@muxoai/sdk 1.2.3 → 1.4.2

package/dist/store.d.ts

@@ -0,0 +1,348 @@
+import { DatabaseSync } from "node:sqlite";
+import type { ActionPlan, ApiKeyRecord, ByokKeyRecord, ConnectionRecord, ExecutionReceipt, ExecutionRun, GovernanceDecisionRecord, GovernancePolicy, LedgerEntry, MemoryContextSummary, ProviderLane, ProvisionedResource, RiskLevel, SupplierSettlement, SupplierSettlementSummary, TeamOnboardingKit, TemporalGraphFact, User, Workspace, WorkspaceMembership, WorkspaceMemoryRecord, WorkspaceRole, WorkspaceSummary } from "./types.js";
+export declare const BYOK_PROVIDER_CATALOG: Record<string, {
+    category: "llm" | "supplier";
+    envVarName: string;
+    label: string;
+}>;
+export declare class MuxoStore {
+    readonly db: DatabaseSync;
+    private readonly vaultKey;
+    constructor(dbPath: string, vaultKey: Buffer);
+    private initSchema;
+    /**
+     * Older databases declared receipts.run_id UNIQUE, which blocks cancellation receipts from
+     * superseding a run's original receipt. SQLite cannot drop a constraint, so rebuild the table.
+     */
+    private migrateReceiptsAllowMultiplePerRun;
+    encryptSecrets(workspaceId: string, secrets: Record<string, string>): string;
+    decryptSecrets(workspaceId: string, payloadHex: string | null): Record<string, string>;
+    ensureDefaultWorkspace(): {
+        user: User;
+        workspace: Workspace;
+        defaultApiKey?: string;
+    };
+    private hashPassword;
+    private hashToken;
+    registerUser(params: {
+        email: string;
+        name: string;
+        password: string;
+        workspaceName?: string;
+    }): {
+        user: User;
+        workspace: Workspace;
+        sessionToken: string;
+        apiKey: string;
+    };
+    loginUser(email: string, password: string): {
+        user: User;
+        workspace: Workspace;
+        sessionToken: string;
+    } | null;
+    createSession(userId: string, workspaceId: string): string;
+    resolveAuthToken(token: string, workspaceOverrideId?: string | null): {
+        user: User;
+        workspace: Workspace;
+        authType: "session" | "api_key";
+        actorId: string;
+    } | null;
+    getUser(userId: string): User | null;
+    getWorkspace(workspaceId: string): Workspace | null;
+    ensureWorkspaceMembership(params: {
+        workspaceId: string;
+        userId: string;
+        role?: WorkspaceRole;
+        teamName?: string | null;
+        joinedViaKeyId?: string | null;
+    }): WorkspaceMembership;
+    userCanAccessWorkspace(userId: string, workspaceId: string): boolean;
+    listUserWorkspaces(userId: string, activeWorkspaceId?: string): WorkspaceSummary[];
+    switchUserWorkspace(userId: string, workspaceId: string): {
+        user: User;
+        workspace: Workspace;
+    } | null;
+    createWorkspaceForUser(params: {
+        userId: string;
+        name: string;
+        teamName?: string | null;
+        role?: WorkspaceRole;
+        switchActive?: boolean;
+    }): {
+        workspace: Workspace;
+        apiKey: string;
+        keyRecord: ApiKeyRecord;
+        membership: WorkspaceMembership;
+    };
+    joinWorkspaceWithApiKey(params: {
+        apiKey: string;
+        userId?: string | null;
+        switchActive?: boolean;
+    }): {
+        workspace: Workspace;
+        keyRecord: ApiKeyRecord;
+        user: User | null;
+        membership: WorkspaceMembership | null;
+    } | null;
+    onboardTeam(params: {
+        currentWorkspaceId: string;
+        userId: string;
+        userEmail?: string | null;
+        teamName: string;
+        role?: WorkspaceRole;
+        mode?: "shared_workspace" | "dedicated_workspace";
+        environment?: "live" | "test";
+        scopes?: string[];
+        inviteEmail?: string | null;
+        baseUrl: string;
+    }): TeamOnboardingKit;
+    updateWorkspacePolicy(workspaceId: string, policy: Partial<GovernancePolicy>): Workspace;
+    createApiKey(params: {
+        workspaceId: string;
+        name: string;
+        environment?: "live" | "test";
+        scopes?: string[];
+        teamName?: string | null;
+        role?: WorkspaceRole;
+        createdByEmail?: string | null;
+    }): {
+        record: ApiKeyRecord;
+        secretKey: string;
+    };
+    listApiKeys(workspaceId: string): ApiKeyRecord[];
+    revokeApiKey(workspaceId: string, keyId: string): boolean;
+    /** Looks up an active workspace API key by its raw secret. */
+    findActiveApiKey(secret: string): {
+        id: string;
+        workspaceId: string;
+    } | null;
+    saveOAuthRefreshToken(params: {
+        refreshToken: string;
+        accessToken: string;
+        keyId: string;
+        workspaceId: string;
+        clientId: string;
+        scope: string;
+    }): void;
+    getOAuthRefreshToken(refreshToken: string): {
+        keyId: string;
+        workspaceId: string;
+        clientId: string;
+        scope: string;
+        accessToken: string;
+    } | null;
+    deleteOAuthRefreshToken(refreshToken: string): void;
+    /**
+     * Maps a verified Clerk session to a local user. Only a verified email can link to an
+     * existing account; otherwise a fresh user and workspace are created so an unverified
+     * address can never take over someone else's account.
+     */
+    provisionClerkUser(clerkUserId: string, identity: {
+        email: string | null;
+        emailVerified: boolean;
+        name: string | null;
+    }, ownerWorkspaceId: string | null): User;
+    getClerkLinkedUser(clerkUserId: string): User | null;
+    getUserByEmail(email: string): User | null;
+    upsertConnection(params: {
+        workspaceId: string;
+        lane: ProviderLane;
+        providerSlug: string;
+        providerName: string;
+        status: ConnectionRecord["status"];
+        externalAccountId?: string | null;
+        redirectUrl?: string | null;
+        metadata?: Record<string, unknown>;
+    }): ConnectionRecord;
+    getConnection(id: string): ConnectionRecord | null;
+    listConnections(workspaceId: string): ConnectionRecord[];
+    upsertResource(params: {
+        workspaceId: string;
+        resourceName: string;
+        providerSlug: string;
+        providerName: string;
+        serviceSlug: string;
+        planSlug?: string | null;
+        status: ProvisionedResource["status"];
+        secrets?: Record<string, string>;
+        externalResourceId?: string | null;
+        metadata?: Record<string, unknown>;
+    }): ProvisionedResource;
+    getResource(workspaceId: string, resourceNameOrId: string): ProvisionedResource | null;
+    findResourceAnyWorkspace(resourceNameOrId: string): ProvisionedResource | null;
+    getDecryptedResourceSecrets(workspaceId: string, resourceNameOrId: string): Record<string, string>;
+    listResources(workspaceId: string): ProvisionedResource[];
+    getDecryptedWorkspaceEnv(workspaceId: string): Record<string, string>;
+    normalizeByokProvider(providerInput: string): {
+        provider: string;
+        category: "llm" | "supplier";
+        envVarName: string;
+    };
+    setByokKey(workspaceId: string, providerInput: string, secretKey: string): ByokKeyRecord;
+    getByokKey(workspaceId: string, providerInput: string): string | null;
+    deleteByokKey(workspaceId: string, providerInput: string): boolean;
+    listByokKeys(workspaceId: string): ByokKeyRecord[];
+    hasByokForLane(workspaceId: string, lane: ProviderLane, toolSlug?: string): boolean;
+    createPlan(params: {
+        workspaceId: string;
+        actorId: string;
+        toolSlug: string;
+        upstreamSlug: string;
+        lane: ProviderLane;
+        riskLevel: RiskLevel;
+        input: Record<string, unknown>;
+        reason: string;
+        creditCost: number;
+        approvalStatus: ActionPlan["approvalStatus"];
+        decisionRecord?: GovernanceDecisionRecord | null;
+        memoryContext?: MemoryContextSummary | null;
+    }): ActionPlan;
+    getPlan(workspaceId: string, planId: string): ActionPlan | null;
+    getPlanById(planId: string): ActionPlan | null;
+    listPlans(workspaceId: string, limit?: number): ActionPlan[];
+    updatePlanApproval(params: {
+        workspaceId: string;
+        planId: string;
+        approvalStatus: "approved" | "rejected";
+        approvedBy: string;
+    }): ActionPlan;
+    createRun(plan: ActionPlan, actorId: string): ExecutionRun;
+    finalizeRun(params: {
+        workspaceId: string;
+        runId: string;
+        status: "succeeded" | "failed" | "cancelled";
+        output?: Record<string, unknown> | null;
+        error?: string | null;
+        actionsMetered: number;
+        creditsMetered: number;
+        durationMs: number;
+        decisionRecord?: GovernanceDecisionRecord | null;
+    }): {
+        run: ExecutionRun;
+        receipt: ExecutionReceipt;
+    };
+    cancelRun(params: {
+        workspaceId: string;
+        runId: string;
+        cancelledBy: string;
+        reason?: string;
+    }): {
+        run: ExecutionRun;
+        receipt: ExecutionReceipt;
+    };
+    private issueReceipt;
+    verifyReceipt(receipt: ExecutionReceipt): boolean;
+    getRun(workspaceId: string, runId: string): ExecutionRun | null;
+    listRuns(workspaceId: string, limit?: number): ExecutionRun[];
+    getReceipt(workspaceId: string, receiptIdOrRunId: string): ExecutionReceipt | null;
+    listReceipts(workspaceId: string, limit?: number): ExecutionReceipt[];
+    markStripeEventProcessed(eventId: string): boolean;
+    upgradeWorkspaceToStarter(params: {
+        workspaceId: string;
+        stripeCustomerId?: string | null;
+        stripeSubscriptionId?: string | null;
+        referenceId: string;
+        bonusCredits?: number;
+    }): Workspace;
+    addWorkspaceCredits(params: {
+        workspaceId: string;
+        credits: number;
+        referenceId: string;
+        description: string;
+    }): Workspace;
+    addLedgerEntry(params: {
+        workspaceId: string;
+        kind: LedgerEntry["kind"];
+        actionsDelta: number;
+        creditsDelta: number;
+        balanceAfter: number;
+        referenceId: string | null;
+        description: string;
+    }): LedgerEntry;
+    computeSupplierSettlement(lane: ProviderLane, toolSlug: string, creditCost: number, settlementStatus?: "settled_by_muxo_master_wallet" | "planned_muxo_master_wallet" | "settled_by_customer_byok" | "planned_customer_byok", workspaceId?: string): SupplierSettlement;
+    getSupplierSettlementSummary(workspaceId: string): SupplierSettlementSummary;
+    listLedgerEntries(workspaceId: string, limit?: number): LedgerEntry[];
+    saveMemoryRecord(params: {
+        workspaceId: string;
+        namespace: string;
+        documentId: string;
+        title: string;
+        content: string;
+        kind: WorkspaceMemoryRecord["kind"];
+        metadata?: Record<string, unknown>;
+    }): WorkspaceMemoryRecord;
+    listMemoryRecords(workspaceId: string, limit?: number): WorkspaceMemoryRecord[];
+    deleteMemoryRecord(workspaceId: string, idOrDocId: string): WorkspaceMemoryRecord | null;
+    upsertTemporalFact(params: {
+        workspaceId: string;
+        subject: string;
+        predicate: string;
+        object: string;
+        summary: string;
+        confidence?: number;
+        sourceKind?: TemporalGraphFact["sourceKind"];
+        sourceReferenceId?: string | null;
+        metadata?: Record<string, unknown>;
+        supersedeExisting?: boolean;
+    }): TemporalGraphFact;
+    listTemporalFacts(workspaceId: string, opts?: {
+        includeHistorical?: boolean;
+        subject?: string;
+        predicate?: string;
+        query?: string;
+        limit?: number;
+    }): TemporalGraphFact[];
+    forgetMatchingMemoryRecords(workspaceId: string, query: string): {
+        deletedMemories: WorkspaceMemoryRecord[];
+        invalidatedFacts: TemporalGraphFact[];
+    };
+    private mapTemporalFact;
+    createAutonomousAgentSignup(params?: {
+        agentName?: string;
+        harness?: string;
+    }): {
+        user: User;
+        workspace: Workspace;
+        apiKey: string;
+        apiKeyRecord: ApiKeyRecord;
+    };
+    getLatestClaimForWorkspace(workspaceId: string): {
+        claimSlug: string;
+        targetEmail: string;
+        status: "invited" | "claimed";
+        claimedAt: string | null;
+        expiresAt: string;
+    } | null;
+    /**
+     * Creates a claim link for a workspace. A claim minted without an email (at agent signup)
+     * stays unusable until the agent names the owner; naming one reuses that same link.
+     */
+    createAgentClaim(params: {
+        workspaceId: string;
+        email: string | null;
+        baseUrl: string;
+    }): {
+        claimSlug: string;
+        claimUrl: string;
+        targetEmail: string;
+        status: "invited" | "claimed";
+        expiresAt: string;
+    };
+    /** Returns a claim only while it can still be accepted (invited and not expired). */
+    getOpenAgentClaim(claimSlug: string): {
+        claimSlug: string;
+        workspace: Workspace;
+        targetEmail: string;
+        status: "invited";
+        expiresAt: string;
+    } | null;
+    /** Transfers workspace ownership to the verified claimer and closes the claim. */
+    acceptAgentClaim(claimSlug: string, userId: string): Workspace | null;
+    private mapUser;
+    private mapWorkspace;
+    private mapConnection;
+    private mapResource;
+    private mapPlan;
+    private mapRun;
+    private mapReceipt;
+}