto"] || "http").split(",")[0].trim();
-                const requestOrigin = req.headers.host
-                    ? `${proto}://${req.headers.host}`
-                    : config.baseUrl;
-                const redirectTarget = new URL(redirectUri);
-                redirectTarget.searchParams.set("code", code);
-                if (stateParam)
-                    redirectTarget.searchParams.set("state", stateParam);
-                redirectTarget.searchParams.set("iss", requestOrigin);
-                if (url.searchParams.get("format") === "json" ||
-                    String(req.headers.accept || "").includes("application/json")) {
-                    sendJson(res, 200, {
-                        ok: true,
-                        code,
-                        state: stateParam || null,
-                        iss: requestOrigin,
-                        client_id: clientId,
-                        redirect_uri: redirectTarget.toString(),
+            if (pathname === "/oauth/authorize" && req.method === "GET") {
+                const parsed = parseAuthorizeRequest(url.searchParams);
+                const wantsJson = url.searchParams.get("format") === "json" ||
+                    String(req.headers.accept || "").includes("application/json");
+                if ("error" in parsed) {
+                    if (wantsJson) {
+                        sendJson(res, 400, { error: "invalid_request", error_description: parsed.error }, { "Cache-Control": "no-store" });
+                    }
+                    else {
+                        res.writeHead(400, consentPageHeaders);
+                        res.end(renderOAuthConsentHtml({ error: parsed.error }));
+                    }
+                    return;
+                }
+                if (wantsJson) {
+                    sendJson(res, 401, {
+                        ok: false,
+                        code: "interactive_sign_in_required",
+                        error: "Open this authorization URL in a browser to sign in and approve access.",
+                        authorizeUrl: url.toString(),
                     });
                     return;
                 }
-                res.writeHead(302, {
-                    Location: redirectTarget.toString(),
-                    "Access-Control-Allow-Origin": "*",
-                });
-                res.end();
+                const clerk = clerkConfig();
+                res.writeHead(200, consentPageHeaders);
+                res.end(renderOAuthConsentHtml({
+                    clientName: parsed.clientName,
+                    redirectOrigin: oauthRedirectOrigin(parsed.redirectUri),
+                    clerk: clerk ? { publishableKey: clerk.publishableKey, frontendApi: clerk.frontendApi } : null,
+                    request: {
+                        client_id: parsed.clientId,
+                        redirect_uri: parsed.redirectUri,
+                        state: parsed.state,
+                        code_challenge: parsed.codeChallenge || "",
+                        code_challenge_method: parsed.codeChallengeMethod || "",
+                        scope: parsed.scope,
+                    },
+                }));
                 return;
             }
-            if (pathname === "/oauth/token" && req.method === "POST") {
-                const rawBody = await readBody(req);
+            if (pathname === "/oauth/authorize" && req.method === "POST") {
+                const auth = await authenticate(req);
+                // A person must approve; agent API keys cannot grant themselves new access.
+                if (!signedInPerson(auth)) {
+                    sendJson(res, 401, { ok: false, code: "auth_required", error: "Sign in to approve this connection." });
+                    return;
+                }
+                const raw = await readBody(req);
                 const contentType = String(req.headers["content-type"] || "");
-                const params = {};
-                if (contentType.includes("application/json")) {
-                    const parsed = JSON.parse(rawBody || "{}");
-                    for (const [k, v] of Object.entries(parsed)) {
-                        if (v !== undefined && v !== null)
-                            params[k] = String(v);
-                    }
+                const params = contentType.includes("application/json")
+                    ? parseOAuthFormBody(raw, "application/json", "")
+                    : new URLSearchParams(raw);
+                const parsed = parseAuthorizeRequest(params);
+                if ("error" in parsed) {
+                    sendJson(res, 400, { ok: false, error: parsed.error });
+                    return;
                 }
-                else {
-                    const sp = new URLSearchParams(rawBody);
-                    for (const [k, v] of sp.entries()) {
-                        params[k] = v;
-                    }
+                const redirectTarget = new URL(parsed.redirectUri);
+                if (parsed.state)
+                    redirectTarget.searchParams.set("state", parsed.state);
+                redirectTarget.searchParams.set("iss", requestOriginOf(req));
+                if (params.get("decision") === "deny") {
+                    redirectTarget.searchParams.set("error", "access_denied");
+                    sendJson(res, 200, { ok: true, redirect: redirectTarget.toString() });
+                    return;
                 }
-                const grantType = params.grant_type || "authorization_code";
-                const code = params.code || "";
-                const codeVerifier = params.code_verifier || "";
-                let accessToken = bootstrap.defaultApiKey || "";
-                let scope = params.scope || "muxo:mcp muxo:read muxo:execute muxo:provision";
-                if (grantType === "authorization_code" && code) {
-                    const record = oauthCodes.get(code);
-                    if (!record || record.expiresAt < Date.now()) {
-                        sendJson(res, 400, {
-                            error: "invalid_grant",
-                            error_description: "Authorization code is invalid or expired.",
-                        });
-                        return;
+                const now = Date.now();
+                for (const [c, rec] of oauthCodes)
+                    if (rec.expiresAt < now)
+                        oauthCodes.delete(c);
+                const code = oauthSecretToken("muxo_code");
+                oauthCodes.set(code, {
+                    userId: auth.ctx.user.id,
+                    workspaceId: auth.ctx.workspace.id,
+                    clientId: parsed.clientId,
+                    clientName: parsed.clientName,
+                    redirectUri: parsed.redirectUri,
+                    scope: parsed.scope,
+                    codeChallenge: parsed.codeChallenge,
+                    codeChallengeMethod: parsed.codeChallengeMethod,
+                    expiresAt: now + OAUTH_CODE_TTL_MS,
+                });
+                redirectTarget.searchParams.set("code", code);
+                sendJson(res, 200, { ok: true, redirect: redirectTarget.toString(), workspaceId: auth.ctx.workspace.id });
+                return;
+            }
+            if (pathname === "/oauth/token" && req.method === "POST") {
+                const form = parseOAuthFormBody(await readBody(req), String(req.headers["content-type"] || ""), String(req.headers.authorization || ""));
+                const grantType = form.get("grant_type") || "";
+                const tokenHeaders = { "Cache-Control": "no-store", Pragma: "no-cache" };
+                const oauthError = (error, description) => sendJson(res, 400, { error, error_description: description }, tokenHeaders);
+                if (grantType === "authorization_code") {
+                    const code = form.get("code") || "";
+                    const rec = oauthCodes.get(code);
+                    if (!rec)
+                        return oauthError("invalid_grant", "Authorization code is invalid or was already used.");
+                    oauthCodes.delete(code);
+                    if (rec.expiresAt < Date.now())
+                        return oauthError("invalid_grant", "Authorization code expired.");
+                    const clientId = form.get("client_id");
+                    if (clientId && clientId !== rec.clientId)
+                        return oauthError("invalid_grant", "client_id does not match.");
+                    const redirectUri = form.get("redirect_uri");
+                    if (redirectUri && redirectUri !== rec.redirectUri) {
+                        return oauthError("invalid_grant", "redirect_uri does not match.");
                     }
-                    if (record.codeChallenge) {
-                        if (!codeVerifier) {
-                            sendJson(res, 400, {
-                                error: "invalid_grant",
-                                error_description: "PKCE code_verifier is required.",
-                            });
-                            return;
-                        }
-                        const method = (record.codeChallengeMethod || "S256").toUpperCase();
-                        const computed = method === "S256"
-                            ? crypto
-                                .createHash("sha256")
-                                .update(codeVerifier)
-                                .digest("base64url")
-                            : codeVerifier;
-                        if (computed !== record.codeChallenge) {
-                            sendJson(res, 400, {
-                                error: "invalid_grant",
-                                error_description: "PKCE code_verifier mismatch.",
-                            });
-                            return;
-                        }
+                    if (rec.codeChallenge) {
+                        const check = await verifyPkce(form.get("code_verifier") || "", rec.codeChallenge, rec.codeChallengeMethod);
+                        if (check === "missing")
+                            return oauthError("invalid_grant", "code_verifier is required.");
+                        if (check === "mismatch")
+                            return oauthError("invalid_grant", "code_verifier does not match.");
                     }
-                    accessToken = record.apiKey;
-                    scope = record.scope;
-                    oauthCodes.delete(code);
-                }
-                else if (!accessToken) {
-                    accessToken = store.createApiKey({
-                        workspaceId: bootstrap.workspace.id,
-                        name: "OAuth Token Key",
+                    const ws = store.getWorkspace(rec.workspaceId);
+                    if (!ws || !store.userCanAccessWorkspace(rec.userId, ws.id)) {
+                        return oauthError("invalid_grant", "Workspace is no longer available.");
+                    }
+                    const minted = store.createApiKey({
+                        workspaceId: ws.id,
+                        name: oauthConnectionKeyName(rec.clientName),
                         environment: "live",
-                    }).secretKey;
+                    });
+                    const refreshToken = oauthSecretToken("muxo_rt");
+                    store.saveOAuthRefreshToken({
+                        refreshToken,
+                        accessToken: minted.secretKey,
+                        keyId: minted.record.id,
+                        workspaceId: ws.id,
+                        clientId: rec.clientId,
+                        scope: rec.scope,
+                    });
+                    sendJson(res, 200, {
+                        access_token: minted.secretKey,
+                        token_type: "Bearer",
+                        expires_in: OAUTH_ACCESS_TOKEN_TTL_SECONDS,
+                        refresh_token: refreshToken,
+                        scope: rec.scope,
+                    }, tokenHeaders);
+                    return;
                 }
-                sendJson(res, 200, {
-                    access_token: accessToken,
-                    token_type: "Bearer",
-                    expires_in: 3600,
-                    refresh_token: `muxo_rt_${crypto.randomBytes(16).toString("hex")}`,
-                    scope,
-                });
-                return;
+                if (grantType === "refresh_token") {
+                    const refreshToken = form.get("refresh_token") || "";
+                    const rec = refreshToken ? store.getOAuthRefreshToken(refreshToken) : null;
+                    const active = rec ? store.findActiveApiKey(rec.accessToken) : null;
+                    if (!rec || !active || active.id !== rec.keyId) {
+                        if (rec)
+                            store.deleteOAuthRefreshToken(refreshToken);
+                        return oauthError("invalid_grant", "Refresh token is invalid or its access was revoked.");
+                    }
+                    const clientId = form.get("client_id");
+                    if (clientId && clientId !== rec.clientId)
+                        return oauthError("invalid_grant", "client_id does not match.");
+                    // Refresh tokens rotate on every use; the replaced token stops working immediately.
+                    store.deleteOAuthRefreshToken(refreshToken);
+                    const rotated = oauthSecretToken("muxo_rt");
+                    store.saveOAuthRefreshToken({
+                        refreshToken: rotated,
+                        accessToken: rec.accessToken,
+                        keyId: rec.keyId,
+                        workspaceId: rec.workspaceId,
+                        clientId: rec.clientId,
+                        scope: rec.scope,
+                    });
+                    sendJson(res, 200, {
+                        access_token: rec.accessToken,
+                        token_type: "Bearer",
+                        expires_in: OAUTH_ACCESS_TOKEN_TTL_SECONDS,
+                        refresh_token: rotated,
+                        scope: rec.scope || DEFAULT_OAUTH_SCOPE,
+                    }, tokenHeaders);
+                    return;
+                }
+                return oauthError("unsupported_grant_type", "Use grant_type=authorization_code (with PKCE) or refresh_token.");
             }
             if (pathname === "/oauth/userinfo" && req.method === "GET") {
-                const ctx = resolveContext(req);
+                const resolved = await requireContext(req, res, pathname);
+                if (!resolved)
+                    return;
+                const { ctx } = resolved;
                 const nickname = (ctx.user.email || "").split("@")[0] ||
                     ctx.user.name.toLowerCase().replace(/\s+/g, ".") ||
                     ctx.user.id;
@@ -452,7 +662,7 @@ export function createMuxoServer(customConfig) {
                     id: ctx.user.id,
                     name: ctx.user.name,
                     email: ctx.user.email,
-                    email_verified: true,
+                    email_verified: Boolean(ctx.user.email),
                     nickname,
                     workspace_id: ctx.workspace.id,
                     workspace_name: ctx.workspace.name,
@@ -467,7 +677,7 @@ export function createMuxoServer(customConfig) {
                     info: {
                         title: "Muxo Unified Agent Execution, Infrastructure, Memory & Governance API",
                         version: MUXO_VERSION,
-                        description: "One governed boundary over Connected Apps (Composio SDK), Instant Tools (Composio Instant), Cloud Infrastructure (Stripe Projects), Supermemory v5 Brain, and Microsoft Agent Governance Toolkit.",
+                        description: "One governed boundary over Connected Apps, Instant Tools, Cloud Infrastructure, Workspace Memory, and Safety & Approvals.",
                     },
                     servers: [{ url: config.baseUrl }],
                     paths: {
@@ -476,6 +686,12 @@ export function createMuxoServer(customConfig) {
                         "/skill.md": { get: { summary: "Canonical agent skill & onboarding markdown" } },
                         "/api/v1/agents/signup": { post: { summary: "Autonomous 2-call agent workspace & mk_live_* key signup" } },
                         "/api/v1/agents/claim": { post: { summary: "Generate human owner claim link for an agent workspace" } },
+                        "/api/v1/do": { post: { summary: "Natural-language task routing, planning, and optional execution" } },
+                        "/api/v1/byok": {
+                            get: { summary: "List configured BYOK provider keys in the AES-256-GCM vault" },
+                            post: { summary: "Store or rotate a BYOK provider key (0 credit cost when active)" },
+                        },
+                        "/api/v1/byok/{provider}": { delete: { summary: "Delete a BYOK provider key from the vault" } },
                         "/api/v1/tools": { get: { summary: "Search unified catalogue across instant.*, app.*, and resource.*" } },
                         "/api/v1/tools/{slug}": { get: { summary: "Inspect tool schema, risk level, credit cost, and LLM context URL" } },
                         "/api/v1/connections": {
@@ -485,19 +701,62 @@ export function createMuxoServer(customConfig) {
                         "/api/v1/connections/wait": { post: { summary: "Wait/poll for browser OAuth handoff completion" } },
                         "/api/v1/plans": {
                             get: { summary: "List governed action plans" },
-                            post: { summary: "Create governed action plan with Supermemory recall & Ed25519 signature" },
+                            post: { summary: "Create governed action plan with Workspace Memory recall & Ed25519 signature" },
                         },
                         "/api/v1/plans/{planId}/approve": { post: { summary: "Approve a pending high-risk action plan" } },
                         "/api/v1/plans/{planId}/execute": { post: { summary: "Execute an approved plan and issue HMAC-SHA256 receipt" } },
                         "/api/v1/resources": { get: { summary: "List provisioned cloud infrastructure resources" } },
                         "/api/v1/resources/env": { get: { summary: "Pull decrypted AES-256-GCM workspace environment secrets" } },
+                        "/api/v1/provisioning/connected_accounts": {
+                            get: { summary: "Inspect workspace Stripe v2 Connected Account & requirements" },
+                            post: { summary: "Create a Stripe v2 Connected Account with developer.projects capability" },
+                        },
+                        "/api/v1/provisioning/connected_account_links": {
+                            post: { summary: "Create a Stripe v2 Hosted Account Link (account_onboarding / account_update)" },
+                        },
+                        "/api/v1/provisioning/connected_account_sessions": {
+                            post: { summary: "Create a Stripe Connect Account Session for Accounts v2 Embedded Onboarding" },
+                        },
+                        "/api/v1/provisioning/eligibility": { get: { summary: "Check Stripe v2 Provisioning eligibility" } },
+                        "/api/v1/provisioning/providers": { get: { summary: "List Stripe v2 Provisioning cloud providers" } },
+                        "/api/v1/provisioning/services": { get: { summary: "List Stripe v2 Provisioning service catalog" } },
+                        "/api/v1/provisioning/payment_profile": { get: { summary: "Inspect Stripe v2 Provisioning payment profile" } },
+                        "/api/v1/provisioning/projects": {
+                            get: { summary: "List Stripe v2 Provisioning projects" },
+                            post: { summary: "Create a Stripe v2 Provisioning project" },
+                        },
+                        "/api/v1/provisioning/resources": {
+                            get: { summary: "List Stripe v2 Provisioning resources" },
+                            post: { summary: "Create a Stripe v2 Provisioning resource" },
+                        },
+                        "/api/v1/provisioning/resources/{id}/reveal_access_configuration": {
+                            post: { summary: "Reveal decrypted credentials for a provisioned resource" },
+                        },
                         "/api/v1/memory": {
-                            get: { summary: "Recall isolated Supermemory v5 workspace brain facts" },
+                            get: { summary: "Recall isolated Workspace Memory facts and hybrid context" },
                             post: { summary: "Store a workspace memory fact or decision" },
                         },
-                        "/api/v1/governance": { get: { summary: "Inspect Microsoft Agent Governance DID, policy, and Merkle audit chain" } },
-                        "/api/v1/billing/topup": { post: { summary: "Purchase Muxo credits (User pays Muxo -> Muxo pays suppliers)" } },
-                        "/api/v1/billing/settlements": { get: { summary: "Inspect Merchant-of-Record supplier settlement ledger" } },
+                        "/api/v1/memory/facts": { get: { summary: "Query temporal Workspace Memory facts with lineage" } },
+                        "/api/v1/memory/forget": { post: { summary: "Delete matching memories and retire matching facts" } },
+                        "/api/v1/policy": {
+                            get: { summary: "Inspect workspace safety & approval policy" },
+                            post: { summary: "Update workspace safety & approval policy" },
+                        },
+                        "/api/v1/governance": { get: { summary: "Inspect workspace Safety & Approvals identity, policy, and audit chain" } },
+                        "/api/v1/governance/kill-switch": { post: { summary: "Pause or resume workspace execution via kill switch" } },
+                        "/api/v1/governance/scan-context": { post: { summary: "Scan untrusted text for prompt injection before storage or use" } },
+                        "/api/v1/guardrails": {
+                            get: { summary: "List active plain-English guardrails, policy, and learned memory defaults" },
+                            post: { summary: "Set or reset guardrails in plain English (e.g. 'never send emails')" },
+                        },
+                        "/approve/{planId}": { get: { summary: "One-click human approval handoff page for a pending plan" } },
+                        "/api/v1/context": {
+                            get: { summary: "Inspect full workspace run context with a plain-English explanation" },
+                            post: { summary: "Inspect workspace run context with an optional query" },
+                        },
+                        "/api/v1/receipts": { get: { summary: "List recent tamper-proof execution receipts with plain-English explanations" } },
+                        "/api/v1/billing/topup": { post: { summary: "Purchase Muxo credits" } },
+                        "/api/v1/billing/settlements": { get: { summary: "Inspect workspace credit activity ledger" } },
                     },
                 });
                 return;
@@ -656,55 +915,98 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 res.end(renderLandingHtml());
                 return;
             }
-            // Autonomous Agent Claim Redemption Route
+            // Workspace claim link: read-only; accepting requires the invited person's verified sign-in.
             if (pathname.startsWith("/claim/") && req.method === "GET") {
                 const claimSlug = decodeURIComponent(pathname.slice("/claim/".length));
-                const redeemed = store.redeemAgentClaim(claimSlug);
-                if (!redeemed) {
-                    sendJson(res, 404, { ok: false, error: "Invalid or expired agent claim link" });
-                    return;
-                }
-                const claimConsoleKey = store.createApiKey({
-                    workspaceId: redeemed.workspace.id,
-                    name: `Owner Claim Session (${redeemed.targetEmail})`,
-                    environment: "live",
-                }).secretKey;
+                const claim = store.getOpenAgentClaim(claimSlug);
                 const wantsHtml = url.searchParams.get("format") !== "json" &&
                     String(req.headers.accept || "").includes("text/html");
-                if (wantsHtml) {
-                    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-                    res.end(`<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="utf-8" />
-  <title>Muxo Agent Workspace Claimed</title>
-  <style>
-    body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; background: #090a0f; color: #f4f4f6; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; }
-    .card { background: #12141f; border: 1px solid #26293d; border-radius: 14px; padding: 32px; max-width: 480px; text-align: center; box-shadow: 0 20px 50px rgba(0,0,0,0.45); }
-    .badge { display: inline-block; background: rgba(45,212,191,0.15); color: #2dd4bf; border: 1px solid rgba(45,212,191,0.35); border-radius: 999px; padding: 4px 12px; font-size: 12px; font-weight: 600; margin-bottom: 16px; }
-    h1 { font-size: 22px; margin: 0 0 10px; }
-    p { color: #a1a7bb; font-size: 14px; line-height: 1.5; margin: 0 0 20px; }
-    code { background: #1c1f30; padding: 3px 7px; border-radius: 6px; color: #e2e8f0; font-size: 12px; }
-    .btn { display: inline-block; background: #ff5a1f; color: #fff; text-decoration: none; padding: 10px 18px; border-radius: 8px; font-size: 14px; font-weight: 600; }
-  </style>
-</head>
-<body>
-  <div class="card">
-    <div class="badge">Ownership Bound</div>
-    <h1>Workspace Claimed</h1>
-    <p>Workspace <code>${redeemed.workspace.name}</code> (${redeemed.workspace.id}) claimed by <strong>${redeemed.targetEmail}</strong>.</p>
-    <p>Console key: <code>${claimConsoleKey}</code><br />Choose “Use an API key instead” in the console and paste it.</p>
-    <a class="btn" href="/?claimed=${encodeURIComponent(redeemed.workspace.slug)}">Open Muxo Console →</a>
-  </div>
-</body>
-</html>`);
+                if (!claim) {
+                    const error = "This claim link is invalid, expired, or was already used.";
+                    if (wantsHtml) {
+                        res.writeHead(410, consentPageHeaders);
+                        res.end(renderOAuthConsentHtml({
+                            error,
+                            claim: { workspaceName: "", targetEmail: "", action: "", cancelUrl: "/" },
+                        }));
+                    }
+                    else {
+                        sendJson(res, 410, { ok: false, code: "claim_invalid", error });
+                    }
+                    return;
+                }
+                if (!wantsHtml) {
+                    sendJson(res, 200, {
+                        ok: true,
+                        code: "sign_in_required",
+                        message: `Open this link in a browser and sign in as ${claim.targetEmail} to claim the workspace.`,
+                        claim: {
+                            workspaceName: claim.workspace.name,
+                            targetEmail: claim.targetEmail,
+                            status: claim.status,
+                            expiresAt: claim.expiresAt,
+                        },
+                        acceptEndpoint: `${requestOriginOf(req)}/api/v1/claims/${encodeURIComponent(claimSlug)}/accept`,
+                    });
+                    return;
+                }
+                const clerk = clerkConfig();
+                res.writeHead(200, consentPageHeaders);
+                res.end(renderOAuthConsentHtml({
+                    clerk: clerk ? { publishableKey: clerk.publishableKey, frontendApi: clerk.frontendApi } : null,
+                    claim: {
+                        workspaceName: claim.workspace.name,
+                        targetEmail: claim.targetEmail,
+                        action: `/api/v1/claims/${encodeURIComponent(claimSlug)}/accept`,
+                        cancelUrl: "/",
+                    },
+                }));
+                return;
+            }
+            const claimAcceptMatch = pathname.match(/^\/api\/v1\/claims\/([^/]+)\/accept$/);
+            if (claimAcceptMatch && req.method === "POST") {
+                const auth = await authenticate(req);
+                // Agents mint claim links with their own key, so a key must never be able to accept one.
+                if (!signedInPerson(auth)) {
+                    sendJson(res, 401, {
+                        ok: false,
+                        code: "auth_required",
+                        error: "Sign in as the invited person to claim this workspace.",
+                    });
+                    return;
+                }
+                const claimSlug = decodeURIComponent(claimAcceptMatch[1]);
+                const claim = store.getOpenAgentClaim(claimSlug);
+                if (!claim) {
+                    sendJson(res, 410, {
+                        ok: false,
+                        code: "claim_invalid",
+                        error: "This claim link is invalid, expired, or was already used.",
+                    });
+                    return;
+                }
+                const emails = await verifiedEmailsOf(auth);
+                if (!emails.includes(claim.targetEmail.toLowerCase())) {
+                    sendJson(res, 403, {
+                        ok: false,
+                        code: "claim_email_mismatch",
+                        error: `This workspace was offered to ${claim.targetEmail}. Sign in with that verified email to claim it.`,
+                    });
+                    return;
+                }
+                const workspace = store.acceptAgentClaim(claimSlug, auth.ctx.user.id);
+                if (!workspace) {
+                    sendJson(res, 410, {
+                        ok: false,
+                        code: "claim_invalid",
+                        error: "This claim link is invalid, expired, or was already used.",
+                    });
                     return;
                 }
                 sendJson(res, 200, {
                     ok: true,
-                    message: `Workspace '${redeemed.workspace.name}' claimed by ${redeemed.targetEmail}`,
-                    apiKey: claimConsoleKey,
-                    claim: redeemed,
+                    redirect: `${requestOriginOf(req)}/`,
+                    workspace: { id: workspace.id, name: workspace.name },
                 });
                 return;
             }
@@ -720,7 +1022,8 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 const connectedAccountId = url.searchParams.get("connected_account_id") ||
                     url.searchParams.get("connectedAccountId") ||
                     undefined;
-                const callbackStatus = url.searchParams.get("status") || "success";
+                const oauthError = url.searchParams.get("error") || url.searchParams.get("error_description");
+                const callbackStatus = oauthError ? "failed" : url.searchParams.get("status") || "success";
                 const handoff = await engine.handleOAuthCallback({
                     workspaceId,
                     provider,
@@ -764,19 +1067,57 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
 </html>`);
                 return;
             }
+            // One-click Plan Approval Handoff Page (GET /approve/:planId)
+            const approvePageMatch = pathname.match(/^\/approve\/([^/]+)$/);
+            if (approvePageMatch && req.method === "GET") {
+                const planId = decodeURIComponent(approvePageMatch[1]);
+                const clerk = clerkConfig();
+                res.writeHead(200, {
+                    "Content-Type": "text/html; charset=utf-8",
+                    "Cache-Control": "no-store",
+                    "Content-Security-Policy": "frame-ancestors 'none'",
+                    "X-Frame-Options": "DENY",
+                    "Referrer-Policy": "no-referrer",
+                });
+                res.end(renderApprovalPageHtml({
+                    planId,
+                    clerk: clerk
+                        ? {
+                            publishableKey: clerk.publishableKey,
+                            frontendApi: clerk.frontendApi,
+                        }
+                        : null,
+                }));
+                return;
+            }
             // Autonomous Agent 2-Call Signup — Public
             if ((pathname === "/api/v1/agents/signup" ||
                 pathname === "/api/v1/auth/signup" ||
                 pathname === "/api/signup") &&
                 req.method === "POST") {
                 const body = JSON.parse((await readBody(req)) || "{}");
+                const ownerEmail = String(body.ownerEmail || body.email || "").trim().toLowerCase();
+                if (ownerEmail && !/^[^\s@]+@[^\s@]+$/.test(ownerEmail)) {
+                    sendJson(res, 400, { ok: false, error: "ownerEmail must be a valid email address" });
+                    return;
+                }
                 const created = store.createAutonomousAgentSignup({
                     agentName: body.agentName ? String(body.agentName) : undefined,
                     harness: body.harness ? String(body.harness) : undefined,
                 });
+                const claim = store.createAgentClaim({
+                    workspaceId: created.workspace.id,
+                    email: ownerEmail || null,
+                    baseUrl: config.baseUrl,
+                });
                 sendJson(res, 201, {
                     ok: true,
                     agentId: created.user.id,
+                    agentDid: workspaceAgentDid(created.workspace.id),
+                    claim_slug: claim.claimSlug,
+                    claimSlug: claim.claimSlug,
+                    claimUrl: claim.claimUrl,
+                    claim: { ...claim, targetEmail: claim.targetEmail || null },
                     workspace: {
                         id: created.workspace.id,
                         name: created.workspace.name,
@@ -794,6 +1135,12 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 return;
             }
             // Streamable HTTP MCP Endpoint (POST /mcp, GET /mcp, HEAD /mcp, DELETE /mcp)
+            if (pathname === "/mcp" && (req.method === "GET" || req.method === "HEAD" || req.method === "DELETE")) {
+                if ((await authenticate(req)).kind === "invalid") {
+                    sendAuthRequired(req, res, pathname);
+                    return;
+                }
+            }
             if (pathname === "/mcp" && (req.method === "GET" || req.method === "HEAD")) {
                 const accept = String(req.headers.accept || "");
                 const sessionId = String(req.headers["mcp-session-id"] || "") ||
@@ -835,11 +1182,14 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 return;
             }
             if (pathname === "/mcp" && req.method === "POST") {
-                const ctx = resolveContext(req);
-                const sessionId = String(req.headers["mcp-session-id"] || "") ||
-                    `mcp_sess_${ctx.workspace.id}`;
                 const raw = await readBody(req);
                 const parsed = JSON.parse(raw || "{}");
+                const resolved = await requireContext(req, res, pathname, !Array.isArray(parsed) && isPublicMcpRequest(parsed));
+                if (!resolved)
+                    return;
+                const { ctx } = resolved;
+                const sessionId = String(req.headers["mcp-session-id"] || "") ||
+                    `mcp_sess_${ctx.workspace.id}`;
                 if (Array.isArray(parsed)) {
                     const responses = (await Promise.all(parsed.map((item) => handleJsonRpcMcpRequest(engine, ctx, (item || {}))))).filter((r) => r !== null);
                     sendJson(res, 200, responses, { "Mcp-Session-Id": sessionId });
@@ -860,7 +1210,23 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
             }
             // Auth Endpoints
             if (pathname === "/api/v1/auth/config" && req.method === "GET") {
-                sendJson(res, 200, { ok: true, provider: "password", clerk: null, signInUrl: "/login" });
+                const clerk = clerkConfig();
+                sendJson(res, 200, {
+                    ok: true,
+                    provider: clerk ? "clerk" : "password",
+                    clerk: clerk ? { publishableKey: clerk.publishableKey, frontendApi: clerk.frontendApi } : null,
+                    signInUrl: `${requestOriginOf(req)}/login`,
+                });
+                return;
+            }
+            if ((pathname === "/api/v1/auth/register" || pathname === "/api/v1/auth/login") &&
+                req.method === "POST" &&
+                clerkConfig()) {
+                sendJson(res, 410, {
+                    ok: false,
+                    code: "use_clerk",
+                    error: `Muxo accounts use secure sign-in. Open ${requestOriginOf(req)}/login to sign in or create an account.`,
+                });
                 return;
             }
             if (pathname === "/api/v1/auth/register" && req.method === "POST") {
@@ -879,6 +1245,7 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 sendJson(res, 201, {
                     ok: true,
                     ...created,
+                    token: created.sessionToken,
                     apiKey: initialKey.secretKey,
                 });
                 return;
@@ -890,21 +1257,34 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                     sendJson(res, 401, { ok: false, error: "Invalid email or password" });
                     return;
                 }
-                sendJson(res, 200, { ok: true, ...loggedIn });
+                sendJson(res, 200, { ok: true, ...loggedIn, token: loggedIn.sessionToken });
                 return;
             }
-            const ctx = resolveContext(req);
+            const isPublicRoute = ((pathname === "/api/v1/tools" || pathname === "/v1/tools/search") &&
+                (req.method === "GET" || req.method === "POST")) ||
+                (pathname.startsWith("/api/v1/tools/") && req.method === "GET") ||
+                (pathname === "/api/v1/billing/webhook" && req.method === "POST");
+            const resolvedCtx = await requireContext(req, res, pathname, isPublicRoute);
+            if (!resolvedCtx)
+                return;
+            const { ctx, auth } = resolvedCtx;
             // Console Bootstrap
             if (pathname === "/api/v1/bootstrap" && req.method === "GET") {
                 const org = engine.getOrganization(ctx).organization;
+                const guardrailsSummary = engine.getGuardrailsSummary(ctx);
                 sendJson(res, 200, {
                     ok: true,
                     profile: engine.getProfile(ctx),
                     organization: org,
                     governance: engine.governance.getStatus(),
+                    plainEnglishGuardrails: guardrailsSummary.plainEnglish,
+                    activeMemoryDefaults: guardrailsSummary.activeDefaults,
+                    activeGuardrails: guardrailsSummary.activeGuardrails,
                     supermemory: {
                         enabled: engine.supermemory.isEnabled(),
                         namespace: engine.supermemory.getWorkspaceNamespace(ctx.workspace.id),
+                        activeDefaults: guardrailsSummary.activeDefaults,
+                        activeGuardrails: guardrailsSummary.activeGuardrails,
                     },
                     surfaces: {
                         publicWebUrl: config.publicWebUrl,
@@ -913,7 +1293,8 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                     },
                     apiKeys: store.listApiKeys(ctx.workspace.id),
                     byokKeys: store.listByokKeys(ctx.workspace.id),
-                    defaultApiKey: bootstrap.defaultApiKey || null,
+                    defaultApiKey: ctx.workspace.id === bootstrap.workspace.id ? bootstrap.defaultApiKey || null : null,
+                    workspaces: store.listUserWorkspaces(ctx.user.id, ctx.workspace.id),
                     connections: store.listConnections(ctx.workspace.id),
                     resources: store.listResources(ctx.workspace.id),
                     plans: store.listPlans(ctx.workspace.id, 25),
@@ -921,11 +1302,122 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 });
                 return;
             }
+            // Multi-Workspace & Team API Key Onboarding Endpoints
+            if (pathname === "/api/v1/workspaces" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    currentWorkspaceId: ctx.workspace.id,
+                    workspaces: store.listUserWorkspaces(ctx.user.id, ctx.workspace.id),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/workspaces" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const name = String(body.name || body.workspaceName || "Team Workspace").trim();
+                const teamName = body.teamName ? String(body.teamName).trim() : null;
+                const switchActive = body.switchActive !== false;
+                const created = store.createWorkspaceForUser({
+                    userId: ctx.user.id,
+                    name,
+                    teamName,
+                    switchActive,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    ...created,
+                    workspaces: store.listUserWorkspaces(ctx.user.id, created.workspace.id),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/workspaces/switch" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const workspaceId = String(body.workspaceId || body.workspace_id || "").trim();
+                const switched = store.switchUserWorkspace(ctx.user.id, workspaceId);
+                if (!switched) {
+                    sendJson(res, 404, {
+                        ok: false,
+                        error: "Workspace not found or not linked to your account",
+                    });
+                    return;
+                }
+                sendJson(res, 200, {
+                    ok: true,
+                    ...switched,
+                    workspaces: store.listUserWorkspaces(ctx.user.id, switched.workspace.id),
+                });
+                return;
+            }
+            if ((pathname === "/api/v1/workspaces/join" || pathname === "/api/v1/auth/key") &&
+                req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const rawKey = String(body.apiKey || body.api_key || body.key || "").trim();
+                const hasExplicitSession = Boolean(String(req.headers.authorization || "").trim()) &&
+                    ctx.authType === "session";
+                const joined = store.joinWorkspaceWithApiKey({
+                    apiKey: rawKey,
+                    userId: hasExplicitSession ? ctx.user.id : null,
+                    switchActive: body.switchActive !== false,
+                });
+                if (!joined) {
+                    sendJson(res, 401, {
+                        ok: false,
+                        error: "Invalid or revoked workspace API key (expected mk_live_... or mk_test_...)",
+                    });
+                    return;
+                }
+                const sessionToken = joined.user && !hasExplicitSession
+                    ? store.createSession(joined.user.id, joined.workspace.id)
+                    : undefined;
+                sendJson(res, 200, {
+                    ok: true,
+                    workspace: joined.workspace,
+                    keyRecord: joined.keyRecord,
+                    user: joined.user,
+                    membership: joined.membership,
+                    ...(sessionToken ? { sessionToken, token: sessionToken } : {}),
+                    workspaces: joined.user
+                        ? store.listUserWorkspaces(joined.user.id, joined.workspace.id)
+                        : [],
+                });
+                return;
+            }
+            if ((pathname === "/api/v1/workspaces/onboard-team" ||
+                pathname === "/api/v1/teams/onboard") &&
+                req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const teamName = String(body.teamName || body.team_name || body.name || "Engineering Team").trim();
+                const role = (body.role ? String(body.role) : "operator");
+                const mode = body.mode === "dedicated_workspace" ? "dedicated_workspace" : "shared_workspace";
+                const inviteEmail = body.inviteEmail || body.email ? String(body.inviteEmail || body.email).trim() : null;
+                const kit = store.onboardTeam({
+                    currentWorkspaceId: ctx.workspace.id,
+                    userId: ctx.user.id,
+                    userEmail: ctx.user.email,
+                    teamName,
+                    role,
+                    mode,
+                    scopes: Array.isArray(body.scopes) ? body.scopes : undefined,
+                    inviteEmail,
+                    baseUrl: config.baseUrl,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    kit,
+                    onboardingKit: kit,
+                    ...kit,
+                    workspaces: store.listUserWorkspaces(ctx.user.id, ctx.workspace.id),
+                });
+                return;
+            }
             // Autonomous Agent Claim Link Creation (Authenticated)
             if (pathname === "/api/v1/agents/claim" && req.method === "POST") {
+                if (auth.kind !== "ok") {
+                    sendAuthRequired(req, res, pathname);
+                    return;
+                }
                 const body = JSON.parse((await readBody(req)) || "{}");
-                const email = String(body.email || "").trim();
-                if (!email || !email.includes("@")) {
+                const email = String(body.email || body.ownerEmail || "").trim().toLowerCase();
+                if (!email || !/^[^\s@]+@[^\s@]+$/.test(email)) {
                     sendJson(res, 400, { ok: false, error: "Valid target email is required" });
                     return;
                 }
@@ -938,6 +1430,7 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                     ok: true,
                     claim: { ...claim, ownerEmail: email },
                     ...claim,
+                    claim_slug: claim.claimSlug,
                     ownerEmail: email,
                 });
                 return;
@@ -946,6 +1439,7 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
             if (pathname === "/api/v1/governance" && req.method === "GET") {
                 const ws = store.getWorkspace(ctx.workspace.id) || ctx.workspace;
                 const fullReport = engine.governance.getGovernanceStatus(ws);
+                const guardrailsSummary = engine.getGuardrailsSummary(ctx);
                 sendJson(res, 200, {
                     ok: true,
                     governance: {
@@ -957,6 +1451,65 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                         auditChain: fullReport.auditChain,
                     },
                     workspacePolicy: ws.policy,
+                    plainEnglishGuardrails: guardrailsSummary.plainEnglish,
+                    activeMemoryDefaults: guardrailsSummary.activeDefaults,
+                    activeGuardrails: guardrailsSummary.activeGuardrails,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/guardrails" && req.method === "GET") {
+                const summary = engine.getGuardrailsSummary(ctx);
+                sendJson(res, 200, {
+                    ok: true,
+                    ...summary,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/guardrails" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                if (body.reset === true) {
+                    const updated = store.updateWorkspacePolicy(ctx.workspace.id, DEFAULT_WORKSPACE_POLICY);
+                    const plainEnglish = describePolicyInPlainEnglish(updated.policy);
+                    sendJson(res, 200, {
+                        ok: true,
+                        workspace: updated,
+                        policy: updated.policy,
+                        plainEnglish,
+                        humanMessage: "Reset workspace guardrails to Safe Default.",
+                    });
+                    return;
+                }
+                const rawParamRules = Array.isArray(body.parameterRules)
+                    ? body.parameterRules
+                    : Array.isArray(body.parameter_rules)
+                        ? body.parameter_rules
+                        : undefined;
+                const prompt = String(body.prompt ||
+                    body.rule ||
+                    body.instruction ||
+                    body.naturalLanguageRule ||
+                    (rawParamRules && rawParamRules.length > 0
+                        ? String(rawParamRules[0]?.description ||
+                            "Structured conditional parameter guardrail")
+                        : "")).trim();
+                if (!prompt && (!rawParamRules || rawParamRules.length === 0)) {
+                    sendJson(res, 400, {
+                        ok: false,
+                        error: "Provide a plain-English guardrail in 'prompt'/'rule' or structured 'parameterRules' (e.g. \"Only allow sending emails to @muxo.ai\" or \"Require approval for Stripe refunds over $50, auto-approve under $50\").",
+                    });
+                    return;
+                }
+                const applied = await engine.applyNaturalLanguageGuardrail(ctx, prompt, {
+                    parameterRules: rawParamRules,
+                    policyPatch: body.policyPatch && typeof body.policyPatch === "object"
+                        ? body.policyPatch
+                        : undefined,
+                    source: rawParamRules ? "mcp_harness" : "deterministic",
+                });
+                sendJson(res, 200, {
+                    ...applied,
+                    policy: applied.workspace.policy,
+                    humanMessage: `Guardrail active: ${applied.guardrail.summary}`,
                 });
                 return;
             }
@@ -989,15 +1542,41 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 sendJson(res, 200, { ok: true, scan });
                 return;
             }
+            // Workspace Context Inspector (natural-language friendly)
+            if ((pathname === "/api/v1/context" || pathname === "/v1/context") &&
+                (req.method === "GET" || req.method === "POST")) {
+                const body = req.method === "POST"
+                    ? JSON.parse((await readBody(req)) || "{}")
+                    : {};
+                const query = url.searchParams.get("query") ||
+                    url.searchParams.get("q") ||
+                    (body.query ? String(body.query) : undefined);
+                const runContext = await engine.getRunContext(ctx, query);
+                sendJson(res, 200, { ok: true, ...runContext });
+                return;
+            }
             // Supermemory v5 Workspace Brain Endpoints
             if (pathname === "/api/v1/memory" && req.method === "GET") {
                 const query = url.searchParams.get("query") ||
                     url.searchParams.get("q") ||
                     undefined;
                 const overview = await engine.getMemoryOverview(ctx, query);
-                sendJson(res, 200, { ok: true, ...overview });
-                return;
-            }
+                sendJson(res, 200, {
+                    ok: true,
+                    ...overview,
+                    activeDefaults: overview.context.activeDefaults || {},
+                    activeGuardrails: overview.context.activeGuardrails || [],
+                });
+                return;
+            }
+            if (pathname === "/api/v1/memory/graph" && req.method === "GET") {
+                const query = url.searchParams.get("query") ||
+                    url.searchParams.get("q") ||
+                    undefined;
+                const graph = await engine.getMemoryGraph(ctx, query);
+                sendJson(res, 200, { ok: true, ...graph });
+                return;
+            }
             if (pathname === "/api/v1/memory/facts" && req.method === "GET") {
                 const query = url.searchParams.get("query") ||
                     url.searchParams.get("q") ||
@@ -1031,6 +1610,48 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
             }
             if (pathname === "/api/v1/memory" && req.method === "POST") {
                 const body = JSON.parse((await readBody(req)) || "{}");
+                const nlPrompt = String(body.prompt || body.remember || "").trim();
+                if (nlPrompt && !body.content) {
+                    const parsed = parseNaturalLanguageMemoryInstruction(nlPrompt);
+                    if (parsed.isMemoryInstruction) {
+                        const primaryFact = parsed.temporalFacts[0];
+                        const record = await engine.addWorkspaceMemory(ctx, {
+                            title: parsed.title,
+                            content: parsed.content,
+                            kind: parsed.kind,
+                            subject: primaryFact?.subject,
+                            predicate: primaryFact?.predicate,
+                            object: primaryFact?.object,
+                            metadata: {
+                                extractedDefaults: parsed.extractedDefaults,
+                                source: "natural_language_api",
+                            },
+                        });
+                        for (const tf of parsed.temporalFacts) {
+                            store.upsertTemporalFact({
+                                workspaceId: ctx.workspace.id,
+                                subject: tf.subject,
+                                predicate: tf.predicate,
+                                object: tf.object,
+                                summary: tf.summary,
+                                confidence: 0.98,
+                                sourceKind: "preference",
+                                sourceReferenceId: record.id,
+                                metadata: { source: "natural_language_api" },
+                            });
+                        }
+                        const overview = await engine.getMemoryOverview(ctx);
+                        sendJson(res, 201, {
+                            ok: true,
+                            memory: record,
+                            activeDefaults: overview.activeDefaults,
+                            explanation: overview.explanation,
+                            humanMessage: parsed.humanSummary,
+                        });
+                        return;
+                    }
+                    body.content = nlPrompt;
+                }
                 const record = await engine.addWorkspaceMemory(ctx, {
                     title: String(body.title || "Workspace Fact"),
                     content: String(body.content || ""),
@@ -1050,18 +1671,37 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 return;
             }
             // API Keys
-            if (pathname === "/api/v1/api-keys" && req.method === "POST") {
+            if ((pathname === "/api/v1/api-keys" || pathname === "/api/v1/keys") &&
+                req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    apiKeys: store.listApiKeys(ctx.workspace.id),
+                    keys: store.listApiKeys(ctx.workspace.id),
+                });
+                return;
+            }
+            if ((pathname === "/api/v1/api-keys" || pathname === "/api/v1/keys") &&
+                req.method === "POST") {
                 const body = JSON.parse((await readBody(req)) || "{}");
                 const created = store.createApiKey({
                     workspaceId: ctx.workspace.id,
-                    name: String(body.name || "API Key"),
+                    name: String(body.name || (body.teamName ? `${String(body.teamName)} Team Key` : "API Key")),
                     environment: body.environment === "test" ? "test" : "live",
+                    scopes: Array.isArray(body.scopes) ? body.scopes : undefined,
+                    teamName: body.teamName ? String(body.teamName) : null,
+                    role: (body.role ? String(body.role) : "operator"),
+                    createdByEmail: ctx.user.email,
                 });
-                sendJson(res, 201, { ok: true, ...created });
+                sendJson(res, 201, { ok: true, apiKey: created.secretKey, ...created });
                 return;
             }
-            if (pathname.startsWith("/api/v1/api-keys/") && req.method === "DELETE") {
-                const keyId = decodeURIComponent(pathname.slice("/api/v1/api-keys/".length));
+            if ((pathname.startsWith("/api/v1/api-keys/") ||
+                pathname.startsWith("/api/v1/keys/")) &&
+                req.method === "DELETE") {
+                const prefix = pathname.startsWith("/api/v1/api-keys/")
+                    ? "/api/v1/api-keys/"
+                    : "/api/v1/keys/";
+                const keyId = decodeURIComponent(pathname.slice(prefix.length));
                 if (!store.revokeApiKey(ctx.workspace.id, keyId)) {
                     sendJson(res, 404, { ok: false, error: "API key not found" });
                     return;
@@ -1128,13 +1768,18 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 }
                 const result = await engine.waitForConnection(ctx, {
                     provider,
-                    timeoutSeconds: body.timeoutSeconds !== undefined
-                        ? Number(body.timeoutSeconds)
-                        : body.timeout_seconds !== undefined
-                            ? Number(body.timeout_seconds)
-                            : 15,
+                    timeoutSeconds: clampWaitSeconds(body.timeoutSeconds ?? body.timeout_seconds),
+                });
+                sendJson(res, 200, result);
+                return;
+            }
+            const connectionWaitMatch = pathname.match(/^\/api\/v1\/connections\/([^/]+)\/wait$/);
+            if (connectionWaitMatch && req.method === "GET") {
+                const result = await engine.waitForConnection(ctx, {
+                    provider: decodeURIComponent(connectionWaitMatch[1]),
+                    timeoutSeconds: clampWaitSeconds(url.searchParams.get("timeout_seconds") ?? url.searchParams.get("timeoutSeconds")),
                 });
-                sendJson(res, 200, { ok: true, ...result });
+                sendJson(res, 200, result);
                 return;
             }
             // Provisioned Resources & Decrypted Vault Env Pull
@@ -1165,11 +1810,687 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 });
                 return;
             }
+            const resourceSecretsMatch = pathname.match(/^\/api\/v1\/resources\/([^/]+)\/secrets$/);
+            if (resourceSecretsMatch && req.method === "GET") {
+                const resourceId = decodeURIComponent(resourceSecretsMatch[1]);
+                const anyRes = store.findResourceAnyWorkspace(resourceId);
+                if (anyRes && anyRes.workspaceId !== ctx.workspace.id) {
+                    sendJson(res, 403, {
+                        ok: false,
+                        code: "resource_workspace_mismatch",
+                        error: "Resource belongs to a different workspace.",
+                    });
+                    return;
+                }
+                const ownedRes = store.getResource(ctx.workspace.id, resourceId);
+                if (!ownedRes) {
+                    sendJson(res, 404, {
+                        ok: false,
+                        code: "resource_not_found",
+                        error: `Resource '${resourceId}' not found in workspace.`,
+                    });
+                    return;
+                }
+                const secrets = store.getDecryptedResourceSecrets(ctx.workspace.id, resourceId);
+                sendJson(res, 200, {
+                    ok: true,
+                    resourceId: ownedRes.id,
+                    resourceName: ownedRes.resourceName,
+                    workspaceId: ctx.workspace.id,
+                    envVarKeys: ownedRes.envVarKeys,
+                    secrets,
+                });
+                return;
+            }
+            // Stripe v2 Provisioning API (`Stripe-Version: 2026-09-30.preview`) Routes
+            if (pathname === "/api/v1/provisioning/audit_log" && req.method === "GET") {
+                const limit = Number(url.searchParams.get("limit") || 50);
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    entries: engine.stripeProjects.getProvisioningAuditLog(limit),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/connected_accounts" && req.method === "GET") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const verifiedAccount = store.getByokKey(ctx.workspace.id, "stripe_connected_account") ||
+                    config.stripeConnectedAccountId ||
+                    "";
+                if (!verifiedAccount) {
+                    sendJson(res, 200, {
+                        ok: true,
+                        apiVersion: engine.stripeProjects.provisioningApiVersion,
+                        connected: false,
+                        account: null,
+                        publishable_key: config.stripePublishableKey || null,
+                    });
+                    return;
+                }
+                const retrieved = await engine.stripeProjects.retrieveConnectedAccount(verifiedAccount, stripeByok);
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    connected: true,
+                    account: retrieved,
+                    publishable_key: config.stripePublishableKey || null,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/connected_accounts" && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const created = await engine.stripeProjects.createConnectedAccount({
+                    contact_email: String(body.contact_email || ctx.user?.email || "owner@muxo.ai"),
+                    display_name: String(body.display_name || ctx.workspace.name || "Muxo Tenant"),
+                    country: body.country ? String(body.country) : "US",
+                    entity_type: body.entity_type === "individual" ? "individual" : "company",
+                    apiKeyOverride: stripeByok,
+                });
+                if (created.id) {
+                    store.setByokKey(ctx.workspace.id, "stripe_connected_account", created.id);
+                }
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...created,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/connected_account_links" && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                let verifiedAccount = store.getByokKey(ctx.workspace.id, "stripe_connected_account") ||
+                    config.stripeConnectedAccountId ||
+                    "";
+                const body = JSON.parse((await readBody(req)) || "{}");
+                if (!verifiedAccount && !body.account && body.auto_create === true) {
+                    const created = await engine.stripeProjects.createConnectedAccount({
+                        contact_email: String(body.contact_email || ctx.user?.email || "owner@muxo.ai"),
+                        display_name: String(body.display_name || ctx.workspace.name || "Muxo Tenant"),
+                        country: body.country ? String(body.country) : "US",
+                        entity_type: body.entity_type === "individual" ? "individual" : "company",
+                        apiKeyOverride: stripeByok,
+                    });
+                    if (created.id) {
+                        store.setByokKey(ctx.workspace.id, "stripe_connected_account", created.id);
+                        verifiedAccount = created.id;
+                    }
+                }
+                const accountId = String(verifiedAccount || body.account || "").trim();
+                if (!accountId) {
+                    sendJson(res, 400, {
+                        ok: false,
+                        error: "No verified connected_account_id is mapped to this tenant workspace.",
+                    });
+                    return;
+                }
+                const link = await engine.stripeProjects.createConnectedAccountLink({
+                    account: accountId,
+                    type: body.type === "account_update" ? "account_update" : "account_onboarding",
+                    fields: body.fields === "eventually_due" ? "eventually_due" : "currently_due",
+                    future_requirements: body.future_requirements === "omit"
+                        ? "omit"
+                        : body.future_requirements === "include"
+                            ? "include"
+                            : undefined,
+                    refresh_url: String(body.refresh_url || `${config.publicWebUrl}/?onboarding=refresh`),
+                    return_url: String(body.return_url || `${config.publicWebUrl}/?onboarding=return`),
+                    apiKeyOverride: stripeByok,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...link,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/connected_account_sessions" && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                let verifiedAccount = store.getByokKey(ctx.workspace.id, "stripe_connected_account") ||
+                    config.stripeConnectedAccountId ||
+                    "";
+                const body = JSON.parse((await readBody(req)) || "{}");
+                if (!verifiedAccount && !body.account && body.auto_create !== false) {
+                    const created = await engine.stripeProjects.createConnectedAccount({
+                        contact_email: String(body.contact_email || ctx.user?.email || "owner@muxo.ai"),
+                        display_name: String(body.display_name || ctx.workspace.name || "Muxo Tenant"),
+                        country: body.country ? String(body.country) : "US",
+                        entity_type: body.entity_type === "individual" ? "individual" : "company",
+                        apiKeyOverride: stripeByok,
+                    });
+                    if (created.id) {
+                        store.setByokKey(ctx.workspace.id, "stripe_connected_account", created.id);
+                        verifiedAccount = created.id;
+                    }
+                }
+                const accountId = String(verifiedAccount || body.account || "").trim();
+                if (!accountId) {
+                    sendJson(res, 400, {
+                        ok: false,
+                        error: "No verified connected_account_id is mapped to this tenant workspace.",
+                    });
+                    return;
+                }
+                const session = await engine.stripeProjects.createConnectedAccountSession({
+                    account: accountId,
+                    enableAccountManagement: Boolean(body.enable_account_management ?? body.enableAccountManagement),
+                    enableNotificationBanner: body.enable_notification_banner !== undefined
+                        ? Boolean(body.enable_notification_banner)
+                        : body.enableNotificationBanner !== undefined
+                            ? Boolean(body.enableNotificationBanner)
+                            : undefined,
+                    disableStripeUserAuthentication: body.disable_stripe_user_authentication !== undefined
+                        ? Boolean(body.disable_stripe_user_authentication)
+                        : body.disableStripeUserAuthentication !== undefined
+                            ? Boolean(body.disableStripeUserAuthentication)
+                            : undefined,
+                    externalAccountCollection: body.external_account_collection !== undefined
+                        ? Boolean(body.external_account_collection)
+                        : body.externalAccountCollection !== undefined
+                            ? Boolean(body.externalAccountCollection)
+                            : undefined,
+                    apiKeyOverride: stripeByok,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    publishable_key: config.stripePublishableKey || null,
+                    embedded_component: "account-onboarding",
+                    collection_options: {
+                        fields: body.fields === "eventually_due" ? "eventually_due" : "currently_due",
+                        future_requirements: body.future_requirements === "omit" ? "omit" : "include",
+                    },
+                    ...session,
+                });
+                return;
+            }
+            const connAccountGetMatch = pathname.match(/^\/api\/v1\/provisioning\/connected_accounts\/([^/]+)$/);
+            if (connAccountGetMatch && req.method === "GET") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const accountId = decodeURIComponent(connAccountGetMatch[1]);
+                const retrieved = await engine.stripeProjects.retrieveConnectedAccount(accountId, stripeByok);
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...retrieved,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/eligibility" && req.method === "GET") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const verifiedContext = store.getByokKey(ctx.workspace.id, "stripe_connected_account") || undefined;
+                const eligibility = await engine.stripeProjects.checkEligibility(stripeByok, verifiedContext);
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...eligibility,
+                });
+                return;
+            }
+            if ((pathname === "/api/v1/provisioning/catalog/providers" ||
+                pathname === "/api/v1/provisioning/providers") &&
+                req.method === "GET") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const verifiedContext = store.getByokKey(ctx.workspace.id, "stripe_connected_account") || undefined;
+                const catalog = url.searchParams.get("catalog") || "prod";
+                const limit = Number(url.searchParams.get("limit") || 100);
+                const page = url.searchParams.get("page") || undefined;
+                const page_url = url.searchParams.get("page_url") || undefined;
+                const development = url.searchParams.get("development") !== null
+                    ? url.searchParams.get("development") === "true"
+                    : undefined;
+                const providers = await engine.stripeProjects.listCatalogProviders({
+                    catalog,
+                    development,
+                    limit,
+                    page,
+                    page_url,
+                    apiKeyOverride: stripeByok,
+                    stripeContext: verifiedContext,
+                });
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...providers,
+                });
+                return;
+            }
+            if ((pathname === "/api/v1/provisioning/catalog/services" ||
+                pathname === "/api/v1/provisioning/services") &&
+                req.method === "GET") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const verifiedContext = store.getByokKey(ctx.workspace.id, "stripe_connected_account") || undefined;
+                const catalog = url.searchParams.get("catalog") || "prod";
+                const limit = Number(url.searchParams.get("limit") || 100);
+                const page = url.searchParams.get("page") || undefined;
+                const page_url = url.searchParams.get("page_url") || undefined;
+                const development = url.searchParams.get("development") !== null
+                    ? url.searchParams.get("development") === "true"
+                    : undefined;
+                const provider_id = url.searchParams.get("provider_id") || undefined;
+                const provider_name = url.searchParams.get("provider_name") || undefined;
+                const services = await engine.stripeProjects.listCatalogServices({
+                    catalog,
+                    development,
+                    limit,
+                    page,
+                    page_url,
+                    provider_id,
+                    provider_name,
+                    apiKeyOverride: stripeByok,
+                    stripeContext: verifiedContext,
+                });
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...services,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/payment_profile" && req.method === "GET") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const verifiedContext = store.getByokKey(ctx.workspace.id, "stripe_connected_account") || undefined;
+                const provider = url.searchParams.get("provider") || undefined;
+                const livemodeParam = url.searchParams.get("livemode");
+                const livemode = livemodeParam !== null ? livemodeParam === "true" : undefined;
+                const profile = await engine.stripeProjects.getPaymentProfile({
+                    provider,
+                    livemode,
+                    apiKeyOverride: stripeByok,
+                    stripeContext: verifiedContext,
+                });
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...profile,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/payment_profile/update_limit" &&
+                req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const verifiedContext = store.getByokKey(ctx.workspace.id, "stripe_connected_account") || undefined;
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const usageLimits = body.usage_limits || {
+                    max_amount: String(body.max_amount ?? "5000"),
+                    currency: String(body.currency || "usd"),
+                    recurring_interval: String(body.recurring_interval || "month"),
+                };
+                const updated = await engine.stripeProjects.updatePaymentProfileLimit({
+                    usage_limits: usageLimits,
+                    provider: body.provider ? String(body.provider) : undefined,
+                    livemode: body.livemode !== undefined ? Boolean(body.livemode) : undefined,
+                    apiKeyOverride: stripeByok,
+                    stripeContext: verifiedContext,
+                });
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...updated,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/payment_method_requests" &&
+                req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const verifiedContext = store.getByokKey(ctx.workspace.id, "stripe_connected_account") || undefined;
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const created = await engine.stripeProjects.createPaymentMethodRequest({
+                    payment_method_owner: body.payment_method_owner === "platform" ||
+                        body.payment_method_owner === "provider"
+                        ? body.payment_method_owner
+                        : undefined,
+                    provider: body.provider ? String(body.provider) : undefined,
+                    source_account: body.source_account ? String(body.source_account) : undefined,
+                    source_customer: body.source_customer ? String(body.source_customer) : undefined,
+                    source_payment_method: body.source_payment_method
+                        ? String(body.source_payment_method)
+                        : undefined,
+                    livemode: body.livemode !== undefined ? Boolean(body.livemode) : undefined,
+                    usage_limits: body.usage_limits,
+                    apiKeyOverride: stripeByok,
+                    stripeContext: verifiedContext,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...created,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/projects" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    object: "v2.list",
+                    data: [
+                        {
+                            id: config.stripeProjectId || `proj_muxo_${ctx.workspace.id}`,
+                            object: "v2.provisioning.project",
+                            name: `${ctx.workspace.name} Cloud Project`,
+                            catalog: "prod",
+                            created: ctx.workspace.createdAt,
+                            livemode: false,
+                        },
+                    ],
+                    next_page_url: null,
+                    previous_page_url: null,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/projects" && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const created = await engine.stripeProjects.createProject({
+                    name: String(body.name || "Muxo Cloud Project"),
+                    catalog: body.catalog || "prod",
+                    project_profile: body.project_profile
+                        ? String(body.project_profile)
+                        : undefined,
+                    apiKeyOverride: stripeByok,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...created,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/provider_connections" &&
+                req.method === "GET") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const limit = Number(url.searchParams.get("limit") || 25);
+                const page = url.searchParams.get("page") || undefined;
+                const provider = url.searchParams.get("provider") || undefined;
+                const connections = engine.stripeProjects.hasStripeV2ApiKey(stripeByok)
+                    ? await engine.stripeProjects.listProviderConnections({
+                        limit,
+                        page,
+                        provider,
+                        apiKeyOverride: stripeByok,
+                    })
+                    : managedProviderConnectionList();
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...connections,
+                });
+                return;
+            }
+            const provConnUnlinkMatch = pathname.match(/^\/api\/v1\/provisioning\/provider_connections\/([^/]+)\/unlink$/);
+            if (provConnUnlinkMatch && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const id = decodeURIComponent(provConnUnlinkMatch[1]);
+                const unlinked = engine.stripeProjects.hasStripeV2ApiKey(stripeByok)
+                    ? await engine.stripeProjects.unlinkProviderConnection(id, stripeByok)
+                    : managedProviderConnectionUnlink(id);
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...unlinked,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/provider_connection_requests" &&
+                req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const reqRes = engine.stripeProjects.hasStripeV2ApiKey(stripeByok)
+                    ? await engine.stripeProjects.createProviderConnectionRequest({
+                        provider: String(body.provider || ""),
+                        configuration: body.configuration && typeof body.configuration === "object"
+                            ? body.configuration
+                            : {},
+                        project: body.project ? String(body.project) : undefined,
+                        apiKeyOverride: stripeByok,
+                    })
+                    : managedProviderConnectionRequest({ provider: String(body.provider || "") });
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...reqRes,
+                });
+                return;
+            }
+            const provConnReqSubmitMatch = pathname.match(/^\/api\/v1\/provisioning\/provider_connection_requests\/([^/]+)\/submit_information$/);
+            if (provConnReqSubmitMatch && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const id = decodeURIComponent(provConnReqSubmitMatch[1]);
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const submitted = engine.stripeProjects.hasStripeV2ApiKey(stripeByok)
+                    ? await engine.stripeProjects.submitProviderConnectionRequestInformation(id, body.submitted_information || body, stripeByok)
+                    : managedProviderConnectionRequest({ id, requestStatus: "complete" });
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...submitted,
+                });
+                return;
+            }
+            const provConnReqGetMatch = pathname.match(/^\/api\/v1\/provisioning\/provider_connection_requests\/([^/]+)$/);
+            if (provConnReqGetMatch && req.method === "GET") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const id = decodeURIComponent(provConnReqGetMatch[1]);
+                const retrieved = engine.stripeProjects.hasStripeV2ApiKey(stripeByok)
+                    ? await engine.stripeProjects.retrieveProviderConnectionRequest(id, stripeByok)
+                    : managedProviderConnectionRequest({ id });
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...retrieved,
+                });
+                return;
+            }
+            const revealAccessMatch = pathname.match(/^\/api\/v1\/provisioning\/resources\/([^/]+)\/reveal_access_configuration$/);
+            if (revealAccessMatch && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const resourceId = decodeURIComponent(revealAccessMatch[1]);
+                const anyRes = store.findResourceAnyWorkspace(resourceId);
+                if (anyRes && anyRes.workspaceId !== ctx.workspace.id) {
+                    sendJson(res, 403, {
+                        ok: false,
+                        code: "resource_workspace_mismatch",
+                        error: "Resource belongs to a different workspace.",
+                    });
+                    return;
+                }
+                if (engine.stripeProjects.hasStripeV2ApiKey(stripeByok)) {
+                    try {
+                        const revealed = await engine.stripeProjects.revealAccessConfiguration(resourceId, stripeByok);
+                        sendJson(res, 200, {
+                            ok: true,
+                            apiVersion: engine.stripeProjects.provisioningApiVersion,
+                            source: "stripe_v2_api",
+                            ...revealed,
+                        });
+                        return;
+                    }
+                    catch {
+                        // Fall through to workspace vault lookup if Stripe v2 returns error
+                    }
+                }
+                const resourceSpecific = store.getDecryptedResourceSecrets(ctx.workspace.id, resourceId);
+                const vaultSecrets = Object.keys(resourceSpecific).length > 0
+                    ? resourceSpecific
+                    : store.getDecryptedWorkspaceEnv(ctx.workspace.id);
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    object: "v2.provisioning.resource.access_configuration",
+                    resource: resourceId,
+                    configuration: vaultSecrets,
+                    created: new Date().toISOString(),
+                    expires_at: null,
+                    livemode: false,
+                    source: "muxo_managed",
+                });
+                return;
+            }
+            const resourceActionMatch = pathname.match(/^\/api\/v1\/provisioning\/resources\/([^/]+)\/(remove|unlink|rotate_credentials|submit_information)$/);
+            if (resourceActionMatch && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const resourceId = decodeURIComponent(resourceActionMatch[1]);
+                const action = resourceActionMatch[2];
+                const body = JSON.parse((await readBody(req)) || "{}");
+                let actionResult;
+                if (!engine.stripeProjects.hasStripeV2ApiKey(stripeByok)) {
+                    actionResult = managedResourceAction(resourceId, action);
+                }
+                else if (action === "remove") {
+                    actionResult = await engine.stripeProjects.removeResource(resourceId, stripeByok);
+                }
+                else if (action === "unlink") {
+                    actionResult = await engine.stripeProjects.unlinkResource(resourceId, stripeByok);
+                }
+                else if (action === "rotate_credentials") {
+                    actionResult = await engine.stripeProjects.rotateResourceCredentials(resourceId, stripeByok);
+                }
+                else {
+                    actionResult = await engine.stripeProjects.submitResourceInformation(resourceId, body.submitted_information || body, stripeByok);
+                }
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...actionResult,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/resources/link" && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const linked = !engine.stripeProjects.hasStripeV2ApiKey(stripeByok)
+                    ? managedResource({
+                        provider: String(body.provider || ""),
+                        serviceRef: String(body.service_ref || ""),
+                        environment: body.environment ? String(body.environment) : "prod",
+                        catalog: body.catalog ? String(body.catalog) : "prod",
+                        status: "active",
+                    })
+                    : await engine.stripeProjects.linkResource({
+                        provider: String(body.provider || ""),
+                        service_ref: String(body.service_ref || ""),
+                        provider_resource_id: body.provider_resource_id
+                            ? String(body.provider_resource_id)
+                            : undefined,
+                        environment: body.environment ? String(body.environment) : "prod",
+                        catalog: body.catalog || "prod",
+                        project: body.project ? String(body.project) : undefined,
+                        apiKeyOverride: stripeByok,
+                    });
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...linked,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/resources" && req.method === "GET") {
+                const resources = store.listResources(ctx.workspace.id);
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    object: "v2.list",
+                    data: resources,
+                    next_page_url: null,
+                    previous_page_url: null,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/resources" && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const providerSlug = String(body.provider || "turso").toLowerCase();
+                const serviceRef = String(body.service_ref || "database").toLowerCase();
+                const resourceName = body.name ? String(body.name) : `${providerSlug}-${serviceRef}`;
+                const created = !engine.stripeProjects.hasStripeV2ApiKey(stripeByok)
+                    ? managedResource({
+                        provider: providerSlug,
+                        serviceRef,
+                        name: resourceName,
+                        environment: body.environment ? String(body.environment) : "prod",
+                        catalog: body.catalog ? String(body.catalog) : "prod",
+                    })
+                    : await engine.stripeProjects.createResource({
+                        provider: providerSlug,
+                        service_ref: serviceRef,
+                        configuration: body.configuration && typeof body.configuration === "object"
+                            ? body.configuration
+                            : {},
+                        name: resourceName,
+                        environment: body.environment ? String(body.environment) : "prod",
+                        catalog: body.catalog || "prod",
+                        project: body.project ? String(body.project) : undefined,
+                        apiKeyOverride: stripeByok,
+                    });
+                const externalId = String(created.id || `prv_res_${Date.now().toString(36)}`);
+                const envKey = `${providerSlug.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_URL`;
+                store.upsertResource({
+                    workspaceId: ctx.workspace.id,
+                    providerSlug,
+                    providerName: providerSlug.toUpperCase(),
+                    serviceSlug: serviceRef,
+                    resourceName,
+                    status: "active",
+                    externalResourceId: externalId,
+                    secrets: { [envKey]: `https://${resourceName}.${providerSlug}.muxo.internal` },
+                    metadata: { source: created.source || "muxo_managed" },
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...created,
+                });
+                return;
+            }
+            const resourceIdMatch = pathname.match(/^\/api\/v1\/provisioning\/resources\/([^/]+)$/);
+            if (resourceIdMatch && (req.method === "GET" || req.method === "POST")) {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const resourceId = decodeURIComponent(resourceIdMatch[1]);
+                if (req.method === "GET") {
+                    const retrieved = engine.stripeProjects.hasStripeV2ApiKey(stripeByok)
+                        ? await engine.stripeProjects.retrieveResource(resourceId, stripeByok)
+                        : managedResource({ id: resourceId });
+                    sendJson(res, 200, {
+                        ok: true,
+                        apiVersion: engine.stripeProjects.provisioningApiVersion,
+                        ...retrieved,
+                    });
+                    return;
+                }
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const updated = engine.stripeProjects.hasStripeV2ApiKey(stripeByok)
+                    ? await engine.stripeProjects.updateResource(resourceId, body.configuration || body, stripeByok)
+                    : managedResource({ id: resourceId, status: "active" });
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...updated,
+                });
+                return;
+            }
             // Governance Policy
+            if (pathname === "/api/v1/policy" && req.method === "GET") {
+                const summary = engine.getGuardrailsSummary(ctx);
+                sendJson(res, 200, {
+                    ok: true,
+                    policy: summary.policy,
+                    plainEnglish: summary.plainEnglish,
+                    explanation: summary.plainEnglish.explanation,
+                    activeDefaults: summary.activeDefaults,
+                    activeGuardrails: summary.activeGuardrails,
+                });
+                return;
+            }
             if (pathname === "/api/v1/policy" && req.method === "POST") {
                 const body = JSON.parse((await readBody(req)) || "{}");
                 const updated = store.updateWorkspacePolicy(ctx.workspace.id, sanitizePolicyPatch(body));
-                sendJson(res, 200, { ok: true, workspace: updated });
+                const plainEnglish = describePolicyInPlainEnglish(updated.policy);
+                sendJson(res, 200, {
+                    ok: true,
+                    workspace: updated,
+                    plainEnglishGuardrails: plainEnglish,
+                    explanation: plainEnglish.explanation,
+                });
                 return;
             }
             // Plans & Approvals & Execution
@@ -1197,18 +2518,53 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 sendJson(res, 201, { ok: true, ...planned });
                 return;
             }
+            const resolvePlanCtx = (planId) => {
+                const found = store.getPlanById(planId);
+                if (found &&
+                    found.workspaceId !== ctx.workspace.id &&
+                    ctx.authType === "session" &&
+                    store.userCanAccessWorkspace(ctx.user.id, found.workspaceId)) {
+                    const targetWs = store.getWorkspace(found.workspaceId);
+                    if (targetWs) {
+                        return { ...ctx, workspace: targetWs };
+                    }
+                }
+                return ctx;
+            };
             const planApproveMatch = pathname.match(/^\/api\/v1\/plans\/([^/]+)\/approve$/);
             if (planApproveMatch && req.method === "POST") {
                 const planId = decodeURIComponent(planApproveMatch[1]);
-                const plan = engine.approvePlan(ctx, planId, "approved");
+                const planCtx = resolvePlanCtx(planId);
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const decision = body.decision === "rejected" || body.decision === "reject"
+                    ? "rejected"
+                    : "approved";
+                const plan = engine.approvePlan(planCtx, planId, decision);
                 sendJson(res, 200, { ok: true, plan });
                 return;
             }
+            const planWaitMatch = pathname.match(/^\/api\/v1\/plans\/([^/]+)\/wait$/);
+            if (planWaitMatch && (req.method === "POST" || req.method === "GET")) {
+                const planId = decodeURIComponent(planWaitMatch[1]);
+                const planCtx = resolvePlanCtx(planId);
+                const body = req.method === "POST" ? JSON.parse((await readBody(req)) || "{}") : {};
+                const rawTimeout = body.timeoutSeconds ??
+                    body.timeout_seconds ??
+                    url.searchParams.get("timeout_seconds") ??
+                    url.searchParams.get("timeoutSeconds");
+                const waited = await engine.waitForPlanApproval(planCtx, {
+                    planId,
+                    timeoutSeconds: clampWaitSeconds(rawTimeout, 15, 60),
+                });
+                sendJson(res, 200, waited);
+                return;
+            }
             const planExecuteMatch = pathname.match(/^\/api\/v1\/plans\/([^/]+)\/execute$/);
             if (planExecuteMatch && req.method === "POST") {
                 const planId = decodeURIComponent(planExecuteMatch[1]);
-                const plan = engine.getPlan(ctx, planId);
-                const result = await engine.executePlanForRisk(ctx, planId, plan.riskLevel);
+                const planCtx = resolvePlanCtx(planId);
+                const plan = engine.getPlan(planCtx, planId);
+                const result = await engine.executePlanForRisk(planCtx, planId, plan.riskLevel);
                 sendJson(res, 200, {
                     ok: true,
                     ...result,
@@ -1219,8 +2575,24 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
             const planGetMatch = pathname.match(/^\/api\/v1\/plans\/([^/]+)$/);
             if (planGetMatch && req.method === "GET") {
                 const planId = decodeURIComponent(planGetMatch[1]);
-                const plan = engine.getPlan(ctx, planId);
-                sendJson(res, 200, { ok: true, plan });
+                const planCtx = resolvePlanCtx(planId);
+                const wait = url.searchParams.get("wait") === "true" ||
+                    url.searchParams.get("wait_for_approval") === "true";
+                if (wait) {
+                    const waited = await engine.waitForPlanApproval(planCtx, {
+                        planId,
+                        timeoutSeconds: clampWaitSeconds(url.searchParams.get("timeout_seconds"), 15, 60),
+                    });
+                    sendJson(res, 200, waited);
+                    return;
+                }
+                const plan = engine.getPlan(planCtx, planId);
+                sendJson(res, 200, {
+                    ok: true,
+                    approved: APPROVED_PLAN_STATUSES.has(plan.approvalStatus),
+                    timedOut: false,
+                    plan,
+                });
                 return;
             }
             // Runs & Receipts
@@ -1236,7 +2608,7 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 const runId = decodeURIComponent(runCancelMatch[1]);
                 const body = JSON.parse((await readBody(req)) || "{}");
                 const cancelled = engine.cancelRun(ctx, runId, body.reason ? String(body.reason) : undefined);
-                sendJson(res, 200, { ok: true, ...cancelled });
+                sendJson(res, 200, cancelled);
                 return;
             }
             const runGetMatch = pathname.match(/^\/api\/v1\/runs\/([^/]+)$/);
@@ -1246,6 +2618,20 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 sendJson(res, 200, { ok: true, run });
                 return;
             }
+            if (pathname === "/api/v1/receipts" && req.method === "GET") {
+                const limit = Math.min(100, Math.max(1, Number(url.searchParams.get("limit") || 25)));
+                const list = engine.listReceipts(ctx, limit);
+                sendJson(res, 200, { ok: true, ...list });
+                return;
+            }
+            if ((pathname === "/api/v1/receipts/verify-chain" ||
+                pathname === "/api/v1/receipts/chain") &&
+                req.method === "GET") {
+                const limit = Math.min(200, Math.max(1, Number(url.searchParams.get("limit") || 100)));
+                const chain = engine.verifyReceiptChain(ctx, limit);
+                sendJson(res, 200, chain);
+                return;
+            }
             if (pathname.startsWith("/api/v1/receipts/") && req.method === "GET") {
                 const receiptId = decodeURIComponent(pathname.slice("/api/v1/receipts/".length));
                 const verified = engine.getReceipt(ctx, receiptId);
@@ -1466,13 +2852,236 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 sendJson(res, 200, { ok: true, received: true });
                 return;
             }
+            // Stripe v2 Billing Meter Event Stream (`POST /v2/billing/meter_event_session` + `POST /v2/billing/meter_event_stream`)
+            if (pathname === "/api/v1/billing/meter_events" && req.method === "GET") {
+                const limit = Number(url.searchParams.get("limit") || 50);
+                const summary = engine.stripeBilling.listMeterEvents(ctx.workspace.id, limit);
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...summary,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/billing/meter_events" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const result = await engine.stripeBilling.recordMeterEvent({
+                    workspace: ctx.workspace,
+                    event_name: body.event_name ? String(body.event_name) : undefined,
+                    value: Number(body.value ?? 1),
+                    lane: body.lane ? String(body.lane) : undefined,
+                    tool_slug: body.tool_slug ? String(body.tool_slug) : undefined,
+                    identifier: body.identifier ? String(body.identifier) : undefined,
+                    timestamp: body.timestamp ? String(body.timestamp) : undefined,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...result,
+                });
+                return;
+            }
+            // Stripe v2 Event Destinations & Provisioning Thin Event Webhook Handler
+            if (pathname === "/api/v1/provisioning/event_destinations" &&
+                req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const destination = await engine.stripeProjects.createV2EventDestination({
+                    name: body.name ? String(body.name) : undefined,
+                    url: String(body.url || `${config.baseUrl}/api/v1/provisioning/events`),
+                    events: Array.isArray(body.events) ? body.events.map(String) : undefined,
+                    apiKeyOverride: stripeByok,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...destination,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/events" && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const verifiedContext = store.getByokKey(ctx.workspace.id, "stripe_connected_account") || undefined;
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const handled = await engine.stripeProjects.handleV2ProvisioningEvent({
+                    event: body,
+                    apiKeyOverride: stripeByok,
+                    stripeContext: verifiedContext,
+                });
+                if (handled.revealedConfiguration &&
+                    Object.keys(handled.revealedConfiguration).length > 0 &&
+                    handled.relatedObjectId) {
+                    store.upsertResource({
+                        workspaceId: ctx.workspace.id,
+                        resourceName: String(handled.resource?.name || handled.relatedObjectId),
+                        providerSlug: String(handled.resource?.provider || "neon"),
+                        providerName: String(handled.resource?.provider || "Neon"),
+                        serviceSlug: String(handled.resource?.service_ref || "postgres"),
+                        planSlug: "launch",
+                        status: "active",
+                        secrets: handled.revealedConfiguration,
+                        externalResourceId: handled.relatedObjectId,
+                        metadata: {
+                            region: "aws-us-east-1",
+                        },
+                    });
+                }
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...handled,
+                });
+                return;
+            }
+            // Composio Dynamic Enterprise Toolkits, Scoped Auth Configs, Triggers & Multi-Tool Batch Execution
+            if (pathname === "/api/v1/toolkits" && req.method === "GET") {
+                const composioByok = store.getByokKey(ctx.workspace.id, "composio");
+                const category = url.searchParams.get("category") || undefined;
+                const search = url.searchParams.get("search") || url.searchParams.get("query") || undefined;
+                const catalog = await engine.composioSdk.listToolkits({
+                    category,
+                    search,
+                    composioApiKey: composioByok,
+                });
+                sendJson(res, 200, { ok: true, ...catalog });
+                return;
+            }
+            if (pathname === "/api/v1/connections/auth-configs" && req.method === "POST") {
+                const composioByok = store.getByokKey(ctx.workspace.id, "composio");
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const created = await engine.composioSdk.createCustomAuthConfig({
+                    workspaceId: ctx.workspace.id,
+                    toolkitSlug: String(body.toolkitSlug || body.provider || "github"),
+                    name: body.name ? String(body.name) : undefined,
+                    authScheme: body.authScheme === "API_KEY" ? "API_KEY" : "OAUTH2",
+                    scopeMode: body.scopeMode === "full_access" ? "full_access" : "read_only",
+                    customScopes: Array.isArray(body.customScopes)
+                        ? body.customScopes.map(String)
+                        : undefined,
+                    credentials: body.credentials && typeof body.credentials === "object"
+                        ? body.credentials
+                        : undefined,
+                    composioApiKey: composioByok,
+                });
+                sendJson(res, 201, { ok: true, ...created });
+                return;
+            }
+            if (pathname === "/api/v1/triggers" && req.method === "GET") {
+                const provider = url.searchParams.get("provider") || undefined;
+                const available = engine.composioSdk.listTriggerTypes(provider);
+                const subscriptions = engine.composioSdk.listActiveTriggers(ctx.workspace.id);
+                const events = engine.composioSdk.listTriggerEvents(ctx.workspace.id, 25);
+                sendJson(res, 200, {
+                    ok: true,
+                    availableTriggers: available,
+                    activeSubscriptions: subscriptions,
+                    recentEvents: events,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/triggers" && req.method === "POST") {
+                const composioByok = store.getByokKey(ctx.workspace.id, "composio");
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const subscription = await engine.composioSdk.enableTrigger({
+                    workspaceId: ctx.workspace.id,
+                    triggerSlug: String(body.triggerSlug || body.trigger_slug || "GITHUB_COMMIT_EVENT"),
+                    providerSlug: String(body.providerSlug || body.provider || "github"),
+                    connectedAccountId: body.connectedAccountId
+                        ? String(body.connectedAccountId)
+                        : undefined,
+                    webhookUrl: body.webhookUrl ? String(body.webhookUrl) : undefined,
+                    config: body.config && typeof body.config === "object" ? body.config : {},
+                    composioApiKey: composioByok,
+                });
+                sendJson(res, 201, { ok: true, subscription });
+                return;
+            }
+            if (pathname === "/api/v1/triggers/webhook" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const triggerSlug = String(body.triggerSlug || body.type || "GITHUB_COMMIT_EVENT").toUpperCase();
+                const providerSlug = String(body.providerSlug || triggerSlug.split("_")[0] || "github").toLowerCase();
+                const payloadObj = body.payload && typeof body.payload === "object"
+                    ? body.payload
+                    : body;
+                const rawPayloadText = JSON.stringify(payloadObj);
+                const injectionScan = engine.governance.scanMemoryContent({
+                    workspaceId: ctx.workspace.id,
+                    content: rawPayloadText,
+                });
+                const disposition = injectionScan.safe ? "dispatched" : "quarantined";
+                const eventRecord = {
+                    id: `trgevt_${Date.now()}_${Math.random().toString(36).slice(2, 7)}`,
+                    workspaceId: ctx.workspace.id,
+                    triggerSlug,
+                    providerSlug,
+                    receivedAt: new Date().toISOString(),
+                    promptInjectionScan: {
+                        safe: injectionScan.safe,
+                        riskScore: injectionScan.findingsCount * 0.35,
+                        findings: injectionScan.findings.map((f) => `${f.patternId}: ${f.description}`),
+                    },
+                    disposition: disposition,
+                    payloadPreview: payloadObj,
+                };
+                engine.composioSdk.recordTriggerEvent(eventRecord);
+                sendJson(res, injectionScan.safe ? 200 : 202, {
+                    ok: true,
+                    ...eventRecord,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/plans/batch" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const batchResult = await engine.executeBatchPlans(ctx, {
+                    items: Array.isArray(body.items) ? body.items : [],
+                    // Only a signed-in person may pre-approve pending plans; agent keys never can.
+                    autoApprove: body.autoApprove === true && signedInPerson(auth),
+                });
+                sendJson(res, 200, { ok: true, ...batchResult });
+                return;
+            }
+            // Cloudflare Vectorize Hybrid Semantic + Bi-Temporal Recall, Durable Workflows, and R2 WORM Audit Archive
+            if (pathname === "/api/v1/memory/hybrid" && (req.method === "GET" || req.method === "POST")) {
+                const body = req.method === "POST" ? JSON.parse((await readBody(req)) || "{}") : {};
+                const query = String(body.query ?? body.q ?? url.searchParams.get("query") ?? url.searchParams.get("q") ?? "");
+                const limit = Number(body.limit ?? url.searchParams.get("limit") ?? 10);
+                const hybrid = engine.searchMemoryHybrid(ctx.workspace.id, query, limit);
+                sendJson(res, 200, { ok: true, ...hybrid });
+                return;
+            }
+            if (pathname === "/api/v1/workflows" && req.method === "GET") {
+                const workflows = engine.listDurableWorkflows(ctx.workspace.id);
+                sendJson(res, 200, { ok: true, workflows });
+                return;
+            }
+            if (pathname === "/api/v1/workflows" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const workflow = await engine.startDurableWorkflow(ctx, {
+                    provider: body.provider ? String(body.provider) : undefined,
+                    serviceRef: body.serviceRef || body.service_ref ? String(body.serviceRef || body.service_ref) : undefined,
+                    name: body.name ? String(body.name) : undefined,
+                    region: body.region ? String(body.region) : undefined,
+                });
+                sendJson(res, 201, { ok: true, workflow });
+                return;
+            }
+            const wfAdvanceMatch = pathname.match(/^\/api\/v1\/workflows\/([^/]+)\/advance$/);
+            if (wfAdvanceMatch && req.method === "POST") {
+                const wfId = decodeURIComponent(wfAdvanceMatch[1]);
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const workflow = await engine.advanceDurableWorkflow(ctx, wfId, body);
+                sendJson(res, 200, { ok: true, workflow });
+                return;
+            }
+            if (pathname === "/api/v1/governance/archive" && req.method === "GET") {
+                const archive = engine.exportTamperEvidentArchive(ctx.workspace.id);
+                sendJson(res, 200, { ok: true, ...archive });
+                return;
+            }
             sendJson(res, 404, { ok: false, error: `Route not found: ${req.method} ${pathname}` });
         }
         catch (err) {
-            sendJson(res, 400, {
-                ok: false,
-                error: String(err?.message || err || "Internal error"),
-            });
+            sendJson(res, err instanceof MuxoToolError ? err.statusCode : 400, errorPayloadFrom(err, "Internal error"));
         }
     });
     return { server, engine, store, defaultApiKey: bootstrap.defaultApiKey };