@muxoai/sdk 1.2.3 → 1.4.2

package/dist/server.js

@@ -0,0 +1,3575 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import http from "node:http";
+import path from "node:path";
+import { getConfig, ROOT_DIR } from "./config.js";
+import { MuxoEngine } from "./engine.js";
+import { getMuxoMcpSkills, handleJsonRpcMcpRequest, MUXO_MCP_SERVER_INSTRUCTIONS, MUXO_MCP_TOOLS, } from "./mcp.js";
+import { APPROVED_PLAN_STATUSES, LATEST_MCP_PROTOCOL_VERSION, MuxoToolError, SUPPORTED_MCP_PROTOCOL_VERSIONS, clampWaitSeconds, errorPayloadFrom, isPublicMcpRequest, validateMcpHttpHeadersAndMeta, workspaceAgentDid, } from "./mcp-schema.js";
+import { MuxoStore } from "./store.js";
+import { managedProviderConnectionList, managedProviderConnectionRequest, managedProviderConnectionUnlink, managedResource, managedResourceAction, } from "./provisioning-managed.js";
+import { DEFAULT_WORKSPACE_POLICY, describePolicyInPlainEnglish, sanitizePolicyPatch, } from "./policy.js";
+import { parseNaturalLanguageMemoryInstruction } from "./providers/supermemory.js";
+import { MUXO_VERSION } from "./version.js";
+import { fetchMuxoConnectLinkMetadata, isStripeProjectsExclusiveProvider, normalizeStripeProjectsProviderSlug, parseComposioWebhookEnvelope, submitMuxoConnectLink, verifyComposioWebhookSignature, wrapMuxoConnectUrl, } from "./composio-catalog.js";
+import { isConsolePath, renderApprovalPageHtml, renderConsoleHtml, renderLandingHtml, renderOAuthCallbackPageHtml, renderOAuthConnectPageHtml, renderOAuthConsentHtml, } from "./ui/console-html.js";
+import { fetchClerkProfile, looksLikeJwt, readClerkConfig, verifyClerkSessionToken, } from "./clerk.js";
+import { DEFAULT_OAUTH_SCOPE, OAUTH_ACCESS_TOKEN_TTL_SECONDS, OAUTH_CODE_TTL_MS, oauthConnectionKeyName, oauthRedirectOrigin, oauthSecretToken, parseAuthorizeRequest, parseOAuthFormBody, verifyPkce, } from "./oauth.js";
+function renderSkillMarkdown(baseUrl) {
+    return `---
+name: muxo
+description: Discover, plan, and execute governed actions across Connected Apps (app.*), Instant Tools (instant.*), Cloud Infrastructure (resource.*), Workspace Memory, and Safety Guardrails through Muxo.
+---
+
+# Muxo — Unified Agent Execution, Infrastructure, Memory & Safety Platform
+
+Muxo provides one unified interface across 4 capabilities so agents and users only ever interact with Muxo:
+
+1. **Instant Tools (\`instant.*\`)**: Zero-OAuth tools ready immediately (\`instant.web.search\`, \`instant.web.scrape\`, \`instant.web.crawl\`, \`instant.seo.audit\`, \`instant.hackernews.top_stories\`, \`instant.github.repo_intel\`, \`instant.dns.lookup\`).
+2. **Connected Apps (\`app.*\`)**: Managed OAuth SaaS integrations (\`app.github.*\`, \`app.gmail.*\`, \`app.slack.*\`, \`app.notion.*\`, \`app.linear.*\`, etc.).
+3. **Cloud Infrastructure (\`resource.*\`)**: Database, cache, storage, and hosting provisioning (\`resource.neon.*\`, \`resource.supabase.*\`, \`resource.turso.*\`, \`resource.cloudflare.*\`, \`resource.vercel.*\`, etc.) with AES-256-GCM secret custody in Muxo Vault.
+4. **Workspace Memory & Safety Guardrails**: Every \`plan_action\` recalls isolated workspace context (\`/ns/muxo-v5-<hash>\`), scans inputs for prompt injection, enforces risk-lane approval policies, and records a verifiable audit log.
+
+## Installable Muxo Plugin (Claude Code, OpenAI Codex, Claude Desktop & ChatGPT)
+
+> **Requirement:** \`@muxoai/cli\` requires **Node.js 22+** (\`node >= 22.0.0\`).
+
+\`\`\`bash
+# Install Muxo CLI & sign in against the hosted workspace (Node.js 22+)
+npm install -g @muxoai/cli@latest
+muxo login --signup --name "my-agent"
+
+# Claude Code marketplace (muxo@muxo):
+claude plugin marketplace add ${baseUrl}/.claude-plugin/marketplace.json
+claude plugin install muxo@muxo
+
+# OpenAI Codex: add a Git repo or local marketplace directory containing .agents/plugins/marketplace.json,
+# or configure [mcp_servers.muxo] in ~/.codex/config.toml (url = "${baseUrl}/mcp")
+
+# Claude Desktop:
+# - Hosted MCP: Settings -> Connectors -> Add custom connector -> ${baseUrl}/mcp
+# - Local stdio server: configure npx -y @muxoai/cli@latest mcp in claude_desktop_config.json
+
+# ChatGPT:
+# - Plugins -> + -> Add custom MCP server -> ${baseUrl}/mcp (OAuth supports CIMD or DCR)
+
+# Link OAuth apps with live browser handoff + polling recovery
+muxo link github --wait
+
+# Plugin manifests served by this instance:
+# - ${baseUrl}/.agents/plugins/marketplace.json (OpenAI Codex local/Git marketplace manifest)
+# - ${baseUrl}/.claude-plugin/marketplace.json (Claude Code marketplace manifest)
+# - ${baseUrl}/api/v1/plugin
+\`\`\`
+
+## CLI-First Autonomous Agent 2-Call Signup
+
+\`\`\`bash
+# 1. Create an autonomous workspace + mk_live_* API key
+curl -sX POST ${baseUrl}/api/v1/agents/signup \\
+  -H "Content-Type: application/json" \\
+  -d '{"agentName":"MyAgent","harness":"claude-code"}'
+
+# 2. (Optional) Generate a human owner claim link
+curl -sX POST ${baseUrl}/api/v1/agents/claim \\
+  -H "Authorization: Bearer <mk_live_key>" \\
+  -H "Content-Type: application/json" \\
+  -d '{"email":"founder@company.com"}'
+\`\`\`
+
+## Endpoint & Authentication
+
+- **MCP Endpoint (Streamable HTTP)**: \`${baseUrl}/mcp\`
+- **OAuth Callback Handoff**: \`${baseUrl}/oauth/callback\`
+- **REST API Base**: \`${baseUrl}/api/v1\`
+- **Marketing & Provider Canvas (muxo.ai)**: \`${baseUrl}/landing\`
+- **Documentation (docs.muxo.ai)**: \`https://docs.muxo.ai\`
+- **Authorization Header**: \`Authorization: Bearer mk_live_<your_key>\`
+
+## 19 Canonical MCP Operations
+
+${MUXO_MCP_TOOLS.map((t, i) => `${i + 1}. \`${t.name}\` — ${t.description}`).join("\n")}
+
+## Standard Execution & OAuth Handoff Workflow
+
+1. **Discover**: Call \`search_tools\` with a keyword or lane filter.
+2. **Inspect**: Call \`inspect_tool\` to read the tool's \`inputSchema\`, \`riskLevel\`, and \`creditCost\`.
+3. **Plan**: Call \`plan_action({ tool_slug, input, reason })\` to receive a \`plan_*\` ID.
+   - If the tool is an unconnected \`app.<provider>.*\` action, \`plan_action\` automatically attaches \`authHandoff.redirectUrl\` and a structured \`humanHandoff\` block. Show \`humanHandoff.url\` to the user, then call \`wait_for_connection({ provider })\` until \`status === "active"\`.
+   - If the plan's \`approvalStatus\` is \`pending_approval\`, \`plan_action\` attaches a \`humanHandoff\` of kind \`approval\` whose \`url\` (\`${baseUrl}/approve/<plan_id>\`) opens a one-click **Review & approve** page for the workspace owner. Send that link to the user and stop until they confirm.
+   - Always follow \`llmGuidance.nextToolCalls\` for the exact next tool call sequence.
+4. **Execute**: Call the matching risk lane tool (\`execute_read\`, \`execute_write\`, \`execute_admin\`, \`execute_financial\`, \`execute_provisioning\`, or \`execute_destructive\`) with \`{ plan_id }\`.
+5. **Verify Receipt**: Every run issues an HMAC-SHA256 chained cryptographic receipt (\`rcpt_*\`) verifiable via \`get_receipt\`.
+
+## Plain-English & Conditional Guardrails (LLM & MCP Harness Native)
+
+Users and LLM harnesses can set safety rules in natural language or structured parameter rules; Muxo compiles and enforces them across all tool calls:
+
+- "Only allow sending emails to @muxo.ai" → conditional recipient domain guardrail (\`must_end_with: @muxo.ai\`)
+- "Require approval for Stripe refunds over $50, auto-approve under $50" → conditional threshold guardrail (\`max_number: 50\`, \`unit: "usd"\`, \`action: "require_approval"\`, \`elseAction: "auto_approve"\`)
+- "Only post Slack messages to #ops-alerts or #deployments" → channel allowlist guardrail
+- "Never spend more than 25 credits per run" → workspace per-run credit cap
+
+Set or inspect them via MCP \`get_run_context({ action: "set_guardrail", prompt: "...", parameter_rules: [...] })\`, dry-run simulate a tool call before planning via \`get_run_context({ action: "check_policy", tool_slug: "...", input: { ... } })\`, reset guardrails via \`get_run_context({ action: "reset_guardrails" })\`, toggle the emergency kill switch via \`get_run_context({ action: "kill_switch", enabled: true, reason: "..." })\`, or scan untrusted inputs for OWASP ASI-06 prompt injection via \`get_run_context({ action: "scan_context", prompt: "..." })\`. Equivalent REST routes: \`POST /api/v1/do\`, \`GET/POST /api/v1/guardrails\`, \`POST /api/v1/guardrails/check\`, and \`POST /api/v1/guardrails/reset\`. Responses always include \`plainEnglishGuardrails\` and a structured \`llmPolicyBrief\` (\`riskLaneMatrix\`, \`parameterRules[].howToComply\`, \`llmSystemDirective\`, and \`agentControlCheatsheet\`).
+
+## MCP Resources & Prompts for AI Harnesses
+
+- **MCP Resources (\`resources/list\` & \`resources/read\`)**:
+  - \`muxo://policy/brief\` — Structured \`llmPolicyBrief\` (risk-lane approval matrix, parameter compliance rules, learned defaults, and agent control cheatsheet)
+  - \`muxo://governance/policy\` — Active guardrails, kill-switch status, trust score, and \`llmPolicyBrief\`
+  - \`muxo://context\` — Live workspace context, active guardrails, provisioned resources, and \`llmSystemPrompt\`
+  - \`muxo://memory/graph\` — Active Supermemory defaults and bi-temporal knowledge graph facts
+- **MCP Prompts (\`prompts/list\` & \`prompts/get\`)**:
+  - \`context\` — Inject workspace memory, active defaults, and guardrail summary
+  - \`policy_guardrails\` — Inject the active \`llmSystemDirective\`, risk-lane matrix, and optional dry-run policy simulation for \`tool_slug\`
+  - \`governed_execution\` — Step-by-step Plan → Approve → Execute → Receipt system instructions
+  - \`security_audit\` — OWASP Agentic Top 10 security and receipt audit workflow
+
+## Active Supermemory (teach Muxo once, auto-fill forever)
+
+Teach preferences in plain English and Muxo auto-fills matching tool inputs on every future plan:
+
+- "Hey Muxo, remember our default GitHub repo is acme/api and default region is us-east-1"
+- "Hey Muxo, forget our staging redis"
+- "What do you remember?"
+
+\`plan_action\` recalls workspace memory before governance checks and reports \`memoryContext.autoFilledInput\` plus \`activeDefaults\` so callers can see exactly which parameters were filled from memory.
+`;
+}
+async function readBody(req) {
+    const chunks = [];
+    for await (const chunk of req) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+function sendJson(res, status, payload, extraHeaders) {
+    const body = JSON.stringify(payload, null, 2);
+    res.writeHead(status, {
+        "Content-Type": "application/json; charset=utf-8",
+        "Access-Control-Allow-Origin": "*",
+        "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Muxo-Workspace-Id, Mcp-Session-Id, mcp-session-id, MCP-Protocol-Version, mcp-protocol-version, Mcp-Method, mcp-method, Mcp-Name, mcp-name",
+        "Access-Control-Expose-Headers": "Mcp-Session-Id, MCP-Protocol-Version, WWW-Authenticate",
+        "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+        ...(extraHeaders || {}),
+    });
+    res.end(body);
+}
+export function createMuxoServer(customConfig) {
+    const config = { ...getConfig(), ...customConfig };
+    const store = new MuxoStore(config.dbPath, config.vaultMasterKey);
+    const engine = new MuxoEngine(config, store);
+    const bootstrap = store.ensureDefaultWorkspace();
+    // OAuth 2.1 DCR + PKCE Authorization Code store for OpenAI Plugin / MCP clients
+    const oauthClients = new Map();
+    oauthClients.set("muxo-openai-plugin", {
+        client_id: "muxo-openai-plugin",
+        client_name: "Muxo Official OpenAI Plugin",
+        redirect_uris: [
+            "https://chatgpt.com/connector_platform_oauth_redirect",
+            "https://platform.openai.com/apps-manage/oauth",
+            "http://127.0.0.1:3118/oauth/callback",
+            "http://localhost:3118/oauth/callback",
+        ],
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        token_endpoint_auth_method: "none",
+        client_id_issued_at: Math.floor(Date.now() / 1000),
+    });
+    const oauthCodes = new Map();
+    const clerkEnv = config.clerkEnv ?? {};
+    const clerkConfig = () => readClerkConfig(clerkEnv, config.baseUrl);
+    const ownerEmails = () => String(clerkEnv.MUXO_OWNER_EMAILS || "")
+        .split(",")
+        .map((s) => s.trim().toLowerCase())
+        .filter(Boolean);
+    const bearerTokenOf = (req) => {
+        const header = String(req.headers.authorization || "").trim();
+        return /^bearer\s+/i.test(header) ? header.replace(/^bearer\s+/i, "").trim() : null;
+    };
+    /**
+     * Resolves the caller from a workspace API key, a console session token, or a Clerk session
+     * JWT. A bearer token that resolves to nothing is "invalid" and must never fall back to a
+     * default workspace.
+     */
+    const authenticate = async (req) => {
+        const token = bearerTokenOf(req);
+        if (token === null)
+            return { kind: "anonymous" };
+        if (!token)
+            return { kind: "invalid" };
+        const wsOverride = String(req.headers["x-muxo-workspace-id"] || "").trim() || null;
+        const resolved = store.resolveAuthToken(token, wsOverride);
+        if (resolved)
+            return { kind: "ok", ctx: resolved, via: resolved.authType };
+        const clerk = looksLikeJwt(token) ? clerkConfig() : null;
+        if (!clerk)
+            return { kind: "invalid" };
+        const session = await verifyClerkSessionToken(token, clerk);
+        if (!session)
+            return { kind: "invalid" };
+        let user = store.getClerkLinkedUser(session.userId);
+        if (!user) {
+            const profile = clerk.secretKey ? await fetchClerkProfile(session.userId, clerk.secretKey) : null;
+            const identity = {
+                email: profile?.email || session.email || null,
+                emailVerified: profile ? profile.emailVerified : Boolean(session.emailVerified),
+                name: profile?.name || null,
+            };
+            const joinsPrimary = Boolean(identity.email && identity.emailVerified && ownerEmails().includes(identity.email.toLowerCase()));
+            user = store.provisionClerkUser(session.userId, identity, joinsPrimary ? bootstrap.workspace.id : null);
+        }
+        const targetWsId = wsOverride && store.userCanAccessWorkspace(user.id, wsOverride) ? wsOverride : user.workspaceId;
+        const workspace = store.getWorkspace(targetWsId) || store.getWorkspace(user.workspaceId);
+        if (!workspace)
+            return { kind: "invalid" };
+        return {
+            kind: "ok",
+            ctx: { user: { ...user, workspaceId: workspace.id }, workspace, actorId: user.id, authType: "session" },
+            via: "clerk",
+            clerkUserId: session.userId,
+            clerkSessionEmail: session.email && session.emailVerified ? session.email : null,
+        };
+    };
+    /** Without Clerk, a local server serves anonymous callers from its primary workspace. */
+    const localFallbackContext = (req) => {
+        const wsOverride = String(req.headers["x-muxo-workspace-id"] || "").trim() || null;
+        const fallbackWsId = wsOverride && store.userCanAccessWorkspace(bootstrap.user.id, wsOverride)
+            ? wsOverride
+            : bootstrap.user.workspaceId || bootstrap.workspace.id;
+        const ws = store.getWorkspace(fallbackWsId) || store.getWorkspace(bootstrap.workspace.id);
+        const user = store.getUser(ws.ownerUserId) || bootstrap.user;
+        return {
+            user,
+            workspace: ws,
+            actorId: user.id,
+            authType: "session",
+        };
+    };
+    const anonymousContext = () => {
+        const epoch = new Date(0).toISOString();
+        return {
+            user: { id: "usr_anonymous", email: "", name: "Anonymous", workspaceId: "ws_public", role: "member", createdAt: epoch },
+            workspace: {
+                id: "ws_public",
+                name: "Public catalog",
+                slug: "public",
+                ownerUserId: "usr_anonymous",
+                tier: "free",
+                monthlyActionsLimit: 0,
+                monthlyActionsUsed: 0,
+                creditsBalance: 0,
+                stripeCustomerId: null,
+                stripeSubscriptionId: null,
+                projectsEnvName: "muxo-public",
+                policy: { ...DEFAULT_WORKSPACE_POLICY },
+                createdAt: epoch,
+                updatedAt: epoch,
+            },
+            actorId: "usr_anonymous",
+            authType: "session",
+        };
+    };
+    const requestOriginOf = (req) => {
+        const proto = String(req.headers["x-forwarded-proto"] || "http").split(",")[0].trim();
+        return req.headers.host ? `${proto}://${req.headers.host}` : config.baseUrl;
+    };
+    const sendAuthRequired = (req, res, pathname, message) => {
+        const origin = requestOriginOf(req);
+        const resourceMetadata = pathname === "/mcp"
+            ? `${origin}/.well-known/oauth-protected-resource/mcp`
+            : `${origin}/.well-known/oauth-protected-resource`;
+        sendJson(res, 401, {
+            ok: false,
+            code: "auth_required",
+            error: message ||
+                `Sign in required. Send a Muxo API key (Authorization: Bearer mk_live_...) or sign in at ${origin}/login.`,
+        }, { "WWW-Authenticate": `Bearer resource_metadata="${resourceMetadata}"` });
+    };
+    /** Emails the signed-in person has verified; agent API keys never count as a person. */
+    const verifiedEmailsOf = async (auth) => {
+        if (auth.kind !== "ok")
+            return [];
+        if (auth.via === "session")
+            return auth.ctx.user.email ? [auth.ctx.user.email.toLowerCase()] : [];
+        if (auth.via !== "clerk")
+            return [];
+        const secretKey = clerkConfig()?.secretKey;
+        if (secretKey && auth.clerkUserId) {
+            const profile = await fetchClerkProfile(auth.clerkUserId, secretKey);
+            if (profile)
+                return profile.verifiedEmails;
+        }
+        return auth.clerkSessionEmail ? [auth.clerkSessionEmail.toLowerCase()] : [];
+    };
+    const signedInPerson = (auth) => auth.kind === "ok" && auth.via !== "api_key";
+    /**
+     * Resolves the caller of a protected route, or answers 401 and returns null. Public routes
+     * accept anonymous callers with an empty catalog context once Clerk sign-in is configured.
+     */
+    const requireContext = async (req, res, pathname, publicRoute = false) => {
+        const auth = await authenticate(req);
+        if (auth.kind === "ok")
+            return { ctx: auth.ctx, auth };
+        if (auth.kind === "invalid") {
+            sendAuthRequired(req, res, pathname);
+            return null;
+        }
+        if (clerkConfig()) {
+            if (publicRoute)
+                return { ctx: anonymousContext(), auth };
+            sendAuthRequired(req, res, pathname);
+            return null;
+        }
+        return { ctx: localFallbackContext(req), auth };
+    };
+    const consentPageHeaders = {
+        "Content-Type": "text/html; charset=utf-8",
+        "Cache-Control": "no-store",
+        "Content-Security-Policy": "frame-ancestors 'none'",
+        "X-Frame-Options": "DENY",
+        "Referrer-Policy": "no-referrer",
+    };
+    const server = http.createServer(async (req, res) => {
+        if (req.method === "OPTIONS") {
+            res.writeHead(204, {
+                "Access-Control-Allow-Origin": "*",
+                "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Muxo-Workspace-Id, Mcp-Session-Id, mcp-session-id, MCP-Protocol-Version, mcp-protocol-version, Mcp-Method, mcp-method, Mcp-Name, mcp-name",
+                "Access-Control-Expose-Headers": "Mcp-Session-Id, MCP-Protocol-Version, WWW-Authenticate",
+                "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+            });
+            res.end();
+            return;
+        }
+        const url = new URL(req.url || "/", config.baseUrl);
+        const pathname = url.pathname;
+        try {
+            // Public Discovery & Health Endpoints
+            if (pathname === "/health" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    status: "ready",
+                    service: "muxo-platform",
+                    version: MUXO_VERSION,
+                    environment: "production",
+                    live_execution: true,
+                    customer_billing: true,
+                    supplier_spending: true,
+                    fundingMode: "muxo_funded",
+                    lanes: {
+                        composio_sdk: Boolean(config.composioApiKey),
+                        composio_instant: true,
+                        stripe_projects: true,
+                        stripe_billing: Boolean(config.stripeSecretKey),
+                        supermemory_v5: engine.supermemory.isEnabled(),
+                        microsoft_governance: true,
+                    },
+                    billing: {
+                        subscriptions: "configured",
+                        prepaid: "configured",
+                        resources: "configured",
+                        merchantOfRecord: "muxo_pays_suppliers",
+                    },
+                    surfaces: {
+                        consoleUrl: `${config.baseUrl}/`,
+                        landingUrl: `${config.baseUrl}/landing`,
+                        publicWebUrl: config.publicWebUrl,
+                        docsUrl: config.docsUrl,
+                    },
+                    mcpToolsCount: MUXO_MCP_TOOLS.length,
+                });
+                return;
+            }
+            if (pathname === "/.well-known/jwks.json" && req.method === "GET") {
+                sendJson(res, 200, {
+                    keys: [
+                        {
+                            kty: "OKP",
+                            crv: "Ed25519",
+                            use: "sig",
+                            alg: "EdDSA",
+                            kid: "muxo-governance-ed25519-v1",
+                        },
+                    ],
+                });
+                return;
+            }
+            if ((pathname === "/.well-known/oauth-protected-resource" ||
+                pathname === "/.well-known/oauth-protected-resource/mcp") &&
+                req.method === "GET") {
+                const proto = String(req.headers["x-forwarded-proto"] || "http").split(",")[0].trim();
+                const requestOrigin = req.headers.host
+                    ? `${proto}://${req.headers.host}`
+                    : config.baseUrl;
+                const resource = pathname === "/.well-known/oauth-protected-resource/mcp"
+                    ? `${requestOrigin}/mcp`
+                    : requestOrigin;
+                sendJson(res, 200, {
+                    resource,
+                    authorization_servers: [requestOrigin],
+                    bearer_methods_supported: ["header"],
+                    scopes_supported: ["mcp:tools", "muxo:mcp", "muxo:read", "muxo:execute", "muxo:provision"],
+                    resource_documentation: `${config.docsUrl}/quickstart`,
+                    mcp_endpoint: `${requestOrigin}/mcp`,
+                });
+                return;
+            }
+            if ((pathname === "/.well-known/oauth-authorization-server" ||
+                pathname === "/.well-known/openid-configuration" ||
+                pathname === "/.well-known/oauth-authorization-server/mcp") &&
+                req.method === "GET") {
+                const proto = String(req.headers["x-forwarded-proto"] || "http").split(",")[0].trim();
+                const requestOrigin = req.headers.host
+                    ? `${proto}://${req.headers.host}`
+                    : config.baseUrl;
+                sendJson(res, 200, {
+                    issuer: requestOrigin,
+                    authorization_endpoint: `${requestOrigin}/oauth/authorize`,
+                    token_endpoint: `${requestOrigin}/oauth/token`,
+                    registration_endpoint: `${requestOrigin}/oauth/register`,
+                    userinfo_endpoint: `${requestOrigin}/oauth/userinfo`,
+                    jwks_uri: `${requestOrigin}/.well-known/jwks.json`,
+                    scopes_supported: [
+                        "mcp:tools",
+                        "muxo:mcp",
+                        "muxo:read",
+                        "muxo:execute",
+                        "muxo:provision",
+                        "openid",
+                        "profile",
+                        "email",
+                    ],
+                    response_types_supported: ["code"],
+                    grant_types_supported: ["authorization_code", "refresh_token"],
+                    token_endpoint_auth_methods_supported: [
+                        "none",
+                        "client_secret_post",
+                        "client_secret_basic",
+                    ],
+                    code_challenge_methods_supported: ["S256", "plain"],
+                    client_id_metadata_document_supported: true,
+                    authorization_response_iss_parameter_supported: true,
+                    service_documentation: `${config.docsUrl}/quickstart`,
+                });
+                return;
+            }
+            if (pathname === "/.well-known/openai-apps-challenge" && req.method === "GET") {
+                const challenge = process.env.OPENAI_APPS_CHALLENGE ||
+                    "muxo-openai-apps-domain-verified";
+                res.writeHead(200, {
+                    "Content-Type": "text/plain; charset=utf-8",
+                    "Access-Control-Allow-Origin": "*",
+                });
+                res.end(challenge);
+                return;
+            }
+            if (pathname === "/oauth/register" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const clientId = typeof body.client_id === "string" && body.client_id.trim()
+                    ? body.client_id.trim()
+                    : `muxo_client_${crypto.randomBytes(8).toString("hex")}`;
+                const clientRecord = {
+                    client_id: clientId,
+                    client_name: String(body.client_name || "OpenAI Plugin MCP Client"),
+                    redirect_uris: Array.isArray(body.redirect_uris)
+                        ? body.redirect_uris.map(String)
+                        : [
+                            "https://chatgpt.com/connector_platform_oauth_redirect",
+                            "http://127.0.0.1:3118/oauth/callback",
+                        ],
+                    grant_types: Array.isArray(body.grant_types)
+                        ? body.grant_types.map(String)
+                        : ["authorization_code", "refresh_token"],
+                    response_types: Array.isArray(body.response_types)
+                        ? body.response_types.map(String)
+                        : ["code"],
+                    token_endpoint_auth_method: String(body.token_endpoint_auth_method || "none"),
+                    client_id_issued_at: Math.floor(Date.now() / 1000),
+                };
+                oauthClients.set(clientId, clientRecord);
+                sendJson(res, 201, clientRecord);
+                return;
+            }
+            if (pathname === "/oauth/authorize" && req.method === "GET") {
+                const parsed = parseAuthorizeRequest(url.searchParams);
+                const wantsJson = url.searchParams.get("format") === "json" ||
+                    String(req.headers.accept || "").includes("application/json");
+                if ("error" in parsed) {
+                    if (wantsJson) {
+                        sendJson(res, 400, { error: "invalid_request", error_description: parsed.error }, { "Cache-Control": "no-store" });
+                    }
+                    else {
+                        res.writeHead(400, consentPageHeaders);
+                        res.end(renderOAuthConsentHtml({ error: parsed.error }));
+                    }
+                    return;
+                }
+                if (wantsJson) {
+                    sendJson(res, 401, {
+                        ok: false,
+                        code: "interactive_sign_in_required",
+                        error: "Open this authorization URL in a browser to sign in and approve access.",
+                        authorizeUrl: url.toString(),
+                    });
+                    return;
+                }
+                const clerk = clerkConfig();
+                res.writeHead(200, consentPageHeaders);
+                res.end(renderOAuthConsentHtml({
+                    clientName: parsed.clientName,
+                    redirectOrigin: oauthRedirectOrigin(parsed.redirectUri),
+                    clerk: clerk ? { publishableKey: clerk.publishableKey, frontendApi: clerk.frontendApi } : null,
+                    request: {
+                        client_id: parsed.clientId,
+                        redirect_uri: parsed.redirectUri,
+                        state: parsed.state,
+                        code_challenge: parsed.codeChallenge || "",
+                        code_challenge_method: parsed.codeChallengeMethod || "",
+                        scope: parsed.scope,
+                    },
+                }));
+                return;
+            }
+            if (pathname === "/oauth/authorize" && req.method === "POST") {
+                const auth = await authenticate(req);
+                // A person must approve; agent API keys cannot grant themselves new access.
+                if (!signedInPerson(auth)) {
+                    sendJson(res, 401, { ok: false, code: "auth_required", error: "Sign in to approve this connection." });
+                    return;
+                }
+                const raw = await readBody(req);
+                const contentType = String(req.headers["content-type"] || "");
+                const params = contentType.includes("application/json")
+                    ? parseOAuthFormBody(raw, "application/json", "")
+                    : new URLSearchParams(raw);
+                const parsed = parseAuthorizeRequest(params);
+                if ("error" in parsed) {
+                    sendJson(res, 400, { ok: false, error: parsed.error });
+                    return;
+                }
+                const redirectTarget = new URL(parsed.redirectUri);
+                if (parsed.state)
+                    redirectTarget.searchParams.set("state", parsed.state);
+                redirectTarget.searchParams.set("iss", requestOriginOf(req));
+                if (params.get("decision") === "deny") {
+                    redirectTarget.searchParams.set("error", "access_denied");
+                    sendJson(res, 200, { ok: true, redirect: redirectTarget.toString() });
+                    return;
+                }
+                const now = Date.now();
+                for (const [c, rec] of oauthCodes)
+                    if (rec.expiresAt < now)
+                        oauthCodes.delete(c);
+                const code = oauthSecretToken("muxo_code");
+                oauthCodes.set(code, {
+                    userId: auth.ctx.user.id,
+                    workspaceId: auth.ctx.workspace.id,
+                    clientId: parsed.clientId,
+                    clientName: parsed.clientName,
+                    redirectUri: parsed.redirectUri,
+                    scope: parsed.scope,
+                    codeChallenge: parsed.codeChallenge,
+                    codeChallengeMethod: parsed.codeChallengeMethod,
+                    expiresAt: now + OAUTH_CODE_TTL_MS,
+                });
+                redirectTarget.searchParams.set("code", code);
+                sendJson(res, 200, { ok: true, redirect: redirectTarget.toString(), workspaceId: auth.ctx.workspace.id });
+                return;
+            }
+            if (pathname === "/oauth/token" && req.method === "POST") {
+                const form = parseOAuthFormBody(await readBody(req), String(req.headers["content-type"] || ""), String(req.headers.authorization || ""));
+                const grantType = form.get("grant_type") || "";
+                const tokenHeaders = { "Cache-Control": "no-store", Pragma: "no-cache" };
+                const oauthError = (error, description) => sendJson(res, 400, { error, error_description: description }, tokenHeaders);
+                if (grantType === "authorization_code") {
+                    const code = form.get("code") || "";
+                    const rec = oauthCodes.get(code);
+                    if (!rec)
+                        return oauthError("invalid_grant", "Authorization code is invalid or was already used.");
+                    oauthCodes.delete(code);
+                    if (rec.expiresAt < Date.now())
+                        return oauthError("invalid_grant", "Authorization code expired.");
+                    const clientId = form.get("client_id");
+                    if (clientId && clientId !== rec.clientId)
+                        return oauthError("invalid_grant", "client_id does not match.");
+                    const redirectUri = form.get("redirect_uri");
+                    if (redirectUri && redirectUri !== rec.redirectUri) {
+                        return oauthError("invalid_grant", "redirect_uri does not match.");
+                    }
+                    if (rec.codeChallenge) {
+                        const check = await verifyPkce(form.get("code_verifier") || "", rec.codeChallenge, rec.codeChallengeMethod);
+                        if (check === "missing")
+                            return oauthError("invalid_grant", "code_verifier is required.");
+                        if (check === "mismatch")
+                            return oauthError("invalid_grant", "code_verifier does not match.");
+                    }
+                    const ws = store.getWorkspace(rec.workspaceId);
+                    if (!ws || !store.userCanAccessWorkspace(rec.userId, ws.id)) {
+                        return oauthError("invalid_grant", "Workspace is no longer available.");
+                    }
+                    const minted = store.createApiKey({
+                        workspaceId: ws.id,
+                        name: oauthConnectionKeyName(rec.clientName),
+                        environment: "live",
+                    });
+                    const refreshToken = oauthSecretToken("muxo_rt");
+                    store.saveOAuthRefreshToken({
+                        refreshToken,
+                        accessToken: minted.secretKey,
+                        keyId: minted.record.id,
+                        workspaceId: ws.id,
+                        clientId: rec.clientId,
+                        scope: rec.scope,
+                    });
+                    sendJson(res, 200, {
+                        access_token: minted.secretKey,
+                        token_type: "Bearer",
+                        expires_in: OAUTH_ACCESS_TOKEN_TTL_SECONDS,
+                        refresh_token: refreshToken,
+                        scope: rec.scope,
+                    }, tokenHeaders);
+                    return;
+                }
+                if (grantType === "refresh_token") {
+                    const refreshToken = form.get("refresh_token") || "";
+                    const rec = refreshToken ? store.getOAuthRefreshToken(refreshToken) : null;
+                    const active = rec ? store.findActiveApiKey(rec.accessToken) : null;
+                    if (!rec || !active || active.id !== rec.keyId) {
+                        if (rec)
+                            store.deleteOAuthRefreshToken(refreshToken);
+                        return oauthError("invalid_grant", "Refresh token is invalid or its access was revoked.");
+                    }
+                    const clientId = form.get("client_id");
+                    if (clientId && clientId !== rec.clientId)
+                        return oauthError("invalid_grant", "client_id does not match.");
+                    // Refresh tokens rotate on every use; the replaced token stops working immediately.
+                    store.deleteOAuthRefreshToken(refreshToken);
+                    const rotated = oauthSecretToken("muxo_rt");
+                    store.saveOAuthRefreshToken({
+                        refreshToken: rotated,
+                        accessToken: rec.accessToken,
+                        keyId: rec.keyId,
+                        workspaceId: rec.workspaceId,
+                        clientId: rec.clientId,
+                        scope: rec.scope,
+                    });
+                    sendJson(res, 200, {
+                        access_token: rec.accessToken,
+                        token_type: "Bearer",
+                        expires_in: OAUTH_ACCESS_TOKEN_TTL_SECONDS,
+                        refresh_token: rotated,
+                        scope: rec.scope || DEFAULT_OAUTH_SCOPE,
+                    }, tokenHeaders);
+                    return;
+                }
+                return oauthError("unsupported_grant_type", "Use grant_type=authorization_code (with PKCE) or refresh_token.");
+            }
+            if (pathname === "/oauth/userinfo" && req.method === "GET") {
+                const resolved = await requireContext(req, res, pathname);
+                if (!resolved)
+                    return;
+                const { ctx } = resolved;
+                const nickname = (ctx.user.email || "").split("@")[0] ||
+                    ctx.user.name.toLowerCase().replace(/\s+/g, ".") ||
+                    ctx.user.id;
+                sendJson(res, 200, {
+                    sub: ctx.user.id,
+                    id: ctx.user.id,
+                    name: ctx.user.name,
+                    email: ctx.user.email,
+                    email_verified: Boolean(ctx.user.email),
+                    nickname,
+                    workspace_id: ctx.workspace.id,
+                    workspace_name: ctx.workspace.name,
+                    tier: ctx.workspace.tier,
+                });
+                return;
+            }
+            if ((pathname === "/api/openapi.json" || pathname === "/openapi.json") &&
+                req.method === "GET") {
+                sendJson(res, 200, {
+                    openapi: "3.1.0",
+                    info: {
+                        title: "Muxo Unified Agent Execution, Infrastructure, Memory & Governance API",
+                        version: MUXO_VERSION,
+                        description: "One governed boundary over Connected Apps, Instant Tools, Cloud Infrastructure, Workspace Memory, and Safety & Approvals.",
+                    },
+                    servers: [{ url: config.baseUrl }],
+                    paths: {
+                        "/health": { get: { summary: "Platform health & 4-pillar readiness" } },
+                        "/mcp": { post: { summary: "Streamable HTTP MCP JSON-RPC 2.0 endpoint (19 tools)" } },
+                        "/skill.md": { get: { summary: "Canonical agent skill & onboarding markdown" } },
+                        "/api/v1/agents/signup": { post: { summary: "Autonomous 2-call agent workspace & mk_live_* key signup" } },
+                        "/api/v1/agents/claim": { post: { summary: "Generate human owner claim link for an agent workspace" } },
+                        "/api/v1/do": { post: { summary: "Natural-language task routing, planning, and optional execution" } },
+                        "/api/v1/byok": {
+                            get: { summary: "List configured BYOK provider keys in the AES-256-GCM vault" },
+                            post: { summary: "Store or rotate a BYOK provider key (0 credit cost when active)" },
+                        },
+                        "/api/v1/byok/{provider}": { delete: { summary: "Delete a BYOK provider key from the vault" } },
+                        "/api/v1/tools": { get: { summary: "Search unified catalogue across instant.*, app.*, and resource.*" } },
+                        "/api/v1/tools/{slug}": { get: { summary: "Inspect tool schema, risk level, credit cost, and LLM context URL" } },
+                        "/api/v1/connections": {
+                            get: { summary: "List connected OAuth accounts and cloud providers" },
+                            post: { summary: "Start managed OAuth connection handoff" },
+                        },
+                        "/api/v1/connections/wait": { post: { summary: "Wait/poll for browser OAuth handoff completion" } },
+                        "/api/v1/plans": {
+                            get: { summary: "List governed action plans" },
+                            post: { summary: "Create governed action plan with Workspace Memory recall & Ed25519 signature" },
+                        },
+                        "/api/v1/plans/{planId}/approve": { post: { summary: "Approve a pending high-risk action plan" } },
+                        "/api/v1/plans/{planId}/execute": { post: { summary: "Execute an approved plan and issue HMAC-SHA256 receipt" } },
+                        "/api/v1/resources": { get: { summary: "List provisioned cloud infrastructure resources" } },
+                        "/api/v1/resources/env": { get: { summary: "Pull decrypted AES-256-GCM workspace environment secrets" } },
+                        "/api/v1/provisioning/connected_accounts": {
+                            get: { summary: "Inspect workspace Stripe v2 Connected Account & requirements" },
+                            post: { summary: "Create a Stripe v2 Connected Account with developer.projects capability" },
+                        },
+                        "/api/v1/provisioning/connected_account_links": {
+                            post: { summary: "Create a Stripe v2 Hosted Account Link (account_onboarding / account_update)" },
+                        },
+                        "/api/v1/provisioning/connected_account_sessions": {
+                            post: { summary: "Create a Stripe Connect Account Session for Accounts v2 Embedded Onboarding" },
+                        },
+                        "/api/v1/provisioning/eligibility": { get: { summary: "Check Stripe v2 Provisioning eligibility" } },
+                        "/api/v1/provisioning/providers": { get: { summary: "List Stripe v2 Provisioning cloud providers" } },
+                        "/api/v1/provisioning/services": { get: { summary: "List Stripe v2 Provisioning service catalog" } },
+                        "/api/v1/provisioning/payment_profile": { get: { summary: "Inspect Stripe v2 Provisioning payment profile" } },
+                        "/api/v1/provisioning/projects": {
+                            get: { summary: "List Stripe v2 Provisioning projects" },
+                            post: { summary: "Create a Stripe v2 Provisioning project" },
+                        },
+                        "/api/v1/provisioning/resources": {
+                            get: { summary: "List Stripe v2 Provisioning resources" },
+                            post: { summary: "Create a Stripe v2 Provisioning resource" },
+                        },
+                        "/api/v1/provisioning/resources/{id}/reveal_access_configuration": {
+                            post: { summary: "Reveal decrypted credentials for a provisioned resource" },
+                        },
+                        "/api/v1/memory": {
+                            get: { summary: "Recall isolated Workspace Memory facts and hybrid context" },
+                            post: { summary: "Store a workspace memory fact or decision" },
+                        },
+                        "/api/v1/memory/facts": { get: { summary: "Query temporal Workspace Memory facts with lineage" } },
+                        "/api/v1/memory/forget": { post: { summary: "Delete matching memories and retire matching facts" } },
+                        "/api/v1/policy": {
+                            get: { summary: "Inspect workspace safety & approval policy" },
+                            post: { summary: "Update workspace safety & approval policy" },
+                        },
+                        "/api/v1/governance": { get: { summary: "Inspect workspace Safety & Approvals identity, policy, and audit chain" } },
+                        "/api/v1/governance/kill-switch": { post: { summary: "Pause or resume workspace execution via kill switch" } },
+                        "/api/v1/governance/scan-context": { post: { summary: "Scan untrusted text for prompt injection before storage or use" } },
+                        "/api/v1/guardrails": {
+                            get: { summary: "List active plain-English guardrails, llmPolicyBrief, policy, and learned memory defaults" },
+                            post: { summary: "Set or reset guardrails in plain English or structured parameterRules" },
+                        },
+                        "/api/v1/guardrails/check": {
+                            post: { summary: "Dry-run evaluate a tool call and arguments against active workspace policy, conditional parameter rules, and memory defaults" },
+                        },
+                        "/api/v1/guardrails/reset": {
+                            post: { summary: "Reset workspace guardrails and parameter rules to Safe Default" },
+                        },
+                        "/approve/{planId}": { get: { summary: "One-click human approval handoff page for a pending plan" } },
+                        "/api/v1/context": {
+                            get: { summary: "Inspect full workspace run context with a plain-English explanation" },
+                            post: { summary: "Inspect workspace run context with an optional query" },
+                        },
+                        "/api/v1/receipts": { get: { summary: "List recent tamper-proof execution receipts with plain-English explanations" } },
+                        "/api/v1/billing/topup": { post: { summary: "Purchase Muxo credits" } },
+                        "/api/v1/billing/settlements": { get: { summary: "Inspect workspace credit activity ledger" } },
+                    },
+                });
+                return;
+            }
+            if (pathname === "/auth.md" && req.method === "GET") {
+                res.writeHead(200, { "Content-Type": "text/markdown; charset=utf-8" });
+                res.end(`# Muxo Authentication & OAuth Handoff Guide
+
+## 1. CLI & Autonomous Agent Signup
+\`\`\`bash
+muxo login --signup --name "my-agent"
+\`\`\`
+Or via HTTP:
+\`\`\`bash
+curl -sX POST ${config.baseUrl}/api/v1/agents/signup -H "Content-Type: application/json" -d '{"agentName":"my-agent"}'
+\`\`\`
+
+## 2. OAuth Connection Handoff
+When \`plan_action\` targets an unconnected \`app.<provider>.*\` tool, Muxo returns \`authHandoff.redirectUrl\`.
+Open the URL in a browser, complete OAuth (which redirects to \`${config.baseUrl}/oauth/callback\`), and call \`wait_for_connection({ provider })\` or \`muxo link <provider> --wait\`.
+
+## 3. Credit Billing & BYOK Support
+Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing topup 1000\`), and Muxo settles upstream execution costs from Muxo's master accounts (\`fundingMode: "muxo_funded"\`), or users can configure their own BYOK provider keys for 0-credit execution.
+`);
+                return;
+            }
+            if (pathname === "/api/setup" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    status: "ready",
+                    mcpToolsCount: MUXO_MCP_TOOLS.length,
+                    mcpEndpoint: `${config.baseUrl}/mcp`,
+                    skillUrl: `${config.baseUrl}/skill.md`,
+                    openApiUrl: `${config.baseUrl}/api/openapi.json`,
+                    oauthCallbackUrl: `${config.baseUrl}/oauth/callback`,
+                    plugins: {
+                        openaiCodex: `${config.baseUrl}/.agents/plugins/marketplace.json`,
+                        claudeDroid: `${config.baseUrl}/.claude-plugin/marketplace.json`,
+                    },
+                });
+                return;
+            }
+            if ((pathname === "/skill.md" || pathname === "/skills.md") && req.method === "GET") {
+                res.writeHead(200, { "Content-Type": "text/markdown; charset=utf-8" });
+                res.end(renderSkillMarkdown(config.baseUrl));
+                return;
+            }
+            if (pathname === "/llms.txt" && req.method === "GET") {
+                res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
+                res.end(`# Muxo\n> Unified agent execution across Connected Apps, Instant Tools, Cloud Infrastructure, Workspace Memory, and Safety Guardrails.\n\n- Skill Document: ${config.baseUrl}/skill.md\n- Auth Guide: ${config.baseUrl}/auth.md\n- OpenAPI 3.1 Spec: ${config.baseUrl}/api/openapi.json\n- MCP Endpoint: ${config.baseUrl}/mcp\n- OAuth Callback Handoff: ${config.baseUrl}/oauth/callback\n- Plugin Marketplace (Codex/OpenAI): ${config.baseUrl}/.agents/plugins/marketplace.json\n- Plugin Marketplace (Claude/Droid): ${config.baseUrl}/.claude-plugin/marketplace.json\n- Console (app.muxo.ai): ${config.baseUrl}/\n- Landing & Provider Canvas (muxo.ai): ${config.baseUrl}/landing\n- Documentation (docs.muxo.ai): ${config.docsUrl}\n\n## Agent-Native Policy, Context & Governance Interface\n- MCP Control Plane (\`get_run_context\`): \`action: "recall" | "remember" | "forget" | "set_guardrail" | "reset_guardrails" | "check_policy" | "governance_status" | "kill_switch" | "scan_context"\`\n- Strict /v1 Organization Brief: \`get_organization({ company_context: { required: false } })\` returns accepted workspace policy facts + learned defaults in \`company_context.packet\`\n- Dry-Run Policy Simulator: \`POST ${config.baseUrl}/api/v1/guardrails/check\` (\`{ "tool_slug": "...", "input": { ... } }\`) or MCP \`get_run_context({ action: "check_policy", tool_slug, input })\`\n- Guardrails & Policy Brief: \`GET/POST ${config.baseUrl}/api/v1/guardrails\`, \`POST ${config.baseUrl}/api/v1/guardrails/reset\`, \`GET ${config.baseUrl}/api/v1/governance\` (includes \`llmPolicyBrief\`)\n- MCP Resources: \`muxo://policy/brief\`, \`muxo://governance/policy\`, \`muxo://context\`, \`muxo://memory/graph\`\n- MCP Prompts: \`context\`, \`policy_guardrails\`, \`governed_execution\`, \`security_audit\`\n`);
+                return;
+            }
+            // Serve Installable Muxo Plugin Manifests & Metadata (Portable OpenAI Agent Plugins + Codex + Claude + Cursor)
+            const pluginJsonRoutes = {
+                "/.agents/plugins/marketplace.json": path.join(ROOT_DIR, ".agents", "plugins", "marketplace.json"),
+                "/.claude-plugin/marketplace.json": path.join(ROOT_DIR, ".claude-plugin", "marketplace.json"),
+                "/plugins/muxo/plugin.json": path.join(ROOT_DIR, "plugins", "muxo", "plugin.json"),
+                "/plugins/muxo/mcp.json": path.join(ROOT_DIR, "plugins", "muxo", "mcp.json"),
+                "/plugins/muxo/.codex-plugin/plugin.json": path.join(ROOT_DIR, "plugins", "muxo", ".codex-plugin", "plugin.json"),
+                "/plugins/muxo/.claude-plugin/plugin.json": path.join(ROOT_DIR, "plugins", "muxo", ".claude-plugin", "plugin.json"),
+                "/plugins/muxo/.cursor-plugin/plugin.json": path.join(ROOT_DIR, "plugins", "muxo", ".cursor-plugin", "plugin.json"),
+                "/plugins/muxo/.app.json": path.join(ROOT_DIR, "plugins", "muxo", ".app.json"),
+                "/plugins/muxo/.mcp.json": path.join(ROOT_DIR, "plugins", "muxo", ".mcp.json"),
+            };
+            if (pluginJsonRoutes[pathname] && req.method === "GET") {
+                const targetFile = pluginJsonRoutes[pathname];
+                if (fs.existsSync(targetFile)) {
+                    sendJson(res, 200, JSON.parse(fs.readFileSync(targetFile, "utf8")));
+                    return;
+                }
+            }
+            const pluginTextRoutes = {
+                "/plugins/muxo/skills/muxo/SKILL.md": {
+                    file: path.join(ROOT_DIR, "plugins", "muxo", "skills", "muxo", "SKILL.md"),
+                    contentType: "text/markdown; charset=utf-8",
+                },
+                "/plugins/muxo/skills/muxo/references/cli.md": {
+                    file: path.join(ROOT_DIR, "plugins", "muxo", "skills", "muxo", "references", "cli.md"),
+                    contentType: "text/markdown; charset=utf-8",
+                },
+                "/plugins/muxo/skills/muxo/references/mcp.md": {
+                    file: path.join(ROOT_DIR, "plugins", "muxo", "skills", "muxo", "references", "mcp.md"),
+                    contentType: "text/markdown; charset=utf-8",
+                },
+                "/plugins/muxo/skills/setup/SKILL.md": {
+                    file: path.join(ROOT_DIR, "plugins", "muxo", "skills", "setup", "SKILL.md"),
+                    contentType: "text/markdown; charset=utf-8",
+                },
+                "/plugins/muxo/skills/muxo-activity-summary/SKILL.md": {
+                    file: path.join(ROOT_DIR, "plugins", "muxo", "skills", "muxo-activity-summary", "SKILL.md"),
+                    contentType: "text/markdown; charset=utf-8",
+                },
+                "/.codex/config.toml": {
+                    file: path.join(ROOT_DIR, ".codex", "config.toml"),
+                    contentType: "text/plain; charset=utf-8",
+                },
+            };
+            if (pluginTextRoutes[pathname] && req.method === "GET") {
+                const entry = pluginTextRoutes[pathname];
+                if (fs.existsSync(entry.file)) {
+                    res.writeHead(200, {
+                        "Content-Type": entry.contentType,
+                        "Access-Control-Allow-Origin": "*",
+                    });
+                    res.end(fs.readFileSync(entry.file, "utf8"));
+                    return;
+                }
+            }
+            if (pathname === "/api/v1/plugin" && req.method === "GET") {
+                const portableManifest = JSON.parse(fs.readFileSync(path.join(ROOT_DIR, "plugins", "muxo", "plugin.json"), "utf8"));
+                const mcpConfig = JSON.parse(fs.readFileSync(path.join(ROOT_DIR, "plugins", "muxo", "mcp.json"), "utf8"));
+                const codexManifest = JSON.parse(fs.readFileSync(path.join(ROOT_DIR, "plugins", "muxo", ".codex-plugin", "plugin.json"), "utf8"));
+                const cursorManifestPath = path.join(ROOT_DIR, "plugins", "muxo", ".cursor-plugin", "plugin.json");
+                const cursorManifest = fs.existsSync(cursorManifestPath)
+                    ? JSON.parse(fs.readFileSync(cursorManifestPath, "utf8"))
+                    : undefined;
+                sendJson(res, 200, {
+                    ok: true,
+                    plugin: portableManifest,
+                    codexPlugin: codexManifest,
+                    cursorPlugin: cursorManifest,
+                    mcp: mcpConfig,
+                    skills: getMuxoMcpSkills().map((s) => ({
+                        name: s.name,
+                        description: s.description,
+                        uri: s.uri,
+                        version: s.version,
+                        files: s.files.length,
+                    })),
+                    marketplaces: {
+                        openaiCodex: `${config.baseUrl}/.agents/plugins/marketplace.json`,
+                        claudeDroid: `${config.baseUrl}/.claude-plugin/marketplace.json`,
+                    },
+                    manifests: {
+                        portablePluginJson: `${config.baseUrl}/plugins/muxo/plugin.json`,
+                        portableMcpJson: `${config.baseUrl}/plugins/muxo/mcp.json`,
+                        onboardingSkill: `${config.baseUrl}/plugins/muxo/skills/setup/SKILL.md`,
+                        activitySummarySkill: `${config.baseUrl}/plugins/muxo/skills/muxo-activity-summary/SKILL.md`,
+                        codexPluginJson: `${config.baseUrl}/plugins/muxo/.codex-plugin/plugin.json`,
+                        cursorPluginJson: `${config.baseUrl}/plugins/muxo/.cursor-plugin/plugin.json`,
+                        codexConfigToml: `${config.baseUrl}/.codex/config.toml`,
+                    },
+                    installCommands: {
+                        codex: "codex plugin add muxo@muxo",
+                        cursor: "/add-plugin muxo",
+                        cliSignup: "muxo login --signup --name my-agent",
+                        oauthHandoff: "muxo link github --wait",
+                    },
+                });
+                return;
+            }
+            // Web Console UI (app.muxo.ai) & SPA deep-links
+            if (isConsolePath(pathname) && req.method === "GET") {
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(renderConsoleHtml());
+                return;
+            }
+            if (pathname === "/downloads/muxo-cli.zip" && req.method === "GET") {
+                res.writeHead(302, {
+                    Location: "https://muxo.ai/plugins/muxo-chatgpt-plugin.zip",
+                    "Cache-Control": "no-store",
+                });
+                res.end();
+                return;
+            }
+            // Built-in Interactive Landing & Provider Canvas (muxo.ai)
+            if (pathname === "/landing" && req.method === "GET") {
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(renderLandingHtml());
+                return;
+            }
+            // Public Stripe Projects Hosted Static Sites (GET /sites/:slug and GET /sites/:slug/*)
+            const siteMatch = pathname.match(/^\/sites\/([^/]+)(?:\/(.*))?$/);
+            if (siteMatch && req.method === "GET") {
+                const siteSlug = decodeURIComponent(siteMatch[1]).replace(/\/+$/, "");
+                const filePath = siteMatch[2] ? decodeURIComponent(siteMatch[2]) : undefined;
+                const htmlContent = engine.getHostedSiteHtml(siteSlug, filePath);
+                if (!htmlContent) {
+                    sendJson(res, 404, {
+                        ok: false,
+                        code: "site_not_found",
+                        error: `Hosted site '${siteSlug}' was not found.`,
+                    });
+                    return;
+                }
+                const contentType = filePath && filePath.endsWith(".css")
+                    ? "text/css; charset=utf-8"
+                    : filePath && filePath.endsWith(".js")
+                        ? "application/javascript; charset=utf-8"
+                        : filePath && filePath.endsWith(".json")
+                            ? "application/json; charset=utf-8"
+                            : "text/html; charset=utf-8";
+                res.writeHead(200, {
+                    "Content-Type": contentType,
+                    "Access-Control-Allow-Origin": "*",
+                    "Cache-Control": "no-store",
+                });
+                res.end(htmlContent);
+                return;
+            }
+            // Workspace claim link: read-only; accepting requires the invited person's verified sign-in.
+            if (pathname.startsWith("/claim/") && req.method === "GET") {
+                const claimSlug = decodeURIComponent(pathname.slice("/claim/".length));
+                const claim = store.getOpenAgentClaim(claimSlug);
+                const wantsHtml = url.searchParams.get("format") !== "json" &&
+                    String(req.headers.accept || "").includes("text/html");
+                if (!claim) {
+                    const error = "This claim link is invalid, expired, or was already used.";
+                    if (wantsHtml) {
+                        res.writeHead(410, consentPageHeaders);
+                        res.end(renderOAuthConsentHtml({
+                            error,
+                            claim: { workspaceName: "", targetEmail: "", action: "", cancelUrl: "/" },
+                        }));
+                    }
+                    else {
+                        sendJson(res, 410, { ok: false, code: "claim_invalid", error });
+                    }
+                    return;
+                }
+                if (!wantsHtml) {
+                    sendJson(res, 200, {
+                        ok: true,
+                        code: "sign_in_required",
+                        message: `Open this link in a browser and sign in as ${claim.targetEmail} to claim the workspace.`,
+                        claim: {
+                            workspaceName: claim.workspace.name,
+                            targetEmail: claim.targetEmail,
+                            status: claim.status,
+                            expiresAt: claim.expiresAt,
+                        },
+                        acceptEndpoint: `${requestOriginOf(req)}/api/v1/claims/${encodeURIComponent(claimSlug)}/accept`,
+                    });
+                    return;
+                }
+                const clerk = clerkConfig();
+                res.writeHead(200, consentPageHeaders);
+                res.end(renderOAuthConsentHtml({
+                    clerk: clerk ? { publishableKey: clerk.publishableKey, frontendApi: clerk.frontendApi } : null,
+                    claim: {
+                        workspaceName: claim.workspace.name,
+                        targetEmail: claim.targetEmail,
+                        action: `/api/v1/claims/${encodeURIComponent(claimSlug)}/accept`,
+                        cancelUrl: "/",
+                    },
+                }));
+                return;
+            }
+            const claimAcceptMatch = pathname.match(/^\/api\/v1\/claims\/([^/]+)\/accept$/);
+            if (claimAcceptMatch && req.method === "POST") {
+                const auth = await authenticate(req);
+                // Agents mint claim links with their own key, so a key must never be able to accept one.
+                if (!signedInPerson(auth)) {
+                    sendJson(res, 401, {
+                        ok: false,
+                        code: "auth_required",
+                        error: "Sign in as the invited person to claim this workspace.",
+                    });
+                    return;
+                }
+                const claimSlug = decodeURIComponent(claimAcceptMatch[1]);
+                const claim = store.getOpenAgentClaim(claimSlug);
+                if (!claim) {
+                    sendJson(res, 410, {
+                        ok: false,
+                        code: "claim_invalid",
+                        error: "This claim link is invalid, expired, or was already used.",
+                    });
+                    return;
+                }
+                const emails = await verifiedEmailsOf(auth);
+                if (!emails.includes(claim.targetEmail.toLowerCase())) {
+                    sendJson(res, 403, {
+                        ok: false,
+                        code: "claim_email_mismatch",
+                        error: `This workspace was offered to ${claim.targetEmail}. Sign in with that verified email to claim it.`,
+                    });
+                    return;
+                }
+                const workspace = store.acceptAgentClaim(claimSlug, auth.ctx.user.id);
+                if (!workspace) {
+                    sendJson(res, 410, {
+                        ok: false,
+                        code: "claim_invalid",
+                        error: "This claim link is invalid, expired, or was already used.",
+                    });
+                    return;
+                }
+                sendJson(res, 200, {
+                    ok: true,
+                    redirect: `${requestOriginOf(req)}/`,
+                    workspace: { id: workspace.id, name: workspace.name },
+                });
+                return;
+            }
+            // Browser OAuth Handoff Callback Route (GET /oauth/callback)
+            if (pathname === "/oauth/callback" && req.method === "GET") {
+                const workspaceId = url.searchParams.get("workspace_id") ||
+                    url.searchParams.get("user_id") ||
+                    bootstrap.workspace.id;
+                const provider = url.searchParams.get("provider") ||
+                    url.searchParams.get("toolkit") ||
+                    url.searchParams.get("appName") ||
+                    "unknown";
+                const connectedAccountId = url.searchParams.get("connected_account_id") ||
+                    url.searchParams.get("connectedAccountId") ||
+                    undefined;
+                const oauthError = url.searchParams.get("error") || url.searchParams.get("error_description");
+                const callbackStatus = oauthError ? "failed" : url.searchParams.get("status") || "success";
+                const handoff = await engine.handleOAuthCallback({
+                    workspaceId,
+                    provider,
+                    connectedAccountId,
+                    status: callbackStatus,
+                });
+                const wantsJson = url.searchParams.get("format") === "json" ||
+                    String(req.headers.accept || "").includes("application/json");
+                if (wantsJson) {
+                    sendJson(res, 200, {
+                        ok: true,
+                        handoff,
+                        message: `${handoff.providerName} OAuth handoff completed (${handoff.status}). Return to your agent or terminal.`,
+                    });
+                    return;
+                }
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(renderOAuthCallbackPageHtml({
+                    providerSlug: handoff.providerSlug,
+                    providerName: handoff.providerName,
+                    status: handoff.status,
+                    workspaceId: handoff.workspaceId,
+                    externalAccountId: handoff.externalAccountId,
+                }));
+                return;
+            }
+            // Public bare /oauth/connect or /connect redirector & zero-OAuth status handler
+            if ((pathname === "/oauth/connect" || pathname === "/connect") && req.method === "GET") {
+                const queryToken = (url.searchParams.get("token") ||
+                    url.searchParams.get("link_token") ||
+                    "").trim();
+                const directRedirect = (url.searchParams.get("redirect_url") ||
+                    url.searchParams.get("url") ||
+                    url.searchParams.get("link") ||
+                    "").trim();
+                const workspaceId = url.searchParams.get("workspace_id") ||
+                    url.searchParams.get("user_id") ||
+                    undefined;
+                const rawProvider = url.searchParams.get("provider") ||
+                    url.searchParams.get("toolkit") ||
+                    "";
+                const cleanProvider = normalizeStripeProjectsProviderSlug(rawProvider) ||
+                    rawProvider.trim().toLowerCase().replace(/^(app\.|resource\.|projects\.)/, "");
+                const wantsJson = url.searchParams.get("format") === "json" ||
+                    String(req.headers.accept || "").includes("application/json");
+                if (queryToken) {
+                    const targetUrl = queryToken.startsWith("s_")
+                        ? `https://backend.composio.dev/api/v3/s/${encodeURIComponent(queryToken.slice(2))}`
+                        : `https://connect.composio.dev/link/${encodeURIComponent(queryToken)}`;
+                    if (wantsJson) {
+                        sendJson(res, 200, { ok: true, status: "pending", redirectUrl: targetUrl });
+                        return;
+                    }
+                    res.writeHead(302, { Location: targetUrl, "Cache-Control": "no-store" });
+                    res.end();
+                    return;
+                }
+                if (directRedirect &&
+                    /^https:\/\/(?:connect|backend)\.composio\.dev\//i.test(directRedirect)) {
+                    if (wantsJson) {
+                        sendJson(res, 200, { ok: true, status: "pending", redirectUrl: directRedirect });
+                        return;
+                    }
+                    res.writeHead(302, { Location: directRedirect, "Cache-Control": "no-store" });
+                    res.end();
+                    return;
+                }
+                if (cleanProvider && !isStripeProjectsExclusiveProvider(cleanProvider)) {
+                    const allWs = [
+                        workspaceId
+                            ? store.getWorkspace(workspaceId)
+                            : store.ensureDefaultWorkspace().workspace,
+                    ].filter(Boolean);
+                    for (const ws of allWs) {
+                        if (!ws)
+                            continue;
+                        const pending = store
+                            .listConnections(ws.id)
+                            .find((c) => c.providerSlug.toLowerCase() === cleanProvider &&
+                            c.redirectUrl &&
+                            !isStripeProjectsExclusiveProvider(c.providerSlug));
+                        if (pending?.redirectUrl) {
+                            const nativeUrl = wrapMuxoConnectUrl(pending.redirectUrl);
+                            if (nativeUrl) {
+                                if (wantsJson) {
+                                    sendJson(res, 200, {
+                                        ok: true,
+                                        provider: cleanProvider,
+                                        status: pending.status,
+                                        redirectUrl: nativeUrl,
+                                    });
+                                    return;
+                                }
+                                res.writeHead(302, { Location: nativeUrl, "Cache-Control": "no-store" });
+                                res.end();
+                                return;
+                            }
+                        }
+                    }
+                }
+                else if (!cleanProvider) {
+                    const allWs = [
+                        workspaceId
+                            ? store.getWorkspace(workspaceId)
+                            : store.ensureDefaultWorkspace().workspace,
+                    ].filter(Boolean);
+                    for (const ws of allWs) {
+                        if (!ws)
+                            continue;
+                        const pending = store
+                            .listConnections(ws.id)
+                            .find((c) => c.status === "pending" &&
+                            c.redirectUrl &&
+                            !isStripeProjectsExclusiveProvider(c.providerSlug));
+                        if (pending?.redirectUrl) {
+                            const nativeUrl = wrapMuxoConnectUrl(pending.redirectUrl);
+                            if (nativeUrl &&
+                                (/^https:\/\/(?:connect|backend)\.composio\.dev\//i.test(nativeUrl) ||
+                                    nativeUrl.includes("/oauth/connect/"))) {
+                                if (wantsJson) {
+                                    sendJson(res, 200, {
+                                        ok: true,
+                                        provider: pending.providerSlug,
+                                        status: "pending",
+                                        redirectUrl: nativeUrl,
+                                    });
+                                    return;
+                                }
+                                res.writeHead(302, { Location: nativeUrl, "Cache-Control": "no-store" });
+                                res.end();
+                                return;
+                            }
+                        }
+                    }
+                }
+                const displayProviderSlug = cleanProvider || "supabase";
+                const displayProviderName = cleanProvider
+                    ? cleanProvider.charAt(0).toUpperCase() + cleanProvider.slice(1)
+                    : "Supabase & Vercel (Stripe Projects)";
+                if (wantsJson) {
+                    sendJson(res, 200, {
+                        ok: true,
+                        status: "active",
+                        lane: "stripe_projects",
+                        provider: displayProviderSlug,
+                        noOAuthRequired: true,
+                        redirectUrl: null,
+                        message: "Provisioned Stripe Projects cloud resources (Supabase, Vercel, Cloudflare, Turso, Neon, etc.) are active immediately with zero OAuth required.",
+                    });
+                    return;
+                }
+                res.writeHead(200, {
+                    "Content-Type": "text/html; charset=utf-8",
+                    "Cache-Control": "no-store",
+                });
+                res.end(renderOAuthCallbackPageHtml({
+                    providerSlug: displayProviderSlug,
+                    providerName: displayProviderName,
+                    status: "active",
+                    workspaceId: workspaceId || "default",
+                    externalAccountId: `sp_conn_${displayProviderSlug}`,
+                }));
+                return;
+            }
+            // Muxo OAuth Connection Handoff (GET/POST /oauth/connect/:token or /connect/:token)
+            const connectPageMatch = pathname.match(/^\/(?:oauth\/)?connect\/([^/]+)$/);
+            if (connectPageMatch && (req.method === "GET" || req.method === "POST")) {
+                const token = decodeURIComponent(connectPageMatch[1]);
+                const workspaceId = url.searchParams.get("workspace_id") ||
+                    url.searchParams.get("user_id") ||
+                    undefined;
+                const providerSlug = url.searchParams.get("provider") ||
+                    url.searchParams.get("toolkit") ||
+                    undefined;
+                const callbackUrl = url.searchParams.get("callback_url") || undefined;
+                const connectedAccountId = url.searchParams.get("connected_account_id") || undefined;
+                if (req.method === "GET") {
+                    const wantsJson = url.searchParams.get("format") === "json" ||
+                        String(req.headers.accept || "").includes("application/json");
+                    const isTestToken = token.startsWith("lk_test");
+                    const forceHtml = url.searchParams.get("render") === "html";
+                    // Redirect real Composio link tokens directly to Composio's native hosted OAuth page
+                    if (!wantsJson && !isTestToken && !forceHtml && (token.startsWith("lk_") || token.startsWith("s_"))) {
+                        const nativeComposioUrl = token.startsWith("s_")
+                            ? `https://backend.composio.dev/api/v3/s/${encodeURIComponent(token.slice(2))}`
+                            : `https://connect.composio.dev/link/${encodeURIComponent(token)}`;
+                        res.writeHead(302, {
+                            Location: nativeComposioUrl,
+                            "Cache-Control": "no-store",
+                        });
+                        res.end();
+                        return;
+                    }
+                    const meta = await fetchMuxoConnectLinkMetadata(token, {
+                        workspaceId,
+                        providerSlug,
+                        callbackUrl,
+                        connectedAccountId,
+                    });
+                    if (url.searchParams.get("continue") === "1" ||
+                        url.searchParams.get("auto") === "1") {
+                        const submitted = await submitMuxoConnectLink(token, {}, {
+                            workspaceId,
+                            providerSlug: meta.toolkitSlug,
+                            callbackUrl: meta.callbackUrl || callbackUrl,
+                            connectedAccountId: meta.connectedAccountId,
+                        });
+                        if (submitted.ok && submitted.redirectUrl) {
+                            res.writeHead(302, { Location: submitted.redirectUrl });
+                            res.end();
+                            return;
+                        }
+                    }
+                    if (wantsJson) {
+                        sendJson(res, 200, { ok: true, handoff: meta });
+                        return;
+                    }
+                    res.writeHead(200, {
+                        "Content-Type": "text/html; charset=utf-8",
+                        "Cache-Control": "no-store",
+                        "Referrer-Policy": "no-referrer",
+                    });
+                    res.end(renderOAuthConnectPageHtml({
+                        token: meta.token,
+                        toolkitSlug: meta.toolkitSlug,
+                        toolkitName: meta.toolkitName,
+                        workspaceId,
+                        authMode: meta.authMode,
+                        status: meta.status,
+                        callbackUrl: meta.callbackUrl || callbackUrl,
+                        expectedInputFields: meta.expectedInputFields,
+                    }));
+                    return;
+                }
+                // POST /oauth/connect/:token
+                const rawBody = await readBody(req);
+                let input = {};
+                const contentType = String(req.headers["content-type"] || "");
+                if (contentType.includes("application/x-www-form-urlencoded")) {
+                    const formParams = new URLSearchParams(rawBody);
+                    for (const [k, v] of formParams.entries()) {
+                        if (v !== "")
+                            input[k] = v;
+                    }
+                }
+                else if (rawBody) {
+                    try {
+                        const parsed = JSON.parse(rawBody);
+                        input =
+                            parsed && typeof parsed.input === "object" && parsed.input !== null
+                                ? parsed.input
+                                : parsed;
+                    }
+                    catch {
+                        input = {};
+                    }
+                }
+                const submitted = await submitMuxoConnectLink(token, input, {
+                    workspaceId,
+                    providerSlug,
+                    callbackUrl,
+                    connectedAccountId,
+                });
+                const wantsJson = url.searchParams.get("format") === "json" ||
+                    String(req.headers.accept || "").includes("application/json") ||
+                    contentType.includes("application/json");
+                if (wantsJson) {
+                    sendJson(res, submitted.ok ? 200 : 400, {
+                        ok: submitted.ok,
+                        status: submitted.status,
+                        redirectUrl: submitted.redirectUrl,
+                        redirect_url: submitted.redirectUrl,
+                        connectedAccountId: submitted.connectedAccountId,
+                        ...(submitted.error ? { error: submitted.error } : {}),
+                    });
+                    return;
+                }
+                if (submitted.ok && submitted.redirectUrl) {
+                    res.writeHead(302, { Location: submitted.redirectUrl });
+                    res.end();
+                    return;
+                }
+                const meta = await fetchMuxoConnectLinkMetadata(token, {
+                    workspaceId,
+                    providerSlug,
+                    callbackUrl,
+                    connectedAccountId,
+                });
+                res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(renderOAuthConnectPageHtml({
+                    token: meta.token,
+                    toolkitSlug: meta.toolkitSlug,
+                    toolkitName: meta.toolkitName,
+                    workspaceId,
+                    authMode: meta.authMode,
+                    status: meta.status,
+                    callbackUrl: meta.callbackUrl || callbackUrl,
+                    expectedInputFields: meta.expectedInputFields,
+                    error: submitted.error || "Could not start authorization handoff.",
+                }));
+                return;
+            }
+            // One-click Plan Approval Handoff Page (GET /approve/:planId)
+            const approvePageMatch = pathname.match(/^\/approve\/([^/]+)$/);
+            if (approvePageMatch && req.method === "GET") {
+                const planId = decodeURIComponent(approvePageMatch[1]);
+                const clerk = clerkConfig();
+                res.writeHead(200, {
+                    "Content-Type": "text/html; charset=utf-8",
+                    "Cache-Control": "no-store",
+                    "Content-Security-Policy": "frame-ancestors 'none'",
+                    "X-Frame-Options": "DENY",
+                    "Referrer-Policy": "no-referrer",
+                });
+                res.end(renderApprovalPageHtml({
+                    planId,
+                    clerk: clerk
+                        ? {
+                            publishableKey: clerk.publishableKey,
+                            frontendApi: clerk.frontendApi,
+                        }
+                        : null,
+                }));
+                return;
+            }
+            // Autonomous Agent 2-Call Signup — Public
+            if ((pathname === "/api/v1/agents/signup" ||
+                pathname === "/api/v1/auth/signup" ||
+                pathname === "/api/signup") &&
+                req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const ownerEmail = String(body.ownerEmail || body.email || "").trim().toLowerCase();
+                if (ownerEmail && !/^[^\s@]+@[^\s@]+$/.test(ownerEmail)) {
+                    sendJson(res, 400, { ok: false, error: "ownerEmail must be a valid email address" });
+                    return;
+                }
+                const created = store.createAutonomousAgentSignup({
+                    agentName: body.agentName ? String(body.agentName) : undefined,
+                    harness: body.harness ? String(body.harness) : undefined,
+                });
+                const claim = store.createAgentClaim({
+                    workspaceId: created.workspace.id,
+                    email: ownerEmail || null,
+                    baseUrl: config.baseUrl,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    agentId: created.user.id,
+                    agentDid: workspaceAgentDid(created.workspace.id),
+                    claim_slug: claim.claimSlug,
+                    claimSlug: claim.claimSlug,
+                    claimUrl: claim.claimUrl,
+                    claim: { ...claim, targetEmail: claim.targetEmail || null },
+                    workspace: {
+                        id: created.workspace.id,
+                        name: created.workspace.name,
+                        slug: created.workspace.slug,
+                        tier: created.workspace.tier,
+                        creditsBalance: created.workspace.creditsBalance,
+                    },
+                    apiKey: created.apiKey,
+                    mcpEndpoint: `${config.baseUrl}/mcp`,
+                    skillUrl: `${config.baseUrl}/skill.md`,
+                    claimEndpoint: `${config.baseUrl}/api/v1/agents/claim`,
+                    governanceDid: engine.governance.getStatus(created.workspace).agentDid,
+                    supermemoryNamespace: engine.supermemory.getWorkspaceNamespace(created.workspace.id),
+                });
+                return;
+            }
+            // Streamable HTTP MCP Endpoint (POST /mcp, GET /mcp, HEAD /mcp, DELETE /mcp)
+            if (pathname === "/mcp" && (req.method === "GET" || req.method === "HEAD" || req.method === "DELETE")) {
+                if ((await authenticate(req)).kind === "invalid") {
+                    sendAuthRequired(req, res, pathname);
+                    return;
+                }
+            }
+            if (pathname === "/mcp" && (req.method === "GET" || req.method === "HEAD")) {
+                const accept = String(req.headers.accept || "");
+                const sessionId = String(req.headers["mcp-session-id"] || "") ||
+                    `mcp_sess_${crypto.randomBytes(8).toString("hex")}`;
+                if (accept.includes("text/event-stream")) {
+                    res.writeHead(200, {
+                        "Content-Type": "text/event-stream; charset=utf-8",
+                        "Cache-Control": "no-cache",
+                        Connection: "keep-alive",
+                        "Mcp-Session-Id": sessionId,
+                        "MCP-Protocol-Version": LATEST_MCP_PROTOCOL_VERSION,
+                        "Access-Control-Allow-Origin": "*",
+                        "Access-Control-Expose-Headers": "Mcp-Session-Id, MCP-Protocol-Version",
+                    });
+                    if (req.method !== "HEAD") {
+                        res.write(`event: endpoint\ndata: ${JSON.stringify({ uri: `${config.baseUrl}/mcp`, sessionId })}\n\n`);
+                    }
+                    res.end();
+                    return;
+                }
+                sendJson(res, 200, {
+                    ok: true,
+                    transport: "streamable-http",
+                    protocolVersion: LATEST_MCP_PROTOCOL_VERSION,
+                    supportedVersions: [...SUPPORTED_MCP_PROTOCOL_VERSIONS],
+                    serverInfo: {
+                        name: "muxo-mcp-server",
+                        title: "Muxo Unified Agent Runtime & Governance MCP Server",
+                        version: MUXO_VERSION,
+                    },
+                    instructions: MUXO_MCP_SERVER_INSTRUCTIONS,
+                    toolsCount: MUXO_MCP_TOOLS.length,
+                    skillsCount: getMuxoMcpSkills().length,
+                }, {
+                    "Mcp-Session-Id": sessionId,
+                    "MCP-Protocol-Version": LATEST_MCP_PROTOCOL_VERSION,
+                });
+                return;
+            }
+            if (pathname === "/mcp" && req.method === "DELETE") {
+                res.writeHead(204, {
+                    "Access-Control-Allow-Origin": "*",
+                });
+                res.end();
+                return;
+            }
+            if (pathname === "/mcp" && req.method === "POST") {
+                const raw = await readBody(req);
+                const parsed = JSON.parse(raw || "{}");
+                const headerCheck = !Array.isArray(parsed)
+                    ? validateMcpHttpHeadersAndMeta({
+                        protocolVersion: String(req.headers["mcp-protocol-version"] || ""),
+                        method: String(req.headers["mcp-method"] || ""),
+                        name: String(req.headers["mcp-name"] || ""),
+                    }, parsed)
+                    : { ok: true, protocolVersion: LATEST_MCP_PROTOCOL_VERSION };
+                if (!headerCheck.ok) {
+                    const fallbackSessionId = String(req.headers["mcp-session-id"] || "") ||
+                        `mcp_sess_${crypto.randomBytes(6).toString("hex")}`;
+                    sendJson(res, 200, {
+                        jsonrpc: "2.0",
+                        id: headerCheck.id,
+                        error: headerCheck.error,
+                    }, {
+                        "Mcp-Session-Id": fallbackSessionId,
+                        "MCP-Protocol-Version": LATEST_MCP_PROTOCOL_VERSION,
+                    });
+                    return;
+                }
+                const resolved = await requireContext(req, res, pathname, !Array.isArray(parsed) && isPublicMcpRequest(parsed));
+                if (!resolved)
+                    return;
+                const { ctx } = resolved;
+                const sessionId = String(req.headers["mcp-session-id"] || "") ||
+                    `mcp_sess_${ctx.workspace.id}`;
+                const responseHeaders = {
+                    "Mcp-Session-Id": sessionId,
+                    "MCP-Protocol-Version": headerCheck.protocolVersion,
+                };
+                if (Array.isArray(parsed)) {
+                    const responses = (await Promise.all(parsed.map((item) => handleJsonRpcMcpRequest(engine, ctx, (item || {}))))).filter((r) => r !== null);
+                    sendJson(res, 200, responses, responseHeaders);
+                    return;
+                }
+                const rpc = parsed;
+                const response = await handleJsonRpcMcpRequest(engine, ctx, rpc);
+                if (!response) {
+                    res.writeHead(202, {
+                        "Access-Control-Allow-Origin": "*",
+                        ...responseHeaders,
+                    });
+                    res.end();
+                    return;
+                }
+                sendJson(res, 200, response, responseHeaders);
+                return;
+            }
+            // Auth Endpoints
+            if (pathname === "/api/v1/auth/config" && req.method === "GET") {
+                const clerk = clerkConfig();
+                sendJson(res, 200, {
+                    ok: true,
+                    provider: clerk ? "clerk" : "password",
+                    clerk: clerk ? { publishableKey: clerk.publishableKey, frontendApi: clerk.frontendApi } : null,
+                    signInUrl: `${requestOriginOf(req)}/login`,
+                });
+                return;
+            }
+            if ((pathname === "/api/v1/auth/register" || pathname === "/api/v1/auth/login") &&
+                req.method === "POST" &&
+                clerkConfig()) {
+                sendJson(res, 410, {
+                    ok: false,
+                    code: "use_clerk",
+                    error: `Muxo accounts use secure sign-in. Open ${requestOriginOf(req)}/login to sign in or create an account.`,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/auth/register" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const created = store.registerUser({
+                    email: String(body.email || ""),
+                    name: String(body.name || "User"),
+                    password: String(body.password || ""),
+                    workspaceName: body.workspaceName ? String(body.workspaceName) : undefined,
+                });
+                const initialKey = store.createApiKey({
+                    workspaceId: created.workspace.id,
+                    name: "Default Live Key",
+                    environment: "live",
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    ...created,
+                    token: created.sessionToken,
+                    apiKey: initialKey.secretKey,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/auth/login" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const loggedIn = store.loginUser(String(body.email || ""), String(body.password || ""));
+                if (!loggedIn) {
+                    sendJson(res, 401, { ok: false, error: "Invalid email or password" });
+                    return;
+                }
+                sendJson(res, 200, { ok: true, ...loggedIn, token: loggedIn.sessionToken });
+                return;
+            }
+            const isPublicRoute = ((pathname === "/api/v1/tools" || pathname === "/v1/tools/search") &&
+                (req.method === "GET" || req.method === "POST")) ||
+                (pathname.startsWith("/api/v1/tools/") && req.method === "GET") ||
+                (pathname === "/api/v1/billing/webhook" && req.method === "POST") ||
+                ((pathname === "/webhooks" ||
+                    pathname === "/webhooks/composio" ||
+                    pathname === "/api/v1/triggers/webhook") &&
+                    req.method === "POST");
+            const resolvedCtx = await requireContext(req, res, pathname, isPublicRoute);
+            if (!resolvedCtx)
+                return;
+            const { ctx, auth } = resolvedCtx;
+            // Console Bootstrap
+            if (pathname === "/api/v1/bootstrap" && req.method === "GET") {
+                const org = engine.getOrganization(ctx).organization;
+                const guardrailsSummary = engine.getGuardrailsSummary(ctx);
+                sendJson(res, 200, {
+                    ok: true,
+                    profile: engine.getProfile(ctx),
+                    organization: org,
+                    governance: engine.governance.getStatus(),
+                    llmPolicyBrief: guardrailsSummary.llmPolicyBrief,
+                    plainEnglishGuardrails: guardrailsSummary.plainEnglish,
+                    activeMemoryDefaults: guardrailsSummary.activeDefaults,
+                    activeGuardrails: guardrailsSummary.activeGuardrails,
+                    supermemory: {
+                        enabled: engine.supermemory.isEnabled(),
+                        namespace: engine.supermemory.getWorkspaceNamespace(ctx.workspace.id),
+                        activeDefaults: guardrailsSummary.activeDefaults,
+                        activeGuardrails: guardrailsSummary.activeGuardrails,
+                    },
+                    surfaces: {
+                        publicWebUrl: config.publicWebUrl,
+                        docsUrl: config.docsUrl,
+                        landingUrl: `${config.baseUrl}/landing`,
+                    },
+                    apiKeys: store.listApiKeys(ctx.workspace.id),
+                    byokKeys: store.listByokKeys(ctx.workspace.id),
+                    defaultApiKey: ctx.workspace.id === bootstrap.workspace.id ? bootstrap.defaultApiKey || null : null,
+                    workspaces: store.listUserWorkspaces(ctx.user.id, ctx.workspace.id),
+                    connections: store.listConnections(ctx.workspace.id),
+                    resources: store.listResources(ctx.workspace.id),
+                    plans: store.listPlans(ctx.workspace.id, 25),
+                    runs: store.listRuns(ctx.workspace.id, 25),
+                });
+                return;
+            }
+            // Multi-Workspace & Team API Key Onboarding Endpoints
+            if (pathname === "/api/v1/workspaces" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    currentWorkspaceId: ctx.workspace.id,
+                    workspaces: store.listUserWorkspaces(ctx.user.id, ctx.workspace.id),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/workspaces" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const name = String(body.name || body.workspaceName || "Team Workspace").trim();
+                const teamName = body.teamName ? String(body.teamName).trim() : null;
+                const switchActive = body.switchActive !== false;
+                const created = store.createWorkspaceForUser({
+                    userId: ctx.user.id,
+                    name,
+                    teamName,
+                    switchActive,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    ...created,
+                    workspaces: store.listUserWorkspaces(ctx.user.id, created.workspace.id),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/workspaces/switch" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const workspaceId = String(body.workspaceId || body.workspace_id || "").trim();
+                const switched = store.switchUserWorkspace(ctx.user.id, workspaceId);
+                if (!switched) {
+                    sendJson(res, 404, {
+                        ok: false,
+                        error: "Workspace not found or not linked to your account",
+                    });
+                    return;
+                }
+                sendJson(res, 200, {
+                    ok: true,
+                    ...switched,
+                    workspaces: store.listUserWorkspaces(ctx.user.id, switched.workspace.id),
+                });
+                return;
+            }
+            if ((pathname === "/api/v1/workspaces/join" || pathname === "/api/v1/auth/key") &&
+                req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const rawKey = String(body.apiKey || body.api_key || body.key || "").trim();
+                const hasExplicitSession = Boolean(String(req.headers.authorization || "").trim()) &&
+                    ctx.authType === "session";
+                const joined = store.joinWorkspaceWithApiKey({
+                    apiKey: rawKey,
+                    userId: hasExplicitSession ? ctx.user.id : null,
+                    switchActive: body.switchActive !== false,
+                });
+                if (!joined) {
+                    sendJson(res, 401, {
+                        ok: false,
+                        error: "Invalid or revoked workspace API key (expected mk_live_... or mk_test_...)",
+                    });
+                    return;
+                }
+                const sessionToken = joined.user && !hasExplicitSession
+                    ? store.createSession(joined.user.id, joined.workspace.id)
+                    : undefined;
+                sendJson(res, 200, {
+                    ok: true,
+                    workspace: joined.workspace,
+                    keyRecord: joined.keyRecord,
+                    user: joined.user,
+                    membership: joined.membership,
+                    ...(sessionToken ? { sessionToken, token: sessionToken } : {}),
+                    workspaces: joined.user
+                        ? store.listUserWorkspaces(joined.user.id, joined.workspace.id)
+                        : [],
+                });
+                return;
+            }
+            if ((pathname === "/api/v1/workspaces/onboard-team" ||
+                pathname === "/api/v1/teams/onboard") &&
+                req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const teamName = String(body.teamName || body.team_name || body.name || "Engineering Team").trim();
+                const role = (body.role ? String(body.role) : "operator");
+                const mode = body.mode === "dedicated_workspace" ? "dedicated_workspace" : "shared_workspace";
+                const inviteEmail = body.inviteEmail || body.email ? String(body.inviteEmail || body.email).trim() : null;
+                const kit = store.onboardTeam({
+                    currentWorkspaceId: ctx.workspace.id,
+                    userId: ctx.user.id,
+                    userEmail: ctx.user.email,
+                    teamName,
+                    role,
+                    mode,
+                    scopes: Array.isArray(body.scopes) ? body.scopes : undefined,
+                    inviteEmail,
+                    baseUrl: config.baseUrl,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    kit,
+                    onboardingKit: kit,
+                    ...kit,
+                    workspaces: store.listUserWorkspaces(ctx.user.id, ctx.workspace.id),
+                });
+                return;
+            }
+            // Autonomous Agent Claim Link Creation (Authenticated)
+            if (pathname === "/api/v1/agents/claim" && req.method === "POST") {
+                if (auth.kind !== "ok") {
+                    sendAuthRequired(req, res, pathname);
+                    return;
+                }
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const email = String(body.email || body.ownerEmail || "").trim().toLowerCase();
+                if (!email || !/^[^\s@]+@[^\s@]+$/.test(email)) {
+                    sendJson(res, 400, { ok: false, error: "Valid target email is required" });
+                    return;
+                }
+                const claim = store.createAgentClaim({
+                    workspaceId: ctx.workspace.id,
+                    email,
+                    baseUrl: config.baseUrl,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    claim: { ...claim, ownerEmail: email },
+                    ...claim,
+                    claim_slug: claim.claimSlug,
+                    ownerEmail: email,
+                });
+                return;
+            }
+            // Microsoft Agent Governance Status & Audit Verification
+            if (pathname === "/api/v1/governance" && req.method === "GET") {
+                const ws = store.getWorkspace(ctx.workspace.id) || ctx.workspace;
+                const fullReport = engine.governance.getGovernanceStatus(ws);
+                const guardrailsSummary = engine.getGuardrailsSummary(ctx);
+                sendJson(res, 200, {
+                    ok: true,
+                    governance: {
+                        ...engine.governance.getStatus(ws),
+                        modules: fullReport.modules,
+                        trustScore: fullReport.trustScore,
+                        killSwitch: fullReport.killSwitch,
+                        contextPoisoning: fullReport.contextPoisoning,
+                        auditChain: fullReport.auditChain,
+                    },
+                    workspacePolicy: ws.policy,
+                    llmPolicyBrief: guardrailsSummary.llmPolicyBrief,
+                    plainEnglishGuardrails: guardrailsSummary.plainEnglish,
+                    activeMemoryDefaults: guardrailsSummary.activeDefaults,
+                    activeGuardrails: guardrailsSummary.activeGuardrails,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/guardrails" && req.method === "GET") {
+                const summary = engine.getGuardrailsSummary(ctx);
+                sendJson(res, 200, {
+                    ok: true,
+                    ...summary,
+                });
+                return;
+            }
+            if ((pathname === "/api/v1/guardrails/reset" || pathname === "/api/v1/policy/reset") &&
+                req.method === "POST") {
+                const resetResult = await engine.resetWorkspaceGuardrails(ctx);
+                sendJson(res, 200, {
+                    ...resetResult,
+                    humanMessage: "Reset workspace guardrails to Safe Default.",
+                });
+                return;
+            }
+            if ((pathname === "/api/v1/guardrails/check" ||
+                pathname === "/api/v1/guardrails/simulate" ||
+                pathname === "/api/v1/policy/check") &&
+                req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const toolSlug = String(body.tool_slug || body.toolSlug || body.slug || body.tool_id || "instant.web.search").trim();
+                const input = (body.input || body.arguments) || {};
+                const result = await engine.checkToolPolicy(ctx, { toolSlug, input });
+                const summary = engine.getGuardrailsSummary(ctx);
+                sendJson(res, 200, {
+                    ...result,
+                    simulation: result,
+                    llmPolicyBrief: summary.llmPolicyBrief,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/guardrails" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                if (body.reset === true) {
+                    const resetResult = await engine.resetWorkspaceGuardrails(ctx);
+                    sendJson(res, 200, {
+                        ...resetResult,
+                        humanMessage: "Reset workspace guardrails to Safe Default.",
+                    });
+                    return;
+                }
+                const rawParamRules = Array.isArray(body.parameterRules)
+                    ? body.parameterRules
+                    : Array.isArray(body.parameter_rules)
+                        ? body.parameter_rules
+                        : undefined;
+                const prompt = String(body.prompt ||
+                    body.rule ||
+                    body.instruction ||
+                    body.naturalLanguageRule ||
+                    (rawParamRules && rawParamRules.length > 0
+                        ? String(rawParamRules[0]?.description ||
+                            "Structured conditional parameter guardrail")
+                        : "")).trim();
+                if (!prompt && (!rawParamRules || rawParamRules.length === 0)) {
+                    sendJson(res, 400, {
+                        ok: false,
+                        error: "Provide a plain-English guardrail in 'prompt'/'rule' or structured 'parameterRules' (e.g. \"Only allow sending emails to @muxo.ai\" or \"Require approval for Stripe refunds over $50, auto-approve under $50\").",
+                    });
+                    return;
+                }
+                const applied = await engine.applyNaturalLanguageGuardrail(ctx, prompt, {
+                    parameterRules: rawParamRules,
+                    policyPatch: body.policyPatch && typeof body.policyPatch === "object"
+                        ? body.policyPatch
+                        : undefined,
+                    source: rawParamRules ? "mcp_harness" : "deterministic",
+                });
+                sendJson(res, 200, {
+                    ...applied,
+                    policy: applied.workspace.policy,
+                    humanMessage: `Guardrail active: ${applied.guardrail.summary}`,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/governance/kill-switch" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const action = String(body.action || "quarantine").toLowerCase();
+                if (action === "resume" || body.active === false) {
+                    const out = engine.resumeWorkspaceKillSwitch(ctx);
+                    sendJson(res, 200, { ok: true, ...out });
+                    return;
+                }
+                const out = await engine.activateWorkspaceKillSwitch(ctx, {
+                    reason: String(body.reason || "Emergency kill-switch activated by workspace operator"),
+                    action: action === "terminate" || action === "suspend"
+                        ? action
+                        : "quarantine",
+                });
+                sendJson(res, 200, { ok: true, ...out });
+                return;
+            }
+            if (pathname === "/api/v1/governance/scan-context" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const scan = engine.governance.scanMemoryContent({
+                    workspaceId: ctx.workspace.id,
+                    sessionId: String(body.sessionId || "default"),
+                    role: body.role || "user",
+                    content: String(body.content || ""),
+                    recordInDetector: Boolean(body.recordInDetector),
+                });
+                sendJson(res, 200, { ok: true, scan });
+                return;
+            }
+            // Workspace Context Inspector (natural-language friendly)
+            if ((pathname === "/api/v1/context" || pathname === "/v1/context") &&
+                (req.method === "GET" || req.method === "POST")) {
+                const body = req.method === "POST"
+                    ? JSON.parse((await readBody(req)) || "{}")
+                    : {};
+                const query = url.searchParams.get("query") ||
+                    url.searchParams.get("q") ||
+                    (body.query ? String(body.query) : undefined);
+                const runContext = await engine.getRunContext(ctx, query);
+                sendJson(res, 200, { ok: true, ...runContext });
+                return;
+            }
+            // Supermemory v5 Workspace Brain Endpoints
+            if (pathname === "/api/v1/memory" && req.method === "GET") {
+                const query = url.searchParams.get("query") ||
+                    url.searchParams.get("q") ||
+                    undefined;
+                const overview = await engine.getMemoryOverview(ctx, query);
+                sendJson(res, 200, {
+                    ok: true,
+                    ...overview,
+                    activeDefaults: overview.context.activeDefaults || {},
+                    activeGuardrails: overview.context.activeGuardrails || [],
+                });
+                return;
+            }
+            if (pathname === "/api/v1/memory/graph" && req.method === "GET") {
+                const query = url.searchParams.get("query") ||
+                    url.searchParams.get("q") ||
+                    undefined;
+                const graph = await engine.getMemoryGraph(ctx, query);
+                sendJson(res, 200, { ok: true, ...graph });
+                return;
+            }
+            if (pathname === "/api/v1/memory/facts" && req.method === "GET") {
+                const query = url.searchParams.get("query") ||
+                    url.searchParams.get("q") ||
+                    undefined;
+                const includeHistorical = url.searchParams.get("historical") !== "false";
+                const facts = store.listTemporalFacts(ctx.workspace.id, {
+                    includeHistorical,
+                    subject: url.searchParams.get("subject") || undefined,
+                    predicate: url.searchParams.get("predicate") || undefined,
+                    query,
+                    limit: Number(url.searchParams.get("limit") || 50),
+                });
+                sendJson(res, 200, {
+                    ok: true,
+                    activeFacts: facts.filter((f) => f.validTo === null),
+                    historicalFacts: facts.filter((f) => f.validTo !== null),
+                    facts,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/memory/forget" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const query = String(body.query || body.q || "").trim();
+                if (!query) {
+                    sendJson(res, 400, { ok: false, error: "query is required to forget matching memories" });
+                    return;
+                }
+                const pruned = await engine.forgetWorkspaceMemoryMatching(ctx, query);
+                sendJson(res, 200, { ok: true, ...pruned });
+                return;
+            }
+            if (pathname === "/api/v1/memory" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const nlPrompt = String(body.prompt || body.remember || "").trim();
+                if (nlPrompt && !body.content) {
+                    const parsed = parseNaturalLanguageMemoryInstruction(nlPrompt);
+                    if (parsed.isMemoryInstruction) {
+                        const primaryFact = parsed.temporalFacts[0];
+                        const record = await engine.addWorkspaceMemory(ctx, {
+                            title: parsed.title,
+                            content: parsed.content,
+                            kind: parsed.kind,
+                            subject: primaryFact?.subject,
+                            predicate: primaryFact?.predicate,
+                            object: primaryFact?.object,
+                            metadata: {
+                                extractedDefaults: parsed.extractedDefaults,
+                                source: "natural_language_api",
+                            },
+                        });
+                        for (const tf of parsed.temporalFacts) {
+                            store.upsertTemporalFact({
+                                workspaceId: ctx.workspace.id,
+                                subject: tf.subject,
+                                predicate: tf.predicate,
+                                object: tf.object,
+                                summary: tf.summary,
+                                confidence: 0.98,
+                                sourceKind: "preference",
+                                sourceReferenceId: record.id,
+                                metadata: { source: "natural_language_api" },
+                            });
+                        }
+                        const overview = await engine.getMemoryOverview(ctx);
+                        sendJson(res, 201, {
+                            ok: true,
+                            memory: record,
+                            activeDefaults: overview.activeDefaults,
+                            explanation: overview.explanation,
+                            humanMessage: parsed.humanSummary,
+                        });
+                        return;
+                    }
+                    body.content = nlPrompt;
+                }
+                const record = await engine.addWorkspaceMemory(ctx, {
+                    title: String(body.title || "Workspace Fact"),
+                    content: String(body.content || ""),
+                    kind: body.kind || "fact",
+                    metadata: body.metadata || {},
+                    subject: body.subject ? String(body.subject) : undefined,
+                    predicate: body.predicate ? String(body.predicate) : undefined,
+                    object: body.object ? String(body.object) : undefined,
+                });
+                sendJson(res, 201, { ok: true, memory: record });
+                return;
+            }
+            if (pathname.startsWith("/api/v1/memory/") && req.method === "DELETE") {
+                const id = decodeURIComponent(pathname.slice("/api/v1/memory/".length));
+                const deleted = await engine.deleteWorkspaceMemory(ctx, id);
+                sendJson(res, 200, { ok: true, ...deleted });
+                return;
+            }
+            // API Keys
+            if ((pathname === "/api/v1/api-keys" || pathname === "/api/v1/keys") &&
+                req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    apiKeys: store.listApiKeys(ctx.workspace.id),
+                    keys: store.listApiKeys(ctx.workspace.id),
+                });
+                return;
+            }
+            if ((pathname === "/api/v1/api-keys" || pathname === "/api/v1/keys") &&
+                req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const created = store.createApiKey({
+                    workspaceId: ctx.workspace.id,
+                    name: String(body.name || (body.teamName ? `${String(body.teamName)} Team Key` : "API Key")),
+                    environment: body.environment === "test" ? "test" : "live",
+                    scopes: Array.isArray(body.scopes) ? body.scopes : undefined,
+                    teamName: body.teamName ? String(body.teamName) : null,
+                    role: (body.role ? String(body.role) : "operator"),
+                    createdByEmail: ctx.user.email,
+                });
+                sendJson(res, 201, { ok: true, apiKey: created.secretKey, ...created });
+                return;
+            }
+            if ((pathname.startsWith("/api/v1/api-keys/") ||
+                pathname.startsWith("/api/v1/keys/")) &&
+                req.method === "DELETE") {
+                const prefix = pathname.startsWith("/api/v1/api-keys/")
+                    ? "/api/v1/api-keys/"
+                    : "/api/v1/keys/";
+                const keyId = decodeURIComponent(pathname.slice(prefix.length));
+                if (!store.revokeApiKey(ctx.workspace.id, keyId)) {
+                    sendJson(res, 404, { ok: false, error: "API key not found" });
+                    return;
+                }
+                sendJson(res, 200, { ok: true, revoked: keyId });
+                return;
+            }
+            // Profile & Organization (v1 and api/v1)
+            if ((pathname === "/api/v1/profile" || pathname === "/v1/profile") && req.method === "GET") {
+                sendJson(res, 200, { ok: true, ...engine.getProfile(ctx) });
+                return;
+            }
+            if ((pathname === "/api/v1/organization" || pathname === "/v1/organization") && req.method === "GET") {
+                sendJson(res, 200, { ok: true, ...engine.getOrganization(ctx) });
+                return;
+            }
+            // Catalog Search & Inspect
+            if ((pathname === "/api/v1/tools" || pathname === "/v1/tools/search") &&
+                (req.method === "GET" || req.method === "POST")) {
+                const body = req.method === "POST" ? JSON.parse((await readBody(req)) || "{}") : {};
+                const query = url.searchParams.get("query") || body.query || undefined;
+                const lane = (url.searchParams.get("lane") || body.lane) ||
+                    "all";
+                const riskLevel = (url.searchParams.get("risk_level") || body.risk_level) ||
+                    undefined;
+                const limit = Number(url.searchParams.get("limit") || body.limit || 30);
+                const results = await engine.searchTools({ query, lane, riskLevel, limit });
+                sendJson(res, 200, { ok: true, ...results });
+                return;
+            }
+            if (pathname.startsWith("/api/v1/tools/") && req.method === "GET") {
+                const slug = decodeURIComponent(pathname.slice("/api/v1/tools/".length));
+                const tool = await engine.inspectTool(slug);
+                sendJson(res, 200, tool);
+                return;
+            }
+            // Connections
+            if (pathname === "/api/v1/connections" && req.method === "GET") {
+                const syncLive = url.searchParams.get("sync") === "true";
+                const provider = url.searchParams.get("provider") || undefined;
+                const status = await engine.connectionStatus(ctx, { provider, syncLive });
+                sendJson(res, 200, { ok: true, ...status });
+                return;
+            }
+            if (pathname === "/api/v1/connections" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const connection = await engine.startConnection(ctx, {
+                    provider: String(body.provider || ""),
+                    lane: body.lane,
+                    callbackUrl: body.callbackUrl ? String(body.callbackUrl) : undefined,
+                });
+                sendJson(res, 201, { ok: true, connection });
+                return;
+            }
+            if (pathname === "/api/v1/connections/wait" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const provider = String(body.provider || "");
+                if (body.simulateCallback === true || body.simulate_callback === true) {
+                    await engine.handleOAuthCallback({
+                        workspaceId: ctx.workspace.id,
+                        provider,
+                        status: "success",
+                    });
+                }
+                const result = await engine.waitForConnection(ctx, {
+                    provider,
+                    timeoutSeconds: clampWaitSeconds(body.timeoutSeconds ?? body.timeout_seconds),
+                });
+                sendJson(res, 200, result);
+                return;
+            }
+            const connectionWaitMatch = pathname.match(/^\/api\/v1\/connections\/([^/]+)\/wait$/);
+            if (connectionWaitMatch && req.method === "GET") {
+                const result = await engine.waitForConnection(ctx, {
+                    provider: decodeURIComponent(connectionWaitMatch[1]),
+                    timeoutSeconds: clampWaitSeconds(url.searchParams.get("timeout_seconds") ?? url.searchParams.get("timeoutSeconds")),
+                });
+                sendJson(res, 200, result);
+                return;
+            }
+            // Provisioned Resources & Decrypted Vault Env Pull
+            if (pathname === "/api/v1/resources" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    resources: store.listResources(ctx.workspace.id),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/resources/env" && req.method === "GET") {
+                // Also pull any fresh .env from Stripe Projects workdir if present
+                const workdirSecrets = await engine.stripeProjects
+                    .pullEnvVarsFromWorkdir()
+                    .catch(() => ({}));
+                const vaultSecrets = store.getDecryptedWorkspaceEnv(ctx.workspace.id);
+                const merged = { ...workdirSecrets, ...vaultSecrets };
+                const dotenvLines = [
+                    `# Muxo Encrypted Vault Export — Workspace ${ctx.workspace.slug} (${ctx.workspace.id})`,
+                    `# Generated at ${new Date().toISOString()}`,
+                    ...Object.entries(merged).map(([k, v]) => `${k}=${JSON.stringify(v)}`),
+                ];
+                sendJson(res, 200, {
+                    ok: true,
+                    workspaceId: ctx.workspace.id,
+                    variables: merged,
+                    dotenv: dotenvLines.join("\n") + "\n",
+                });
+                return;
+            }
+            const resourceSecretsMatch = pathname.match(/^\/api\/v1\/resources\/([^/]+)\/secrets$/);
+            if (resourceSecretsMatch && req.method === "GET") {
+                const resourceId = decodeURIComponent(resourceSecretsMatch[1]);
+                const anyRes = store.findResourceAnyWorkspace(resourceId);
+                if (anyRes && anyRes.workspaceId !== ctx.workspace.id) {
+                    sendJson(res, 403, {
+                        ok: false,
+                        code: "resource_workspace_mismatch",
+                        error: "Resource belongs to a different workspace.",
+                    });
+                    return;
+                }
+                const ownedRes = store.getResource(ctx.workspace.id, resourceId);
+                if (!ownedRes) {
+                    sendJson(res, 404, {
+                        ok: false,
+                        code: "resource_not_found",
+                        error: `Resource '${resourceId}' not found in workspace.`,
+                    });
+                    return;
+                }
+                const secrets = store.getDecryptedResourceSecrets(ctx.workspace.id, resourceId);
+                sendJson(res, 200, {
+                    ok: true,
+                    resourceId: ownedRes.id,
+                    resourceName: ownedRes.resourceName,
+                    workspaceId: ctx.workspace.id,
+                    envVarKeys: ownedRes.envVarKeys,
+                    secrets,
+                });
+                return;
+            }
+            // Stripe v2 Provisioning API (`Stripe-Version: 2026-09-30.preview`) Routes
+            if (pathname === "/api/v1/provisioning/audit_log" && req.method === "GET") {
+                const limit = Number(url.searchParams.get("limit") || 50);
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    entries: engine.stripeProjects.getProvisioningAuditLog(limit),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/connected_accounts" && req.method === "GET") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const verifiedAccount = store.getByokKey(ctx.workspace.id, "stripe_connected_account") ||
+                    config.stripeConnectedAccountId ||
+                    "";
+                if (!verifiedAccount) {
+                    sendJson(res, 200, {
+                        ok: true,
+                        apiVersion: engine.stripeProjects.provisioningApiVersion,
+                        connected: false,
+                        account: null,
+                        publishable_key: config.stripePublishableKey || null,
+                    });
+                    return;
+                }
+                const retrieved = await engine.stripeProjects.retrieveConnectedAccount(verifiedAccount, stripeByok);
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    connected: true,
+                    account: retrieved,
+                    publishable_key: config.stripePublishableKey || null,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/connected_accounts" && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const created = await engine.stripeProjects.createConnectedAccount({
+                    contact_email: String(body.contact_email || ctx.user?.email || "owner@muxo.ai"),
+                    display_name: String(body.display_name || ctx.workspace.name || "Muxo Tenant"),
+                    country: body.country ? String(body.country) : "US",
+                    entity_type: body.entity_type === "individual" ? "individual" : "company",
+                    apiKeyOverride: stripeByok,
+                });
+                if (created.id) {
+                    store.setByokKey(ctx.workspace.id, "stripe_connected_account", created.id);
+                }
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...created,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/connected_account_links" && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                let verifiedAccount = store.getByokKey(ctx.workspace.id, "stripe_connected_account") ||
+                    config.stripeConnectedAccountId ||
+                    "";
+                const body = JSON.parse((await readBody(req)) || "{}");
+                if (!verifiedAccount && !body.account && body.auto_create === true) {
+                    const created = await engine.stripeProjects.createConnectedAccount({
+                        contact_email: String(body.contact_email || ctx.user?.email || "owner@muxo.ai"),
+                        display_name: String(body.display_name || ctx.workspace.name || "Muxo Tenant"),
+                        country: body.country ? String(body.country) : "US",
+                        entity_type: body.entity_type === "individual" ? "individual" : "company",
+                        apiKeyOverride: stripeByok,
+                    });
+                    if (created.id) {
+                        store.setByokKey(ctx.workspace.id, "stripe_connected_account", created.id);
+                        verifiedAccount = created.id;
+                    }
+                }
+                const accountId = String(verifiedAccount || body.account || "").trim();
+                if (!accountId) {
+                    sendJson(res, 400, {
+                        ok: false,
+                        error: "No verified connected_account_id is mapped to this tenant workspace.",
+                    });
+                    return;
+                }
+                const link = await engine.stripeProjects.createConnectedAccountLink({
+                    account: accountId,
+                    type: body.type === "account_update" ? "account_update" : "account_onboarding",
+                    fields: body.fields === "eventually_due" ? "eventually_due" : "currently_due",
+                    future_requirements: body.future_requirements === "omit"
+                        ? "omit"
+                        : body.future_requirements === "include"
+                            ? "include"
+                            : undefined,
+                    refresh_url: String(body.refresh_url || `${config.publicWebUrl}/?onboarding=refresh`),
+                    return_url: String(body.return_url || `${config.publicWebUrl}/?onboarding=return`),
+                    apiKeyOverride: stripeByok,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...link,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/connected_account_sessions" && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                let verifiedAccount = store.getByokKey(ctx.workspace.id, "stripe_connected_account") ||
+                    config.stripeConnectedAccountId ||
+                    "";
+                const body = JSON.parse((await readBody(req)) || "{}");
+                if (!verifiedAccount && !body.account && body.auto_create !== false) {
+                    const created = await engine.stripeProjects.createConnectedAccount({
+                        contact_email: String(body.contact_email || ctx.user?.email || "owner@muxo.ai"),
+                        display_name: String(body.display_name || ctx.workspace.name || "Muxo Tenant"),
+                        country: body.country ? String(body.country) : "US",
+                        entity_type: body.entity_type === "individual" ? "individual" : "company",
+                        apiKeyOverride: stripeByok,
+                    });
+                    if (created.id) {
+                        store.setByokKey(ctx.workspace.id, "stripe_connected_account", created.id);
+                        verifiedAccount = created.id;
+                    }
+                }
+                const accountId = String(verifiedAccount || body.account || "").trim();
+                if (!accountId) {
+                    sendJson(res, 400, {
+                        ok: false,
+                        error: "No verified connected_account_id is mapped to this tenant workspace.",
+                    });
+                    return;
+                }
+                const session = await engine.stripeProjects.createConnectedAccountSession({
+                    account: accountId,
+                    enableAccountManagement: Boolean(body.enable_account_management ?? body.enableAccountManagement),
+                    enableNotificationBanner: body.enable_notification_banner !== undefined
+                        ? Boolean(body.enable_notification_banner)
+                        : body.enableNotificationBanner !== undefined
+                            ? Boolean(body.enableNotificationBanner)
+                            : undefined,
+                    disableStripeUserAuthentication: body.disable_stripe_user_authentication !== undefined
+                        ? Boolean(body.disable_stripe_user_authentication)
+                        : body.disableStripeUserAuthentication !== undefined
+                            ? Boolean(body.disableStripeUserAuthentication)
+                            : undefined,
+                    externalAccountCollection: body.external_account_collection !== undefined
+                        ? Boolean(body.external_account_collection)
+                        : body.externalAccountCollection !== undefined
+                            ? Boolean(body.externalAccountCollection)
+                            : undefined,
+                    apiKeyOverride: stripeByok,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    publishable_key: config.stripePublishableKey || null,
+                    embedded_component: "account-onboarding",
+                    collection_options: {
+                        fields: body.fields === "eventually_due" ? "eventually_due" : "currently_due",
+                        future_requirements: body.future_requirements === "omit" ? "omit" : "include",
+                    },
+                    ...session,
+                });
+                return;
+            }
+            const connAccountGetMatch = pathname.match(/^\/api\/v1\/provisioning\/connected_accounts\/([^/]+)$/);
+            if (connAccountGetMatch && req.method === "GET") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const accountId = decodeURIComponent(connAccountGetMatch[1]);
+                const retrieved = await engine.stripeProjects.retrieveConnectedAccount(accountId, stripeByok);
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...retrieved,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/eligibility" && req.method === "GET") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const verifiedContext = store.getByokKey(ctx.workspace.id, "stripe_connected_account") || undefined;
+                const eligibility = await engine.stripeProjects.checkEligibility(stripeByok, verifiedContext);
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...eligibility,
+                });
+                return;
+            }
+            if ((pathname === "/api/v1/provisioning/catalog/providers" ||
+                pathname === "/api/v1/provisioning/providers") &&
+                req.method === "GET") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const verifiedContext = store.getByokKey(ctx.workspace.id, "stripe_connected_account") || undefined;
+                const catalog = url.searchParams.get("catalog") || "prod";
+                const limit = Number(url.searchParams.get("limit") || 100);
+                const page = url.searchParams.get("page") || undefined;
+                const page_url = url.searchParams.get("page_url") || undefined;
+                const development = url.searchParams.get("development") !== null
+                    ? url.searchParams.get("development") === "true"
+                    : undefined;
+                const providers = await engine.stripeProjects.listCatalogProviders({
+                    catalog,
+                    development,
+                    limit,
+                    page,
+                    page_url,
+                    apiKeyOverride: stripeByok,
+                    stripeContext: verifiedContext,
+                });
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...providers,
+                });
+                return;
+            }
+            if ((pathname === "/api/v1/provisioning/catalog/services" ||
+                pathname === "/api/v1/provisioning/services") &&
+                req.method === "GET") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const verifiedContext = store.getByokKey(ctx.workspace.id, "stripe_connected_account") || undefined;
+                const catalog = url.searchParams.get("catalog") || "prod";
+                const limit = Number(url.searchParams.get("limit") || 100);
+                const page = url.searchParams.get("page") || undefined;
+                const page_url = url.searchParams.get("page_url") || undefined;
+                const development = url.searchParams.get("development") !== null
+                    ? url.searchParams.get("development") === "true"
+                    : undefined;
+                const provider_id = url.searchParams.get("provider_id") || undefined;
+                const provider_name = url.searchParams.get("provider_name") || undefined;
+                const services = await engine.stripeProjects.listCatalogServices({
+                    catalog,
+                    development,
+                    limit,
+                    page,
+                    page_url,
+                    provider_id,
+                    provider_name,
+                    apiKeyOverride: stripeByok,
+                    stripeContext: verifiedContext,
+                });
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...services,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/payment_profile" && req.method === "GET") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const verifiedContext = store.getByokKey(ctx.workspace.id, "stripe_connected_account") || undefined;
+                const provider = url.searchParams.get("provider") || undefined;
+                const livemodeParam = url.searchParams.get("livemode");
+                const livemode = livemodeParam !== null ? livemodeParam === "true" : undefined;
+                const profile = await engine.stripeProjects.getPaymentProfile({
+                    provider,
+                    livemode,
+                    apiKeyOverride: stripeByok,
+                    stripeContext: verifiedContext,
+                });
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...profile,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/payment_profile/update_limit" &&
+                req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const verifiedContext = store.getByokKey(ctx.workspace.id, "stripe_connected_account") || undefined;
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const usageLimits = body.usage_limits || {
+                    max_amount: String(body.max_amount ?? "5000"),
+                    currency: String(body.currency || "usd"),
+                    recurring_interval: String(body.recurring_interval || "month"),
+                };
+                const updated = await engine.stripeProjects.updatePaymentProfileLimit({
+                    usage_limits: usageLimits,
+                    provider: body.provider ? String(body.provider) : undefined,
+                    livemode: body.livemode !== undefined ? Boolean(body.livemode) : undefined,
+                    apiKeyOverride: stripeByok,
+                    stripeContext: verifiedContext,
+                });
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...updated,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/payment_method_requests" &&
+                req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const verifiedContext = store.getByokKey(ctx.workspace.id, "stripe_connected_account") || undefined;
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const created = await engine.stripeProjects.createPaymentMethodRequest({
+                    payment_method_owner: body.payment_method_owner === "platform" ||
+                        body.payment_method_owner === "provider"
+                        ? body.payment_method_owner
+                        : undefined,
+                    provider: body.provider ? String(body.provider) : undefined,
+                    source_account: body.source_account ? String(body.source_account) : undefined,
+                    source_customer: body.source_customer ? String(body.source_customer) : undefined,
+                    source_payment_method: body.source_payment_method
+                        ? String(body.source_payment_method)
+                        : undefined,
+                    livemode: body.livemode !== undefined ? Boolean(body.livemode) : undefined,
+                    usage_limits: body.usage_limits,
+                    apiKeyOverride: stripeByok,
+                    stripeContext: verifiedContext,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...created,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/projects" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    object: "v2.list",
+                    data: [
+                        {
+                            id: config.stripeProjectId || `proj_muxo_${ctx.workspace.id}`,
+                            object: "v2.provisioning.project",
+                            name: `${ctx.workspace.name} Cloud Project`,
+                            catalog: "prod",
+                            created: ctx.workspace.createdAt,
+                            livemode: false,
+                        },
+                    ],
+                    next_page_url: null,
+                    previous_page_url: null,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/projects" && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const created = await engine.stripeProjects.createProject({
+                    name: String(body.name || "Muxo Cloud Project"),
+                    catalog: body.catalog || "prod",
+                    project_profile: body.project_profile
+                        ? String(body.project_profile)
+                        : undefined,
+                    apiKeyOverride: stripeByok,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...created,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/provider_connections" &&
+                req.method === "GET") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const limit = Number(url.searchParams.get("limit") || 25);
+                const page = url.searchParams.get("page") || undefined;
+                const provider = url.searchParams.get("provider") || undefined;
+                const connections = engine.stripeProjects.hasStripeV2ApiKey(stripeByok)
+                    ? await engine.stripeProjects.listProviderConnections({
+                        limit,
+                        page,
+                        provider,
+                        apiKeyOverride: stripeByok,
+                    })
+                    : managedProviderConnectionList();
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...connections,
+                });
+                return;
+            }
+            const provConnUnlinkMatch = pathname.match(/^\/api\/v1\/provisioning\/provider_connections\/([^/]+)\/unlink$/);
+            if (provConnUnlinkMatch && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const id = decodeURIComponent(provConnUnlinkMatch[1]);
+                const unlinked = engine.stripeProjects.hasStripeV2ApiKey(stripeByok)
+                    ? await engine.stripeProjects.unlinkProviderConnection(id, stripeByok)
+                    : managedProviderConnectionUnlink(id);
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...unlinked,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/provider_connection_requests" &&
+                req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const reqRes = engine.stripeProjects.hasStripeV2ApiKey(stripeByok)
+                    ? await engine.stripeProjects.createProviderConnectionRequest({
+                        provider: String(body.provider || ""),
+                        configuration: body.configuration && typeof body.configuration === "object"
+                            ? body.configuration
+                            : {},
+                        project: body.project ? String(body.project) : undefined,
+                        apiKeyOverride: stripeByok,
+                    })
+                    : managedProviderConnectionRequest({ provider: String(body.provider || "") });
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...reqRes,
+                });
+                return;
+            }
+            const provConnReqSubmitMatch = pathname.match(/^\/api\/v1\/provisioning\/provider_connection_requests\/([^/]+)\/submit_information$/);
+            if (provConnReqSubmitMatch && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const id = decodeURIComponent(provConnReqSubmitMatch[1]);
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const submitted = engine.stripeProjects.hasStripeV2ApiKey(stripeByok)
+                    ? await engine.stripeProjects.submitProviderConnectionRequestInformation(id, body.submitted_information || body, stripeByok)
+                    : managedProviderConnectionRequest({ id, requestStatus: "complete" });
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...submitted,
+                });
+                return;
+            }
+            const provConnReqGetMatch = pathname.match(/^\/api\/v1\/provisioning\/provider_connection_requests\/([^/]+)$/);
+            if (provConnReqGetMatch && req.method === "GET") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const id = decodeURIComponent(provConnReqGetMatch[1]);
+                const retrieved = engine.stripeProjects.hasStripeV2ApiKey(stripeByok)
+                    ? await engine.stripeProjects.retrieveProviderConnectionRequest(id, stripeByok)
+                    : managedProviderConnectionRequest({ id });
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...retrieved,
+                });
+                return;
+            }
+            const revealAccessMatch = pathname.match(/^\/api\/v1\/provisioning\/resources\/([^/]+)\/reveal_access_configuration$/);
+            if (revealAccessMatch && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const resourceId = decodeURIComponent(revealAccessMatch[1]);
+                const anyRes = store.findResourceAnyWorkspace(resourceId);
+                if (anyRes && anyRes.workspaceId !== ctx.workspace.id) {
+                    sendJson(res, 403, {
+                        ok: false,
+                        code: "resource_workspace_mismatch",
+                        error: "Resource belongs to a different workspace.",
+                    });
+                    return;
+                }
+                if (engine.stripeProjects.hasStripeV2ApiKey(stripeByok)) {
+                    try {
+                        const revealed = await engine.stripeProjects.revealAccessConfiguration(resourceId, stripeByok);
+                        sendJson(res, 200, {
+                            ok: true,
+                            apiVersion: engine.stripeProjects.provisioningApiVersion,
+                            source: "stripe_v2_api",
+                            ...revealed,
+                        });
+                        return;
+                    }
+                    catch {
+                        // Fall through to workspace vault lookup if Stripe v2 returns error
+                    }
+                }
+                const resourceSpecific = store.getDecryptedResourceSecrets(ctx.workspace.id, resourceId);
+                const vaultSecrets = Object.keys(resourceSpecific).length > 0
+                    ? resourceSpecific
+                    : store.getDecryptedWorkspaceEnv(ctx.workspace.id);
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    object: "v2.provisioning.resource.access_configuration",
+                    resource: resourceId,
+                    configuration: vaultSecrets,
+                    created: new Date().toISOString(),
+                    expires_at: null,
+                    livemode: false,
+                    source: "muxo_managed",
+                });
+                return;
+            }
+            const resourceActionMatch = pathname.match(/^\/api\/v1\/provisioning\/resources\/([^/]+)\/(remove|unlink|rotate_credentials|submit_information)$/);
+            if (resourceActionMatch && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const resourceId = decodeURIComponent(resourceActionMatch[1]);
+                const action = resourceActionMatch[2];
+                const body = JSON.parse((await readBody(req)) || "{}");
+                let actionResult;
+                if (!engine.stripeProjects.hasStripeV2ApiKey(stripeByok)) {
+                    actionResult = managedResourceAction(resourceId, action);
+                }
+                else if (action === "remove") {
+                    actionResult = await engine.stripeProjects.removeResource(resourceId, stripeByok);
+                }
+                else if (action === "unlink") {
+                    actionResult = await engine.stripeProjects.unlinkResource(resourceId, stripeByok);
+                }
+                else if (action === "rotate_credentials") {
+                    actionResult = await engine.stripeProjects.rotateResourceCredentials(resourceId, stripeByok);
+                }
+                else {
+                    actionResult = await engine.stripeProjects.submitResourceInformation(resourceId, body.submitted_information || body, stripeByok);
+                }
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...actionResult,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/resources/link" && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const linked = !engine.stripeProjects.hasStripeV2ApiKey(stripeByok)
+                    ? managedResource({
+                        provider: String(body.provider || ""),
+                        serviceRef: String(body.service_ref || ""),
+                        environment: body.environment ? String(body.environment) : "prod",
+                        catalog: body.catalog ? String(body.catalog) : "prod",
+                        status: "active",
+                    })
+                    : await engine.stripeProjects.linkResource({
+                        provider: String(body.provider || ""),
+                        service_ref: String(body.service_ref || ""),
+                        provider_resource_id: body.provider_resource_id
+                            ? String(body.provider_resource_id)
+                            : undefined,
+                        environment: body.environment ? String(body.environment) : "prod",
+                        catalog: body.catalog || "prod",
+                        project: body.project ? String(body.project) : undefined,
+                        apiKeyOverride: stripeByok,
+                    });
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...linked,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/resources" && req.method === "GET") {
+                const resources = store.listResources(ctx.workspace.id);
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    object: "v2.list",
+                    data: resources,
+                    next_page_url: null,
+                    previous_page_url: null,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/resources" && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const providerSlug = String(body.provider || "turso").toLowerCase();
+                const serviceRef = String(body.service_ref || "database").toLowerCase();
+                const resourceName = body.name ? String(body.name) : `${providerSlug}-${serviceRef}`;
+                const created = !engine.stripeProjects.hasStripeV2ApiKey(stripeByok)
+                    ? managedResource({
+                        provider: providerSlug,
+                        serviceRef,
+                        name: resourceName,
+                        environment: body.environment ? String(body.environment) : "prod",
+                        catalog: body.catalog ? String(body.catalog) : "prod",
+                    })
+                    : await engine.stripeProjects.createResource({
+                        provider: providerSlug,
+                        service_ref: serviceRef,
+                        configuration: body.configuration && typeof body.configuration === "object"
+                            ? body.configuration
+                            : {},
+                        name: resourceName,
+                        environment: body.environment ? String(body.environment) : "prod",
+                        catalog: body.catalog || "prod",
+                        project: body.project ? String(body.project) : undefined,
+                        apiKeyOverride: stripeByok,
+                    });
+                const externalId = String(created.id || `prv_res_${Date.now().toString(36)}`);
+                const envKey = `${providerSlug.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_URL`;
+                store.upsertResource({
+                    workspaceId: ctx.workspace.id,
+                    providerSlug,
+                    providerName: providerSlug.toUpperCase(),
+                    serviceSlug: serviceRef,
+                    resourceName,
+                    status: "active",
+                    externalResourceId: externalId,
+                    secrets: { [envKey]: `https://${resourceName}.${providerSlug}.muxo.internal` },
+                    metadata: { source: created.source || "muxo_managed" },
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...created,
+                });
+                return;
+            }
+            const resourceIdMatch = pathname.match(/^\/api\/v1\/provisioning\/resources\/([^/]+)$/);
+            if (resourceIdMatch && (req.method === "GET" || req.method === "POST")) {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const resourceId = decodeURIComponent(resourceIdMatch[1]);
+                if (req.method === "GET") {
+                    const retrieved = engine.stripeProjects.hasStripeV2ApiKey(stripeByok)
+                        ? await engine.stripeProjects.retrieveResource(resourceId, stripeByok)
+                        : managedResource({ id: resourceId });
+                    sendJson(res, 200, {
+                        ok: true,
+                        apiVersion: engine.stripeProjects.provisioningApiVersion,
+                        ...retrieved,
+                    });
+                    return;
+                }
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const updated = engine.stripeProjects.hasStripeV2ApiKey(stripeByok)
+                    ? await engine.stripeProjects.updateResource(resourceId, body.configuration || body, stripeByok)
+                    : managedResource({ id: resourceId, status: "active" });
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...updated,
+                });
+                return;
+            }
+            // Governance Policy
+            if (pathname === "/api/v1/policy" && req.method === "GET") {
+                const summary = engine.getGuardrailsSummary(ctx);
+                sendJson(res, 200, {
+                    ok: true,
+                    policy: summary.policy,
+                    plainEnglish: summary.plainEnglish,
+                    explanation: summary.plainEnglish.explanation,
+                    activeDefaults: summary.activeDefaults,
+                    activeGuardrails: summary.activeGuardrails,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/policy" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const updated = store.updateWorkspacePolicy(ctx.workspace.id, sanitizePolicyPatch(body));
+                const plainEnglish = describePolicyInPlainEnglish(updated.policy);
+                sendJson(res, 200, {
+                    ok: true,
+                    workspace: updated,
+                    plainEnglishGuardrails: plainEnglish,
+                    explanation: plainEnglish.explanation,
+                });
+                return;
+            }
+            // Plans & Approvals & Execution
+            if (pathname === "/api/v1/plans" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    plans: store.listPlans(ctx.workspace.id, 50),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/plans" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const rawFunding = body.fundingMode || body.funding_mode;
+                const fundingMode = rawFunding === "byok" || rawFunding === "customer_funded"
+                    ? "byok"
+                    : rawFunding === "muxo_funded"
+                        ? "muxo_funded"
+                        : undefined;
+                const planned = await engine.planAction(ctx, {
+                    toolSlug: String(body.toolSlug || body.tool_slug || ""),
+                    input: body.input || {},
+                    reason: body.reason ? String(body.reason) : undefined,
+                    fundingMode,
+                });
+                sendJson(res, 201, { ok: true, ...planned });
+                return;
+            }
+            const resolvePlanCtx = (planId) => {
+                const found = store.getPlanById(planId);
+                if (found &&
+                    found.workspaceId !== ctx.workspace.id &&
+                    ctx.authType === "session" &&
+                    store.userCanAccessWorkspace(ctx.user.id, found.workspaceId)) {
+                    const targetWs = store.getWorkspace(found.workspaceId);
+                    if (targetWs) {
+                        return { ...ctx, workspace: targetWs };
+                    }
+                }
+                return ctx;
+            };
+            const planApproveMatch = pathname.match(/^\/api\/v1\/plans\/([^/]+)\/approve$/);
+            if (planApproveMatch && req.method === "POST") {
+                const planId = decodeURIComponent(planApproveMatch[1]);
+                const planCtx = resolvePlanCtx(planId);
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const decision = body.decision === "rejected" || body.decision === "reject"
+                    ? "rejected"
+                    : "approved";
+                const plan = engine.approvePlan(planCtx, planId, decision);
+                sendJson(res, 200, { ok: true, plan });
+                return;
+            }
+            const planWaitMatch = pathname.match(/^\/api\/v1\/plans\/([^/]+)\/wait$/);
+            if (planWaitMatch && (req.method === "POST" || req.method === "GET")) {
+                const planId = decodeURIComponent(planWaitMatch[1]);
+                const planCtx = resolvePlanCtx(planId);
+                const body = req.method === "POST" ? JSON.parse((await readBody(req)) || "{}") : {};
+                const rawTimeout = body.timeoutSeconds ??
+                    body.timeout_seconds ??
+                    url.searchParams.get("timeout_seconds") ??
+                    url.searchParams.get("timeoutSeconds");
+                const waited = await engine.waitForPlanApproval(planCtx, {
+                    planId,
+                    timeoutSeconds: clampWaitSeconds(rawTimeout, 15, 60),
+                });
+                sendJson(res, 200, waited);
+                return;
+            }
+            const planExecuteMatch = pathname.match(/^\/api\/v1\/plans\/([^/]+)\/execute$/);
+            if (planExecuteMatch && req.method === "POST") {
+                const planId = decodeURIComponent(planExecuteMatch[1]);
+                const planCtx = resolvePlanCtx(planId);
+                const plan = engine.getPlan(planCtx, planId);
+                const result = await engine.executePlanForRisk(planCtx, planId, plan.riskLevel);
+                sendJson(res, 200, {
+                    ok: true,
+                    ...result,
+                    settlement: result.receipt?.supplierSettlement || null,
+                });
+                return;
+            }
+            const planGetMatch = pathname.match(/^\/api\/v1\/plans\/([^/]+)$/);
+            if (planGetMatch && req.method === "GET") {
+                const planId = decodeURIComponent(planGetMatch[1]);
+                const planCtx = resolvePlanCtx(planId);
+                const wait = url.searchParams.get("wait") === "true" ||
+                    url.searchParams.get("wait_for_approval") === "true";
+                if (wait) {
+                    const waited = await engine.waitForPlanApproval(planCtx, {
+                        planId,
+                        timeoutSeconds: clampWaitSeconds(url.searchParams.get("timeout_seconds"), 15, 60),
+                    });
+                    sendJson(res, 200, waited);
+                    return;
+                }
+                const plan = engine.getPlan(planCtx, planId);
+                sendJson(res, 200, {
+                    ok: true,
+                    approved: APPROVED_PLAN_STATUSES.has(plan.approvalStatus),
+                    timedOut: false,
+                    plan,
+                });
+                return;
+            }
+            // Runs & Receipts
+            if (pathname === "/api/v1/runs" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    runs: store.listRuns(ctx.workspace.id, 50),
+                });
+                return;
+            }
+            const runCancelMatch = pathname.match(/^\/api\/v1\/runs\/([^/]+)\/cancel$/);
+            if (runCancelMatch && req.method === "POST") {
+                const runId = decodeURIComponent(runCancelMatch[1]);
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const cancelled = engine.cancelRun(ctx, runId, body.reason ? String(body.reason) : undefined);
+                sendJson(res, 200, cancelled);
+                return;
+            }
+            const runGetMatch = pathname.match(/^\/api\/v1\/runs\/([^/]+)$/);
+            if (runGetMatch && req.method === "GET") {
+                const runId = decodeURIComponent(runGetMatch[1]);
+                const run = engine.getRun(ctx, runId);
+                sendJson(res, 200, { ok: true, run });
+                return;
+            }
+            if (pathname === "/api/v1/receipts" && req.method === "GET") {
+                const limit = Math.min(100, Math.max(1, Number(url.searchParams.get("limit") || 25)));
+                const list = engine.listReceipts(ctx, limit);
+                sendJson(res, 200, { ok: true, ...list });
+                return;
+            }
+            if ((pathname === "/api/v1/receipts/verify-chain" ||
+                pathname === "/api/v1/receipts/chain") &&
+                req.method === "GET") {
+                const limit = Math.min(200, Math.max(1, Number(url.searchParams.get("limit") || 100)));
+                const chain = engine.verifyReceiptChain(ctx, limit);
+                sendJson(res, 200, chain);
+                return;
+            }
+            if (pathname.startsWith("/api/v1/receipts/") && req.method === "GET") {
+                const receiptId = decodeURIComponent(pathname.slice("/api/v1/receipts/".length));
+                const verified = engine.getReceipt(ctx, receiptId);
+                sendJson(res, 200, { ok: true, ...verified });
+                return;
+            }
+            // BYOK (Bring Your Own Key) Encrypted Vault Management
+            if (pathname === "/api/v1/byok" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    workspaceId: ctx.workspace.id,
+                    keys: store.listByokKeys(ctx.workspace.id),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/byok" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const provider = String(body.provider || "").trim();
+                const secretKey = String(body.secretKey || body.apiKey || body.key || "").trim();
+                if (!provider || !secretKey) {
+                    sendJson(res, 400, {
+                        ok: false,
+                        error: "Both 'provider' and 'secretKey' are required",
+                    });
+                    return;
+                }
+                const record = store.setByokKey(ctx.workspace.id, provider, secretKey);
+                sendJson(res, 201, {
+                    ok: true,
+                    key: record,
+                    keys: store.listByokKeys(ctx.workspace.id),
+                });
+                return;
+            }
+            if (pathname.startsWith("/api/v1/byok/") && req.method === "DELETE") {
+                const provider = decodeURIComponent(pathname.slice("/api/v1/byok/".length));
+                const deleted = store.deleteByokKey(ctx.workspace.id, provider);
+                sendJson(res, 200, {
+                    ok: true,
+                    deleted,
+                    provider,
+                    keys: store.listByokKeys(ctx.workspace.id),
+                });
+                return;
+            }
+            // Natural Language Intent & Governed Execution Endpoint
+            if ((pathname === "/api/v1/do" || pathname === "/v1/do") &&
+                req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const prompt = String(body.prompt ||
+                    body.instruction ||
+                    body.query ||
+                    body.command ||
+                    body.toolSlug ||
+                    body.tool ||
+                    "").trim();
+                if (!prompt) {
+                    sendJson(res, 400, {
+                        ok: false,
+                        error: "Missing 'prompt' or 'instruction' in request body",
+                    });
+                    return;
+                }
+                const dryRun = body.dryRun === true ||
+                    body.dry_run === true ||
+                    body.planOnly === true ||
+                    body.autoExecute === false ||
+                    body.auto_execute === false;
+                const autoApprove = body.autoApprove !== false &&
+                    body.auto_approve !== false &&
+                    body.approveRisky !== false &&
+                    body.approve_risky !== false;
+                const rawFunding = body.fundingMode || body.funding_mode;
+                const fundingMode = rawFunding === "byok" || rawFunding === "customer_funded"
+                    ? "byok"
+                    : rawFunding === "muxo_funded"
+                        ? "muxo_funded"
+                        : undefined;
+                const result = await engine.doNaturalLanguage(ctx, {
+                    prompt,
+                    input: body.input && typeof body.input === "object"
+                        ? body.input
+                        : undefined,
+                    autoApprove,
+                    dryRun,
+                    planOnly: dryRun,
+                    fundingMode,
+                });
+                sendJson(res, 200, result);
+                return;
+            }
+            // Live Stripe Billing, Credit Top-Up & Supplier Settlement Ledger
+            if ((pathname === "/api/v1/billing/status" || pathname === "/api/v1/billing") &&
+                req.method === "GET") {
+                const ws = store.getWorkspace(ctx.workspace.id);
+                const settlementSummary = store.getSupplierSettlementSummary(ctx.workspace.id);
+                const byokKeys = store.listByokKeys(ctx.workspace.id);
+                sendJson(res, 200, {
+                    ok: true,
+                    workspaceId: ws.id,
+                    workspace: ws,
+                    tier: ws.tier,
+                    creditsBalance: ws.creditsBalance,
+                    creditBalance: ws.creditsBalance,
+                    monthlyActionsUsed: ws.monthlyActionsUsed,
+                    monthlyActionsLimit: ws.monthlyActionsLimit,
+                    stripeConfigured: engine.stripeBilling.isConfigured,
+                    stripeCustomerId: ws.stripeCustomerId,
+                    stripeSubscriptionId: ws.stripeSubscriptionId,
+                    settlementSummary,
+                    byokKeys,
+                    entries: store.listLedgerEntries(ctx.workspace.id, 25),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/billing/ledger" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    entries: store.listLedgerEntries(ctx.workspace.id, 50),
+                    settlementSummary: store.getSupplierSettlementSummary(ctx.workspace.id),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/billing/settlements" && req.method === "GET") {
+                sendJson(res, 200, {
+                    ok: true,
+                    settlementSummary: store.getSupplierSettlementSummary(ctx.workspace.id),
+                    entries: store.listLedgerEntries(ctx.workspace.id, 100),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/billing/topup" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const credits = Math.max(1, Math.min(1000000, Number(body.credits || 1000)));
+                const referenceId = String(body.referenceId || "").trim() ||
+                    `topup_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+                const usdPaid = (credits * 0.01).toFixed(2);
+                const updatedWorkspace = store.addWorkspaceCredits({
+                    workspaceId: ctx.workspace.id,
+                    credits,
+                    referenceId,
+                    description: String(body.description || "").trim() ||
+                        `User purchased +${credits.toLocaleString()} Muxo Credits ($${usdPaid} USD -> Muxo Master Wallet)`,
+                });
+                sendJson(res, 200, {
+                    ok: true,
+                    creditsAdded: credits,
+                    creditBalance: updatedWorkspace.creditsBalance,
+                    creditsBalance: updatedWorkspace.creditsBalance,
+                    usdPaid: Number(usdPaid),
+                    workspace: updatedWorkspace,
+                    settlementSummary: store.getSupplierSettlementSummary(ctx.workspace.id),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/billing/upgrade" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const referenceId = String(body.referenceId || "").trim() ||
+                    `upgrade_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+                const bonusCredits = body.bonusCredits !== undefined ? Number(body.bonusCredits) : 1000;
+                const updatedWorkspace = store.upgradeWorkspaceToStarter({
+                    workspaceId: ctx.workspace.id,
+                    stripeCustomerId: ctx.workspace.stripeCustomerId ||
+                        `cus_muxo_${ctx.workspace.id.slice(3, 11)}`,
+                    stripeSubscriptionId: ctx.workspace.stripeSubscriptionId ||
+                        `sub_muxo_${referenceId.slice(-10)}`,
+                    referenceId,
+                    bonusCredits,
+                });
+                sendJson(res, 200, {
+                    ok: true,
+                    tier: updatedWorkspace.tier,
+                    creditsBalance: updatedWorkspace.creditsBalance,
+                    creditBalance: updatedWorkspace.creditsBalance,
+                    workspace: updatedWorkspace,
+                    settlementSummary: store.getSupplierSettlementSummary(ctx.workspace.id),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/billing/checkout" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const kind = body.kind === "credit_topup" ? "credit_topup" : "starter_subscription";
+                const credits = body.credits ? Number(body.credits) : 1000;
+                const session = await engine.stripeBilling.createCheckoutSession({
+                    workspace: ctx.workspace,
+                    customerEmail: ctx.user.email,
+                    kind,
+                    credits,
+                    returnBaseUrl: body.returnBaseUrl ? String(body.returnBaseUrl) : config.baseUrl,
+                });
+                sendJson(res, 200, { ok: true, ...session });
+                return;
+            }
+            if (pathname === "/api/v1/billing/verify-session" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const verified = await engine.stripeBilling.verifyAndFulfillCheckoutSession(String(body.sessionId || ""), ctx.workspace.id, body.kind === "credit_topup"
+                    ? "credit_topup"
+                    : body.kind === "starter_subscription"
+                        ? "starter_subscription"
+                        : undefined);
+                sendJson(res, 200, { ok: true, ...verified });
+                return;
+            }
+            if (pathname === "/api/v1/billing/webhook" && req.method === "POST") {
+                const rawBody = await readBody(req);
+                const sig = String(req.headers["stripe-signature"] || "");
+                if (!engine.stripeBilling.verifyWebhookSignature(rawBody, sig)) {
+                    sendJson(res, 400, { ok: false, error: "Invalid Stripe webhook signature" });
+                    return;
+                }
+                const event = JSON.parse(rawBody || "{}");
+                if (event.type === "checkout.session.completed") {
+                    const sessionObj = event.data?.object;
+                    if (sessionObj?.id) {
+                        await engine.stripeBilling.verifyAndFulfillCheckoutSession(String(sessionObj.id));
+                    }
+                }
+                sendJson(res, 200, { ok: true, received: true });
+                return;
+            }
+            // Stripe v2 Billing Meter Event Stream (`POST /v2/billing/meter_event_session` + `POST /v2/billing/meter_event_stream`)
+            if (pathname === "/api/v1/billing/meter_events" && req.method === "GET") {
+                const limit = Number(url.searchParams.get("limit") || 50);
+                const summary = engine.stripeBilling.listMeterEvents(ctx.workspace.id, limit);
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...summary,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/billing/meter_events" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const result = await engine.stripeBilling.recordMeterEvent({
+                    workspace: ctx.workspace,
+                    event_name: body.event_name ? String(body.event_name) : undefined,
+                    value: Number(body.value ?? 1),
+                    lane: body.lane ? String(body.lane) : undefined,
+                    tool_slug: body.tool_slug ? String(body.tool_slug) : undefined,
+                    identifier: body.identifier ? String(body.identifier) : undefined,
+                    timestamp: body.timestamp ? String(body.timestamp) : undefined,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...result,
+                });
+                return;
+            }
+            // Stripe v2 Event Destinations & Provisioning Thin Event Webhook Handler
+            if (pathname === "/api/v1/provisioning/event_destinations" &&
+                req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const destination = await engine.stripeProjects.createV2EventDestination({
+                    name: body.name ? String(body.name) : undefined,
+                    url: String(body.url || `${config.baseUrl}/api/v1/provisioning/events`),
+                    events: Array.isArray(body.events) ? body.events.map(String) : undefined,
+                    apiKeyOverride: stripeByok,
+                });
+                sendJson(res, 201, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...destination,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/provisioning/events" && req.method === "POST") {
+                const stripeByok = store.getByokKey(ctx.workspace.id, "stripe");
+                const verifiedContext = store.getByokKey(ctx.workspace.id, "stripe_connected_account") || undefined;
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const handled = await engine.stripeProjects.handleV2ProvisioningEvent({
+                    event: body,
+                    apiKeyOverride: stripeByok,
+                    stripeContext: verifiedContext,
+                });
+                if (handled.revealedConfiguration &&
+                    Object.keys(handled.revealedConfiguration).length > 0 &&
+                    handled.relatedObjectId) {
+                    store.upsertResource({
+                        workspaceId: ctx.workspace.id,
+                        resourceName: String(handled.resource?.name || handled.relatedObjectId),
+                        providerSlug: String(handled.resource?.provider || "neon"),
+                        providerName: String(handled.resource?.provider || "Neon"),
+                        serviceSlug: String(handled.resource?.service_ref || "postgres"),
+                        planSlug: "launch",
+                        status: "active",
+                        secrets: handled.revealedConfiguration,
+                        externalResourceId: handled.relatedObjectId,
+                        metadata: {
+                            region: "aws-us-east-1",
+                        },
+                    });
+                }
+                sendJson(res, 200, {
+                    ok: true,
+                    apiVersion: engine.stripeProjects.provisioningApiVersion,
+                    ...handled,
+                });
+                return;
+            }
+            // Composio Dynamic Enterprise Toolkits, Scoped Auth Configs, Triggers & Multi-Tool Batch Execution
+            if (pathname === "/api/v1/toolkits" && req.method === "GET") {
+                const composioByok = store.getByokKey(ctx.workspace.id, "composio");
+                const category = url.searchParams.get("category") || undefined;
+                const search = url.searchParams.get("search") || url.searchParams.get("query") || undefined;
+                const catalog = await engine.composioSdk.listToolkits({
+                    category,
+                    search,
+                    composioApiKey: composioByok,
+                });
+                sendJson(res, 200, { ok: true, ...catalog });
+                return;
+            }
+            if (pathname === "/api/v1/connections/auth-configs" && req.method === "POST") {
+                const composioByok = store.getByokKey(ctx.workspace.id, "composio");
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const created = await engine.composioSdk.createCustomAuthConfig({
+                    workspaceId: ctx.workspace.id,
+                    toolkitSlug: String(body.toolkitSlug || body.provider || "github"),
+                    name: body.name ? String(body.name) : undefined,
+                    authScheme: body.authScheme === "API_KEY" ? "API_KEY" : "OAUTH2",
+                    scopeMode: body.scopeMode === "full_access" ? "full_access" : "read_only",
+                    customScopes: Array.isArray(body.customScopes)
+                        ? body.customScopes.map(String)
+                        : undefined,
+                    credentials: body.credentials && typeof body.credentials === "object"
+                        ? body.credentials
+                        : undefined,
+                    composioApiKey: composioByok,
+                });
+                sendJson(res, 201, { ok: true, ...created });
+                return;
+            }
+            if (pathname === "/api/v1/triggers" && req.method === "GET") {
+                const provider = url.searchParams.get("provider") || undefined;
+                const triggerSlug = url.searchParams.get("triggerSlug") || url.searchParams.get("trigger_slug") || undefined;
+                const composioByok = store.getByokKey(ctx.workspace.id, "composio");
+                const available = engine.composioSdk.listTriggerTypes(provider);
+                const subscriptions = engine.composioSdk.listActiveTriggers(ctx.workspace.id);
+                const events = engine.composioSdk.listTriggerEvents(ctx.workspace.id, 25);
+                const triggerType = triggerSlug
+                    ? await engine.composioSdk.getTriggerType(triggerSlug, composioByok)
+                    : undefined;
+                sendJson(res, 200, {
+                    ok: true,
+                    availableTriggers: available,
+                    activeSubscriptions: subscriptions,
+                    recentEvents: events,
+                    webhookConfig: engine.composioSdk.getWebhookConfigInfo(),
+                    ...(triggerType ? { triggerType } : {}),
+                });
+                return;
+            }
+            if (pathname === "/api/v1/triggers" && req.method === "POST") {
+                const composioByok = store.getByokKey(ctx.workspace.id, "composio");
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const rawConfig = body.triggerConfig && typeof body.triggerConfig === "object"
+                    ? body.triggerConfig
+                    : body.config && typeof body.config === "object"
+                        ? body.config
+                        : {};
+                const subscription = await engine.composioSdk.enableTrigger({
+                    workspaceId: ctx.workspace.id,
+                    userId: body.userId ? String(body.userId) : undefined,
+                    triggerSlug: String(body.triggerSlug || body.trigger_slug || "GITHUB_COMMIT_EVENT"),
+                    providerSlug: String(body.providerSlug || body.provider || "github"),
+                    connectedAccountId: body.connectedAccountId
+                        ? String(body.connectedAccountId)
+                        : undefined,
+                    webhookUrl: body.webhookUrl ? String(body.webhookUrl) : undefined,
+                    config: rawConfig,
+                    subscribe: body.subscribe === true,
+                    composioApiKey: composioByok,
+                });
+                sendJson(res, 201, { ok: true, subscription });
+                return;
+            }
+            if ((pathname === "/api/v1/triggers/webhook" ||
+                pathname === "/webhooks" ||
+                pathname === "/webhooks/composio") &&
+                req.method === "POST") {
+                const rawBody = await readBody(req);
+                const sigHeader = String(req.headers["webhook-signature"] ||
+                    req.headers["x-composio-webhook-signature"] ||
+                    "").trim();
+                const webhookIdHeader = String(req.headers["webhook-id"] || req.headers["x-composio-webhook-id"] || "").trim();
+                const webhookTimestampHeader = String(req.headers["webhook-timestamp"] ||
+                    req.headers["x-composio-webhook-timestamp"] ||
+                    "").trim();
+                const webhookVersionHeader = String(req.headers["x-composio-webhook-version"] || "").trim();
+                let signatureVerified = false;
+                if (sigHeader) {
+                    const check = await verifyComposioWebhookSignature({
+                        rawPayload: rawBody,
+                        signatureHeader: sigHeader,
+                        webhookIdHeader,
+                        webhookTimestampHeader,
+                        secret: config.composioWebhookSecret,
+                    });
+                    if (config.composioWebhookSecret && !check.verified) {
+                        sendJson(res, 401, {
+                            ok: false,
+                            error: `Invalid Composio webhook signature (${check.reason || "verification_failed"})`,
+                        });
+                        return;
+                    }
+                    signatureVerified = check.verified;
+                }
+                const body = JSON.parse(rawBody || "{}");
+                const envelope = parseComposioWebhookEnvelope(body, {
+                    webhookId: webhookIdHeader || undefined,
+                    webhookTimestamp: webhookTimestampHeader || undefined,
+                    webhookVersion: webhookVersionHeader || undefined,
+                });
+                let targetWorkspaceId = ctx.workspace.id;
+                if (envelope.userId && store.getWorkspace(envelope.userId)) {
+                    targetWorkspaceId = envelope.userId;
+                }
+                if (envelope.eventType === "composio.connected_account.activated" ||
+                    envelope.eventType === "composio.connected_account.expired") {
+                    const nextStatus = envelope.eventType === "composio.connected_account.activated"
+                        ? "active"
+                        : "expired";
+                    store.upsertConnection({
+                        workspaceId: targetWorkspaceId,
+                        lane: "composio_sdk",
+                        providerSlug: envelope.providerSlug,
+                        providerName: envelope.providerSlug.charAt(0).toUpperCase() +
+                            envelope.providerSlug.slice(1),
+                        status: nextStatus,
+                        externalAccountId: envelope.connectedAccountId || null,
+                        metadata: {
+                            webhookEvent: envelope.eventType,
+                            webhookId: envelope.webhookId,
+                            updatedViaWebhookAt: new Date().toISOString(),
+                        },
+                    });
+                    if (nextStatus === "expired") {
+                        engine.composioSdk.disableTriggersMatching({
+                            workspaceId: targetWorkspaceId,
+                            connectedAccountId: envelope.connectedAccountId,
+                        });
+                    }
+                }
+                else if (envelope.eventType === "composio.trigger.disabled") {
+                    engine.composioSdk.disableTriggersMatching({
+                        workspaceId: targetWorkspaceId,
+                        triggerId: envelope.triggerId,
+                        triggerSlug: envelope.triggerSlug,
+                        connectedAccountId: envelope.connectedAccountId,
+                    });
+                }
+                const rawPayloadText = JSON.stringify(envelope.payloadObj);
+                const injectionScan = engine.governance.scanMemoryContent({
+                    workspaceId: targetWorkspaceId,
+                    content: rawPayloadText,
+                });
+                const disposition = injectionScan.safe ? "dispatched" : "quarantined";
+                const eventRecord = {
+                    id: `trgevt_${Date.now()}_${Math.random().toString(36).slice(2, 7)}`,
+                    workspaceId: targetWorkspaceId,
+                    eventType: envelope.eventType,
+                    webhookVersion: envelope.webhookVersion,
+                    signatureVerified,
+                    webhookId: envelope.webhookId,
+                    triggerId: envelope.triggerId,
+                    triggerSlug: envelope.triggerSlug,
+                    providerSlug: envelope.providerSlug,
+                    connectedAccountId: envelope.connectedAccountId,
+                    userId: envelope.userId,
+                    projectId: envelope.projectId,
+                    orgId: envelope.orgId,
+                    receivedAt: new Date().toISOString(),
+                    promptInjectionScan: {
+                        safe: injectionScan.safe,
+                        riskScore: injectionScan.findingsCount * 0.35,
+                        findings: injectionScan.findings.map((f) => `${f.patternId}: ${f.description}`),
+                    },
+                    disposition: disposition,
+                    payloadPreview: envelope.payloadObj,
+                };
+                engine.composioSdk.recordTriggerEvent(eventRecord);
+                sendJson(res, injectionScan.safe ? 200 : 202, {
+                    ok: true,
+                    ...eventRecord,
+                });
+                return;
+            }
+            if (pathname === "/api/v1/plans/batch" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const batchResult = await engine.executeBatchPlans(ctx, {
+                    items: Array.isArray(body.items) ? body.items : [],
+                    // Only a signed-in person may pre-approve pending plans; agent keys never can.
+                    autoApprove: body.autoApprove === true && signedInPerson(auth),
+                });
+                sendJson(res, 200, { ok: true, ...batchResult });
+                return;
+            }
+            // Cloudflare Vectorize Hybrid Semantic + Bi-Temporal Recall, Durable Workflows, and R2 WORM Audit Archive
+            if (pathname === "/api/v1/memory/hybrid" && (req.method === "GET" || req.method === "POST")) {
+                const body = req.method === "POST" ? JSON.parse((await readBody(req)) || "{}") : {};
+                const query = String(body.query ?? body.q ?? url.searchParams.get("query") ?? url.searchParams.get("q") ?? "");
+                const limit = Number(body.limit ?? url.searchParams.get("limit") ?? 10);
+                const hybrid = engine.searchMemoryHybrid(ctx.workspace.id, query, limit);
+                sendJson(res, 200, { ok: true, ...hybrid });
+                return;
+            }
+            if (pathname === "/api/v1/workflows" && req.method === "GET") {
+                const workflows = engine.listDurableWorkflows(ctx.workspace.id);
+                sendJson(res, 200, { ok: true, workflows });
+                return;
+            }
+            if (pathname === "/api/v1/workflows" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const workflow = await engine.startDurableWorkflow(ctx, {
+                    provider: body.provider ? String(body.provider) : undefined,
+                    serviceRef: body.serviceRef || body.service_ref ? String(body.serviceRef || body.service_ref) : undefined,
+                    name: body.name ? String(body.name) : undefined,
+                    region: body.region ? String(body.region) : undefined,
+                });
+                sendJson(res, 201, { ok: true, workflow });
+                return;
+            }
+            const wfAdvanceMatch = pathname.match(/^\/api\/v1\/workflows\/([^/]+)\/advance$/);
+            if (wfAdvanceMatch && req.method === "POST") {
+                const wfId = decodeURIComponent(wfAdvanceMatch[1]);
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const workflow = await engine.advanceDurableWorkflow(ctx, wfId, body);
+                sendJson(res, 200, { ok: true, workflow });
+                return;
+            }
+            if (pathname === "/api/v1/governance/archive" && req.method === "GET") {
+                const archive = engine.exportTamperEvidentArchive(ctx.workspace.id);
+                sendJson(res, 200, { ok: true, ...archive });
+                return;
+            }
+            sendJson(res, 404, { ok: false, error: `Route not found: ${req.method} ${pathname}` });
+        }
+        catch (err) {
+            sendJson(res, err instanceof MuxoToolError ? err.statusCode : 400, errorPayloadFrom(err, "Internal error"));
+        }
+    });
+    return { server, engine, store, defaultApiKey: bootstrap.defaultApiKey };
+}
+// Start server when invoked directly
+const isMain = process.argv[1] &&
+    (process.argv[1].endsWith("server.ts") || process.argv[1].endsWith("server.js"));
+if (isMain) {
+    const config = getConfig();
+    const { server, defaultApiKey } = createMuxoServer(config);
+    server.listen(config.port, () => {
+        console.log(`\n⚡ Muxo Platform running at ${config.baseUrl}`);
+        console.log(`   ├─ Web Console:     ${config.baseUrl}/`);
+        console.log(`   ├─ MCP Server:      ${config.baseUrl}/mcp`);
+        console.log(`   ├─ Agent Skill:     ${config.baseUrl}/skill.md`);
+        console.log(`   └─ Health Check:    ${config.baseUrl}/health`);
+        if (defaultApiKey) {
+            console.log(`\n🔑 Initial Workspace API Key created (save this): ${defaultApiKey}\n`);
+        }
+    });
+}