@muxoai/sdk 1.2.2 → 1.3.0

package/dist/server.js

@@ -0,0 +1,1277 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import http from "node:http";
+import path from "node:path";
+import { getConfig, ROOT_DIR } from "./config.js";
+import { MuxoEngine } from "./engine.js";
+import { getMuxoMcpSkills, handleJsonRpcMcpRequest, MUXO_MCP_SERVER_INSTRUCTIONS, MUXO_MCP_TOOLS, } from "./mcp.js";
+import { MuxoStore } from "./store.js";
+import { renderConsoleHtml, renderLandingHtml } from "./ui/console-html.js";
+function renderSkillMarkdown(baseUrl) {
+    return `---
+name: muxo
+description: Discover, plan, and execute governed actions across Connected Apps (Composio SDK), Instant Tools (Composio Instant), Cloud Infrastructure (Stripe Projects), Contextual Memory (Supermemory v5), and Cryptographic Governance (Microsoft Agent Governance Toolkit) through Muxo.
+---
+
+# Muxo — Unified Agent Execution, Infrastructure, Memory & Governance Platform
+
+Muxo provides one governed interface over 4 pillars so agents and customers only ever interact with Muxo:
+
+1. **Instant Tools (\`instant.*\`)**: Zero-OAuth tools powered by Composio Instant (\`instant.web.search\`, \`instant.web.scrape\`, \`instant.hackernews.top_stories\`, \`instant.github.repo_intel\`, \`instant.dns.lookup\`).
+2. **Connected Apps (\`app.*\`)**: Managed OAuth SaaS integrations powered by Composio SDK (\`app.github.*\`, \`app.gmail.*\`, \`app.slack.*\`, \`app.notion.*\`, \`app.linear.*\`, etc.).
+3. **Cloud Infrastructure (\`resource.*\`)**: Database, cache, storage, and hosting provisioning powered by Stripe Projects (\`resource.neon.*\`, \`resource.supabase.*\`, \`resource.turso.*\`, \`resource.cloudflare.*\`, \`resource.vercel.*\`, etc.) with AES-256-GCM secret custody in Muxo Vault.
+4. **Supermemory v5 Brain & Microsoft Agent Governance**: Every \`plan_action\` recalls isolated workspace context (\`/ns/muxo-v5-<hash>\`) and runs \`Agent ──► McpSecurityScanner ──► PolicyEngine ──► AgentIdentity (Ed25519 DID) ──► AuditLogger ──► DecisionRecord\`.
+
+## Installable Muxo Plugin (OpenAI Codex, ChatGPT, Claude Code & Factory Droid)
+
+\`\`\`bash
+# Install Muxo CLI & sign in (or auto-provision an isolated external workspace)
+npm install -g muxo-platform
+muxo login --signup --name "my-agent"
+
+# Link OAuth apps with live browser handoff + polling recovery
+muxo link github --wait
+
+# Plugin manifests served by this instance:
+# - ${baseUrl}/.agents/plugins/marketplace.json (OpenAI Codex / ChatGPT)
+# - ${baseUrl}/.claude-plugin/marketplace.json (Claude Code / Factory Droid)
+# - ${baseUrl}/api/v1/plugin
+\`\`\`
+
+## Autonomous Agent 2-Call Signup (Zero Browser Required)
+
+\`\`\`bash
+# 1. Create an autonomous workspace + mk_live_* API key
+curl -sX POST ${baseUrl}/api/v1/agents/signup \\
+  -H "Content-Type: application/json" \\
+  -d '{"agentName":"MyAgent","harness":"claude-code"}'
+
+# 2. (Optional) Generate a human owner claim link
+curl -sX POST ${baseUrl}/api/v1/agents/claim \\
+  -H "Authorization: Bearer <mk_live_key>" \\
+  -H "Content-Type: application/json" \\
+  -d '{"email":"founder@company.com"}'
+\`\`\`
+
+## Endpoint & Authentication
+
+- **MCP Endpoint (Streamable HTTP)**: \`${baseUrl}/mcp\`
+- **OAuth Callback Handoff**: \`${baseUrl}/oauth/callback\`
+- **REST API Base**: \`${baseUrl}/api/v1\`
+- **Marketing & Provider Canvas (muxo.ai)**: \`${baseUrl}/landing\`
+- **Documentation (docs.muxo.ai)**: \`https://docs.muxo.ai\`
+- **Authorization Header**: \`Authorization: Bearer mk_live_<your_key>\`
+
+## 19 Canonical MCP Operations
+
+${MUXO_MCP_TOOLS.map((t, i) => `${i + 1}. \`${t.name}\` — ${t.description}`).join("\n")}
+
+## Standard Execution & OAuth Handoff Workflow
+
+1. **Discover**: Call \`search_tools\` with a keyword or lane filter.
+2. **Inspect**: Call \`inspect_tool\` to read the tool's \`inputSchema\`, \`riskLevel\`, and \`creditCost\`.
+3. **Plan**: Call \`plan_action({ tool_slug, input, reason })\` to receive a \`plan_*\` ID.
+   - If the tool is an unconnected \`app.<provider>.*\` action, \`plan_action\` automatically attaches \`authHandoff.redirectUrl\`. Show that URL to the user, then call \`wait_for_connection({ provider })\` until \`status === "active"\`.
+4. **Execute**: Call the matching risk lane tool (\`execute_read\`, \`execute_write\`, \`execute_admin\`, \`execute_financial\`, \`execute_provisioning\`, or \`execute_destructive\`) with \`{ plan_id }\`.
+5. **Verify Receipt**: Every run issues an HMAC-SHA256 chained cryptographic receipt (\`rcpt_*\`) verifiable via \`get_receipt\`.
+`;
+}
+async function readBody(req) {
+    const chunks = [];
+    for await (const chunk of req) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+function sendJson(res, status, payload, extraHeaders) {
+    const body = JSON.stringify(payload, null, 2);
+    res.writeHead(status, {
+        "Content-Type": "application/json; charset=utf-8",
+        "Access-Control-Allow-Origin": "*",
+        "Access-Control-Allow-Headers": "Content-Type, Authorization, Mcp-Session-Id",
+        "Access-Control-Expose-Headers": "Mcp-Session-Id, WWW-Authenticate",
+        "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+        ...(extraHeaders || {}),
+    });
+    res.end(body);
+}
+export function createMuxoServer(customConfig) {
+    const config = { ...getConfig(), ...customConfig };
+    const store = new MuxoStore(config.dbPath, config.vaultMasterKey);
+    const engine = new MuxoEngine(config, store);
+    const bootstrap = store.ensureDefaultWorkspace();
+    // OAuth 2.1 DCR + PKCE Authorization Code store for OpenAI Plugin / MCP clients
+    const oauthClients = new Map();
+    oauthClients.set("muxo-openai-plugin", {
+        client_id: "muxo-openai-plugin",
+        client_name: "Muxo Official OpenAI Plugin",
+        redirect_uris: [
+            "https://chatgpt.com/connector_platform_oauth_redirect",
+            "https://platform.openai.com/apps-manage/oauth",
+            "http://127.0.0.1:3118/oauth/callback",
+            "http://localhost:3118/oauth/callback",
+        ],
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        token_endpoint_auth_method: "none",
+        client_id_issued_at: Math.floor(Date.now() / 1000),
+    });
+    const oauthCodes = new Map();
+    const resolveContext = (req) => {
+        const authHeader = String(req.headers.authorization || "").trim();
+        if (authHeader.toLowerCase().startsWith("bearer ")) {
+            const token = authHeader.slice(7).trim();
+            const resolved = store.resolveAuthToken(token);
+            if (resolved)
+                return resolved;
+        }
+        // Default local console session fallback to the primary workspace
+        const ws = store.getWorkspace(bootstrap.workspace.id);
+        const user = store.getUser(ws.ownerUserId);
+        return {
+            user,
+            workspace: ws,
+            actorId: user.id,
+            authType: "session",
+        };
+    };
+    const server = http.createServer(async (req, res) => {
+        if (req.method === "OPTIONS") {
+            res.writeHead(204, {
+                "Access-Control-Allow-Origin": "*",
+                "Access-Control-Allow-Headers": "Content-Type, Authorization",
+                "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+            });
+            res.end();
+            return;
+        }
+        const url = new URL(req.url || "/", config.baseUrl);
+        const pathname = url.pathname;
+        try {
+            // Public Discovery & Health Endpoints
+            if (pathname === "/health" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    status: "ready",
+                    service: "muxo-platform",
+                    version: "1.3.0",
+                    environment: "production",
+                    live_execution: true,
+                    customer_billing: true,
+                    supplier_spending: true,
+                    fundingMode: "muxo_funded",
+                    lanes: {
+                        composio_sdk: Boolean(config.composioApiKey),
+                        composio_instant: true,
+                        stripe_projects: true,
+                        stripe_billing: Boolean(config.stripeSecretKey),
+                        supermemory_v5: engine.supermemory.isEnabled(),
+                        microsoft_governance: true,
+                    },
+                    billing: {
+                        subscriptions: "configured",
+                        prepaid: "configured",
+                        resources: "configured",
+                        merchantOfRecord: "muxo_pays_suppliers",
+                    },
+                    surfaces: {
+                        consoleUrl: `${config.baseUrl}/`,
+                        landingUrl: `${config.baseUrl}/landing`,
+                        publicWebUrl: config.publicWebUrl,
+                        docsUrl: config.docsUrl,
+                    },
+                    mcpToolsCount: MUXO_MCP_TOOLS.length,
+                });
+                return;
+            }
+            if ((pathname === "/.well-known/oauth-protected-resource" ||
+                pathname === "/.well-known/oauth-protected-resource/mcp") &&
+                req.method === "GET") {
+                const proto = String(req.headers["x-forwarded-proto"] || "http").split(",")[0].trim();
+                const requestOrigin = req.headers.host
+                    ? `${proto}://${req.headers.host}`
+                    : config.baseUrl;
+                const resource = pathname === "/.well-known/oauth-protected-resource/mcp"
+                    ? `${requestOrigin}/mcp`
+                    : requestOrigin;
+                sendJson(res, 200, {
+                    resource,
+                    authorization_servers: [requestOrigin],
+                    bearer_methods_supported: ["header"],
+                    scopes_supported: ["muxo:mcp", "muxo:read", "muxo:execute", "muxo:provision"],
+                    resource_documentation: `${config.docsUrl}/quickstart`,
+                    mcp_endpoint: `${requestOrigin}/mcp`,
+                });
+                return;
+            }
+            if ((pathname === "/.well-known/oauth-authorization-server" ||
+                pathname === "/.well-known/openid-configuration" ||
+                pathname === "/.well-known/oauth-authorization-server/mcp") &&
+                req.method === "GET") {
+                const proto = String(req.headers["x-forwarded-proto"] || "http").split(",")[0].trim();
+                const requestOrigin = req.headers.host
+                    ? `${proto}://${req.headers.host}`
+                    : config.baseUrl;
+                sendJson(res, 200, {
+                    issuer: requestOrigin,
+                    authorization_endpoint: `${requestOrigin}/oauth/authorize`,
+                    token_endpoint: `${requestOrigin}/oauth/token`,
+                    registration_endpoint: `${requestOrigin}/oauth/register`,
+                    userinfo_endpoint: `${requestOrigin}/oauth/userinfo`,
+                    jwks_uri: `${requestOrigin}/.well-known/jwks.json`,
+                    scopes_supported: [
+                        "muxo:mcp",
+                        "muxo:read",
+                        "muxo:execute",
+                        "muxo:provision",
+                        "openid",
+                        "profile",
+                        "email",
+                    ],
+                    response_types_supported: ["code"],
+                    grant_types_supported: [
+                        "authorization_code",
+                        "refresh_token",
+                        "client_credentials",
+                    ],
+                    token_endpoint_auth_methods_supported: [
+                        "none",
+                        "client_secret_post",
+                        "client_secret_basic",
+                    ],
+                    code_challenge_methods_supported: ["S256", "plain"],
+                    client_id_metadata_document_supported: true,
+                    service_documentation: `${config.docsUrl}/quickstart`,
+                });
+                return;
+            }
+            if (pathname === "/oauth/register" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const clientId = typeof body.client_id === "string" && body.client_id.trim()
+                    ? body.client_id.trim()
+                    : `muxo_client_${crypto.randomBytes(8).toString("hex")}`;
+                const clientRecord = {
+                    client_id: clientId,
+                    client_name: String(body.client_name || "OpenAI Plugin MCP Client"),
+                    redirect_uris: Array.isArray(body.redirect_uris)
+                        ? body.redirect_uris.map(String)
+                        : [
+                            "https://chatgpt.com/connector_platform_oauth_redirect",
+                            "http://127.0.0.1:3118/oauth/callback",
+                        ],
+                    grant_types: Array.isArray(body.grant_types)
+                        ? body.grant_types.map(String)
+                        : ["authorization_code", "refresh_token"],
+                    response_types: Array.isArray(body.response_types)
+                        ? body.response_types.map(String)
+                        : ["code"],
+                    token_endpoint_auth_method: String(body.token_endpoint_auth_method || "none"),
+                    client_id_issued_at: Math.floor(Date.now() / 1000),
+                };
+                oauthClients.set(clientId, clientRecord);
+                sendJson(res, 201, clientRecord);
+                return;
+            }
+            if (pathname === "/oauth/authorize" &&
+                (req.method === "GET" || req.method === "POST")) {
+                const bodyParams = req.method === "POST"
+                    ? new URLSearchParams(await readBody(req))
+                    : url.searchParams;
+                const clientId = bodyParams.get("client_id") ||
+                    url.searchParams.get("client_id") ||
+                    "muxo-openai-plugin";
+                const redirectUri = bodyParams.get("redirect_uri") ||
+                    url.searchParams.get("redirect_uri") ||
+                    "http://127.0.0.1:3118/oauth/callback";
+                const stateParam = bodyParams.get("state") || url.searchParams.get("state") || "";
+                const scope = bodyParams.get("scope") ||
+                    url.searchParams.get("scope") ||
+                    "muxo:mcp muxo:read muxo:execute muxo:provision";
+                const codeChallenge = bodyParams.get("code_challenge") ||
+                    url.searchParams.get("code_challenge") ||
+                    undefined;
+                const codeChallengeMethod = bodyParams.get("code_challenge_method") ||
+                    url.searchParams.get("code_challenge_method") ||
+                    "S256";
+                const code = `muxo_auth_code_${crypto.randomBytes(16).toString("hex")}`;
+                const issuedKey = bootstrap.defaultApiKey ||
+                    store.createApiKey({
+                        workspaceId: bootstrap.workspace.id,
+                        name: `OAuth Client (${clientId})`,
+                        environment: "live",
+                    }).secretKey;
+                oauthCodes.set(code, {
+                    code,
+                    clientId,
+                    redirectUri,
+                    scope,
+                    codeChallenge,
+                    codeChallengeMethod,
+                    workspaceId: bootstrap.workspace.id,
+                    apiKey: issuedKey,
+                    expiresAt: Date.now() + 10 * 60 * 1000,
+                });
+                const redirectTarget = new URL(redirectUri);
+                redirectTarget.searchParams.set("code", code);
+                if (stateParam)
+                    redirectTarget.searchParams.set("state", stateParam);
+                if (url.searchParams.get("format") === "json" ||
+                    String(req.headers.accept || "").includes("application/json")) {
+                    sendJson(res, 200, {
+                        ok: true,
+                        code,
+                        state: stateParam || null,
+                        client_id: clientId,
+                        redirect_uri: redirectTarget.toString(),
+                    });
+                    return;
+                }
+                res.writeHead(302, {
+                    Location: redirectTarget.toString(),
+                    "Access-Control-Allow-Origin": "*",
+                });
+                res.end();
+                return;
+            }
+            if (pathname === "/oauth/token" && req.method === "POST") {
+                const rawBody = await readBody(req);
+                const contentType = String(req.headers["content-type"] || "");
+                const params = {};
+                if (contentType.includes("application/json")) {
+                    const parsed = JSON.parse(rawBody || "{}");
+                    for (const [k, v] of Object.entries(parsed)) {
+                        if (v !== undefined && v !== null)
+                            params[k] = String(v);
+                    }
+                }
+                else {
+                    const sp = new URLSearchParams(rawBody);
+                    for (const [k, v] of sp.entries()) {
+                        params[k] = v;
+                    }
+                }
+                const grantType = params.grant_type || "authorization_code";
+                const code = params.code || "";
+                const codeVerifier = params.code_verifier || "";
+                let accessToken = bootstrap.defaultApiKey || "";
+                let scope = params.scope || "muxo:mcp muxo:read muxo:execute muxo:provision";
+                if (grantType === "authorization_code" && code) {
+                    const record = oauthCodes.get(code);
+                    if (!record || record.expiresAt < Date.now()) {
+                        sendJson(res, 400, {
+                            error: "invalid_grant",
+                            error_description: "Authorization code is invalid or expired.",
+                        });
+                        return;
+                    }
+                    if (record.codeChallenge) {
+                        if (!codeVerifier) {
+                            sendJson(res, 400, {
+                                error: "invalid_grant",
+                                error_description: "PKCE code_verifier is required.",
+                            });
+                            return;
+                        }
+                        const method = (record.codeChallengeMethod || "S256").toUpperCase();
+                        const computed = method === "S256"
+                            ? crypto
+                                .createHash("sha256")
+                                .update(codeVerifier)
+                                .digest("base64url")
+                            : codeVerifier;
+                        if (computed !== record.codeChallenge) {
+                            sendJson(res, 400, {
+                                error: "invalid_grant",
+                                error_description: "PKCE code_verifier mismatch.",
+                            });
+                            return;
+                        }
+                    }
+                    accessToken = record.apiKey;
+                    scope = record.scope;
+                    oauthCodes.delete(code);
+                }
+                else if (!accessToken) {
+                    accessToken = store.createApiKey({
+                        workspaceId: bootstrap.workspace.id,
+                        name: "OAuth Token Key",
+                        environment: "live",
+                    }).secretKey;
+                }
+                sendJson(res, 200, {
+                    access_token: accessToken,
+                    token_type: "Bearer",
+                    expires_in: 3600,
+                    refresh_token: `muxo_rt_${crypto.randomBytes(16).toString("hex")}`,
+                    scope,
+                });
+                return;
+            }
+            if (pathname === "/oauth/userinfo" && req.method === "GET") {
+                const ctx = resolveContext(req);
+                sendJson(res, 200, {
+                    sub: ctx.user.id,
+                    id: ctx.user.id,
+                    name: ctx.user.name,
+                    email: ctx.user.email,
+                    workspace_id: ctx.workspace.id,
+                    workspace_name: ctx.workspace.name,
+                    tier: ctx.workspace.tier,
+                });
+                return;
+            }
+            if ((pathname === "/api/openapi.json" || pathname === "/openapi.json") &&
+                req.method === "GET") {
+                sendJson(res, 200, {
+                    openapi: "3.1.0",
+                    info: {
+                        title: "Muxo Unified Agent Execution, Infrastructure, Memory & Governance API",
+                        version: "1.3.0",
+                        description: "One governed boundary over Connected Apps (Composio SDK), Instant Tools (Composio Instant), Cloud Infrastructure (Stripe Projects), Supermemory v5 Brain, and Microsoft Agent Governance Toolkit.",
+                    },
+                    servers: [{ url: config.baseUrl }],
+                    paths: {
+                        "/health": { get: { summary: "Platform health & 4-pillar readiness" } },
+                        "/mcp": { post: { summary: "Streamable HTTP MCP JSON-RPC 2.0 endpoint (19 tools)" } },
+                        "/skill.md": { get: { summary: "Canonical agent skill & onboarding markdown" } },
+                        "/api/v1/agents/signup": { post: { summary: "Autonomous 2-call agent workspace & mk_live_* key signup" } },
+                        "/api/v1/agents/claim": { post: { summary: "Generate human owner claim link for an agent workspace" } },
+                        "/api/v1/tools": { get: { summary: "Search unified catalogue across instant.*, app.*, and resource.*" } },
+                        "/api/v1/tools/{slug}": { get: { summary: "Inspect tool schema, risk level, credit cost, and LLM context URL" } },
+                        "/api/v1/connections": {
+                            get: { summary: "List connected OAuth accounts and cloud providers" },
+                            post: { summary: "Start managed OAuth connection handoff" },
+                        },
+                        "/api/v1/connections/wait": { post: { summary: "Wait/poll for browser OAuth handoff completion" } },
+                        "/api/v1/plans": {
+                            get: { summary: "List governed action plans" },
+                            post: { summary: "Create governed action plan with Supermemory recall & Ed25519 signature" },
+                        },
+                        "/api/v1/plans/{planId}/approve": { post: { summary: "Approve a pending high-risk action plan" } },
+                        "/api/v1/plans/{planId}/execute": { post: { summary: "Execute an approved plan and issue HMAC-SHA256 receipt" } },
+                        "/api/v1/resources": { get: { summary: "List provisioned cloud infrastructure resources" } },
+                        "/api/v1/resources/env": { get: { summary: "Pull decrypted AES-256-GCM workspace environment secrets" } },
+                        "/api/v1/memory": {
+                            get: { summary: "Recall isolated Supermemory v5 workspace brain facts" },
+                            post: { summary: "Store a workspace memory fact or decision" },
+                        },
+                        "/api/v1/governance": { get: { summary: "Inspect Microsoft Agent Governance DID, policy, and Merkle audit chain" } },
+                        "/api/v1/billing/topup": { post: { summary: "Purchase Muxo credits (User pays Muxo -> Muxo pays suppliers)" } },
+                        "/api/v1/billing/settlements": { get: { summary: "Inspect Merchant-of-Record supplier settlement ledger" } },
+                    },
+                });
+                return;
+            }
+            if (pathname === "/auth.md" && req.method === "GET") {
+                res.writeHead(200, { "Content-Type": "text/markdown; charset=utf-8" });
+                res.end(`# Muxo Authentication & OAuth Handoff Guide
+
+## 1. CLI & Autonomous Agent Signup
+\`\`\`bash
+muxo login --signup --name "my-agent"
+\`\`\`
+Or via HTTP:
+\`\`\`bash
+curl -sX POST ${config.baseUrl}/api/v1/agents/signup -H "Content-Type: application/json" -d '{"agentName":"my-agent"}'
+\`\`\`
+
+## 2. OAuth Connection Handoff (Composio Plugin Pattern)
+When \`plan_action\` targets an unconnected \`app.<provider>.*\` tool, Muxo returns \`authHandoff.redirectUrl\`.
+Open the URL in a browser, complete OAuth (which redirects to \`${config.baseUrl}/oauth/callback\`), and call \`wait_for_connection({ provider })\` or \`muxo link <provider> --wait\`.
+
+## 3. Merchant-of-Record Credit Settlement
+Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing topup 1000\`), and Muxo settles wholesale supplier costs across Composio and Stripe Projects from Muxo's master accounts (\`fundingMode: "muxo_funded"\`).
+`);
+                return;
+            }
+            if (pathname === "/api/setup" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    status: "ready",
+                    mcpToolsCount: MUXO_MCP_TOOLS.length,
+                    mcpEndpoint: `${config.baseUrl}/mcp`,
+                    skillUrl: `${config.baseUrl}/skill.md`,
+                    openApiUrl: `${config.baseUrl}/api/openapi.json`,
+                    oauthCallbackUrl: `${config.baseUrl}/oauth/callback`,
+                    plugins: {
+                        openaiCodex: `${config.baseUrl}/.agents/plugins/marketplace.json`,
+                        claudeDroid: `${config.baseUrl}/.claude-plugin/marketplace.json`,
+                    },
+                });
+                return;
+            }
+            if ((pathname === "/skill.md" || pathname === "/skills.md") && req.method === "GET") {
+                res.writeHead(200, { "Content-Type": "text/markdown; charset=utf-8" });
+                res.end(renderSkillMarkdown(config.baseUrl));
+                return;
+            }
+            if (pathname === "/llms.txt" && req.method === "GET") {
+                res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
+                res.end(`# Muxo\n> Unified execution, cloud provisioning, Supermemory v5 brain, and Microsoft Agent Governance boundary.\n\n- Skill Document: ${config.baseUrl}/skill.md\n- Auth Guide: ${config.baseUrl}/auth.md\n- OpenAPI 3.1 Spec: ${config.baseUrl}/api/openapi.json\n- MCP Endpoint: ${config.baseUrl}/mcp\n- OAuth Callback Handoff: ${config.baseUrl}/oauth/callback\n- Plugin Marketplace (Codex/OpenAI): ${config.baseUrl}/.agents/plugins/marketplace.json\n- Plugin Marketplace (Claude/Droid): ${config.baseUrl}/.claude-plugin/marketplace.json\n- Console (app.muxo.ai): ${config.baseUrl}/\n- Landing & Provider Canvas (muxo.ai): ${config.baseUrl}/landing\n- Documentation (docs.muxo.ai): ${config.docsUrl}\n`);
+                return;
+            }
+            // Serve Installable Muxo Plugin Manifests & Metadata (Portable OpenAI Agent Plugins + Codex + Claude)
+            const pluginJsonRoutes = {
+                "/.agents/plugins/marketplace.json": path.join(ROOT_DIR, ".agents", "plugins", "marketplace.json"),
+                "/.claude-plugin/marketplace.json": path.join(ROOT_DIR, ".claude-plugin", "marketplace.json"),
+                "/plugins/muxo/plugin.json": path.join(ROOT_DIR, "plugins", "muxo", "plugin.json"),
+                "/plugins/muxo/mcp.json": path.join(ROOT_DIR, "plugins", "muxo", "mcp.json"),
+                "/plugins/muxo/.codex-plugin/plugin.json": path.join(ROOT_DIR, "plugins", "muxo", ".codex-plugin", "plugin.json"),
+                "/plugins/muxo/.claude-plugin/plugin.json": path.join(ROOT_DIR, "plugins", "muxo", ".claude-plugin", "plugin.json"),
+                "/plugins/muxo/.app.json": path.join(ROOT_DIR, "plugins", "muxo", ".app.json"),
+                "/plugins/muxo/.mcp.json": path.join(ROOT_DIR, "plugins", "muxo", ".mcp.json"),
+            };
+            if (pluginJsonRoutes[pathname] && req.method === "GET") {
+                const targetFile = pluginJsonRoutes[pathname];
+                if (fs.existsSync(targetFile)) {
+                    sendJson(res, 200, JSON.parse(fs.readFileSync(targetFile, "utf8")));
+                    return;
+                }
+            }
+            const pluginTextRoutes = {
+                "/plugins/muxo/skills/muxo/SKILL.md": {
+                    file: path.join(ROOT_DIR, "plugins", "muxo", "skills", "muxo", "SKILL.md"),
+                    contentType: "text/markdown; charset=utf-8",
+                },
+                "/plugins/muxo/skills/muxo/references/cli.md": {
+                    file: path.join(ROOT_DIR, "plugins", "muxo", "skills", "muxo", "references", "cli.md"),
+                    contentType: "text/markdown; charset=utf-8",
+                },
+                "/plugins/muxo/skills/muxo/references/mcp.md": {
+                    file: path.join(ROOT_DIR, "plugins", "muxo", "skills", "muxo", "references", "mcp.md"),
+                    contentType: "text/markdown; charset=utf-8",
+                },
+                "/plugins/muxo/skills/setup/SKILL.md": {
+                    file: path.join(ROOT_DIR, "plugins", "muxo", "skills", "setup", "SKILL.md"),
+                    contentType: "text/markdown; charset=utf-8",
+                },
+                "/.codex/config.toml": {
+                    file: path.join(ROOT_DIR, ".codex", "config.toml"),
+                    contentType: "text/plain; charset=utf-8",
+                },
+            };
+            if (pluginTextRoutes[pathname] && req.method === "GET") {
+                const entry = pluginTextRoutes[pathname];
+                if (fs.existsSync(entry.file)) {
+                    res.writeHead(200, {
+                        "Content-Type": entry.contentType,
+                        "Access-Control-Allow-Origin": "*",
+                    });
+                    res.end(fs.readFileSync(entry.file, "utf8"));
+                    return;
+                }
+            }
+            if (pathname === "/api/v1/plugin" && req.method === "GET") {
+                const portableManifest = JSON.parse(fs.readFileSync(path.join(ROOT_DIR, "plugins", "muxo", "plugin.json"), "utf8"));
+                const mcpConfig = JSON.parse(fs.readFileSync(path.join(ROOT_DIR, "plugins", "muxo", "mcp.json"), "utf8"));
+                const codexManifest = JSON.parse(fs.readFileSync(path.join(ROOT_DIR, "plugins", "muxo", ".codex-plugin", "plugin.json"), "utf8"));
+                sendJson(res, 200, {
+                    ok: true,
+                    plugin: portableManifest,
+                    codexPlugin: codexManifest,
+                    mcp: mcpConfig,
+                    skills: getMuxoMcpSkills().map((s) => ({
+                        name: s.name,
+                        description: s.description,
+                        uri: s.uri,
+                        version: s.version,
+                        files: s.files.length,
+                    })),
+                    marketplaces: {
+                        openaiCodex: `${config.baseUrl}/.agents/plugins/marketplace.json`,
+                        claudeDroid: `${config.baseUrl}/.claude-plugin/marketplace.json`,
+                    },
+                    manifests: {
+                        portablePluginJson: `${config.baseUrl}/plugins/muxo/plugin.json`,
+                        portableMcpJson: `${config.baseUrl}/plugins/muxo/mcp.json`,
+                        onboardingSkill: `${config.baseUrl}/plugins/muxo/skills/setup/SKILL.md`,
+                        codexPluginJson: `${config.baseUrl}/plugins/muxo/.codex-plugin/plugin.json`,
+                        codexConfigToml: `${config.baseUrl}/.codex/config.toml`,
+                    },
+                    installCommands: {
+                        codex: "codex plugin add muxo@muxo",
+                        cliSignup: "muxo login --signup --name my-agent",
+                        oauthHandoff: "muxo link github --wait",
+                    },
+                });
+                return;
+            }
+            // Web Console UI (app.muxo.ai)
+            if ((pathname === "/" || pathname === "/console") && req.method === "GET") {
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(renderConsoleHtml());
+                return;
+            }
+            // Built-in Interactive Landing & Provider Canvas (muxo.ai)
+            if (pathname === "/landing" && req.method === "GET") {
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(renderLandingHtml());
+                return;
+            }
+            // Autonomous Agent Claim Redemption Route
+            if (pathname.startsWith("/claim/") && req.method === "GET") {
+                const claimSlug = decodeURIComponent(pathname.slice("/claim/".length));
+                const redeemed = store.redeemAgentClaim(claimSlug);
+                if (!redeemed) {
+                    sendJson(res, 404, { ok: false, error: "Invalid or expired agent claim link" });
+                    return;
+                }
+                const wantsHtml = url.searchParams.get("format") !== "json" &&
+                    String(req.headers.accept || "").includes("text/html");
+                if (wantsHtml) {
+                    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                    res.end(`<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <title>Muxo Agent Workspace Claimed</title>
+  <style>
+    body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; background: #090a0f; color: #f4f4f6; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; }
+    .card { background: #12141f; border: 1px solid #26293d; border-radius: 14px; padding: 32px; max-width: 480px; text-align: center; box-shadow: 0 20px 50px rgba(0,0,0,0.45); }
+    .badge { display: inline-block; background: rgba(45,212,191,0.15); color: #2dd4bf; border: 1px solid rgba(45,212,191,0.35); border-radius: 999px; padding: 4px 12px; font-size: 12px; font-weight: 600; margin-bottom: 16px; }
+    h1 { font-size: 22px; margin: 0 0 10px; }
+    p { color: #a1a7bb; font-size: 14px; line-height: 1.5; margin: 0 0 20px; }
+    code { background: #1c1f30; padding: 3px 7px; border-radius: 6px; color: #e2e8f0; font-size: 12px; }
+    .btn { display: inline-block; background: #ff5a1f; color: #fff; text-decoration: none; padding: 10px 18px; border-radius: 8px; font-size: 14px; font-weight: 600; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="badge">Ownership Bound</div>
+    <h1>Workspace Claimed</h1>
+    <p>Workspace <code>${redeemed.workspace.name}</code> (${redeemed.workspace.id}) claimed by <strong>${redeemed.targetEmail}</strong>.</p>
+    <a class="btn" href="/?claimed=${encodeURIComponent(redeemed.workspace.slug)}">Open Muxo Console →</a>
+  </div>
+</body>
+</html>`);
+                    return;
+                }
+                sendJson(res, 200, {
+                    ok: true,
+                    message: `Workspace '${redeemed.workspace.name}' claimed by ${redeemed.targetEmail}`,
+                    claim: redeemed,
+                });
+                return;
+            }
+            // Browser OAuth Handoff Callback Route (GET /oauth/callback)
+            if (pathname === "/oauth/callback" && req.method === "GET") {
+                const workspaceId = url.searchParams.get("workspace_id") ||
+                    url.searchParams.get("user_id") ||
+                    bootstrap.workspace.id;
+                const provider = url.searchParams.get("provider") ||
+                    url.searchParams.get("toolkit") ||
+                    url.searchParams.get("appName") ||
+                    "unknown";
+                const connectedAccountId = url.searchParams.get("connected_account_id") ||
+                    url.searchParams.get("connectedAccountId") ||
+                    undefined;
+                const callbackStatus = url.searchParams.get("status") || "success";
+                const handoff = await engine.handleOAuthCallback({
+                    workspaceId,
+                    provider,
+                    connectedAccountId,
+                    status: callbackStatus,
+                });
+                const wantsJson = url.searchParams.get("format") === "json" ||
+                    String(req.headers.accept || "").includes("application/json");
+                if (wantsJson) {
+                    sendJson(res, 200, {
+                        ok: true,
+                        handoff,
+                        message: `${handoff.providerName} OAuth handoff completed (${handoff.status}). Return to your agent or terminal.`,
+                    });
+                    return;
+                }
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(`<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <title>Muxo OAuth Handoff Complete</title>
+  <style>
+    body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; background: #090a0f; color: #f4f4f6; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; }
+    .card { background: #12141f; border: 1px solid #26293d; border-radius: 14px; padding: 32px; max-width: 460px; text-align: center; box-shadow: 0 20px 50px rgba(0,0,0,0.45); }
+    .badge { display: inline-block; background: rgba(16,185,129,0.15); color: #34d399; border: 1px solid rgba(16,185,129,0.35); border-radius: 999px; padding: 4px 12px; font-size: 12px; font-weight: 600; margin-bottom: 16px; }
+    h1 { font-size: 22px; margin: 0 0 10px; }
+    p { color: #a1a7bb; font-size: 14px; line-height: 1.5; margin: 0 0 20px; }
+    code { background: #1c1f30; padding: 3px 7px; border-radius: 6px; color: #e2e8f0; font-size: 12px; }
+    .btn { display: inline-block; background: #6366f1; color: #fff; text-decoration: none; padding: 10px 18px; border-radius: 8px; font-size: 14px; font-weight: 600; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="badge">OAuth Handoff Complete (${handoff.status.toUpperCase()})</div>
+    <h1>${handoff.providerName} Connected to Muxo</h1>
+    <p>Workspace <code>${handoff.workspaceId}</code> is now linked${handoff.externalAccountId ? ` (<code>${handoff.externalAccountId}</code>)` : ""}. You can close this window and return to ChatGPT, Codex, Claude Code, Droid, or your terminal.</p>
+    <a class="btn" href="/?connected=${encodeURIComponent(handoff.providerSlug)}">Open Muxo Console</a>
+  </div>
+</body>
+</html>`);
+                return;
+            }
+            // Autonomous Agent 2-Call Signup (agents.composio.dev pattern) — Public
+            if (pathname === "/api/v1/agents/signup" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const created = store.createAutonomousAgentSignup({
+                    agentName: body.agentName ? String(body.agentName) : undefined,
+                    harness: body.harness ? String(body.harness) : undefined,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    agentId: created.user.id,
+                    workspace: {
+                        id: created.workspace.id,
+                        name: created.workspace.name,
+                        slug: created.workspace.slug,
+                        tier: created.workspace.tier,
+                        creditsBalance: created.workspace.creditsBalance,
+                    },
+                    apiKey: created.apiKey,
+                    mcpEndpoint: `${config.baseUrl}/mcp`,
+                    skillUrl: `${config.baseUrl}/skill.md`,
+                    claimEndpoint: `${config.baseUrl}/api/v1/agents/claim`,
+                    governanceDid: engine.governance.getStatus(created.workspace).agentDid,
+                    supermemoryNamespace: engine.supermemory.getWorkspaceNamespace(created.workspace.id),
+                });
+                return;
+            }
+            // Streamable HTTP MCP Endpoint (POST /mcp, GET /mcp, DELETE /mcp)
+            if (pathname === "/mcp" && req.method === "GET") {
+                const accept = String(req.headers.accept || "");
+                const sessionId = String(req.headers["mcp-session-id"] || "") ||
+                    `mcp_sess_${crypto.randomBytes(8).toString("hex")}`;
+                if (accept.includes("text/event-stream")) {
+                    res.writeHead(200, {
+                        "Content-Type": "text/event-stream; charset=utf-8",
+                        "Cache-Control": "no-cache",
+                        Connection: "keep-alive",
+                        "Mcp-Session-Id": sessionId,
+                        "Access-Control-Allow-Origin": "*",
+                    });
+                    res.write(`event: endpoint\ndata: ${JSON.stringify({ uri: `${config.baseUrl}/mcp`, sessionId })}\n\n`);
+                    res.end();
+                    return;
+                }
+                sendJson(res, 200, {
+                    ok: true,
+                    transport: "streamable-http",
+                    protocolVersion: "2025-06-18",
+                    serverInfo: {
+                        name: "muxo-mcp-server",
+                        version: "1.3.0",
+                    },
+                    instructions: MUXO_MCP_SERVER_INSTRUCTIONS,
+                    toolsCount: MUXO_MCP_TOOLS.length,
+                    skillsCount: getMuxoMcpSkills().length,
+                });
+                return;
+            }
+            if (pathname === "/mcp" && req.method === "DELETE") {
+                res.writeHead(204, {
+                    "Access-Control-Allow-Origin": "*",
+                });
+                res.end();
+                return;
+            }
+            if (pathname === "/mcp" && req.method === "POST") {
+                const ctx = resolveContext(req);
+                const sessionId = String(req.headers["mcp-session-id"] || "") ||
+                    `mcp_sess_${ctx.workspace.id}`;
+                const raw = await readBody(req);
+                const parsed = JSON.parse(raw || "{}");
+                if (Array.isArray(parsed)) {
+                    const responses = (await Promise.all(parsed.map((item) => handleJsonRpcMcpRequest(engine, ctx, (item || {}))))).filter((r) => r !== null);
+                    sendJson(res, 200, responses, { "Mcp-Session-Id": sessionId });
+                    return;
+                }
+                const rpc = parsed;
+                const response = await handleJsonRpcMcpRequest(engine, ctx, rpc);
+                if (!response) {
+                    res.writeHead(202, {
+                        "Access-Control-Allow-Origin": "*",
+                        "Mcp-Session-Id": sessionId,
+                    });
+                    res.end();
+                    return;
+                }
+                sendJson(res, 200, response, { "Mcp-Session-Id": sessionId });
+                return;
+            }
+            // Auth Endpoints
+            if (pathname === "/api/v1/auth/register" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const created = store.registerUser({
+                    email: String(body.email || ""),
+                    name: String(body.name || "User"),
+                    password: String(body.password || ""),
+                    workspaceName: body.workspaceName ? String(body.workspaceName) : undefined,
+                });
+                sendJson(res, 201, { ok: true, ...created });
+                return;
+            }
+            if (pathname === "/api/v1/auth/login" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const loggedIn = store.loginUser(String(body.email || ""), String(body.password || ""));
+                if (!loggedIn) {
+                    sendJson(res, 401, { ok: false, error: "Invalid email or password" });
+                    return;
+                }
+                sendJson(res, 200, { ok: true, ...loggedIn });
+                return;
+            }
+            const ctx = resolveContext(req);
+            // Console Bootstrap
+            if (pathname === "/api/v1/bootstrap" && req.method === "GET") {
+                const org = engine.getOrganization(ctx).organization;
+                sendJson(res, 200, {
+                    ok: true,
+                    profile: engine.getProfile(ctx),
+                    organization: org,
+                    governance: engine.governance.getStatus(),
+                    supermemory: {
+                        enabled: engine.supermemory.isEnabled(),
+                        namespace: engine.supermemory.getWorkspaceNamespace(ctx.workspace.id),
+                    },
+                    surfaces: {
+                        publicWebUrl: config.publicWebUrl,
+                        docsUrl: config.docsUrl,
+                        landingUrl: `${config.baseUrl}/landing`,
+                    },
+                    apiKeys: store.listApiKeys(ctx.workspace.id),
+                    byokKeys: store.listByokKeys(ctx.workspace.id),
+                    defaultApiKey: bootstrap.defaultApiKey || null,
+                    connections: store.listConnections(ctx.workspace.id),
+                    resources: store.listResources(ctx.workspace.id),
+                    plans: store.listPlans(ctx.workspace.id, 25),
+                    runs: store.listRuns(ctx.workspace.id, 25),
+                });
+                return;
+            }
+            // Autonomous Agent Claim Link Creation (Authenticated)
+            if (pathname === "/api/v1/agents/claim" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const email = String(body.email || "").trim();
+                if (!email || !email.includes("@")) {
+                    sendJson(res, 400, { ok: false, error: "Valid target email is required" });
+                    return;
+                }
+                const claim = store.createAgentClaim({
+                    workspaceId: ctx.workspace.id,
+                    email,
+                    baseUrl: config.baseUrl,
+                });
+                sendJson(res, 201, { ok: true, claim, ...claim });
+                return;
+            }
+            // Microsoft Agent Governance Status & Audit Verification
+            if (pathname === "/api/v1/governance" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    governance: engine.governance.getStatus(),
+                    workspacePolicy: ctx.workspace.policy,
+                });
+                return;
+            }
+            // Supermemory v5 Workspace Brain Endpoints
+            if (pathname === "/api/v1/memory" && req.method === "GET") {
+                const query = url.searchParams.get("query") ||
+                    url.searchParams.get("q") ||
+                    undefined;
+                const overview = await engine.getMemoryOverview(ctx, query);
+                sendJson(res, 200, { ok: true, ...overview });
+                return;
+            }
+            if (pathname === "/api/v1/memory" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const record = await engine.addWorkspaceMemory(ctx, {
+                    title: String(body.title || "Workspace Fact"),
+                    content: String(body.content || ""),
+                    kind: body.kind || "fact",
+                    metadata: body.metadata || {},
+                });
+                sendJson(res, 201, { ok: true, memory: record });
+                return;
+            }
+            if (pathname.startsWith("/api/v1/memory/") && req.method === "DELETE") {
+                const id = decodeURIComponent(pathname.slice("/api/v1/memory/".length));
+                const deleted = await engine.deleteWorkspaceMemory(ctx, id);
+                sendJson(res, 200, { ok: true, ...deleted });
+                return;
+            }
+            // API Keys
+            if (pathname === "/api/v1/api-keys" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const created = store.createApiKey({
+                    workspaceId: ctx.workspace.id,
+                    name: String(body.name || "API Key"),
+                    environment: body.environment === "test" ? "test" : "live",
+                });
+                sendJson(res, 201, { ok: true, ...created });
+                return;
+            }
+            // Profile & Organization (v1 and api/v1)
+            if ((pathname === "/api/v1/profile" || pathname === "/v1/profile") && req.method === "GET") {
+                sendJson(res, 200, { ok: true, ...engine.getProfile(ctx) });
+                return;
+            }
+            if ((pathname === "/api/v1/organization" || pathname === "/v1/organization") && req.method === "GET") {
+                sendJson(res, 200, { ok: true, ...engine.getOrganization(ctx) });
+                return;
+            }
+            // Catalog Search & Inspect
+            if ((pathname === "/api/v1/tools" || pathname === "/v1/tools/search") &&
+                (req.method === "GET" || req.method === "POST")) {
+                const body = req.method === "POST" ? JSON.parse((await readBody(req)) || "{}") : {};
+                const query = url.searchParams.get("query") || body.query || undefined;
+                const lane = (url.searchParams.get("lane") || body.lane) ||
+                    "all";
+                const riskLevel = (url.searchParams.get("risk_level") || body.risk_level) ||
+                    undefined;
+                const limit = Number(url.searchParams.get("limit") || body.limit || 30);
+                const results = await engine.searchTools({ query, lane, riskLevel, limit });
+                sendJson(res, 200, { ok: true, ...results });
+                return;
+            }
+            if (pathname.startsWith("/api/v1/tools/") && req.method === "GET") {
+                const slug = decodeURIComponent(pathname.slice("/api/v1/tools/".length));
+                const tool = await engine.inspectTool(slug);
+                sendJson(res, 200, tool);
+                return;
+            }
+            // Connections
+            if (pathname === "/api/v1/connections" && req.method === "GET") {
+                const syncLive = url.searchParams.get("sync") === "true";
+                const provider = url.searchParams.get("provider") || undefined;
+                const status = await engine.connectionStatus(ctx, { provider, syncLive });
+                sendJson(res, 200, { ok: true, ...status });
+                return;
+            }
+            if (pathname === "/api/v1/connections" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const connection = await engine.startConnection(ctx, {
+                    provider: String(body.provider || ""),
+                    lane: body.lane,
+                    callbackUrl: body.callbackUrl ? String(body.callbackUrl) : undefined,
+                });
+                sendJson(res, 201, { ok: true, connection });
+                return;
+            }
+            if (pathname === "/api/v1/connections/wait" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const provider = String(body.provider || "");
+                if (body.simulateCallback === true || body.simulate_callback === true) {
+                    await engine.handleOAuthCallback({
+                        workspaceId: ctx.workspace.id,
+                        provider,
+                        status: "success",
+                    });
+                }
+                const result = await engine.waitForConnection(ctx, {
+                    provider,
+                    timeoutSeconds: body.timeoutSeconds !== undefined
+                        ? Number(body.timeoutSeconds)
+                        : body.timeout_seconds !== undefined
+                            ? Number(body.timeout_seconds)
+                            : 15,
+                });
+                sendJson(res, 200, { ok: true, ...result });
+                return;
+            }
+            // Provisioned Resources & Decrypted Vault Env Pull
+            if (pathname === "/api/v1/resources" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    resources: store.listResources(ctx.workspace.id),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/resources/env" && req.method === "GET") {
+                // Also pull any fresh .env from Stripe Projects workdir if present
+                const workdirSecrets = await engine.stripeProjects
+                    .pullEnvVarsFromWorkdir()
+                    .catch(() => ({}));
+                const vaultSecrets = store.getDecryptedWorkspaceEnv(ctx.workspace.id);
+                const merged = { ...workdirSecrets, ...vaultSecrets };
+                const dotenvLines = [
+                    `# Muxo Encrypted Vault Export — Workspace ${ctx.workspace.slug} (${ctx.workspace.id})`,
+                    `# Generated at ${new Date().toISOString()}`,
+                    ...Object.entries(merged).map(([k, v]) => `${k}=${JSON.stringify(v)}`),
+                ];
+                sendJson(res, 200, {
+                    ok: true,
+                    workspaceId: ctx.workspace.id,
+                    variables: merged,
+                    dotenv: dotenvLines.join("\n") + "\n",
+                });
+                return;
+            }
+            // Governance Policy
+            if (pathname === "/api/v1/policy" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const updated = store.updateWorkspacePolicy(ctx.workspace.id, body);
+                sendJson(res, 200, { ok: true, workspace: updated });
+                return;
+            }
+            // Plans & Approvals & Execution
+            if (pathname === "/api/v1/plans" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    plans: store.listPlans(ctx.workspace.id, 50),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/plans" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const planned = await engine.planAction(ctx, {
+                    toolSlug: String(body.toolSlug || body.tool_slug || ""),
+                    input: body.input || {},
+                    reason: body.reason ? String(body.reason) : undefined,
+                });
+                sendJson(res, 201, { ok: true, ...planned });
+                return;
+            }
+            const planApproveMatch = pathname.match(/^\/api\/v1\/plans\/([^/]+)\/approve$/);
+            if (planApproveMatch && req.method === "POST") {
+                const planId = decodeURIComponent(planApproveMatch[1]);
+                const plan = engine.approvePlan(ctx, planId, "approved");
+                sendJson(res, 200, { ok: true, plan });
+                return;
+            }
+            const planExecuteMatch = pathname.match(/^\/api\/v1\/plans\/([^/]+)\/execute$/);
+            if (planExecuteMatch && req.method === "POST") {
+                const planId = decodeURIComponent(planExecuteMatch[1]);
+                const plan = engine.getPlan(ctx, planId);
+                const result = await engine.executePlanForRisk(ctx, planId, plan.riskLevel);
+                sendJson(res, 200, { ok: true, ...result });
+                return;
+            }
+            // Runs & Receipts
+            if (pathname === "/api/v1/runs" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    runs: store.listRuns(ctx.workspace.id, 50),
+                });
+                return;
+            }
+            if (pathname.startsWith("/api/v1/receipts/") && req.method === "GET") {
+                const receiptId = decodeURIComponent(pathname.slice("/api/v1/receipts/".length));
+                const verified = engine.getReceipt(ctx, receiptId);
+                sendJson(res, 200, { ok: true, ...verified });
+                return;
+            }
+            // BYOK (Bring Your Own Key) Encrypted Vault Management
+            if (pathname === "/api/v1/byok" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    workspaceId: ctx.workspace.id,
+                    keys: store.listByokKeys(ctx.workspace.id),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/byok" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const provider = String(body.provider || "").trim();
+                const secretKey = String(body.secretKey || body.apiKey || body.key || "").trim();
+                if (!provider || !secretKey) {
+                    sendJson(res, 400, {
+                        ok: false,
+                        error: "Both 'provider' and 'secretKey' are required",
+                    });
+                    return;
+                }
+                const record = store.setByokKey(ctx.workspace.id, provider, secretKey);
+                sendJson(res, 201, {
+                    ok: true,
+                    key: record,
+                    keys: store.listByokKeys(ctx.workspace.id),
+                });
+                return;
+            }
+            if (pathname.startsWith("/api/v1/byok/") && req.method === "DELETE") {
+                const provider = decodeURIComponent(pathname.slice("/api/v1/byok/".length));
+                const deleted = store.deleteByokKey(ctx.workspace.id, provider);
+                sendJson(res, 200, {
+                    ok: true,
+                    deleted,
+                    provider,
+                    keys: store.listByokKeys(ctx.workspace.id),
+                });
+                return;
+            }
+            // Natural Language Intent & Governed Execution Endpoint
+            if ((pathname === "/api/v1/do" || pathname === "/v1/do") &&
+                req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const prompt = String(body.prompt || body.instruction || body.query || body.command || "").trim();
+                if (!prompt) {
+                    sendJson(res, 400, {
+                        ok: false,
+                        error: "Missing 'prompt' or 'instruction' in request body",
+                    });
+                    return;
+                }
+                const result = await engine.doNaturalLanguage(ctx, {
+                    prompt,
+                    input: body.input && typeof body.input === "object"
+                        ? body.input
+                        : undefined,
+                    autoApprove: body.autoApprove !== false,
+                    dryRun: body.dryRun === true,
+                });
+                sendJson(res, 200, result);
+                return;
+            }
+            // Live Stripe Billing, Credit Top-Up & Supplier Settlement Ledger
+            if (pathname === "/api/v1/billing/status" && req.method === "GET") {
+                const ws = store.getWorkspace(ctx.workspace.id);
+                const settlementSummary = store.getSupplierSettlementSummary(ctx.workspace.id);
+                const byokKeys = store.listByokKeys(ctx.workspace.id);
+                sendJson(res, 200, {
+                    ok: true,
+                    workspaceId: ws.id,
+                    workspace: ws,
+                    tier: ws.tier,
+                    creditsBalance: ws.creditsBalance,
+                    creditBalance: ws.creditsBalance,
+                    monthlyActionsUsed: ws.monthlyActionsUsed,
+                    monthlyActionsLimit: ws.monthlyActionsLimit,
+                    stripeConfigured: engine.stripeBilling.isConfigured,
+                    stripeCustomerId: ws.stripeCustomerId,
+                    stripeSubscriptionId: ws.stripeSubscriptionId,
+                    settlementSummary,
+                    byokKeys,
+                    entries: store.listLedgerEntries(ctx.workspace.id, 25),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/billing/ledger" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    entries: store.listLedgerEntries(ctx.workspace.id, 50),
+                    settlementSummary: store.getSupplierSettlementSummary(ctx.workspace.id),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/billing/settlements" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    settlementSummary: store.getSupplierSettlementSummary(ctx.workspace.id),
+                    entries: store.listLedgerEntries(ctx.workspace.id, 100),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/billing/topup" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const credits = Math.max(1, Math.min(1000000, Number(body.credits || 1000)));
+                const referenceId = String(body.referenceId || "").trim() ||
+                    `topup_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+                const usdPaid = (credits * 0.01).toFixed(2);
+                const updatedWorkspace = store.addWorkspaceCredits({
+                    workspaceId: ctx.workspace.id,
+                    credits,
+                    referenceId,
+                    description: String(body.description || "").trim() ||
+                        `User purchased +${credits.toLocaleString()} Muxo Credits ($${usdPaid} USD -> Muxo Master Wallet)`,
+                });
+                sendJson(res, 200, {
+                    ok: true,
+                    creditsAdded: credits,
+                    usdPaid: Number(usdPaid),
+                    workspace: updatedWorkspace,
+                    settlementSummary: store.getSupplierSettlementSummary(ctx.workspace.id),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/billing/upgrade" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const referenceId = String(body.referenceId || "").trim() ||
+                    `upgrade_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+                const bonusCredits = body.bonusCredits !== undefined ? Number(body.bonusCredits) : 1000;
+                const updatedWorkspace = store.upgradeWorkspaceToStarter({
+                    workspaceId: ctx.workspace.id,
+                    stripeCustomerId: ctx.workspace.stripeCustomerId ||
+                        `cus_muxo_${ctx.workspace.id.slice(3, 11)}`,
+                    stripeSubscriptionId: ctx.workspace.stripeSubscriptionId ||
+                        `sub_muxo_${referenceId.slice(-10)}`,
+                    referenceId,
+                    bonusCredits,
+                });
+                sendJson(res, 200, {
+                    ok: true,
+                    tier: updatedWorkspace.tier,
+                    creditsBalance: updatedWorkspace.creditsBalance,
+                    creditBalance: updatedWorkspace.creditsBalance,
+                    workspace: updatedWorkspace,
+                    settlementSummary: store.getSupplierSettlementSummary(ctx.workspace.id),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/billing/checkout" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const kind = body.kind === "credit_topup" ? "credit_topup" : "starter_subscription";
+                const credits = body.credits ? Number(body.credits) : 1000;
+                const session = await engine.stripeBilling.createCheckoutSession({
+                    workspace: ctx.workspace,
+                    customerEmail: ctx.user.email,
+                    kind,
+                    credits,
+                    returnBaseUrl: body.returnBaseUrl ? String(body.returnBaseUrl) : config.baseUrl,
+                });
+                sendJson(res, 200, { ok: true, ...session });
+                return;
+            }
+            if (pathname === "/api/v1/billing/verify-session" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const verified = await engine.stripeBilling.verifyAndFulfillCheckoutSession(String(body.sessionId || ""), ctx.workspace.id, body.kind === "credit_topup"
+                    ? "credit_topup"
+                    : body.kind === "starter_subscription"
+                        ? "starter_subscription"
+                        : undefined);
+                sendJson(res, 200, { ok: true, ...verified });
+                return;
+            }
+            if (pathname === "/api/v1/billing/webhook" && req.method === "POST") {
+                const rawBody = await readBody(req);
+                const sig = String(req.headers["stripe-signature"] || "");
+                if (!engine.stripeBilling.verifyWebhookSignature(rawBody, sig)) {
+                    sendJson(res, 400, { ok: false, error: "Invalid Stripe webhook signature" });
+                    return;
+                }
+                const event = JSON.parse(rawBody || "{}");
+                if (event.type === "checkout.session.completed") {
+                    const sessionObj = event.data?.object;
+                    if (sessionObj?.id) {
+                        await engine.stripeBilling.verifyAndFulfillCheckoutSession(String(sessionObj.id));
+                    }
+                }
+                sendJson(res, 200, { ok: true, received: true });
+                return;
+            }
+            sendJson(res, 404, { ok: false, error: `Route not found: ${req.method} ${pathname}` });
+        }
+        catch (err) {
+            sendJson(res, 400, {
+                ok: false,
+                error: String(err?.message || err || "Internal error"),
+            });
+        }
+    });
+    return { server, engine, store, defaultApiKey: bootstrap.defaultApiKey };
+}
+// Start server when invoked directly
+const isMain = process.argv[1] &&
+    (process.argv[1].endsWith("server.ts") || process.argv[1].endsWith("server.js"));
+if (isMain) {
+    const config = getConfig();
+    const { server, defaultApiKey } = createMuxoServer(config);
+    server.listen(config.port, () => {
+        console.log(`\n⚡ Muxo Platform running at ${config.baseUrl}`);
+        console.log(`   ├─ Web Console:     ${config.baseUrl}/`);
+        console.log(`   ├─ MCP Server:      ${config.baseUrl}/mcp`);
+        console.log(`   ├─ Agent Skill:     ${config.baseUrl}/skill.md`);
+        console.log(`   └─ Health Check:    ${config.baseUrl}/health`);
+        if (defaultApiKey) {
+            console.log(`\n🔑 Initial Workspace API Key created (save this): ${defaultApiKey}\n`);
+        }
+    });
+}