@muxoai/platform 1.4.0 → 1.4.2

package/dist/store.js

@@ -18,16 +18,58 @@ const DEFAULT_POLICY = {
     allowProvisioning: true,
     maxCreditsPerRun: 250,
 };
+const RECEIPTS_COLUMN_NAMES = [
+    "id",
+    "run_id",
+    "plan_id",
+    "workspace_id",
+    "actor_id",
+    "tool_slug",
+    "lane",
+    "risk_level",
+    "status",
+    "actions_metered",
+    "credits_metered",
+    "input_hash",
+    "output_hash",
+    "prev_receipt_hash",
+    "receipt_hash",
+    "signature",
+    "decision_record_json",
+    "issued_at",
+];
+const RECEIPTS_TABLE_COLUMNS = `
+  id TEXT PRIMARY KEY,
+  run_id TEXT NOT NULL,
+  plan_id TEXT NOT NULL,
+  workspace_id TEXT NOT NULL,
+  actor_id TEXT NOT NULL,
+  tool_slug TEXT NOT NULL,
+  lane TEXT NOT NULL,
+  risk_level TEXT NOT NULL,
+  status TEXT NOT NULL,
+  actions_metered INTEGER NOT NULL,
+  credits_metered INTEGER NOT NULL,
+  input_hash TEXT NOT NULL,
+  output_hash TEXT NOT NULL,
+  prev_receipt_hash TEXT NOT NULL,
+  receipt_hash TEXT NOT NULL,
+  signature TEXT NOT NULL,
+  decision_record_json TEXT,
+  issued_at TEXT NOT NULL
+`;
 export class MuxoStore {
     db;
     vaultKey;
     constructor(dbPath, vaultKey) {
         this.db = new DatabaseSync(dbPath);
+        this.db.exec("PRAGMA busy_timeout = 10000;");
         this.vaultKey = vaultKey;
         this.initSchema();
     }
     initSchema() {
         this.db.exec(`
+      PRAGMA busy_timeout = 10000;
       PRAGMA journal_mode = WAL;
       PRAGMA foreign_keys = ON;
 
@@ -153,26 +195,7 @@ export class MuxoStore {
         completed_at TEXT
       );
 
-      CREATE TABLE IF NOT EXISTS receipts (
-        id TEXT PRIMARY KEY,
-        run_id TEXT NOT NULL UNIQUE,
-        plan_id TEXT NOT NULL,
-        workspace_id TEXT NOT NULL,
-        actor_id TEXT NOT NULL,
-        tool_slug TEXT NOT NULL,
-        lane TEXT NOT NULL,
-        risk_level TEXT NOT NULL,
-        status TEXT NOT NULL,
-        actions_metered INTEGER NOT NULL,
-        credits_metered INTEGER NOT NULL,
-        input_hash TEXT NOT NULL,
-        output_hash TEXT NOT NULL,
-        prev_receipt_hash TEXT NOT NULL,
-        receipt_hash TEXT NOT NULL,
-        signature TEXT NOT NULL,
-        decision_record_json TEXT,
-        issued_at TEXT NOT NULL
-      );
+      CREATE TABLE IF NOT EXISTS receipts (${RECEIPTS_TABLE_COLUMNS});
 
       CREATE TABLE IF NOT EXISTS memories (
         id TEXT PRIMARY KEY,
@@ -240,12 +263,42 @@ export class MuxoStore {
         updated_at TEXT NOT NULL,
         PRIMARY KEY (workspace_id, provider)
       );
+
+      CREATE TABLE IF NOT EXISTS workspace_members (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        user_id TEXT NOT NULL,
+        role TEXT NOT NULL DEFAULT 'operator',
+        team_name TEXT,
+        joined_via_key_id TEXT,
+        created_at TEXT NOT NULL,
+        UNIQUE(workspace_id, user_id)
+      );
+
+      CREATE TABLE IF NOT EXISTS clerk_users (
+        clerk_user_id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL,
+        created_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS oauth_refresh_tokens (
+        token_hash TEXT PRIMARY KEY,
+        key_id TEXT NOT NULL,
+        workspace_id TEXT NOT NULL,
+        client_id TEXT NOT NULL,
+        scope TEXT NOT NULL,
+        encrypted_access_token TEXT NOT NULL,
+        created_at TEXT NOT NULL
+      );
     `);
         // Backwards-compatible column migrations for existing databases
         for (const stmt of [
             "ALTER TABLE plans ADD COLUMN decision_record_json TEXT",
             "ALTER TABLE plans ADD COLUMN memory_context_json TEXT",
             "ALTER TABLE receipts ADD COLUMN decision_record_json TEXT",
+            "ALTER TABLE api_keys ADD COLUMN team_name TEXT",
+            "ALTER TABLE api_keys ADD COLUMN role TEXT DEFAULT 'operator'",
+            "ALTER TABLE api_keys ADD COLUMN created_by_email TEXT",
         ]) {
             try {
                 this.db.exec(stmt);
@@ -254,6 +307,38 @@ export class MuxoStore {
                 // Column already exists
             }
         }
+        this.migrateReceiptsAllowMultiplePerRun();
+        this.db.exec("CREATE INDEX IF NOT EXISTS idx_receipts_workspace_run ON receipts(workspace_id, run_id)");
+    }
+    /**
+     * Older databases declared receipts.run_id UNIQUE, which blocks cancellation receipts from
+     * superseding a run's original receipt. SQLite cannot drop a constraint, so rebuild the table.
+     */
+    migrateReceiptsAllowMultiplePerRun() {
+        const indexes = this.db.prepare("PRAGMA index_list(receipts)").all();
+        const hasUniqueRunId = indexes.some((idx) => {
+            if (!idx.unique || idx.origin !== "u")
+                return false;
+            const cols = this.db.prepare(`PRAGMA index_info("${idx.name}")`).all();
+            return cols.length === 1 && cols[0].name === "run_id";
+        });
+        if (!hasUniqueRunId)
+            return;
+        const columns = RECEIPTS_COLUMN_NAMES.join(", ");
+        this.db.exec("BEGIN");
+        try {
+            this.db.exec(`
+        CREATE TABLE receipts_migrated (${RECEIPTS_TABLE_COLUMNS});
+        INSERT INTO receipts_migrated (${columns}) SELECT ${columns} FROM receipts ORDER BY rowid;
+        DROP TABLE receipts;
+        ALTER TABLE receipts_migrated RENAME TO receipts;
+      `);
+            this.db.exec("COMMIT");
+        }
+        catch (err) {
+            this.db.exec("ROLLBACK");
+            throw err;
+        }
     }
     // --- Encryption Vault (AES-256-GCM) ---
     encryptSecrets(workspaceId, secrets) {
@@ -349,11 +434,18 @@ export class MuxoStore {
             referenceId: workspaceId,
             description: "Free Plan initial monthly allowance (1,000 actions + 250 trial credits)",
         });
+        this.ensureWorkspaceMembership({
+            workspaceId,
+            userId,
+            role: "owner",
+        });
         const sessionToken = this.createSession(userId, workspaceId);
         const defaultKey = this.createApiKey({
             workspaceId,
             name: "Default Live Key",
             environment: "live",
+            role: "owner",
+            createdByEmail: params.email.toLowerCase().trim(),
         });
         return {
             user: this.getUser(userId),
@@ -372,6 +464,11 @@ export class MuxoStore {
             return null;
         const user = this.mapUser(row);
         const workspace = this.getWorkspace(user.workspaceId);
+        this.ensureWorkspaceMembership({
+            workspaceId: workspace.id,
+            userId: user.id,
+            role: user.role,
+        });
         const sessionToken = this.createSession(user.id, workspace.id);
         return { user, workspace, sessionToken };
     }
@@ -385,7 +482,7 @@ export class MuxoStore {
             .run(this.hashToken(rawToken), userId, workspaceId, expires.toISOString(), now.toISOString());
         return rawToken;
     }
-    resolveAuthToken(token) {
+    resolveAuthToken(token, workspaceOverrideId) {
         const trimmed = token.trim();
         if (!trimmed)
             return null;
@@ -423,11 +520,22 @@ export class MuxoStore {
             return null;
         }
         const user = this.getUser(String(sessionRow.user_id));
-        const workspace = this.getWorkspace(String(sessionRow.workspace_id));
-        if (!user || !workspace)
+        if (!user)
+            return null;
+        let targetWorkspaceId = String(sessionRow.workspace_id || user.workspaceId);
+        if (workspaceOverrideId &&
+            workspaceOverrideId.trim() &&
+            this.userCanAccessWorkspace(user.id, workspaceOverrideId.trim())) {
+            targetWorkspaceId = workspaceOverrideId.trim();
+        }
+        else if (user.workspaceId && this.userCanAccessWorkspace(user.id, user.workspaceId)) {
+            targetWorkspaceId = user.workspaceId;
+        }
+        const workspace = this.getWorkspace(targetWorkspaceId);
+        if (!workspace)
             return null;
         return {
-            user,
+            user: { ...user, workspaceId: workspace.id },
             workspace,
             authType: "session",
             actorId: user.id,
@@ -445,6 +553,326 @@ export class MuxoStore {
             .get(workspaceId);
         return row ? this.mapWorkspace(row) : null;
     }
+    ensureWorkspaceMembership(params) {
+        const now = new Date().toISOString();
+        const role = params.role || "operator";
+        const existing = this.db
+            .prepare("SELECT * FROM workspace_members WHERE workspace_id = ? AND user_id = ?")
+            .get(params.workspaceId, params.userId);
+        if (existing) {
+            if (params.teamName || params.role) {
+                this.db
+                    .prepare("UPDATE workspace_members SET role = COALESCE(?, role), team_name = COALESCE(?, team_name) WHERE id = ?")
+                    .run(params.role || null, params.teamName || null, String(existing.id));
+            }
+            return {
+                id: String(existing.id),
+                workspaceId: String(existing.workspace_id),
+                userId: String(existing.user_id),
+                role: (params.role || String(existing.role) || "operator"),
+                teamName: params.teamName ?? (existing.team_name ? String(existing.team_name) : null),
+                joinedViaKeyId: existing.joined_via_key_id ? String(existing.joined_via_key_id) : null,
+                createdAt: String(existing.created_at),
+            };
+        }
+        const id = `wsm_${crypto.randomBytes(8).toString("hex")}`;
+        this.db
+            .prepare(`INSERT INTO workspace_members (
+          id, workspace_id, user_id, role, team_name, joined_via_key_id, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?)`)
+            .run(id, params.workspaceId, params.userId, role, params.teamName || null, params.joinedViaKeyId || null, now);
+        return {
+            id,
+            workspaceId: params.workspaceId,
+            userId: params.userId,
+            role,
+            teamName: params.teamName || null,
+            joinedViaKeyId: params.joinedViaKeyId || null,
+            createdAt: now,
+        };
+    }
+    userCanAccessWorkspace(userId, workspaceId) {
+        const ws = this.getWorkspace(workspaceId);
+        if (!ws)
+            return false;
+        if (ws.ownerUserId === userId)
+            return true;
+        const user = this.getUser(userId);
+        if (user?.workspaceId === workspaceId)
+            return true;
+        const mem = this.db
+            .prepare("SELECT id FROM workspace_members WHERE workspace_id = ? AND user_id = ?")
+            .get(workspaceId, userId);
+        return Boolean(mem);
+    }
+    listUserWorkspaces(userId, activeWorkspaceId) {
+        const user = this.getUser(userId);
+        const currentId = activeWorkspaceId || user?.workspaceId || "";
+        const ownedRows = this.db
+            .prepare("SELECT * FROM workspaces WHERE owner_user_id = ? ORDER BY created_at ASC")
+            .all(userId);
+        const memberRows = this.db
+            .prepare(`SELECT w.*, m.role AS member_role, m.team_name AS member_team_name
+         FROM workspace_members m
+         JOIN workspaces w ON w.id = m.workspace_id
+         WHERE m.user_id = ?
+         ORDER BY m.created_at ASC`)
+            .all(userId);
+        const byId = new Map();
+        for (const r of ownedRows) {
+            const ws = this.mapWorkspace(r);
+            byId.set(ws.id, {
+                id: ws.id,
+                name: ws.name,
+                slug: ws.slug,
+                tier: ws.tier,
+                creditsBalance: ws.creditsBalance,
+                monthlyActionsUsed: ws.monthlyActionsUsed,
+                monthlyActionsLimit: ws.monthlyActionsLimit,
+                role: "owner",
+                teamName: null,
+                isCurrent: ws.id === currentId,
+                createdAt: ws.createdAt,
+            });
+        }
+        for (const r of memberRows) {
+            const ws = this.mapWorkspace(r);
+            const existing = byId.get(ws.id);
+            byId.set(ws.id, {
+                id: ws.id,
+                name: ws.name,
+                slug: ws.slug,
+                tier: ws.tier,
+                creditsBalance: ws.creditsBalance,
+                monthlyActionsUsed: ws.monthlyActionsUsed,
+                monthlyActionsLimit: ws.monthlyActionsLimit,
+                role: existing?.role === "owner" ? "owner" : String(r.member_role || "operator"),
+                teamName: r.member_team_name ? String(r.member_team_name) : existing?.teamName || null,
+                isCurrent: ws.id === currentId,
+                createdAt: ws.createdAt,
+            });
+        }
+        if (currentId && !byId.has(currentId)) {
+            const ws = this.getWorkspace(currentId);
+            if (ws) {
+                byId.set(ws.id, {
+                    id: ws.id,
+                    name: ws.name,
+                    slug: ws.slug,
+                    tier: ws.tier,
+                    creditsBalance: ws.creditsBalance,
+                    monthlyActionsUsed: ws.monthlyActionsUsed,
+                    monthlyActionsLimit: ws.monthlyActionsLimit,
+                    role: ws.ownerUserId === userId ? "owner" : "operator",
+                    teamName: null,
+                    isCurrent: true,
+                    createdAt: ws.createdAt,
+                });
+            }
+        }
+        return Array.from(byId.values());
+    }
+    switchUserWorkspace(userId, workspaceId) {
+        if (!this.userCanAccessWorkspace(userId, workspaceId))
+            return null;
+        const workspace = this.getWorkspace(workspaceId);
+        if (!workspace)
+            return null;
+        this.db
+            .prepare("UPDATE users SET workspace_id = ? WHERE id = ?")
+            .run(workspaceId, userId);
+        this.db
+            .prepare("UPDATE sessions SET workspace_id = ? WHERE user_id = ?")
+            .run(workspaceId, userId);
+        const user = this.getUser(userId);
+        if (!user)
+            return null;
+        return { user, workspace };
+    }
+    createWorkspaceForUser(params) {
+        const now = new Date().toISOString();
+        const workspaceId = `ws_${crypto.randomBytes(8).toString("hex")}`;
+        const cleanName = params.name.trim() || "Team Workspace";
+        const slugBase = cleanName
+            .toLowerCase()
+            .replace(/[^a-z0-9]+/g, "-")
+            .replace(/^-|-$/g, "");
+        const slug = `${slugBase || "ws"}-${crypto.randomBytes(3).toString("hex")}`;
+        const projectsEnvName = `muxo_${workspaceId.slice(3, 11)}`;
+        const starterCredits = 250;
+        this.db
+            .prepare(`INSERT INTO workspaces (
+          id, name, slug, owner_user_id, tier,
+          monthly_actions_limit, monthly_actions_used, credits_balance,
+          stripe_customer_id, stripe_subscription_id, projects_env_name,
+          policy_json, created_at, updated_at
+        ) VALUES (?, ?, ?, ?, 'free', 1000, 0, ?, NULL, NULL, ?, ?, ?, ?)`)
+            .run(workspaceId, cleanName, slug, params.userId, starterCredits, projectsEnvName, JSON.stringify(DEFAULT_POLICY), now, now);
+        this.addLedgerEntry({
+            workspaceId,
+            kind: "plan_grant",
+            actionsDelta: 1000,
+            creditsDelta: starterCredits,
+            balanceAfter: starterCredits,
+            referenceId: workspaceId,
+            description: `Workspace '${cleanName}' initial monthly allowance (1,000 actions + 250 trial credits)`,
+        });
+        const user = this.getUser(params.userId);
+        const keyRes = this.createApiKey({
+            workspaceId,
+            name: params.teamName ? `${params.teamName} — Team Key` : `${cleanName} — Default Key`,
+            environment: "live",
+            teamName: params.teamName || cleanName,
+            role: params.role || "owner",
+            createdByEmail: user?.email || null,
+        });
+        const membership = this.ensureWorkspaceMembership({
+            workspaceId,
+            userId: params.userId,
+            role: "owner",
+            teamName: params.teamName || null,
+            joinedViaKeyId: keyRes.record.id,
+        });
+        if (params.switchActive !== false) {
+            this.switchUserWorkspace(params.userId, workspaceId);
+        }
+        return {
+            workspace: this.getWorkspace(workspaceId),
+            apiKey: keyRes.secretKey,
+            keyRecord: keyRes.record,
+            membership,
+        };
+    }
+    joinWorkspaceWithApiKey(params) {
+        const trimmed = String(params.apiKey || "").trim();
+        if (!trimmed.startsWith("mk_live_") && !trimmed.startsWith("mk_test_")) {
+            return null;
+        }
+        const hash = this.hashToken(trimmed);
+        const row = this.db
+            .prepare("SELECT * FROM api_keys WHERE key_hash = ? AND revoked_at IS NULL")
+            .get(hash);
+        if (!row)
+            return null;
+        const workspace = this.getWorkspace(String(row.workspace_id));
+        if (!workspace)
+            return null;
+        const keyRecord = {
+            id: String(row.id),
+            workspaceId: String(row.workspace_id),
+            name: String(row.name),
+            keyPrefix: String(row.key_prefix),
+            environment: String(row.environment),
+            scopes: JSON.parse(String(row.scopes_json || "[]")),
+            teamName: row.team_name ? String(row.team_name) : null,
+            role: (row.role ? String(row.role) : "operator"),
+            createdByEmail: row.created_by_email ? String(row.created_by_email) : null,
+            lastUsedAt: row.last_used_at ? String(row.last_used_at) : null,
+            revokedAt: row.revoked_at ? String(row.revoked_at) : null,
+            createdAt: String(row.created_at),
+        };
+        let membership = null;
+        let user = null;
+        if (params.userId) {
+            membership = this.ensureWorkspaceMembership({
+                workspaceId: workspace.id,
+                userId: params.userId,
+                role: workspace.ownerUserId === params.userId ? "owner" : (keyRecord.role || "operator"),
+                teamName: keyRecord.teamName || keyRecord.name,
+                joinedViaKeyId: keyRecord.id,
+            });
+            if (params.switchActive !== false) {
+                this.switchUserWorkspace(params.userId, workspace.id);
+            }
+            user = this.getUser(params.userId);
+        }
+        else {
+            user = this.getUser(workspace.ownerUserId);
+        }
+        return {
+            workspace,
+            keyRecord,
+            user,
+            membership,
+        };
+    }
+    onboardTeam(params) {
+        const cleanTeam = params.teamName.trim() || "Engineering Team";
+        const role = params.role || "operator";
+        const mode = params.mode === "dedicated_workspace" ? "dedicated_workspace" : "shared_workspace";
+        const cleanBase = params.baseUrl.replace(/\/$/, "");
+        const env = params.environment === "test" ? "test" : "live";
+        let targetWorkspace;
+        let apiKey;
+        let keyRecord;
+        if (mode === "dedicated_workspace") {
+            const currentWs = this.getWorkspace(params.currentWorkspaceId);
+            const wsName = currentWs ? `${currentWs.name} — ${cleanTeam}` : `${cleanTeam} Workspace`;
+            const created = this.createWorkspaceForUser({
+                userId: params.userId,
+                name: wsName,
+                teamName: cleanTeam,
+                role,
+                switchActive: false,
+            });
+            targetWorkspace = created.workspace;
+            apiKey = created.apiKey;
+            keyRecord = created.keyRecord;
+        }
+        else {
+            const currentWs = this.getWorkspace(params.currentWorkspaceId);
+            if (!currentWs)
+                throw new Error(`Workspace ${params.currentWorkspaceId} not found`);
+            targetWorkspace = currentWs;
+            const createdKey = this.createApiKey({
+                workspaceId: targetWorkspace.id,
+                name: `${cleanTeam} (${role})`,
+                environment: env,
+                scopes: params.scopes,
+                teamName: cleanTeam,
+                role,
+                createdByEmail: params.userEmail || null,
+            });
+            apiKey = createdKey.secretKey;
+            keyRecord = createdKey.record;
+        }
+        let claimUrl = null;
+        if (params.inviteEmail && params.inviteEmail.includes("@")) {
+            const claim = this.createAgentClaim({
+                workspaceId: targetWorkspace.id,
+                email: params.inviteEmail,
+                baseUrl: cleanBase,
+            });
+            claimUrl = claim.claimUrl;
+        }
+        return {
+            mode,
+            workspace: targetWorkspace,
+            teamName: cleanTeam,
+            role,
+            apiKey,
+            keyRecord,
+            claimUrl,
+            consoleUrl: `${cleanBase}/login`,
+            cliSetupCommand: `npx muxo setup --api-key ${apiKey} --url ${cleanBase}`,
+            mcpConfig: {
+                mcpServers: {
+                    muxo: {
+                        url: `${cleanBase}/mcp`,
+                        headers: {
+                            Authorization: `Bearer ${apiKey}`,
+                        },
+                    },
+                },
+            },
+            instructions: [
+                `Share this Team API Key with ${cleanTeam} (${role} access to '${targetWorkspace.name}').`,
+                `Console: Open ${cleanBase}/login, click "Join with a Team API Key", and paste the key (if signed in with Clerk, the workspace is permanently linked to their switcher).`,
+                `CLI & MCP: Run \`npx -y @muxoai/platform setup --api-key ${apiKey}\` to configure Claude Code, Cursor, Windsurf, or Codex in one command.`,
+                `Approvals: Team members can also paste this key directly on any ${cleanBase}/approve/<planId> link to review and approve actions.`,
+            ],
+        };
+    }
     updateWorkspacePolicy(workspaceId, policy) {
         const ws = this.getWorkspace(workspaceId);
         if (!ws)
@@ -466,12 +894,16 @@ export class MuxoStore {
         const rawSecret = `mk_${env}_${id.slice(4)}_${crypto.randomBytes(16).toString("hex")}`;
         const keyPrefix = `${rawSecret.slice(0, 16)}...${rawSecret.slice(-4)}`;
         const scopes = params.scopes || ["tools:read", "tools:execute", "resources:provision"];
+        const teamName = params.teamName ? params.teamName.trim() : null;
+        const role = params.role || "operator";
+        const createdByEmail = params.createdByEmail ? params.createdByEmail.trim() : null;
         const now = new Date().toISOString();
         this.db
             .prepare(`INSERT INTO api_keys (
-          id, workspace_id, name, key_prefix, key_hash, environment, scopes_json, created_at
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
-            .run(id, params.workspaceId, params.name, keyPrefix, this.hashToken(rawSecret), env, JSON.stringify(scopes), now);
+          id, workspace_id, name, key_prefix, key_hash, environment, scopes_json,
+          team_name, role, created_by_email, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(id, params.workspaceId, params.name, keyPrefix, this.hashToken(rawSecret), env, JSON.stringify(scopes), teamName, role, createdByEmail, now);
         return {
             record: {
                 id,
@@ -480,6 +912,9 @@ export class MuxoStore {
                 keyPrefix,
                 environment: env,
                 scopes,
+                teamName,
+                role,
+                createdByEmail,
                 lastUsedAt: null,
                 revokedAt: null,
                 createdAt: now,
@@ -498,6 +933,9 @@ export class MuxoStore {
             keyPrefix: String(r.key_prefix),
             environment: String(r.environment),
             scopes: JSON.parse(String(r.scopes_json || "[]")),
+            teamName: r.team_name ? String(r.team_name) : null,
+            role: (r.role ? String(r.role) : "operator"),
+            createdByEmail: r.created_by_email ? String(r.created_by_email) : null,
             lastUsedAt: r.last_used_at ? String(r.last_used_at) : null,
             revokedAt: r.revoked_at ? String(r.revoked_at) : null,
             createdAt: String(r.created_at),
@@ -508,8 +946,95 @@ export class MuxoStore {
         const res = this.db
             .prepare("UPDATE api_keys SET revoked_at = ? WHERE id = ? AND workspace_id = ?")
             .run(now, keyId, workspaceId);
+        if (res.changes > 0) {
+            this.db.prepare("DELETE FROM oauth_refresh_tokens WHERE key_id = ?").run(keyId);
+        }
         return res.changes > 0;
     }
+    /** Looks up an active workspace API key by its raw secret. */
+    findActiveApiKey(secret) {
+        const row = this.db
+            .prepare("SELECT id, workspace_id FROM api_keys WHERE key_hash = ? AND revoked_at IS NULL")
+            .get(this.hashToken(secret.trim()));
+        return row ? { id: String(row.id), workspaceId: String(row.workspace_id) } : null;
+    }
+    // --- OAuth refresh tokens (hashed; the access token is kept encrypted so refresh can return it) ---
+    saveOAuthRefreshToken(params) {
+        this.db
+            .prepare(`INSERT INTO oauth_refresh_tokens (
+          token_hash, key_id, workspace_id, client_id, scope, encrypted_access_token, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?)`)
+            .run(this.hashToken(params.refreshToken), params.keyId, params.workspaceId, params.clientId, params.scope, this.encryptSecrets(params.workspaceId, { accessToken: params.accessToken }), new Date().toISOString());
+    }
+    getOAuthRefreshToken(refreshToken) {
+        const row = this.db
+            .prepare("SELECT * FROM oauth_refresh_tokens WHERE token_hash = ?")
+            .get(this.hashToken(refreshToken));
+        if (!row)
+            return null;
+        const workspaceId = String(row.workspace_id);
+        let accessToken = "";
+        try {
+            accessToken = this.decryptSecrets(workspaceId, String(row.encrypted_access_token)).accessToken || "";
+        }
+        catch {
+            return null;
+        }
+        return {
+            keyId: String(row.key_id),
+            workspaceId,
+            clientId: String(row.client_id),
+            scope: String(row.scope),
+            accessToken,
+        };
+    }
+    deleteOAuthRefreshToken(refreshToken) {
+        this.db.prepare("DELETE FROM oauth_refresh_tokens WHERE token_hash = ?").run(this.hashToken(refreshToken));
+    }
+    // --- Clerk sign-in ---
+    /**
+     * Maps a verified Clerk session to a local user. Only a verified email can link to an
+     * existing account; otherwise a fresh user and workspace are created so an unverified
+     * address can never take over someone else's account.
+     */
+    provisionClerkUser(clerkUserId, identity, ownerWorkspaceId) {
+        const mappedUser = this.getClerkLinkedUser(clerkUserId);
+        if (mappedUser)
+            return mappedUser;
+        const email = identity.email ? identity.email.trim().toLowerCase() : null;
+        const verifiedEmail = email && identity.emailVerified ? email : null;
+        let user = verifiedEmail ? this.getUserByEmail(verifiedEmail) : null;
+        if (!user) {
+            const displayName = identity.name || (verifiedEmail ? verifiedEmail.split("@")[0] : "Muxo user");
+            const placeholder = `${clerkUserId.toLowerCase()}@clerk.users.muxo.invalid`;
+            user = this.registerUser({
+                email: verifiedEmail || placeholder,
+                name: displayName,
+                password: crypto.randomBytes(24).toString("hex"),
+            }).user;
+        }
+        if (ownerWorkspaceId && verifiedEmail && this.getWorkspace(ownerWorkspaceId)) {
+            this.ensureWorkspaceMembership({ workspaceId: ownerWorkspaceId, userId: user.id, role: "owner" });
+            this.db.prepare("UPDATE users SET workspace_id = ? WHERE id = ?").run(ownerWorkspaceId, user.id);
+            user = this.getUser(user.id);
+        }
+        this.db
+            .prepare("INSERT OR REPLACE INTO clerk_users (clerk_user_id, user_id, created_at) VALUES (?, ?, ?)")
+            .run(clerkUserId, user.id, new Date().toISOString());
+        return user;
+    }
+    getClerkLinkedUser(clerkUserId) {
+        const mapped = this.db
+            .prepare("SELECT user_id FROM clerk_users WHERE clerk_user_id = ?")
+            .get(clerkUserId);
+        return mapped ? this.getUser(mapped.user_id) : null;
+    }
+    getUserByEmail(email) {
+        const row = this.db
+            .prepare("SELECT * FROM users WHERE email = ?")
+            .get(email.trim().toLowerCase());
+        return row ? this.mapUser(row) : null;
+    }
     // --- Connections ---
     upsertConnection(params) {
         const now = new Date().toISOString();
@@ -621,10 +1146,24 @@ export class MuxoStore {
     }
     getResource(workspaceId, resourceNameOrId) {
         const row = this.db
-            .prepare("SELECT * FROM resources WHERE workspace_id = ? AND (resource_name = ? OR id = ?)")
-            .get(workspaceId, resourceNameOrId, resourceNameOrId);
+            .prepare("SELECT * FROM resources WHERE workspace_id = ? AND (resource_name = ? OR id = ? OR external_resource_id = ?)")
+            .get(workspaceId, resourceNameOrId, resourceNameOrId, resourceNameOrId);
+        return row ? this.mapResource(row) : null;
+    }
+    findResourceAnyWorkspace(resourceNameOrId) {
+        const row = this.db
+            .prepare("SELECT * FROM resources WHERE id = ? OR external_resource_id = ? OR resource_name = ? LIMIT 1")
+            .get(resourceNameOrId, resourceNameOrId, resourceNameOrId);
         return row ? this.mapResource(row) : null;
     }
+    getDecryptedResourceSecrets(workspaceId, resourceNameOrId) {
+        const row = this.db
+            .prepare("SELECT encrypted_secrets_hex FROM resources WHERE workspace_id = ? AND (id = ? OR external_resource_id = ? OR resource_name = ?) LIMIT 1")
+            .get(workspaceId, resourceNameOrId, resourceNameOrId, resourceNameOrId);
+        if (!row)
+            return {};
+        return this.decryptSecrets(workspaceId, row.encrypted_secrets_hex);
+    }
     listResources(workspaceId) {
         const rows = this.db
             .prepare("SELECT * FROM resources WHERE workspace_id = ? ORDER BY updated_at DESC")
@@ -799,6 +1338,12 @@ export class MuxoStore {
             .get(planId, workspaceId);
         return row ? this.mapPlan(row) : null;
     }
+    getPlanById(planId) {
+        const row = this.db
+            .prepare("SELECT * FROM plans WHERE id = ?")
+            .get(planId);
+        return row ? this.mapPlan(row) : null;
+    }
     listPlans(workspaceId, limit = 50) {
         const rows = this.db
             .prepare("SELECT * FROM plans WHERE workspace_id = ? ORDER BY created_at DESC LIMIT ?")
@@ -879,10 +1424,41 @@ export class MuxoStore {
             receipt,
         };
     }
+    cancelRun(params) {
+        const run = this.getRun(params.workspaceId, params.runId);
+        if (!run)
+            throw new Error(`Run ${params.runId} not found`);
+        const now = new Date().toISOString();
+        const cancellation = {
+            cancelled: true,
+            cancelledBy: params.cancelledBy,
+            cancelledAt: now,
+            previousStatus: run.status,
+            supersedesReceiptId: run.receiptId,
+            ...(params.reason ? { reason: params.reason } : {}),
+        };
+        const receipt = this.issueReceipt({
+            run,
+            status: "cancelled",
+            output: cancellation,
+            actionsMetered: 0,
+            creditsMetered: 0,
+            decisionRecord: null,
+            issuedAt: now,
+        });
+        this.db
+            .prepare(`UPDATE runs
+         SET status = 'cancelled', output_json = COALESCE(output_json, ?), error = ?,
+             receipt_id = ?, completed_at = COALESCE(completed_at, ?),
+             duration_ms = COALESCE(duration_ms, ?)
+         WHERE id = ? AND workspace_id = ?`)
+            .run(JSON.stringify(cancellation), params.reason || "Cancelled by operator", receipt.id, now, Math.max(0, Date.now() - new Date(run.startedAt).getTime()), run.id, params.workspaceId);
+        return { run: this.getRun(params.workspaceId, run.id), receipt };
+    }
     issueReceipt(params) {
         const id = `rcpt_${crypto.randomBytes(8).toString("hex")}`;
         const lastReceipt = this.db
-            .prepare("SELECT receipt_hash FROM receipts WHERE workspace_id = ? ORDER BY issued_at DESC LIMIT 1")
+            .prepare("SELECT receipt_hash FROM receipts WHERE workspace_id = ? ORDER BY issued_at DESC, rowid DESC LIMIT 1")
             .get(params.run.workspaceId);
         const prevReceiptHash = lastReceipt?.receipt_hash || "genesis_0000000000000000";
         const inputHash = crypto
@@ -964,14 +1540,17 @@ export class MuxoStore {
         return rows.map((r) => this.mapRun(r));
     }
     getReceipt(workspaceId, receiptIdOrRunId) {
+        // A cancelled run has both its original and its cancellation receipt; prefer an exact
+        // receipt id match, otherwise the newest receipt for the run.
         const row = this.db
-            .prepare("SELECT * FROM receipts WHERE workspace_id = ? AND (id = ? OR run_id = ?)")
-            .get(workspaceId, receiptIdOrRunId, receiptIdOrRunId);
+            .prepare(`SELECT * FROM receipts WHERE workspace_id = ? AND (id = ? OR run_id = ?)
+         ORDER BY CASE WHEN id = ? THEN 0 ELSE 1 END, issued_at DESC, rowid DESC LIMIT 1`)
+            .get(workspaceId, receiptIdOrRunId, receiptIdOrRunId, receiptIdOrRunId);
         return row ? this.mapReceipt(row) : null;
     }
     listReceipts(workspaceId, limit = 50) {
         const rows = this.db
-            .prepare("SELECT * FROM receipts WHERE workspace_id = ? ORDER BY issued_at DESC LIMIT ?")
+            .prepare("SELECT * FROM receipts WHERE workspace_id = ? ORDER BY issued_at DESC, rowid DESC LIMIT ?")
             .all(workspaceId, limit);
         return rows.map((r) => this.mapReceipt(r));
     }
@@ -1507,46 +2086,92 @@ export class MuxoStore {
             expiresAt: String(row.expires_at),
         };
     }
+    /**
+     * Creates a claim link for a workspace. A claim minted without an email (at agent signup)
+     * stays unusable until the agent names the owner; naming one reuses that same link.
+     */
     createAgentClaim(params) {
-        const claimSlug = crypto.randomBytes(9).toString("base64url");
+        const targetEmail = (params.email || "").trim().toLowerCase();
         const now = new Date();
         const expires = new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000);
-        this.db
-            .prepare(`INSERT INTO agent_claims (
-          claim_slug, workspace_id, target_email, status, claimed_at, expires_at, created_at
-        ) VALUES (?, ?, ?, 'invited', NULL, ?, ?)`)
-            .run(claimSlug, params.workspaceId, params.email.trim().toLowerCase(), expires.toISOString(), now.toISOString());
+        const unbound = targetEmail
+            ? this.db
+                .prepare(`SELECT claim_slug FROM agent_claims
+             WHERE workspace_id = ? AND status = 'invited' AND target_email = ''
+             ORDER BY created_at DESC LIMIT 1`)
+                .get(params.workspaceId)
+            : undefined;
+        const claimSlug = unbound?.claim_slug || crypto.randomBytes(24).toString("base64url");
+        if (unbound) {
+            this.db
+                .prepare("UPDATE agent_claims SET target_email = ?, expires_at = ? WHERE claim_slug = ?")
+                .run(targetEmail, expires.toISOString(), claimSlug);
+        }
+        else {
+            this.db
+                .prepare(`INSERT INTO agent_claims (
+            claim_slug, workspace_id, target_email, status, claimed_at, expires_at, created_at
+          ) VALUES (?, ?, ?, 'invited', NULL, ?, ?)`)
+                .run(claimSlug, params.workspaceId, targetEmail, expires.toISOString(), now.toISOString());
+        }
         return {
             claimSlug,
             claimUrl: `${params.baseUrl.replace(/\/$/, "")}/claim/${claimSlug}`,
-            targetEmail: params.email.trim().toLowerCase(),
+            targetEmail,
             status: "invited",
             expiresAt: expires.toISOString(),
         };
     }
-    redeemAgentClaim(claimSlug) {
+    /** Returns a claim only while it can still be accepted (invited and not expired). */
+    getOpenAgentClaim(claimSlug) {
         const row = this.db
             .prepare("SELECT * FROM agent_claims WHERE claim_slug = ?")
             .get(claimSlug);
-        if (!row)
+        if (!row || String(row.status) !== "invited" || !row.target_email)
             return null;
-        const now = new Date().toISOString();
-        const workspaceId = String(row.workspace_id);
-        const targetEmail = String(row.target_email);
-        this.db
-            .prepare("UPDATE agent_claims SET status = 'claimed', claimed_at = ? WHERE claim_slug = ?")
-            .run(now, claimSlug);
-        const workspace = this.getWorkspace(workspaceId);
+        if (Date.parse(String(row.expires_at)) <= Date.now())
+            return null;
+        const workspace = this.getWorkspace(String(row.workspace_id));
         if (!workspace)
             return null;
         return {
             claimSlug,
             workspace,
-            targetEmail,
-            status: "claimed",
-            claimedAt: now,
+            targetEmail: String(row.target_email),
+            status: "invited",
+            expiresAt: String(row.expires_at),
         };
     }
+    /** Transfers workspace ownership to the verified claimer and closes the claim. */
+    acceptAgentClaim(claimSlug, userId) {
+        const claim = this.getOpenAgentClaim(claimSlug);
+        if (!claim || !this.getUser(userId))
+            return null;
+        const now = new Date().toISOString();
+        this.db.exec("BEGIN");
+        try {
+            const closed = this.db
+                .prepare("UPDATE agent_claims SET status = 'claimed', claimed_at = ? WHERE claim_slug = ? AND status = 'invited'")
+                .run(now, claimSlug);
+            if (closed.changes === 0) {
+                this.db.exec("ROLLBACK");
+                return null;
+            }
+            this.db
+                .prepare("UPDATE workspaces SET owner_user_id = ?, updated_at = ? WHERE id = ?")
+                .run(userId, now, claim.workspace.id);
+            this.db
+                .prepare("UPDATE users SET workspace_id = ?, role = 'owner' WHERE id = ?")
+                .run(claim.workspace.id, userId);
+            this.ensureWorkspaceMembership({ workspaceId: claim.workspace.id, userId, role: "owner" });
+            this.db.exec("COMMIT");
+        }
+        catch (err) {
+            this.db.exec("ROLLBACK");
+            throw err;
+        }
+        return this.getWorkspace(claim.workspace.id);
+    }
     // --- Row Mappers ---
     mapUser(row) {
         return {