@muxoai/sdk 1.2.3 → 1.3.0

package/dist/providers/microsoft-governance.js

@@ -0,0 +1,415 @@
+import crypto from "node:crypto";
+import { AgentIdentity, AuditLogger, McpSecurityScanner, PolicyEngine, } from "../../vendor/microsoft-governance/dist/index.js";
+const SDK_VERSION = "5.0.0";
+const POLICY_ID = "muxo-microsoft-agent-governance-v5";
+// PKCS#8 DER prefix for a 32-byte Ed25519 private key seed (OID 1.3.101.112)
+const ED25519_PKCS8_PREFIX = Buffer.from([
+    0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70,
+    0x04, 0x22, 0x04, 0x20,
+]);
+function deriveDeterministicIdentity(seedMaterial, agentId, capabilities, opts) {
+    const rawSeed = crypto
+        .createHmac("sha256", seedMaterial)
+        .update(`muxo-ed25519-agent-identity:${agentId}`)
+        .digest();
+    const pkcs8Der = Buffer.concat([ED25519_PKCS8_PREFIX, rawSeed]);
+    const privateKeyObj = crypto.createPrivateKey({
+        key: pkcs8Der,
+        format: "der",
+        type: "pkcs8",
+    });
+    const publicKeyObj = crypto.createPublicKey(privateKeyObj);
+    const pubDer = Buffer.from(publicKeyObj.export({ type: "spki", format: "der" }));
+    const privDer = Buffer.from(privateKeyObj.export({ type: "pkcs8", format: "der" }));
+    const fingerprint = crypto
+        .createHash("sha256")
+        .update(pubDer)
+        .digest("hex")
+        .slice(0, 16);
+    const did = `did:agentmesh:${agentId}:${fingerprint}`;
+    return AgentIdentity.fromJSON({
+        did,
+        publicKey: pubDer.toString("base64"),
+        privateKey: privDer.toString("base64"),
+        capabilities,
+        name: opts.name || agentId,
+        organization: opts.organization || "muxo.ai",
+        createdAt: opts.createdAt || new Date().toISOString(),
+    });
+}
+export class MicrosoftGovernanceAdapter {
+    scanner;
+    seedMaterial;
+    auditLoggers = new Map();
+    identities = new Map();
+    defaultIdentity;
+    constructor(seed) {
+        this.scanner = new McpSecurityScanner();
+        this.seedMaterial = Buffer.isBuffer(seed)
+            ? seed
+            : Buffer.from(String(seed ||
+                process.env.MUXO_VAULT_SECRET ||
+                process.env.COMPOSIO_API_KEY ||
+                "muxo-governance-ed25519-seed-v5"), "utf8");
+        this.defaultIdentity = deriveDeterministicIdentity(this.seedMaterial, "muxo-control-plane", [
+            "instant.*",
+            "app.*",
+            "resource.*",
+            "mcp.execute",
+            "governance.verify",
+        ], {
+            name: "Muxo Control Plane Agent",
+            organization: "muxo.ai",
+        });
+    }
+    /**
+     * Returns (or deterministically derives) the Ed25519 AgentIdentity (`did:agentmesh:...`) for a workspace.
+     */
+    getWorkspaceIdentity(workspace) {
+        let identity = this.identities.get(workspace.id);
+        if (!identity) {
+            identity = deriveDeterministicIdentity(this.seedMaterial, `muxo-workspace-${workspace.slug || workspace.id}`, [
+                "instant.*",
+                "app.*",
+                "resource.*",
+                "mcp.execute",
+                "governance.verify",
+            ], {
+                name: `${workspace.name} Agent Boundary`,
+                organization: workspace.id,
+                createdAt: workspace.createdAt,
+            });
+            this.identities.set(workspace.id, identity);
+        }
+        return identity;
+    }
+    /**
+     * Returns (or lazily initializes) the SHA-256 hash-chained AuditLogger for a workspace.
+     */
+    getWorkspaceAuditLogger(workspaceId) {
+        let logger = this.auditLoggers.get(workspaceId);
+        if (!logger) {
+            logger = new AuditLogger();
+            this.auditLoggers.set(workspaceId, logger);
+        }
+        return logger;
+    }
+    /**
+     * Compiles the workspace's GovernancePolicy into a declarative Microsoft PolicyEngine instance.
+     */
+    createPolicyEngine(policy) {
+        const engine = new PolicyEngine();
+        const rules = [];
+        for (const blockedSlug of policy.blockedToolSlugs || []) {
+            const normalized = blockedSlug.trim();
+            if (!normalized)
+                continue;
+            rules.push({
+                name: `deny-blocked-tool-${normalized.replace(/[^a-zA-Z0-9_-]/g, "_")}`,
+                ruleAction: "deny",
+                priority: 100,
+                condition: {
+                    tool_slug: normalized,
+                },
+            });
+        }
+        if (policy.mode === "enforce") {
+            for (const risk of policy.requireApprovalFor || []) {
+                rules.push({
+                    name: `require-owner-approval-for-${risk}`,
+                    ruleAction: "require_approval",
+                    priority: 80,
+                    condition: {
+                        risk_level: risk,
+                        owner_approved: false,
+                    },
+                });
+            }
+        }
+        rules.push({
+            name: "allow-governed-action",
+            ruleAction: "allow",
+            priority: 10,
+            condition: {
+                workspace_active: true,
+            },
+        });
+        engine.loadJson(JSON.stringify({
+            apiVersion: "governance.toolkit/v1",
+            name: POLICY_ID,
+            version: "5.0.0",
+            description: "Muxo Unified Execution Boundary Policy",
+            scope: "tenant",
+            default_action: "deny",
+            rules,
+        }));
+        return engine;
+    }
+    /**
+     * Runs the full Microsoft Agent Governance pipeline:
+     * Agent ──► McpSecurityScanner ──► PolicyEngine ──► AgentIdentity (Ed25519 DID) ──► AuditLogger ──► DecisionRecord
+     */
+    evaluateAction(params) {
+        const { workspace, actorId, tool, input, reason, stage } = params;
+        const ownerApproved = Boolean(params.ownerApproved);
+        const decidedAt = new Date().toISOString();
+        // 1. McpSecurityScanner: inspect tool definition + input arguments for prompt injection / exfiltration
+        const serializedInput = JSON.stringify(input || {});
+        const scanResult = this.scanner.scan({
+            name: tool.slug,
+            description: `${tool.description}\nReason: ${reason}\nArgs: ${serializedInput}`,
+            parameters: tool.inputSchema,
+        });
+        const extraFindings = (scanResult.threats || []).map((t) => ({
+            category: String(t.type || "mcp_scan"),
+            severity: String(t.severity || "medium"),
+            description: String(t.description || "Security scanner finding"),
+        }));
+        // Additional argument-level prompt-injection / secret-exfiltration heuristics
+        const suspiciousPatterns = [
+            {
+                regex: /ignore\s+(all\s+)?previous\s+instructions/i,
+                category: "prompt_injection",
+                severity: "high",
+                description: "Detected prompt injection override phrase in tool arguments or reason",
+            },
+            {
+                regex: /(cat|curl|wget)\s+.*(\/etc\/passwd|\.env|id_rsa|AWS_SECRET_ACCESS_KEY)/i,
+                category: "credential_exfiltration",
+                severity: "high",
+                description: "Detected credential or sensitive file exfiltration pattern in arguments",
+            },
+        ];
+        for (const pat of suspiciousPatterns) {
+            if (pat.regex.test(serializedInput) || pat.regex.test(reason)) {
+                extraFindings.push({
+                    category: pat.category,
+                    severity: pat.severity,
+                    description: pat.description,
+                });
+            }
+        }
+        const highSeverityFinding = extraFindings.some((f) => f.severity === "high" || f.severity === "critical");
+        // 2. PolicyEngine: evaluate declarative rules against tool slug, risk level, and approval state
+        const policy = workspace.policy;
+        const policyEngine = this.createPolicyEngine(policy);
+        const identity = this.getWorkspaceIdentity(workspace);
+        const policyDecision = policyEngine.evaluatePolicy(identity.did, {
+            tool_slug: tool.slug,
+            risk_level: tool.riskLevel,
+            lane: tool.lane,
+            stage,
+            owner_approved: ownerApproved,
+            workspace_active: true,
+        });
+        let finalDecision = policyDecision.action === "deny"
+            ? "deny"
+            : policyDecision.action === "require_approval"
+                ? "require_approval"
+                : "allow";
+        // Block explicitly blocked tools even in monitor mode, or high-severity injection findings in enforce mode
+        if ((policy.blockedToolSlugs || []).includes(tool.slug) ||
+            (highSeverityFinding && policy.mode === "enforce")) {
+            finalDecision = "deny";
+        }
+        // 3. AuditLogger: append tamper-evident SHA-256 hash-chained log entry
+        const auditLogger = this.getWorkspaceAuditLogger(workspace.id);
+        const auditDecision = finalDecision === "deny" ? "deny" : "allow";
+        const auditEntry = auditLogger.log({
+            agentId: identity.did,
+            action: `${stage}.${tool.riskLevel}:${tool.slug}`,
+            decision: auditDecision,
+            skillAuditMetadata: {
+                skillName: tool.slug,
+                skillOrigin: tool.lane,
+                provenanceSourceTrust: "trusted",
+            },
+        });
+        const chainVerified = auditLogger.verify();
+        // 4. AgentIdentity (Ed25519 DID): cryptographically sign the decision record
+        const bindingHash = crypto
+            .createHash("sha256")
+            .update(JSON.stringify({
+            workspaceId: workspace.id,
+            actorId,
+            toolSlug: tool.slug,
+            riskLevel: tool.riskLevel,
+            stage,
+            input,
+            finalDecision,
+            auditHash: auditEntry.hash,
+            decidedAt,
+        }))
+            .digest("hex");
+        const signaturePayload = [
+            POLICY_ID,
+            identity.did,
+            workspace.id,
+            actorId,
+            tool.slug,
+            tool.riskLevel,
+            finalDecision,
+            auditEntry.hash,
+            auditEntry.previousHash,
+            bindingHash,
+            decidedAt,
+        ].join("|");
+        const sigBytes = identity.sign(Buffer.from(signaturePayload, "utf8"));
+        const ed25519Signature = Buffer.from(sigBytes).toString("hex");
+        const publicKeyHex = Buffer.from(identity.publicKey).toString("hex");
+        const verdict = finalDecision === "require_approval" ? "escalate" : finalDecision;
+        const decisionReason = finalDecision === "deny"
+            ? highSeverityFinding
+                ? `Blocked by McpSecurityScanner: ${extraFindings.map((f) => f.description).join("; ")}`
+                : `Denied by policy rule ${policyDecision.matchedRule || "default"}`
+            : finalDecision === "require_approval"
+                ? `Escalated for human owner approval (${tool.riskLevel} risk lane)`
+                : `Allowed by Microsoft Agent Governance (${policyDecision.matchedRule || "allow-governed-action"})`;
+        return {
+            id: `dec_${crypto.randomBytes(8).toString("hex")}`,
+            sdk: "@microsoft/agent-governance-sdk",
+            sdkVersion: SDK_VERSION,
+            policyId: POLICY_ID,
+            mode: policy.mode,
+            agentDid: identity.did,
+            agentPublicKey: publicKeyHex,
+            actorId,
+            workspaceId: workspace.id,
+            action: `${stage}.${tool.riskLevel}:${tool.slug}`,
+            riskLevel: tool.riskLevel,
+            decision: finalDecision,
+            verdict,
+            reason: decisionReason,
+            matchedRule: policyDecision.matchedRule ?? null,
+            securityScan: {
+                safe: scanResult.safe && !highSeverityFinding,
+                riskLevel: highSeverityFinding
+                    ? "high"
+                    : scanResult.risk_score > 50
+                        ? "medium"
+                        : "low",
+                findingsCount: extraFindings.length,
+                findings: extraFindings,
+            },
+            auditEntry: {
+                timestamp: auditEntry.timestamp,
+                agentId: auditEntry.agentId,
+                action: auditEntry.action,
+                decision: auditDecision,
+                hash: auditEntry.hash,
+                previousHash: auditEntry.previousHash,
+                chainVerified,
+            },
+            ed25519Signature,
+            signature: ed25519Signature,
+            bindingHash,
+            decidedAt,
+        };
+    }
+    evaluatePlan(params) {
+        return this.evaluateAction({
+            ...params,
+            stage: "plan",
+        });
+    }
+    evaluateExecution(params) {
+        return this.evaluateAction({
+            workspace: params.workspace,
+            actorId: params.actorId,
+            tool: params.tool,
+            input: params.plan.input,
+            reason: params.plan.reason,
+            stage: "execute",
+            ownerApproved: params.plan.approvalStatus === "approved" ||
+                params.plan.approvalStatus === "auto_approved",
+        });
+    }
+    /**
+     * Verifies a DecisionRecord's Ed25519 signature and the workspace's SHA-256 audit hash chain.
+     */
+    verifyDecisionRecord(workspaceOrRecord, maybeRecord) {
+        const record = maybeRecord || workspaceOrRecord;
+        const workspace = maybeRecord ? workspaceOrRecord : undefined;
+        const identity = workspace
+            ? this.getWorkspaceIdentity(workspace)
+            : this.identities.get(record.workspaceId) || this.defaultIdentity;
+        const stagePrefix = record.action.split(":")[0] || "";
+        const toolSlug = record.action.slice(stagePrefix.length + 1);
+        const signaturePayload = [
+            record.policyId,
+            record.agentDid,
+            record.workspaceId,
+            record.actorId,
+            toolSlug,
+            record.riskLevel,
+            record.decision,
+            record.auditEntry.hash,
+            record.auditEntry.previousHash,
+            record.bindingHash,
+            record.decidedAt,
+        ].join("|");
+        let ed25519Verified = false;
+        try {
+            if (identity.did === record.agentDid) {
+                ed25519Verified = identity.verify(Buffer.from(signaturePayload, "utf8"), Buffer.from(record.ed25519Signature, "hex"));
+            }
+            else if (record.agentPublicKey && record.ed25519Signature) {
+                const pubKeyObj = crypto.createPublicKey({
+                    key: Buffer.from(record.agentPublicKey, "hex"),
+                    format: "der",
+                    type: "spki",
+                });
+                ed25519Verified = crypto.verify(null, Buffer.from(signaturePayload, "utf8"), pubKeyObj, Buffer.from(record.ed25519Signature, "hex"));
+            }
+        }
+        catch {
+            ed25519Verified = false;
+        }
+        const auditLogger = this.getWorkspaceAuditLogger(record.workspaceId);
+        const auditChainVerified = auditLogger.verify();
+        return ed25519Verified && auditChainVerified;
+    }
+    getStatus(workspace) {
+        const identity = workspace
+            ? this.getWorkspaceIdentity(workspace)
+            : this.identities.values().next().value || this.defaultIdentity;
+        let totalEntries = 0;
+        let allVerified = true;
+        for (const logger of this.auditLoggers.values()) {
+            totalEntries += logger.length;
+            if (!logger.verify())
+                allVerified = false;
+        }
+        return {
+            sdk: "@microsoft/agent-governance-sdk",
+            sdkVersion: SDK_VERSION,
+            policyId: POLICY_ID,
+            pipeline: "Agent ──► McpSecurityScanner ──► PolicyEngine ──► AgentIdentity (Ed25519 DID) ──► AuditLogger ──► DecisionRecord",
+            agentDid: identity.did,
+            publicKeyHex: Buffer.from(identity.publicKey).toString("hex"),
+            auditEntriesCount: totalEntries,
+            auditChainIntegrity: allVerified,
+        };
+    }
+    /**
+     * Returns a live governance status report for a workspace.
+     */
+    getGovernanceStatus(workspace) {
+        const identity = this.getWorkspaceIdentity(workspace);
+        const auditLogger = this.getWorkspaceAuditLogger(workspace.id);
+        const entries = auditLogger.getEntries();
+        return {
+            sdk: "@microsoft/agent-governance-sdk",
+            sdkVersion: SDK_VERSION,
+            policyId: POLICY_ID,
+            pipeline: "Agent ──► McpSecurityScanner ──► PolicyEngine ──► AgentIdentity (Ed25519 DID) ──► AuditLogger ──► DecisionRecord",
+            agentIdentity: identity.toJSON(),
+            policy: workspace.policy,
+            auditChain: {
+                entriesCount: entries.length,
+                chainVerified: auditLogger.verify(),
+                recentEntries: entries.slice(-15).reverse(),
+            },
+        };
+    }
+}

package/dist/providers/stripe-billing.d.ts

@@ -0,0 +1,41 @@
+import type { MuxoConfig } from "../config.js";
+import type { MuxoStore } from "../store.js";
+import type { ToolDescriptor, Workspace } from "../types.js";
+export declare class StripeBillingAdapter {
+    private readonly config;
+    private readonly store;
+    private resolvedStarterPriceId;
+    private resolvedCreditsPriceId;
+    constructor(config: MuxoConfig, store: MuxoStore);
+    private getEffectiveStripeKey;
+    get isConfigured(): boolean;
+    listTools(): ToolDescriptor[];
+    private stripeRequest;
+    ensurePrices(workspaceId?: string): Promise<{
+        starterPriceId: string;
+        creditsPriceId: string;
+    }>;
+    createCheckoutSession(params: {
+        workspace: Workspace;
+        customerEmail: string;
+        kind: "starter_subscription" | "credit_topup";
+        credits?: number;
+        returnBaseUrl?: string;
+    }): Promise<{
+        sessionId: string;
+        url: string;
+        mode: "stripe_live" | "muxo_instant_checkout";
+    }>;
+    verifyAndFulfillCheckoutSession(sessionId: string, fallbackWorkspaceId?: string, fallbackKind?: "starter_subscription" | "credit_topup"): Promise<{
+        fulfilled: boolean;
+        workspace: Workspace | null;
+        kind: string;
+    }>;
+    executeTool(params: {
+        workspace: Workspace;
+        customerEmail: string;
+        toolSlug: string;
+        input: Record<string, unknown>;
+    }): Promise<Record<string, unknown>>;
+    verifyWebhookSignature(rawBody: string, signatureHeader: string): boolean;
+}