@muxoai/platform 1.4.1 → 1.4.3

package/dist/engine.js

@@ -1,9 +1,11 @@
 import crypto from "node:crypto";
-import { APPROVED_PLAN_STATUSES, approvalRequiredError, buildApprovalUrl, clampWaitSeconds, looksLikeToolSlug, unknownToolError, } from "./mcp-schema.js";
-import { completeCloudProvisioningWorkflow, createCloudProvisioningWorkflow, normalizeWorkflowTarget, workflowNotFoundError, } from "./durable-workflow.js";
+import { isStripeProjectsExclusiveProvider, normalizeStripeProjectsProviderSlug, wrapMuxoConnectUrl, } from "./composio-catalog.js";
+import { APPROVED_PLAN_STATUSES, approvalRequiredError, buildApprovalHumanHandoff, buildApprovalUrl, buildOAuthHumanHandoff, clampWaitSeconds, looksLikeToolSlug, unknownToolError, } from "./mcp-schema.js";
+import { completeCloudProvisioningWorkflow, createCloudProvisioningWorkflow, exportTemporalEventHistory, normalizeWorkflowTarget, rollbackDurableWorkflow as runSagaRollbackOnWorkflow, signalDurableWorkflow as sendSignalToWorkflow, workflowNotFoundError, } from "./durable-workflow.js";
 import { buildMemoryKnowledgeGraph } from "./memory-graph.js";
+import { MUXO_COMMERCIAL_PLAYBOOKS, buildCommercialRoiReport, buildOtelTraceExport, buildPlaybookSagaExecution, compileWorkspacePolicyToCedarAndRego, evaluateCedarAndOpaPolicy, getCommercialPlaybook, } from "./oss-suite.js";
 import { resolveNaturalLanguageIntent, } from "./nl.js";
-import { compileNaturalLanguageGuardrailWithLlm, describePolicyInPlainEnglish, formatHumanFriendlyExplanation, parseNaturalLanguageGuardrail, } from "./policy.js";
+import { DEFAULT_WORKSPACE_POLICY, buildLlmPolicyAndGovernanceBrief, compileNaturalLanguageGuardrailWithLlm, describePolicyInPlainEnglish, formatHumanFriendlyExplanation, parseNaturalLanguageGuardrail, simulatePolicyEvaluation, } from "./policy.js";
 import { ComposioInstantAdapter } from "./providers/composio-instant.js";
 import { ComposioSdkAdapter } from "./providers/composio-sdk.js";
 import { MicrosoftGovernanceAdapter } from "./providers/microsoft-governance.js";
@@ -73,6 +75,24 @@ export class MuxoEngine {
         const connections = this.store.listConnections(ws.id);
         const supplierSettlementSummary = this.store.getSupplierSettlementSummary(ws.id);
         const plainEnglishPolicy = describePolicyInPlainEnglish(ws.policy);
+        const localMemories = this.store.listMemoryRecords(ws.id, 25);
+        const activeFacts = this.store.listTemporalFacts(ws.id, {
+            includeHistorical: false,
+            limit: 30,
+        });
+        const inferred = extractActiveMemoryDefaults({
+            memories: localMemories,
+            temporalFacts: activeFacts,
+        });
+        const trustScore = this.governance.getWorkspaceTrustScore(ws.id);
+        const govStatus = this.governance.getStatus(ws);
+        const llmPolicyBrief = buildLlmPolicyAndGovernanceBrief(ws.policy, {
+            workspaceName: ws.name,
+            workspaceSlug: ws.slug,
+            activeDefaults: inferred.activeDefaults,
+            trustScore: { overall: trustScore.overall, tier: trustScore.tier },
+            agentDid: govStatus.agentDid,
+        });
         return {
             organization: {
                 id: ws.id,
@@ -88,12 +108,16 @@ export class MuxoEngine {
                 supplierSettlementSummary,
                 policy: ws.policy,
                 plainEnglishPolicy,
+                llmPolicyBrief,
+                activeDefaults: inferred.activeDefaults,
                 explanation: plainEnglishPolicy.explanation,
                 activeConnectionsCount: connections.filter((c) => c.status === "active").length,
                 provisionedResourcesCount: resources.filter((r) => r.status === "active").length,
                 projectsEnvironment: ws.projectsEnvName,
                 createdAt: ws.createdAt,
             },
+            llmPolicyBrief,
+            activeDefaults: inferred.activeDefaults,
         };
     }
     // 3. search_tools
@@ -101,7 +125,16 @@ export class MuxoEngine {
         const limit = Math.min(100, Math.max(1, Number(params.limit || 25)));
         const lane = params.lane || "all";
         const query = params.query?.trim();
+        const queryTokens = (query || "")
+            .toLowerCase()
+            .split(/[\s,._/-]+/)
+            .filter(Boolean);
+        const prefersStripeProjects = queryTokens.some((tok) => isStripeProjectsExclusiveProvider(tok) ||
+            /^(provision|deploy|deployment|publish|host|hosting|static|landing|database|postgres|sqlite|redis)$/.test(tok));
         const results = [];
+        if (lane === "all" && prefersStripeProjects) {
+            results.push(...this.stripeProjects.searchTools(query, limit));
+        }
         if (lane === "all" || lane === "composio_instant") {
             results.push(...this.composioInstant.searchTools(query, limit));
         }
@@ -109,8 +142,10 @@ export class MuxoEngine {
             const sdkTools = await this.composioSdk.searchTools(query, limit);
             results.push(...sdkTools);
         }
-        if (lane === "all" || lane === "stripe_projects") {
+        if (lane === "stripe_projects" || (lane === "all" && !prefersStripeProjects)) {
             results.push(...this.stripeProjects.searchTools(query, limit));
+        }
+        if (lane === "all" || lane === "stripe_projects") {
             const billingTools = this.stripeBilling.listTools().filter((t) => {
                 if (!query)
                     return true;
@@ -131,7 +166,7 @@ export class MuxoEngine {
     async listAllCatalogTools() {
         const instant = this.composioInstant.searchTools(undefined, 100);
         const sdk = await this.composioSdk.searchTools(undefined, 100);
-        const proj = this.stripeProjects.searchTools(undefined, 100);
+        const proj = this.stripeProjects.getTools();
         const billing = this.stripeBilling.listTools();
         return [...instant, ...billing, ...sdk, ...proj];
     }
@@ -162,6 +197,9 @@ export class MuxoEngine {
             const composioByok = this.store.getByokKey(ctx.workspace.id, "composio");
             const liveComposio = await this.composioSdk.listLiveConnections(ctx.workspace.id, composioByok);
             for (const c of liveComposio) {
+                if (isStripeProjectsExclusiveProvider(c.providerSlug)) {
+                    continue;
+                }
                 this.store.upsertConnection({
                     workspaceId: ctx.workspace.id,
                     lane: "composio_sdk",
@@ -191,15 +229,63 @@ export class MuxoEngine {
                 // Keep cached connections if CLI is busy
             }
         }
-        let connections = this.store.listConnections(ctx.workspace.id);
+        let connections = this.store.listConnections(ctx.workspace.id).map((c) => {
+            if (isStripeProjectsExclusiveProvider(c.providerSlug)) {
+                return {
+                    ...c,
+                    lane: "stripe_projects",
+                    status: "active",
+                    redirectUrl: null,
+                };
+            }
+            return c.lane === "composio_sdk" && c.redirectUrl
+                ? {
+                    ...c,
+                    redirectUrl: wrapMuxoConnectUrl(c.redirectUrl, this.config.baseUrl, {
+                        workspaceId: c.workspaceId,
+                        providerSlug: c.providerSlug,
+                        externalAccountId: c.externalAccountId,
+                    }),
+                }
+                : c;
+        });
         if (params?.provider) {
-            const target = params.provider.toLowerCase();
-            connections = connections.filter((c) => c.providerSlug.toLowerCase() === target ||
-                c.providerName.toLowerCase().includes(target));
+            const target = normalizeStripeProjectsProviderSlug(params.provider) || params.provider.toLowerCase();
+            if (isStripeProjectsExclusiveProvider(target)) {
+                const activeRecord = this.store.upsertConnection({
+                    workspaceId: ctx.workspace.id,
+                    lane: "stripe_projects",
+                    providerSlug: target,
+                    providerName: target.charAt(0).toUpperCase() + target.slice(1),
+                    status: "active",
+                    externalAccountId: `sp_conn_${target}`,
+                    redirectUrl: null,
+                    metadata: {
+                        managedBy: "stripe_projects",
+                        requiresOAuth: false,
+                    },
+                });
+                connections = [activeRecord];
+            }
+            else {
+                connections = connections.filter((c) => c.providerSlug.toLowerCase() === target ||
+                    c.providerName.toLowerCase().includes(target));
+            }
         }
+        const targetConn = connections[0] || null;
+        const isActive = targetConn
+            ? targetConn.status === "active"
+            : connections.some((c) => c.status === "active");
         return {
+            ok: true,
             workspaceId: ctx.workspace.id,
             instantWalletStatus: "active",
+            connected: isActive,
+            ready: isActive,
+            timedOut: false,
+            status: targetConn?.status || "not_connected",
+            redirectUrl: isActive ? null : targetConn?.redirectUrl || null,
+            connection: targetConn,
             connections,
             summary: {
                 total: connections.length,
@@ -209,11 +295,18 @@ export class MuxoEngine {
             },
         };
     }
+    getHostedSiteHtml(slug, filePath) {
+        return this.stripeProjects.getHostedSiteHtml(slug, filePath);
+    }
     // 6. start_connection
     async startConnection(ctx, params) {
         const rawProvider = params.provider.trim().toLowerCase();
-        const isProjectsLane = params.lane === "stripe_projects" || rawProvider.startsWith("resource.");
-        const cleanSlug = rawProvider.replace(/^(app\.|resource\.)/, "");
+        const cleanSlug = normalizeStripeProjectsProviderSlug(rawProvider) ||
+            rawProvider.replace(/^(app\.|resource\.|projects\.)/, "");
+        const isProjectsLane = params.lane === "stripe_projects" ||
+            rawProvider.startsWith("resource.") ||
+            rawProvider.startsWith("projects.") ||
+            isStripeProjectsExclusiveProvider(cleanSlug);
         if (isProjectsLane) {
             const stripeByok = this.store.getByokKey(ctx.workspace.id, "stripe");
             const linked = await this.stripeProjects.linkProvider(cleanSlug, stripeByok);
@@ -258,10 +351,9 @@ export class MuxoEngine {
     }
     // 6b. wait_for_connection (OAuth handoff polling & recovery, like COMPOSIO_WAIT_FOR_CONNECTIONS)
     async waitForConnection(ctx, params) {
-        const cleanSlug = params.provider
-            .trim()
-            .toLowerCase()
-            .replace(/^(app\.|resource\.)/, "");
+        const rawProvider = params.provider.trim().toLowerCase();
+        const cleanSlug = normalizeStripeProjectsProviderSlug(rawProvider) ||
+            rawProvider.replace(/^(app\.|resource\.|projects\.)/, "");
         if (!cleanSlug) {
             throw new Error("provider is required to wait for a connection (e.g. 'github').");
         }
@@ -283,6 +375,22 @@ export class MuxoEngine {
             elapsedMs: Date.now() - startedAt,
             message,
         });
+        if (isStripeProjectsExclusiveProvider(cleanSlug)) {
+            const activeRecord = this.store.upsertConnection({
+                workspaceId: ctx.workspace.id,
+                lane: "stripe_projects",
+                providerSlug: cleanSlug,
+                providerName: cleanSlug.charAt(0).toUpperCase() + cleanSlug.slice(1),
+                status: "active",
+                externalAccountId: `sp_conn_${cleanSlug}`,
+                redirectUrl: null,
+                metadata: {
+                    managedBy: "stripe_projects",
+                    requiresOAuth: false,
+                },
+            });
+            return connectedResult(activeRecord, `${activeRecord.providerName} is managed via Stripe Projects Cloud Infrastructure and is active immediately (no OAuth required).`);
+        }
         let current = this.store
             .listConnections(ctx.workspace.id)
             .find((c) => c.providerSlug.toLowerCase() === cleanSlug);
@@ -341,6 +449,16 @@ export class MuxoEngine {
         if (!current) {
             current = await this.startConnection(ctx, { provider: cleanSlug });
         }
+        else if (current.redirectUrl) {
+            current = {
+                ...current,
+                redirectUrl: wrapMuxoConnectUrl(current.redirectUrl, this.config.baseUrl, {
+                    workspaceId: ctx.workspace.id,
+                    providerSlug: cleanSlug,
+                    externalAccountId: current.externalAccountId,
+                }),
+            };
+        }
         return {
             ok: true,
             connected: false,
@@ -527,14 +645,21 @@ export class MuxoEngine {
                     // Keep existing connection state if offline
                 }
                 if (!existingConn || existingConn.status !== "active") {
+                    const wrappedRedirectUrl = existingConn?.redirectUrl
+                        ? wrapMuxoConnectUrl(existingConn.redirectUrl, this.config.baseUrl, {
+                            workspaceId: ws.id,
+                            providerSlug: tool.providerSlug,
+                            externalAccountId: existingConn.externalAccountId,
+                        })
+                        : null;
                     authHandoff = {
                         required: true,
                         provider: tool.providerSlug,
                         status: existingConn?.status || "pending",
-                        redirectUrl: existingConn?.redirectUrl || null,
+                        redirectUrl: wrappedRedirectUrl,
                         externalAccountId: existingConn?.externalAccountId || null,
-                        instructions: existingConn?.redirectUrl
-                            ? `Ask the user to authorize ${tool.providerName} at ${existingConn.redirectUrl}, then call wait_for_connection({ provider: "${tool.providerSlug}" }) before executing ${plan.id}.`
+                        instructions: wrappedRedirectUrl
+                            ? `Ask the user to authorize ${tool.providerName} at ${wrappedRedirectUrl}, then call wait_for_connection({ provider: "${tool.providerSlug}" }) before executing ${plan.id}.`
                             : `Call start_connection({ provider: "${tool.providerSlug}" }) to authorize ${tool.providerName} before executing ${plan.id}.`,
                     };
                 }
@@ -606,25 +731,15 @@ export class MuxoEngine {
         });
     }
     buildApprovalHandoff(plan) {
-        const url = `${this.config.baseUrl}/approve/${encodeURIComponent(plan.id)}`;
-        return {
-            kind: "approval",
-            url,
-            ctaLabel: "Review & approve",
-            headline: `Muxo needs your approval to run ${plan.toolSlug}`,
-            instructions: `Open ${url} to review and approve this ${plan.riskLevel}-risk action with one click (or run \`muxo approve ${plan.id}\`). Nothing runs until you approve.`,
-            planId: plan.id,
-        };
+        return buildApprovalHumanHandoff(this.config.baseUrl, plan);
     }
     buildOAuthHandoff(handoff, providerName) {
-        return {
-            kind: "oauth",
-            url: handoff.redirectUrl,
-            ctaLabel: `Connect ${providerName}`,
-            headline: `Connect ${providerName} to continue`,
+        return buildOAuthHumanHandoff({
+            providerSlug: handoff.provider,
+            providerName,
+            redirectUrl: handoff.redirectUrl,
             instructions: handoff.instructions,
-            provider: handoff.provider,
-        };
+        });
     }
     buildPlanLlmGuidance(plan, authHandoff) {
         const executeTool = `execute_${plan.riskLevel}`;
@@ -767,6 +882,7 @@ export class MuxoEngine {
         }
         const enriched = {
             ...ctx,
+            enabled: true,
             staticFacts,
             dynamicContext,
             recalledMemories: recalled,
@@ -833,6 +949,13 @@ export class MuxoEngine {
             technical: contextTechnical,
             policy: ws.policy,
         });
+        const llmPolicyBrief = buildLlmPolicyAndGovernanceBrief(ws.policy, {
+            workspaceName: ws.name,
+            workspaceSlug: ws.slug,
+            activeDefaults: memoryContext.activeDefaults || {},
+            trustScore: { overall: trustScore.overall, tier: trustScore.tier },
+            agentDid: governanceStatus.agentDid,
+        });
         const llmSystemPrompt = [
             `# Muxo Governed Workspace Context (${ws.name} / ${ws.slug})`,
             `- **Language Preference**: ${ws.policy.languageMode || "hybrid"}${ws.policy.customInstructions?.length ? ` (Custom Instructions: ${ws.policy.customInstructions.join("; ")})` : ""}`,
@@ -840,6 +963,7 @@ export class MuxoEngine {
             `- **Learned Memory Defaults (Auto-Fill)**: ${defaultsList.length > 0 ? defaultsList.join(", ") : "none"}`,
             `- **Credits & Quota**: ${ws.creditsBalance} credits ($${(ws.creditsBalance * 0.01).toFixed(2)}) available, ${actionsRemaining} monthly actions remaining`,
             `- **Active Cloud Resources**: ${activeResources.length > 0 ? activeResources.map((r) => `${r.resourceName} (${r.serviceSlug})`).join(", ") : "none"}`,
+            llmPolicyBrief.llmSystemDirective,
             memoryContext.formattedPromptContext,
         ].join("\n");
         return {
@@ -848,6 +972,7 @@ export class MuxoEngine {
             projectsEnvironment: ws.projectsEnvName,
             policy: ws.policy,
             plainEnglishPolicy,
+            llmPolicyBrief,
             languageMode: ws.policy.languageMode || "hybrid",
             customInstructions: ws.policy.customInstructions || [],
             activeDefaults: (memoryContext.activeDefaults ||
@@ -1006,18 +1131,25 @@ export class MuxoEngine {
     }
     /**
      * Synthesizes a Bi-Temporal Knowledge Graph (entities, active relationships, superseded historical relationships,
-     * Mermaid diagram, and human + technical explanations) directly from SQLite temporal_facts, memories, resources, and connections.
+     * Mermaid diagram, point-in-time `asOf` time-travel, 2-hop BFS subgraph, and human + technical explanations)
+     * directly from SQLite temporal_facts, memories, resources, and connections.
      */
-    async getMemoryGraph(ctx, query) {
+    async getMemoryGraph(ctx, queryOrOptions) {
         const ws = this.store.getWorkspace(ctx.workspace.id);
-        const overview = await this.getMemoryOverview(ctx, query);
+        const opts = typeof queryOrOptions === "string"
+            ? { query: queryOrOptions }
+            : queryOrOptions || {};
+        const overview = await this.getMemoryOverview(ctx, opts.query);
         return buildMemoryKnowledgeGraph({
             workspace: ws,
             namespace: overview.namespace,
-            query,
+            query: opts.query,
+            asOf: opts.asOf || null,
+            focalEntity: opts.focalEntity || null,
+            maxHops: opts.maxHops,
             facts: this.store.listTemporalFacts(ws.id, {
                 includeHistorical: true,
-                query,
+                query: opts.query,
                 limit: 100,
             }),
             resources: this.store.listResources(ws.id),
@@ -1060,7 +1192,10 @@ export class MuxoEngine {
     // 10-15. execute_<risk_level>
     async executePlanForRisk(ctx, planId, expectedRisk) {
         const plan = this.getPlan(ctx, planId);
-        if (plan.riskLevel !== expectedRisk) {
+        const isProjectsWriteCompatible = plan.lane === "stripe_projects" &&
+            plan.riskLevel === "provisioning" &&
+            expectedRisk === "write";
+        if (plan.riskLevel !== expectedRisk && !isProjectsWriteCompatible) {
             throw new Error(`Risk lane mismatch: Plan '${plan.id}' has risk level '${plan.riskLevel}', so it must be executed with 'execute_${plan.riskLevel}' instead of 'execute_${expectedRisk}'.`);
         }
         if (plan.runId) {
@@ -1107,7 +1242,16 @@ export class MuxoEngine {
         }
         let activeConnId = null;
         if (plan.lane === "composio_sdk" && tool.requiresAuth) {
-            let connections = this.store.listConnections(ctx.workspace.id);
+            let connections = this.store.listConnections(ctx.workspace.id).map((c) => c.lane === "composio_sdk" && c.redirectUrl
+                ? {
+                    ...c,
+                    redirectUrl: wrapMuxoConnectUrl(c.redirectUrl, this.config.baseUrl, {
+                        workspaceId: c.workspaceId,
+                        providerSlug: c.providerSlug,
+                        externalAccountId: c.externalAccountId,
+                    }),
+                }
+                : c);
             let activeConn = connections.find((c) => c.lane === "composio_sdk" &&
                 c.providerSlug === tool.providerSlug &&
                 c.status === "active");
@@ -1581,6 +1725,22 @@ export class MuxoEngine {
         const governance = this.governance.getStatus(ws);
         const trustScore = this.governance.getWorkspaceTrustScore(ws.id);
         const plainEnglish = describePolicyInPlainEnglish(ws.policy);
+        const localMemories = this.store.listMemoryRecords(ws.id, 25);
+        const activeFacts = this.store.listTemporalFacts(ws.id, {
+            includeHistorical: false,
+            limit: 30,
+        });
+        const inferred = extractActiveMemoryDefaults({
+            memories: localMemories,
+            temporalFacts: activeFacts,
+        });
+        const llmPolicyBrief = buildLlmPolicyAndGovernanceBrief(ws.policy, {
+            workspaceName: ws.name,
+            workspaceSlug: ws.slug,
+            activeDefaults: inferred.activeDefaults,
+            trustScore: { overall: trustScore.overall, tier: trustScore.tier },
+            agentDid: governance.agentDid,
+        });
         const killSwitch = {
             active: Boolean(ws.policy.killSwitchActive),
             reason: ws.policy.killSwitchReason || null,
@@ -1603,9 +1763,70 @@ export class MuxoEngine {
             trustScore,
             policy: ws.policy,
             plainEnglish,
+            llmPolicyBrief,
             explanation,
         };
     }
+    resetWorkspaceGuardrails(ctx) {
+        const ws = this.store.getWorkspace(ctx.workspace.id);
+        const updated = this.store.updateWorkspacePolicy(ws.id, {
+            ...DEFAULT_WORKSPACE_POLICY,
+            parameterRules: [],
+            customInstructions: [],
+            naturalLanguageRules: [],
+            blockedToolSlugs: [],
+        });
+        this.governance.resumeKillSwitch(ws.id);
+        const plainEnglish = describePolicyInPlainEnglish(updated.policy);
+        const llmPolicyBrief = buildLlmPolicyAndGovernanceBrief(updated.policy, {
+            workspaceName: updated.name,
+            workspaceSlug: updated.slug,
+        });
+        return {
+            ok: true,
+            action: "reset_guardrails",
+            workspace: updated,
+            policy: updated.policy,
+            plainEnglish,
+            llmPolicyBrief,
+            explanation: plainEnglish.explanation,
+        };
+    }
+    async checkToolPolicy(ctx, params) {
+        const ws = this.store.getWorkspace(ctx.workspace.id);
+        const localMemories = this.store.listMemoryRecords(ws.id, 25);
+        const activeFacts = this.store.listTemporalFacts(ws.id, {
+            includeHistorical: false,
+            limit: 30,
+        });
+        const inferred = extractActiveMemoryDefaults({
+            memories: localMemories,
+            temporalFacts: activeFacts,
+        });
+        let riskLevel;
+        let creditCost;
+        let lane;
+        let resolvedSlug = String(params.toolSlug || "instant.web.search").trim();
+        try {
+            const tool = await this.inspectTool(resolvedSlug);
+            resolvedSlug = tool.slug;
+            riskLevel = tool.riskLevel;
+            creditCost = tool.creditCost;
+            lane = tool.lane;
+        }
+        catch {
+            // Fallback to slug prefix heuristics in simulatePolicyEvaluation
+        }
+        return simulatePolicyEvaluation({
+            policy: ws.policy,
+            toolSlug: resolvedSlug,
+            riskLevel,
+            creditCost,
+            lane,
+            input: params.input || {},
+            activeDefaults: inferred.activeDefaults,
+        });
+    }
     setKillSwitch(ctx, active, reason) {
         const ws = this.store.getWorkspace(ctx.workspace.id);
         const updated = this.store.updateWorkspacePolicy(ws.id, {
@@ -1656,10 +1877,16 @@ export class MuxoEngine {
             memories: localMemories,
             temporalFacts: activeFacts,
         });
+        const llmPolicyBrief = buildLlmPolicyAndGovernanceBrief(ws.policy, {
+            workspaceName: ws.name,
+            workspaceSlug: ws.slug,
+            activeDefaults: inferred.activeDefaults,
+        });
         return {
             workspaceId: ws.id,
             policy: ws.policy,
             plainEnglish,
+            llmPolicyBrief,
             activeDefaults: inferred.activeDefaults,
             activeGuardrails: Array.from(new Set([
                 ...(ws.policy.naturalLanguageRules || []),
@@ -1701,11 +1928,16 @@ export class MuxoEngine {
             // Non-blocking if memory scan/storage fails
         }
         const plainEnglish = describePolicyInPlainEnglish(updated.policy);
+        const llmPolicyBrief = buildLlmPolicyAndGovernanceBrief(updated.policy, {
+            workspaceName: updated.name,
+            workspaceSlug: updated.slug,
+        });
         return {
             ok: true,
             workspace: updated,
             guardrail: parsed,
             plainEnglish,
+            llmPolicyBrief,
             memoryRecord,
         };
     }
@@ -2249,6 +2481,139 @@ export class MuxoEngine {
     listDurableWorkflows(workspaceId) {
         return Array.from(this.durableWorkflows.values()).filter((w) => w.workspaceId === workspaceId);
     }
+    getDurableWorkflow(ctx, workflowId) {
+        const wf = this.durableWorkflows.get(workflowId);
+        if (!wf || wf.workspaceId !== ctx.workspace.id) {
+            throw workflowNotFoundError(workflowId);
+        }
+        return wf;
+    }
+    getDurableWorkflowHistory(ctx, workflowId) {
+        const wf = this.getDurableWorkflow(ctx, workflowId);
+        return exportTemporalEventHistory(wf);
+    }
+    signalDurableWorkflow(ctx, workflowId, params) {
+        const wf = this.getDurableWorkflow(ctx, workflowId);
+        return sendSignalToWorkflow(wf, params);
+    }
+    rollbackDurableWorkflow(ctx, workflowId, params) {
+        const wf = this.getDurableWorkflow(ctx, workflowId);
+        return runSagaRollbackOnWorkflow(wf, params);
+    }
+    /**
+     * AWS Cedar & Open Policy Agent (OPA / Rego) Policy-as-Code Compiler & Evaluator.
+     */
+    getPolicyAsCodeBundle(ctx) {
+        const ws = this.store.getWorkspace(ctx.workspace.id);
+        return compileWorkspacePolicyToCedarAndRego(ws.policy, ws);
+    }
+    async evaluatePolicyAsCode(ctx, params) {
+        const ws = this.store.getWorkspace(ctx.workspace.id);
+        let resolvedSlug = String(params.toolSlug || "instant.web.search").trim();
+        let riskLevel = params.riskLevel;
+        let creditCost = params.creditCost;
+        let lane = params.lane;
+        try {
+            const tool = await this.inspectTool(resolvedSlug);
+            resolvedSlug = tool.slug;
+            if (!riskLevel)
+                riskLevel = tool.riskLevel;
+            if (typeof creditCost !== "number")
+                creditCost = tool.creditCost;
+            if (!lane)
+                lane = tool.lane;
+        }
+        catch {
+            // Fall back to slug prefix heuristics
+        }
+        return evaluateCedarAndOpaPolicy({
+            policy: ws.policy,
+            workspace: ws,
+            toolSlug: resolvedSlug,
+            input: params.input || {},
+            riskLevel,
+            creditCost,
+            lane,
+        });
+    }
+    /**
+     * OpenTelemetry (OTel GenAI / MCP Semantic Conventions) & Langfuse Trace Exporter.
+     */
+    exportOtelTraces(ctx, limit = 25) {
+        const ws = this.store.getWorkspace(ctx.workspace.id);
+        const runs = this.store.listRuns(ws.id, limit);
+        const receipts = this.store.listReceipts(ws.id, limit);
+        const plans = this.store.listPlans(ws.id, limit);
+        return buildOtelTraceExport({
+            workspace: ws,
+            runs,
+            receipts,
+            plans,
+        });
+    }
+    /**
+     * Turnkey Commercial Business Saga Playbooks.
+     */
+    listCommercialPlaybooks() {
+        return MUXO_COMMERCIAL_PLAYBOOKS;
+    }
+    runCommercialPlaybook(ctx, params) {
+        const ws = this.store.getWorkspace(ctx.workspace.id);
+        const playbook = getCommercialPlaybook(params.slug);
+        if (!playbook) {
+            const err = new Error(`Unknown commercial playbook '${params.slug}'. Available playbooks: ${MUXO_COMMERCIAL_PLAYBOOKS.map((p) => p.slug).join(", ")}`);
+            err.statusCode = 404;
+            err.code = "PLAYBOOK_NOT_FOUND";
+            throw err;
+        }
+        const wfId = `wf_saga_${Date.now()}_${crypto.randomBytes(4).toString("hex")}`;
+        const executed = buildPlaybookSagaExecution({
+            id: wfId,
+            workspaceId: ws.id,
+            workspaceSlug: ws.slug,
+            playbook,
+            input: params.input || {},
+        });
+        this.durableWorkflows.set(wfId, executed.workflow);
+        const savedFact = this.store.upsertTemporalFact({
+            workspaceId: ws.id,
+            subject: executed.temporalFact.subject,
+            predicate: executed.temporalFact.predicate,
+            object: executed.temporalFact.object,
+            summary: executed.temporalFact.summary,
+            confidence: 0.99,
+            sourceKind: "execution_outcome",
+            sourceReferenceId: executed.temporalFact.episodeId,
+        });
+        return {
+            ok: true,
+            playbook: executed.playbook,
+            workflow: executed.workflow,
+            temporalFact: savedFact,
+        };
+    }
+    /**
+     * FinOps & Commercial ROI Unit-Economics Analytics.
+     */
+    getCommercialRoiReport(ctx) {
+        const ws = this.store.getWorkspace(ctx.workspace.id);
+        const runs = this.store.listRuns(ws.id, 100);
+        const plans = this.store.listPlans(ws.id, 100);
+        const resources = this.store.listResources(ws.id);
+        const byokKeys = this.store.listByokKeys(ws.id);
+        const temporalFacts = this.store.listTemporalFacts(ws.id, {
+            includeHistorical: false,
+            limit: 100,
+        });
+        return buildCommercialRoiReport({
+            workspace: ws,
+            runs,
+            plans,
+            resources,
+            byokKeys,
+            temporalFacts,
+        });
+    }
     /**
      * Hybrid Semantic Vector + Bi-Temporal Recall (`@cf/baai/bge-base-en-v1.5` + Vectorize model).
      */

package/dist/index.d.ts

@@ -1,6 +1,9 @@
 export { getConfig, ROOT_DIR, type MuxoConfig } from "./config.js";
+export * from "./durable-workflow.js";
 export { MuxoEngine, type ExecutionContext } from "./engine.js";
 export { handleJsonRpcMcpRequest, MUXO_MCP_TOOLS, type McpToolDefinition } from "./mcp.js";
+export * from "./memory-graph.js";
+export * from "./oss-suite.js";
 export { MuxoClient, type MuxoClientOptions } from "./sdk.js";
 export { createMuxoServer } from "./server.js";
 export { MuxoStore } from "./store.js";