@muxoai/sdk 1.2.3 → 1.4.2

package/dist/store.js

@@ -0,0 +1,2323 @@
+import { DatabaseSync } from "node:sqlite";
+import crypto from "node:crypto";
+export const BYOK_PROVIDER_CATALOG = {
+    openai: { category: "llm", envVarName: "OPENAI_API_KEY", label: "OpenAI (GPT-4o / o3-mini)" },
+    anthropic: { category: "llm", envVarName: "ANTHROPIC_API_KEY", label: "Anthropic (Claude 3.7 Sonnet)" },
+    gemini: { category: "llm", envVarName: "GEMINI_API_KEY", label: "Google Gemini" },
+    openrouter: { category: "llm", envVarName: "OPENROUTER_API_KEY", label: "OpenRouter (Universal LLM)" },
+    composio: { category: "supplier", envVarName: "COMPOSIO_API_KEY", label: "Composio SDK & Instant" },
+    stripe: { category: "supplier", envVarName: "STRIPE_SECRET_KEY", label: "Stripe Projects & Billing" },
+    supermemory: { category: "supplier", envVarName: "SUPERMEMORY_API_KEY", label: "Supermemory v5 Knowledge Graph" },
+    firecrawl: { category: "supplier", envVarName: "FIRECRAWL_API_KEY", label: "Firecrawl Web Scrape & Crawl" },
+    exa: { category: "supplier", envVarName: "EXA_API_KEY", label: "Exa Semantic Web Search" },
+};
+const DEFAULT_POLICY = {
+    mode: "enforce",
+    requireApprovalFor: ["admin", "financial", "provisioning", "destructive"],
+    allowInstantWallet: true,
+    allowProvisioning: true,
+    maxCreditsPerRun: 250,
+};
+const RECEIPTS_COLUMN_NAMES = [
+    "id",
+    "run_id",
+    "plan_id",
+    "workspace_id",
+    "actor_id",
+    "tool_slug",
+    "lane",
+    "risk_level",
+    "status",
+    "actions_metered",
+    "credits_metered",
+    "input_hash",
+    "output_hash",
+    "prev_receipt_hash",
+    "receipt_hash",
+    "signature",
+    "decision_record_json",
+    "issued_at",
+];
+const RECEIPTS_TABLE_COLUMNS = `
+  id TEXT PRIMARY KEY,
+  run_id TEXT NOT NULL,
+  plan_id TEXT NOT NULL,
+  workspace_id TEXT NOT NULL,
+  actor_id TEXT NOT NULL,
+  tool_slug TEXT NOT NULL,
+  lane TEXT NOT NULL,
+  risk_level TEXT NOT NULL,
+  status TEXT NOT NULL,
+  actions_metered INTEGER NOT NULL,
+  credits_metered INTEGER NOT NULL,
+  input_hash TEXT NOT NULL,
+  output_hash TEXT NOT NULL,
+  prev_receipt_hash TEXT NOT NULL,
+  receipt_hash TEXT NOT NULL,
+  signature TEXT NOT NULL,
+  decision_record_json TEXT,
+  issued_at TEXT NOT NULL
+`;
+export class MuxoStore {
+    db;
+    vaultKey;
+    constructor(dbPath, vaultKey) {
+        this.db = new DatabaseSync(dbPath);
+        this.db.exec("PRAGMA busy_timeout = 10000;");
+        this.vaultKey = vaultKey;
+        this.initSchema();
+    }
+    initSchema() {
+        this.db.exec(`
+      PRAGMA busy_timeout = 10000;
+      PRAGMA journal_mode = WAL;
+      PRAGMA foreign_keys = ON;
+
+      CREATE TABLE IF NOT EXISTS users (
+        id TEXT PRIMARY KEY,
+        email TEXT NOT NULL UNIQUE,
+        name TEXT NOT NULL,
+        password_hash TEXT NOT NULL,
+        workspace_id TEXT NOT NULL,
+        role TEXT NOT NULL DEFAULT 'owner',
+        created_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS sessions (
+        token_hash TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL,
+        workspace_id TEXT NOT NULL,
+        expires_at TEXT NOT NULL,
+        created_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS workspaces (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        slug TEXT NOT NULL UNIQUE,
+        owner_user_id TEXT NOT NULL,
+        tier TEXT NOT NULL DEFAULT 'free',
+        monthly_actions_limit INTEGER NOT NULL DEFAULT 1000,
+        monthly_actions_used INTEGER NOT NULL DEFAULT 0,
+        credits_balance INTEGER NOT NULL DEFAULT 100,
+        stripe_customer_id TEXT,
+        stripe_subscription_id TEXT,
+        projects_env_name TEXT NOT NULL,
+        policy_json TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS api_keys (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        name TEXT NOT NULL,
+        key_prefix TEXT NOT NULL,
+        key_hash TEXT NOT NULL UNIQUE,
+        environment TEXT NOT NULL DEFAULT 'live',
+        scopes_json TEXT NOT NULL,
+        last_used_at TEXT,
+        revoked_at TEXT,
+        created_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS connections (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        lane TEXT NOT NULL,
+        provider_slug TEXT NOT NULL,
+        provider_name TEXT NOT NULL,
+        status TEXT NOT NULL,
+        external_account_id TEXT,
+        redirect_url TEXT,
+        metadata_json TEXT NOT NULL DEFAULT '{}',
+        updated_at TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        UNIQUE(workspace_id, lane, provider_slug)
+      );
+
+      CREATE TABLE IF NOT EXISTS resources (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        resource_name TEXT NOT NULL,
+        provider_slug TEXT NOT NULL,
+        provider_name TEXT NOT NULL,
+        service_slug TEXT NOT NULL,
+        plan_slug TEXT,
+        status TEXT NOT NULL,
+        env_var_keys_json TEXT NOT NULL DEFAULT '[]',
+        encrypted_secrets_hex TEXT,
+        external_resource_id TEXT,
+        metadata_json TEXT NOT NULL DEFAULT '{}',
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(workspace_id, resource_name)
+      );
+
+      CREATE TABLE IF NOT EXISTS plans (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        actor_id TEXT NOT NULL,
+        tool_slug TEXT NOT NULL,
+        upstream_slug TEXT NOT NULL,
+        lane TEXT NOT NULL,
+        risk_level TEXT NOT NULL,
+        input_json TEXT NOT NULL,
+        reason TEXT NOT NULL,
+        credit_cost INTEGER NOT NULL DEFAULT 0,
+        approval_status TEXT NOT NULL,
+        approved_by TEXT,
+        approved_at TEXT,
+        run_id TEXT,
+        decision_record_json TEXT,
+        memory_context_json TEXT,
+        created_at TEXT NOT NULL,
+        expires_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS runs (
+        id TEXT PRIMARY KEY,
+        plan_id TEXT NOT NULL,
+        workspace_id TEXT NOT NULL,
+        actor_id TEXT NOT NULL,
+        tool_slug TEXT NOT NULL,
+        lane TEXT NOT NULL,
+        risk_level TEXT NOT NULL,
+        status TEXT NOT NULL,
+        input_json TEXT NOT NULL,
+        output_json TEXT,
+        error TEXT,
+        actions_metered INTEGER NOT NULL DEFAULT 0,
+        credits_metered INTEGER NOT NULL DEFAULT 0,
+        duration_ms INTEGER,
+        receipt_id TEXT,
+        started_at TEXT NOT NULL,
+        completed_at TEXT
+      );
+
+      CREATE TABLE IF NOT EXISTS receipts (${RECEIPTS_TABLE_COLUMNS});
+
+      CREATE TABLE IF NOT EXISTS memories (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        namespace TEXT NOT NULL,
+        document_id TEXT NOT NULL,
+        title TEXT NOT NULL,
+        content TEXT NOT NULL,
+        kind TEXT NOT NULL,
+        metadata_json TEXT NOT NULL DEFAULT '{}',
+        created_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS temporal_facts (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        subject TEXT NOT NULL,
+        predicate TEXT NOT NULL,
+        object TEXT NOT NULL,
+        summary TEXT NOT NULL,
+        confidence REAL NOT NULL DEFAULT 0.95,
+        valid_from TEXT NOT NULL,
+        valid_to TEXT,
+        superseded_by_id TEXT,
+        source_kind TEXT NOT NULL DEFAULT 'fact',
+        source_reference_id TEXT,
+        metadata_json TEXT NOT NULL DEFAULT '{}',
+        created_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS agent_claims (
+        claim_slug TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        target_email TEXT NOT NULL,
+        status TEXT NOT NULL DEFAULT 'invited',
+        claimed_at TEXT,
+        expires_at TEXT NOT NULL,
+        created_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS ledger_entries (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        kind TEXT NOT NULL,
+        actions_delta INTEGER NOT NULL DEFAULT 0,
+        credits_delta INTEGER NOT NULL DEFAULT 0,
+        balance_after INTEGER NOT NULL DEFAULT 0,
+        reference_id TEXT,
+        description TEXT NOT NULL,
+        created_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS processed_stripe_events (
+        event_id TEXT PRIMARY KEY,
+        processed_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS byok_keys (
+        workspace_id TEXT NOT NULL,
+        provider TEXT NOT NULL,
+        category TEXT NOT NULL,
+        env_var_name TEXT NOT NULL,
+        key_preview TEXT NOT NULL,
+        encrypted_secret_hex TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY (workspace_id, provider)
+      );
+
+      CREATE TABLE IF NOT EXISTS workspace_members (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        user_id TEXT NOT NULL,
+        role TEXT NOT NULL DEFAULT 'operator',
+        team_name TEXT,
+        joined_via_key_id TEXT,
+        created_at TEXT NOT NULL,
+        UNIQUE(workspace_id, user_id)
+      );
+
+      CREATE TABLE IF NOT EXISTS clerk_users (
+        clerk_user_id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL,
+        created_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS oauth_refresh_tokens (
+        token_hash TEXT PRIMARY KEY,
+        key_id TEXT NOT NULL,
+        workspace_id TEXT NOT NULL,
+        client_id TEXT NOT NULL,
+        scope TEXT NOT NULL,
+        encrypted_access_token TEXT NOT NULL,
+        created_at TEXT NOT NULL
+      );
+    `);
+        // Backwards-compatible column migrations for existing databases
+        for (const stmt of [
+            "ALTER TABLE plans ADD COLUMN decision_record_json TEXT",
+            "ALTER TABLE plans ADD COLUMN memory_context_json TEXT",
+            "ALTER TABLE receipts ADD COLUMN decision_record_json TEXT",
+            "ALTER TABLE api_keys ADD COLUMN team_name TEXT",
+            "ALTER TABLE api_keys ADD COLUMN role TEXT DEFAULT 'operator'",
+            "ALTER TABLE api_keys ADD COLUMN created_by_email TEXT",
+        ]) {
+            try {
+                this.db.exec(stmt);
+            }
+            catch {
+                // Column already exists
+            }
+        }
+        this.migrateReceiptsAllowMultiplePerRun();
+        this.db.exec("CREATE INDEX IF NOT EXISTS idx_receipts_workspace_run ON receipts(workspace_id, run_id)");
+    }
+    /**
+     * Older databases declared receipts.run_id UNIQUE, which blocks cancellation receipts from
+     * superseding a run's original receipt. SQLite cannot drop a constraint, so rebuild the table.
+     */
+    migrateReceiptsAllowMultiplePerRun() {
+        const indexes = this.db.prepare("PRAGMA index_list(receipts)").all();
+        const hasUniqueRunId = indexes.some((idx) => {
+            if (!idx.unique || idx.origin !== "u")
+                return false;
+            const cols = this.db.prepare(`PRAGMA index_info("${idx.name}")`).all();
+            return cols.length === 1 && cols[0].name === "run_id";
+        });
+        if (!hasUniqueRunId)
+            return;
+        const columns = RECEIPTS_COLUMN_NAMES.join(", ");
+        this.db.exec("BEGIN");
+        try {
+            this.db.exec(`
+        CREATE TABLE receipts_migrated (${RECEIPTS_TABLE_COLUMNS});
+        INSERT INTO receipts_migrated (${columns}) SELECT ${columns} FROM receipts ORDER BY rowid;
+        DROP TABLE receipts;
+        ALTER TABLE receipts_migrated RENAME TO receipts;
+      `);
+            this.db.exec("COMMIT");
+        }
+        catch (err) {
+            this.db.exec("ROLLBACK");
+            throw err;
+        }
+    }
+    // --- Encryption Vault (AES-256-GCM) ---
+    encryptSecrets(workspaceId, secrets) {
+        const iv = crypto.randomBytes(12);
+        const aad = Buffer.from(`muxo-vault:${workspaceId}`, "utf8");
+        const cipher = crypto.createCipheriv("aes-256-gcm", this.vaultKey, iv);
+        cipher.setAAD(aad);
+        const plaintext = Buffer.from(JSON.stringify(secrets), "utf8");
+        const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return `${iv.toString("hex")}:${tag.toString("hex")}:${encrypted.toString("hex")}`;
+    }
+    decryptSecrets(workspaceId, payloadHex) {
+        if (!payloadHex)
+            return {};
+        const parts = payloadHex.split(":");
+        if (parts.length !== 3)
+            return {};
+        const [ivHex, tagHex, dataHex] = parts;
+        const iv = Buffer.from(ivHex, "hex");
+        const tag = Buffer.from(tagHex, "hex");
+        const encrypted = Buffer.from(dataHex, "hex");
+        const aad = Buffer.from(`muxo-vault:${workspaceId}`, "utf8");
+        const decipher = crypto.createDecipheriv("aes-256-gcm", this.vaultKey, iv);
+        decipher.setAAD(aad);
+        decipher.setAuthTag(tag);
+        const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+        return JSON.parse(decrypted.toString("utf8"));
+    }
+    // --- Bootstrap / Auth ---
+    ensureDefaultWorkspace() {
+        const existing = this.db
+            .prepare("SELECT id FROM workspaces ORDER BY created_at ASC LIMIT 1")
+            .get();
+        if (existing) {
+            const workspace = this.getWorkspace(existing.id);
+            const user = this.getUser(workspace.ownerUserId);
+            return { user, workspace };
+        }
+        const created = this.registerUser({
+            email: "founder@muxo.ai",
+            name: "Muxo Founder",
+            password: "muxo-demo-password",
+            workspaceName: "Muxo Default Workspace",
+        });
+        const apiKeyRes = this.createApiKey({
+            workspaceId: created.workspace.id,
+            name: "Default CLI & MCP Key",
+            environment: "live",
+        });
+        return {
+            user: created.user,
+            workspace: created.workspace,
+            defaultApiKey: apiKeyRes.secretKey,
+        };
+    }
+    hashPassword(password) {
+        const salt = "muxo-pw-salt-v1";
+        return crypto.scryptSync(password, salt, 32).toString("hex");
+    }
+    hashToken(token) {
+        return crypto.createHash("sha256").update(token).digest("hex");
+    }
+    registerUser(params) {
+        const now = new Date().toISOString();
+        const userId = `usr_${crypto.randomBytes(8).toString("hex")}`;
+        const workspaceId = `ws_${crypto.randomBytes(8).toString("hex")}`;
+        const slugBase = (params.workspaceName || params.name || "workspace")
+            .toLowerCase()
+            .replace(/[^a-z0-9]+/g, "-")
+            .replace(/^-|-$/g, "");
+        const slug = `${slugBase || "ws"}-${crypto.randomBytes(3).toString("hex")}`;
+        const projectsEnvName = `muxo_${workspaceId.slice(3, 11)}`;
+        const starterCredits = 250; // Initial trial credits for instant tools & exploration
+        this.db
+            .prepare(`INSERT INTO users (id, email, name, password_hash, workspace_id, role, created_at)
+         VALUES (?, ?, ?, ?, ?, 'owner', ?)`)
+            .run(userId, params.email.toLowerCase().trim(), params.name.trim(), this.hashPassword(params.password), workspaceId, now);
+        this.db
+            .prepare(`INSERT INTO workspaces (
+          id, name, slug, owner_user_id, tier,
+          monthly_actions_limit, monthly_actions_used, credits_balance,
+          stripe_customer_id, stripe_subscription_id, projects_env_name,
+          policy_json, created_at, updated_at
+        ) VALUES (?, ?, ?, ?, 'free', 1000, 0, ?, NULL, NULL, ?, ?, ?, ?)`)
+            .run(workspaceId, params.workspaceName?.trim() || `${params.name.trim()}'s Workspace`, slug, userId, starterCredits, projectsEnvName, JSON.stringify(DEFAULT_POLICY), now, now);
+        this.addLedgerEntry({
+            workspaceId,
+            kind: "plan_grant",
+            actionsDelta: 1000,
+            creditsDelta: starterCredits,
+            balanceAfter: starterCredits,
+            referenceId: workspaceId,
+            description: "Free Plan initial monthly allowance (1,000 actions + 250 trial credits)",
+        });
+        this.ensureWorkspaceMembership({
+            workspaceId,
+            userId,
+            role: "owner",
+        });
+        const sessionToken = this.createSession(userId, workspaceId);
+        const defaultKey = this.createApiKey({
+            workspaceId,
+            name: "Default Live Key",
+            environment: "live",
+            role: "owner",
+            createdByEmail: params.email.toLowerCase().trim(),
+        });
+        return {
+            user: this.getUser(userId),
+            workspace: this.getWorkspace(workspaceId),
+            sessionToken,
+            apiKey: defaultKey.secretKey,
+        };
+    }
+    loginUser(email, password) {
+        const row = this.db
+            .prepare("SELECT * FROM users WHERE email = ?")
+            .get(email.toLowerCase().trim());
+        if (!row)
+            return null;
+        if (row.password_hash !== this.hashPassword(password))
+            return null;
+        const user = this.mapUser(row);
+        const workspace = this.getWorkspace(user.workspaceId);
+        this.ensureWorkspaceMembership({
+            workspaceId: workspace.id,
+            userId: user.id,
+            role: user.role,
+        });
+        const sessionToken = this.createSession(user.id, workspace.id);
+        return { user, workspace, sessionToken };
+    }
+    createSession(userId, workspaceId) {
+        const rawToken = `mxs_${crypto.randomBytes(24).toString("hex")}`;
+        const now = new Date();
+        const expires = new Date(now.getTime() + 30 * 24 * 3600 * 1000);
+        this.db
+            .prepare(`INSERT INTO sessions (token_hash, user_id, workspace_id, expires_at, created_at)
+         VALUES (?, ?, ?, ?, ?)`)
+            .run(this.hashToken(rawToken), userId, workspaceId, expires.toISOString(), now.toISOString());
+        return rawToken;
+    }
+    resolveAuthToken(token, workspaceOverrideId) {
+        const trimmed = token.trim();
+        if (!trimmed)
+            return null;
+        if (trimmed.startsWith("mk_live_") || trimmed.startsWith("mk_test_")) {
+            const hash = this.hashToken(trimmed);
+            const row = this.db
+                .prepare("SELECT * FROM api_keys WHERE key_hash = ? AND revoked_at IS NULL")
+                .get(hash);
+            if (!row)
+                return null;
+            const now = new Date().toISOString();
+            this.db
+                .prepare("UPDATE api_keys SET last_used_at = ? WHERE id = ?")
+                .run(now, String(row.id));
+            const workspace = this.getWorkspace(String(row.workspace_id));
+            if (!workspace)
+                return null;
+            const user = this.getUser(workspace.ownerUserId);
+            if (!user)
+                return null;
+            return {
+                user,
+                workspace,
+                authType: "api_key",
+                actorId: `key:${String(row.id)}`,
+            };
+        }
+        const hash = this.hashToken(trimmed);
+        const sessionRow = this.db
+            .prepare("SELECT * FROM sessions WHERE token_hash = ?")
+            .get(hash);
+        if (!sessionRow)
+            return null;
+        if (new Date(String(sessionRow.expires_at)).getTime() < Date.now()) {
+            return null;
+        }
+        const user = this.getUser(String(sessionRow.user_id));
+        if (!user)
+            return null;
+        let targetWorkspaceId = String(sessionRow.workspace_id || user.workspaceId);
+        if (workspaceOverrideId &&
+            workspaceOverrideId.trim() &&
+            this.userCanAccessWorkspace(user.id, workspaceOverrideId.trim())) {
+            targetWorkspaceId = workspaceOverrideId.trim();
+        }
+        else if (user.workspaceId && this.userCanAccessWorkspace(user.id, user.workspaceId)) {
+            targetWorkspaceId = user.workspaceId;
+        }
+        const workspace = this.getWorkspace(targetWorkspaceId);
+        if (!workspace)
+            return null;
+        return {
+            user: { ...user, workspaceId: workspace.id },
+            workspace,
+            authType: "session",
+            actorId: user.id,
+        };
+    }
+    getUser(userId) {
+        const row = this.db
+            .prepare("SELECT * FROM users WHERE id = ?")
+            .get(userId);
+        return row ? this.mapUser(row) : null;
+    }
+    getWorkspace(workspaceId) {
+        const row = this.db
+            .prepare("SELECT * FROM workspaces WHERE id = ?")
+            .get(workspaceId);
+        return row ? this.mapWorkspace(row) : null;
+    }
+    ensureWorkspaceMembership(params) {
+        const now = new Date().toISOString();
+        const role = params.role || "operator";
+        const existing = this.db
+            .prepare("SELECT * FROM workspace_members WHERE workspace_id = ? AND user_id = ?")
+            .get(params.workspaceId, params.userId);
+        if (existing) {
+            if (params.teamName || params.role) {
+                this.db
+                    .prepare("UPDATE workspace_members SET role = COALESCE(?, role), team_name = COALESCE(?, team_name) WHERE id = ?")
+                    .run(params.role || null, params.teamName || null, String(existing.id));
+            }
+            return {
+                id: String(existing.id),
+                workspaceId: String(existing.workspace_id),
+                userId: String(existing.user_id),
+                role: (params.role || String(existing.role) || "operator"),
+                teamName: params.teamName ?? (existing.team_name ? String(existing.team_name) : null),
+                joinedViaKeyId: existing.joined_via_key_id ? String(existing.joined_via_key_id) : null,
+                createdAt: String(existing.created_at),
+            };
+        }
+        const id = `wsm_${crypto.randomBytes(8).toString("hex")}`;
+        this.db
+            .prepare(`INSERT INTO workspace_members (
+          id, workspace_id, user_id, role, team_name, joined_via_key_id, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?)`)
+            .run(id, params.workspaceId, params.userId, role, params.teamName || null, params.joinedViaKeyId || null, now);
+        return {
+            id,
+            workspaceId: params.workspaceId,
+            userId: params.userId,
+            role,
+            teamName: params.teamName || null,
+            joinedViaKeyId: params.joinedViaKeyId || null,
+            createdAt: now,
+        };
+    }
+    userCanAccessWorkspace(userId, workspaceId) {
+        const ws = this.getWorkspace(workspaceId);
+        if (!ws)
+            return false;
+        if (ws.ownerUserId === userId)
+            return true;
+        const user = this.getUser(userId);
+        if (user?.workspaceId === workspaceId)
+            return true;
+        const mem = this.db
+            .prepare("SELECT id FROM workspace_members WHERE workspace_id = ? AND user_id = ?")
+            .get(workspaceId, userId);
+        return Boolean(mem);
+    }
+    listUserWorkspaces(userId, activeWorkspaceId) {
+        const user = this.getUser(userId);
+        const currentId = activeWorkspaceId || user?.workspaceId || "";
+        const ownedRows = this.db
+            .prepare("SELECT * FROM workspaces WHERE owner_user_id = ? ORDER BY created_at ASC")
+            .all(userId);
+        const memberRows = this.db
+            .prepare(`SELECT w.*, m.role AS member_role, m.team_name AS member_team_name
+         FROM workspace_members m
+         JOIN workspaces w ON w.id = m.workspace_id
+         WHERE m.user_id = ?
+         ORDER BY m.created_at ASC`)
+            .all(userId);
+        const byId = new Map();
+        for (const r of ownedRows) {
+            const ws = this.mapWorkspace(r);
+            byId.set(ws.id, {
+                id: ws.id,
+                name: ws.name,
+                slug: ws.slug,
+                tier: ws.tier,
+                creditsBalance: ws.creditsBalance,
+                monthlyActionsUsed: ws.monthlyActionsUsed,
+                monthlyActionsLimit: ws.monthlyActionsLimit,
+                role: "owner",
+                teamName: null,
+                isCurrent: ws.id === currentId,
+                createdAt: ws.createdAt,
+            });
+        }
+        for (const r of memberRows) {
+            const ws = this.mapWorkspace(r);
+            const existing = byId.get(ws.id);
+            byId.set(ws.id, {
+                id: ws.id,
+                name: ws.name,
+                slug: ws.slug,
+                tier: ws.tier,
+                creditsBalance: ws.creditsBalance,
+                monthlyActionsUsed: ws.monthlyActionsUsed,
+                monthlyActionsLimit: ws.monthlyActionsLimit,
+                role: existing?.role === "owner" ? "owner" : String(r.member_role || "operator"),
+                teamName: r.member_team_name ? String(r.member_team_name) : existing?.teamName || null,
+                isCurrent: ws.id === currentId,
+                createdAt: ws.createdAt,
+            });
+        }
+        if (currentId && !byId.has(currentId)) {
+            const ws = this.getWorkspace(currentId);
+            if (ws) {
+                byId.set(ws.id, {
+                    id: ws.id,
+                    name: ws.name,
+                    slug: ws.slug,
+                    tier: ws.tier,
+                    creditsBalance: ws.creditsBalance,
+                    monthlyActionsUsed: ws.monthlyActionsUsed,
+                    monthlyActionsLimit: ws.monthlyActionsLimit,
+                    role: ws.ownerUserId === userId ? "owner" : "operator",
+                    teamName: null,
+                    isCurrent: true,
+                    createdAt: ws.createdAt,
+                });
+            }
+        }
+        return Array.from(byId.values());
+    }
+    switchUserWorkspace(userId, workspaceId) {
+        if (!this.userCanAccessWorkspace(userId, workspaceId))
+            return null;
+        const workspace = this.getWorkspace(workspaceId);
+        if (!workspace)
+            return null;
+        this.db
+            .prepare("UPDATE users SET workspace_id = ? WHERE id = ?")
+            .run(workspaceId, userId);
+        this.db
+            .prepare("UPDATE sessions SET workspace_id = ? WHERE user_id = ?")
+            .run(workspaceId, userId);
+        const user = this.getUser(userId);
+        if (!user)
+            return null;
+        return { user, workspace };
+    }
+    createWorkspaceForUser(params) {
+        const now = new Date().toISOString();
+        const workspaceId = `ws_${crypto.randomBytes(8).toString("hex")}`;
+        const cleanName = params.name.trim() || "Team Workspace";
+        const slugBase = cleanName
+            .toLowerCase()
+            .replace(/[^a-z0-9]+/g, "-")
+            .replace(/^-|-$/g, "");
+        const slug = `${slugBase || "ws"}-${crypto.randomBytes(3).toString("hex")}`;
+        const projectsEnvName = `muxo_${workspaceId.slice(3, 11)}`;
+        const starterCredits = 250;
+        this.db
+            .prepare(`INSERT INTO workspaces (
+          id, name, slug, owner_user_id, tier,
+          monthly_actions_limit, monthly_actions_used, credits_balance,
+          stripe_customer_id, stripe_subscription_id, projects_env_name,
+          policy_json, created_at, updated_at
+        ) VALUES (?, ?, ?, ?, 'free', 1000, 0, ?, NULL, NULL, ?, ?, ?, ?)`)
+            .run(workspaceId, cleanName, slug, params.userId, starterCredits, projectsEnvName, JSON.stringify(DEFAULT_POLICY), now, now);
+        this.addLedgerEntry({
+            workspaceId,
+            kind: "plan_grant",
+            actionsDelta: 1000,
+            creditsDelta: starterCredits,
+            balanceAfter: starterCredits,
+            referenceId: workspaceId,
+            description: `Workspace '${cleanName}' initial monthly allowance (1,000 actions + 250 trial credits)`,
+        });
+        const user = this.getUser(params.userId);
+        const keyRes = this.createApiKey({
+            workspaceId,
+            name: params.teamName ? `${params.teamName} — Team Key` : `${cleanName} — Default Key`,
+            environment: "live",
+            teamName: params.teamName || cleanName,
+            role: params.role || "owner",
+            createdByEmail: user?.email || null,
+        });
+        const membership = this.ensureWorkspaceMembership({
+            workspaceId,
+            userId: params.userId,
+            role: "owner",
+            teamName: params.teamName || null,
+            joinedViaKeyId: keyRes.record.id,
+        });
+        if (params.switchActive !== false) {
+            this.switchUserWorkspace(params.userId, workspaceId);
+        }
+        return {
+            workspace: this.getWorkspace(workspaceId),
+            apiKey: keyRes.secretKey,
+            keyRecord: keyRes.record,
+            membership,
+        };
+    }
+    joinWorkspaceWithApiKey(params) {
+        const trimmed = String(params.apiKey || "").trim();
+        if (!trimmed.startsWith("mk_live_") && !trimmed.startsWith("mk_test_")) {
+            return null;
+        }
+        const hash = this.hashToken(trimmed);
+        const row = this.db
+            .prepare("SELECT * FROM api_keys WHERE key_hash = ? AND revoked_at IS NULL")
+            .get(hash);
+        if (!row)
+            return null;
+        const workspace = this.getWorkspace(String(row.workspace_id));
+        if (!workspace)
+            return null;
+        const keyRecord = {
+            id: String(row.id),
+            workspaceId: String(row.workspace_id),
+            name: String(row.name),
+            keyPrefix: String(row.key_prefix),
+            environment: String(row.environment),
+            scopes: JSON.parse(String(row.scopes_json || "[]")),
+            teamName: row.team_name ? String(row.team_name) : null,
+            role: (row.role ? String(row.role) : "operator"),
+            createdByEmail: row.created_by_email ? String(row.created_by_email) : null,
+            lastUsedAt: row.last_used_at ? String(row.last_used_at) : null,
+            revokedAt: row.revoked_at ? String(row.revoked_at) : null,
+            createdAt: String(row.created_at),
+        };
+        let membership = null;
+        let user = null;
+        if (params.userId) {
+            membership = this.ensureWorkspaceMembership({
+                workspaceId: workspace.id,
+                userId: params.userId,
+                role: workspace.ownerUserId === params.userId ? "owner" : (keyRecord.role || "operator"),
+                teamName: keyRecord.teamName || keyRecord.name,
+                joinedViaKeyId: keyRecord.id,
+            });
+            if (params.switchActive !== false) {
+                this.switchUserWorkspace(params.userId, workspace.id);
+            }
+            user = this.getUser(params.userId);
+        }
+        else {
+            user = this.getUser(workspace.ownerUserId);
+        }
+        return {
+            workspace,
+            keyRecord,
+            user,
+            membership,
+        };
+    }
+    onboardTeam(params) {
+        const cleanTeam = params.teamName.trim() || "Engineering Team";
+        const role = params.role || "operator";
+        const mode = params.mode === "dedicated_workspace" ? "dedicated_workspace" : "shared_workspace";
+        const cleanBase = params.baseUrl.replace(/\/$/, "");
+        const env = params.environment === "test" ? "test" : "live";
+        let targetWorkspace;
+        let apiKey;
+        let keyRecord;
+        if (mode === "dedicated_workspace") {
+            const currentWs = this.getWorkspace(params.currentWorkspaceId);
+            const wsName = currentWs ? `${currentWs.name} — ${cleanTeam}` : `${cleanTeam} Workspace`;
+            const created = this.createWorkspaceForUser({
+                userId: params.userId,
+                name: wsName,
+                teamName: cleanTeam,
+                role,
+                switchActive: false,
+            });
+            targetWorkspace = created.workspace;
+            apiKey = created.apiKey;
+            keyRecord = created.keyRecord;
+        }
+        else {
+            const currentWs = this.getWorkspace(params.currentWorkspaceId);
+            if (!currentWs)
+                throw new Error(`Workspace ${params.currentWorkspaceId} not found`);
+            targetWorkspace = currentWs;
+            const createdKey = this.createApiKey({
+                workspaceId: targetWorkspace.id,
+                name: `${cleanTeam} (${role})`,
+                environment: env,
+                scopes: params.scopes,
+                teamName: cleanTeam,
+                role,
+                createdByEmail: params.userEmail || null,
+            });
+            apiKey = createdKey.secretKey;
+            keyRecord = createdKey.record;
+        }
+        let claimUrl = null;
+        if (params.inviteEmail && params.inviteEmail.includes("@")) {
+            const claim = this.createAgentClaim({
+                workspaceId: targetWorkspace.id,
+                email: params.inviteEmail,
+                baseUrl: cleanBase,
+            });
+            claimUrl = claim.claimUrl;
+        }
+        return {
+            mode,
+            workspace: targetWorkspace,
+            teamName: cleanTeam,
+            role,
+            apiKey,
+            keyRecord,
+            claimUrl,
+            consoleUrl: `${cleanBase}/login`,
+            cliSetupCommand: `npx muxo setup --api-key ${apiKey} --url ${cleanBase}`,
+            mcpConfig: {
+                mcpServers: {
+                    muxo: {
+                        url: `${cleanBase}/mcp`,
+                        headers: {
+                            Authorization: `Bearer ${apiKey}`,
+                        },
+                    },
+                },
+            },
+            instructions: [
+                `Share this Team API Key with ${cleanTeam} (${role} access to '${targetWorkspace.name}').`,
+                `Console: Open ${cleanBase}/login, click "Join with a Team API Key", and paste the key (if signed in with Clerk, the workspace is permanently linked to their switcher).`,
+                `CLI & MCP: Run \`npx -y @muxoai/platform setup --api-key ${apiKey}\` to configure Claude Code, Cursor, Windsurf, or Codex in one command.`,
+                `Approvals: Team members can also paste this key directly on any ${cleanBase}/approve/<planId> link to review and approve actions.`,
+            ],
+        };
+    }
+    updateWorkspacePolicy(workspaceId, policy) {
+        const ws = this.getWorkspace(workspaceId);
+        if (!ws)
+            throw new Error(`Workspace ${workspaceId} not found`);
+        const merged = {
+            ...ws.policy,
+            ...policy,
+        };
+        const now = new Date().toISOString();
+        this.db
+            .prepare("UPDATE workspaces SET policy_json = ?, updated_at = ? WHERE id = ?")
+            .run(JSON.stringify(merged), now, workspaceId);
+        return this.getWorkspace(workspaceId);
+    }
+    // --- API Keys ---
+    createApiKey(params) {
+        const env = params.environment || "live";
+        const id = `key_${crypto.randomBytes(6).toString("hex")}`;
+        const rawSecret = `mk_${env}_${id.slice(4)}_${crypto.randomBytes(16).toString("hex")}`;
+        const keyPrefix = `${rawSecret.slice(0, 16)}...${rawSecret.slice(-4)}`;
+        const scopes = params.scopes || ["tools:read", "tools:execute", "resources:provision"];
+        const teamName = params.teamName ? params.teamName.trim() : null;
+        const role = params.role || "operator";
+        const createdByEmail = params.createdByEmail ? params.createdByEmail.trim() : null;
+        const now = new Date().toISOString();
+        this.db
+            .prepare(`INSERT INTO api_keys (
+          id, workspace_id, name, key_prefix, key_hash, environment, scopes_json,
+          team_name, role, created_by_email, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(id, params.workspaceId, params.name, keyPrefix, this.hashToken(rawSecret), env, JSON.stringify(scopes), teamName, role, createdByEmail, now);
+        return {
+            record: {
+                id,
+                workspaceId: params.workspaceId,
+                name: params.name,
+                keyPrefix,
+                environment: env,
+                scopes,
+                teamName,
+                role,
+                createdByEmail,
+                lastUsedAt: null,
+                revokedAt: null,
+                createdAt: now,
+            },
+            secretKey: rawSecret,
+        };
+    }
+    listApiKeys(workspaceId) {
+        const rows = this.db
+            .prepare("SELECT * FROM api_keys WHERE workspace_id = ? ORDER BY created_at DESC")
+            .all(workspaceId);
+        return rows.map((r) => ({
+            id: String(r.id),
+            workspaceId: String(r.workspace_id),
+            name: String(r.name),
+            keyPrefix: String(r.key_prefix),
+            environment: String(r.environment),
+            scopes: JSON.parse(String(r.scopes_json || "[]")),
+            teamName: r.team_name ? String(r.team_name) : null,
+            role: (r.role ? String(r.role) : "operator"),
+            createdByEmail: r.created_by_email ? String(r.created_by_email) : null,
+            lastUsedAt: r.last_used_at ? String(r.last_used_at) : null,
+            revokedAt: r.revoked_at ? String(r.revoked_at) : null,
+            createdAt: String(r.created_at),
+        }));
+    }
+    revokeApiKey(workspaceId, keyId) {
+        const now = new Date().toISOString();
+        const res = this.db
+            .prepare("UPDATE api_keys SET revoked_at = ? WHERE id = ? AND workspace_id = ?")
+            .run(now, keyId, workspaceId);
+        if (res.changes > 0) {
+            this.db.prepare("DELETE FROM oauth_refresh_tokens WHERE key_id = ?").run(keyId);
+        }
+        return res.changes > 0;
+    }
+    /** Looks up an active workspace API key by its raw secret. */
+    findActiveApiKey(secret) {
+        const row = this.db
+            .prepare("SELECT id, workspace_id FROM api_keys WHERE key_hash = ? AND revoked_at IS NULL")
+            .get(this.hashToken(secret.trim()));
+        return row ? { id: String(row.id), workspaceId: String(row.workspace_id) } : null;
+    }
+    // --- OAuth refresh tokens (hashed; the access token is kept encrypted so refresh can return it) ---
+    saveOAuthRefreshToken(params) {
+        this.db
+            .prepare(`INSERT INTO oauth_refresh_tokens (
+          token_hash, key_id, workspace_id, client_id, scope, encrypted_access_token, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?)`)
+            .run(this.hashToken(params.refreshToken), params.keyId, params.workspaceId, params.clientId, params.scope, this.encryptSecrets(params.workspaceId, { accessToken: params.accessToken }), new Date().toISOString());
+    }
+    getOAuthRefreshToken(refreshToken) {
+        const row = this.db
+            .prepare("SELECT * FROM oauth_refresh_tokens WHERE token_hash = ?")
+            .get(this.hashToken(refreshToken));
+        if (!row)
+            return null;
+        const workspaceId = String(row.workspace_id);
+        let accessToken = "";
+        try {
+            accessToken = this.decryptSecrets(workspaceId, String(row.encrypted_access_token)).accessToken || "";
+        }
+        catch {
+            return null;
+        }
+        return {
+            keyId: String(row.key_id),
+            workspaceId,
+            clientId: String(row.client_id),
+            scope: String(row.scope),
+            accessToken,
+        };
+    }
+    deleteOAuthRefreshToken(refreshToken) {
+        this.db.prepare("DELETE FROM oauth_refresh_tokens WHERE token_hash = ?").run(this.hashToken(refreshToken));
+    }
+    // --- Clerk sign-in ---
+    /**
+     * Maps a verified Clerk session to a local user. Only a verified email can link to an
+     * existing account; otherwise a fresh user and workspace are created so an unverified
+     * address can never take over someone else's account.
+     */
+    provisionClerkUser(clerkUserId, identity, ownerWorkspaceId) {
+        const mappedUser = this.getClerkLinkedUser(clerkUserId);
+        if (mappedUser)
+            return mappedUser;
+        const email = identity.email ? identity.email.trim().toLowerCase() : null;
+        const verifiedEmail = email && identity.emailVerified ? email : null;
+        let user = verifiedEmail ? this.getUserByEmail(verifiedEmail) : null;
+        if (!user) {
+            const displayName = identity.name || (verifiedEmail ? verifiedEmail.split("@")[0] : "Muxo user");
+            const placeholder = `${clerkUserId.toLowerCase()}@clerk.users.muxo.invalid`;
+            user = this.registerUser({
+                email: verifiedEmail || placeholder,
+                name: displayName,
+                password: crypto.randomBytes(24).toString("hex"),
+            }).user;
+        }
+        if (ownerWorkspaceId && verifiedEmail && this.getWorkspace(ownerWorkspaceId)) {
+            this.ensureWorkspaceMembership({ workspaceId: ownerWorkspaceId, userId: user.id, role: "owner" });
+            this.db.prepare("UPDATE users SET workspace_id = ? WHERE id = ?").run(ownerWorkspaceId, user.id);
+            user = this.getUser(user.id);
+        }
+        this.db
+            .prepare("INSERT OR REPLACE INTO clerk_users (clerk_user_id, user_id, created_at) VALUES (?, ?, ?)")
+            .run(clerkUserId, user.id, new Date().toISOString());
+        return user;
+    }
+    getClerkLinkedUser(clerkUserId) {
+        const mapped = this.db
+            .prepare("SELECT user_id FROM clerk_users WHERE clerk_user_id = ?")
+            .get(clerkUserId);
+        return mapped ? this.getUser(mapped.user_id) : null;
+    }
+    getUserByEmail(email) {
+        const row = this.db
+            .prepare("SELECT * FROM users WHERE email = ?")
+            .get(email.trim().toLowerCase());
+        return row ? this.mapUser(row) : null;
+    }
+    // --- Connections ---
+    upsertConnection(params) {
+        const now = new Date().toISOString();
+        const existing = this.db
+            .prepare("SELECT id FROM connections WHERE workspace_id = ? AND lane = ? AND provider_slug = ?")
+            .get(params.workspaceId, params.lane, params.providerSlug);
+        const id = existing?.id || `conn_${crypto.randomBytes(8).toString("hex")}`;
+        this.db
+            .prepare(`INSERT INTO connections (
+          id, workspace_id, lane, provider_slug, provider_name, status,
+          external_account_id, redirect_url, metadata_json, updated_at, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(workspace_id, lane, provider_slug) DO UPDATE SET
+          provider_name = excluded.provider_name,
+          status = excluded.status,
+          external_account_id = COALESCE(excluded.external_account_id, connections.external_account_id),
+          redirect_url = CASE
+            WHEN excluded.status = 'active' THEN NULL
+            ELSE COALESCE(excluded.redirect_url, connections.redirect_url)
+          END,
+          metadata_json = excluded.metadata_json,
+          updated_at = excluded.updated_at`)
+            .run(id, params.workspaceId, params.lane, params.providerSlug, params.providerName, params.status, params.externalAccountId ?? null, params.redirectUrl ?? null, JSON.stringify(params.metadata || {}), now, now);
+        const connRecord = this.getConnection(id);
+        this.upsertTemporalFact({
+            workspaceId: params.workspaceId,
+            subject: `app:${params.providerSlug}`,
+            predicate: "CONNECTION_STATUS",
+            object: `${params.lane}:${params.status}`,
+            summary: `App ${params.providerName} (${params.providerSlug}) connection on ${params.lane} is ${params.status}`,
+            confidence: 1.0,
+            sourceKind: "resource_topology",
+            sourceReferenceId: connRecord.id,
+            metadata: {
+                lane: params.lane,
+                providerSlug: params.providerSlug,
+                status: params.status,
+            },
+        });
+        return connRecord;
+    }
+    getConnection(id) {
+        const row = this.db
+            .prepare("SELECT * FROM connections WHERE id = ?")
+            .get(id);
+        return row ? this.mapConnection(row) : null;
+    }
+    listConnections(workspaceId) {
+        const rows = this.db
+            .prepare("SELECT * FROM connections WHERE workspace_id = ? ORDER BY updated_at DESC")
+            .all(workspaceId);
+        return rows.map((r) => this.mapConnection(r));
+    }
+    // --- Provisioned Resources (Stripe Projects Vault) ---
+    upsertResource(params) {
+        const now = new Date().toISOString();
+        const existing = this.db
+            .prepare("SELECT id, env_var_keys_json, encrypted_secrets_hex FROM resources WHERE workspace_id = ? AND resource_name = ?")
+            .get(params.workspaceId, params.resourceName);
+        const id = existing?.id || `res_${crypto.randomBytes(8).toString("hex")}`;
+        let envVarKeys = existing
+            ? JSON.parse(existing.env_var_keys_json || "[]")
+            : [];
+        let encryptedHex = existing?.encrypted_secrets_hex || null;
+        if (params.secrets && Object.keys(params.secrets).length > 0) {
+            const mergedSecrets = {
+                ...this.decryptSecrets(params.workspaceId, encryptedHex),
+                ...params.secrets,
+            };
+            envVarKeys = Object.keys(mergedSecrets).sort();
+            encryptedHex = this.encryptSecrets(params.workspaceId, mergedSecrets);
+        }
+        this.db
+            .prepare(`INSERT INTO resources (
+          id, workspace_id, resource_name, provider_slug, provider_name,
+          service_slug, plan_slug, status, env_var_keys_json,
+          encrypted_secrets_hex, external_resource_id, metadata_json,
+          created_at, updated_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(workspace_id, resource_name) DO UPDATE SET
+          status = excluded.status,
+          service_slug = excluded.service_slug,
+          plan_slug = COALESCE(excluded.plan_slug, resources.plan_slug),
+          env_var_keys_json = excluded.env_var_keys_json,
+          encrypted_secrets_hex = COALESCE(excluded.encrypted_secrets_hex, resources.encrypted_secrets_hex),
+          external_resource_id = COALESCE(excluded.external_resource_id, resources.external_resource_id),
+          metadata_json = excluded.metadata_json,
+          updated_at = excluded.updated_at`)
+            .run(id, params.workspaceId, params.resourceName, params.providerSlug, params.providerName, params.serviceSlug, params.planSlug ?? null, params.status, JSON.stringify(envVarKeys), encryptedHex, params.externalResourceId ?? null, JSON.stringify(params.metadata || {}), now, now);
+        const resRecord = this.getResource(params.workspaceId, params.resourceName);
+        this.upsertTemporalFact({
+            workspaceId: params.workspaceId,
+            subject: `resource:${params.resourceName}`,
+            predicate: "PROVISIONED_ON",
+            object: `${params.serviceSlug}:${params.status}`,
+            summary: `Resource "${params.resourceName}" provisioned on ${params.serviceSlug} (${params.providerName}) with status ${params.status} [${resRecord.envVarKeys.join(", ") || "no env keys"}]`,
+            confidence: 1.0,
+            sourceKind: "resource_topology",
+            sourceReferenceId: resRecord.id,
+            metadata: {
+                providerSlug: params.providerSlug,
+                serviceSlug: params.serviceSlug,
+                planSlug: params.planSlug ?? null,
+                status: params.status,
+                envVarKeys: resRecord.envVarKeys,
+            },
+        });
+        return resRecord;
+    }
+    getResource(workspaceId, resourceNameOrId) {
+        const row = this.db
+            .prepare("SELECT * FROM resources WHERE workspace_id = ? AND (resource_name = ? OR id = ? OR external_resource_id = ?)")
+            .get(workspaceId, resourceNameOrId, resourceNameOrId, resourceNameOrId);
+        return row ? this.mapResource(row) : null;
+    }
+    findResourceAnyWorkspace(resourceNameOrId) {
+        const row = this.db
+            .prepare("SELECT * FROM resources WHERE id = ? OR external_resource_id = ? OR resource_name = ? LIMIT 1")
+            .get(resourceNameOrId, resourceNameOrId, resourceNameOrId);
+        return row ? this.mapResource(row) : null;
+    }
+    getDecryptedResourceSecrets(workspaceId, resourceNameOrId) {
+        const row = this.db
+            .prepare("SELECT encrypted_secrets_hex FROM resources WHERE workspace_id = ? AND (id = ? OR external_resource_id = ? OR resource_name = ?) LIMIT 1")
+            .get(workspaceId, resourceNameOrId, resourceNameOrId, resourceNameOrId);
+        if (!row)
+            return {};
+        return this.decryptSecrets(workspaceId, row.encrypted_secrets_hex);
+    }
+    listResources(workspaceId) {
+        const rows = this.db
+            .prepare("SELECT * FROM resources WHERE workspace_id = ? ORDER BY updated_at DESC")
+            .all(workspaceId);
+        return rows.map((r) => this.mapResource(r));
+    }
+    getDecryptedWorkspaceEnv(workspaceId) {
+        const rows = this.db
+            .prepare("SELECT encrypted_secrets_hex FROM resources WHERE workspace_id = ? AND status = 'active'")
+            .all(workspaceId);
+        const merged = {};
+        for (const row of rows) {
+            Object.assign(merged, this.decryptSecrets(workspaceId, row.encrypted_secrets_hex));
+        }
+        const byokRows = this.db
+            .prepare("SELECT encrypted_secret_hex FROM byok_keys WHERE workspace_id = ?")
+            .all(workspaceId);
+        for (const row of byokRows) {
+            Object.assign(merged, this.decryptSecrets(workspaceId, row.encrypted_secret_hex));
+        }
+        return merged;
+    }
+    // --- BYOK (Bring Your Own Key) Encrypted Vault ---
+    normalizeByokProvider(providerInput) {
+        const raw = providerInput.trim().toLowerCase();
+        for (const [slug, meta] of Object.entries(BYOK_PROVIDER_CATALOG)) {
+            if (raw === slug || raw === meta.envVarName.toLowerCase()) {
+                return { provider: slug, category: meta.category, envVarName: meta.envVarName };
+            }
+        }
+        const clean = raw.replace(/[^a-z0-9_]/g, "");
+        const envVarName = raw.endsWith("_key") || raw.endsWith("_token")
+            ? raw.toUpperCase()
+            : `${clean.toUpperCase()}_API_KEY`;
+        return {
+            provider: clean || "custom",
+            category: "supplier",
+            envVarName,
+        };
+    }
+    setByokKey(workspaceId, providerInput, secretKey) {
+        const trimmed = secretKey.trim();
+        if (!trimmed) {
+            throw new Error("BYOK secretKey must not be empty");
+        }
+        const { provider, category, envVarName } = this.normalizeByokProvider(providerInput);
+        const now = new Date().toISOString();
+        const keyPreview = trimmed.length <= 8
+            ? `${trimmed.slice(0, 2)}***`
+            : `${trimmed.slice(0, 6)}...${trimmed.slice(-4)}`;
+        const encryptedHex = this.encryptSecrets(workspaceId, { [envVarName]: trimmed });
+        this.db
+            .prepare(`INSERT INTO byok_keys (
+          workspace_id, provider, category, env_var_name, key_preview, encrypted_secret_hex, updated_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(workspace_id, provider) DO UPDATE SET
+          category = excluded.category,
+          env_var_name = excluded.env_var_name,
+          key_preview = excluded.key_preview,
+          encrypted_secret_hex = excluded.encrypted_secret_hex,
+          updated_at = excluded.updated_at`)
+            .run(workspaceId, provider, category, envVarName, keyPreview, encryptedHex, now);
+        return {
+            provider,
+            providerSlug: provider,
+            category,
+            envVarName,
+            keyPreview,
+            configured: true,
+            updatedAt: now,
+        };
+    }
+    getByokKey(workspaceId, providerInput) {
+        const { provider, envVarName } = this.normalizeByokProvider(providerInput);
+        const row = this.db
+            .prepare("SELECT encrypted_secret_hex FROM byok_keys WHERE workspace_id = ? AND provider = ?")
+            .get(workspaceId, provider);
+        if (!row)
+            return null;
+        const dec = this.decryptSecrets(workspaceId, row.encrypted_secret_hex);
+        return dec[envVarName] || Object.values(dec)[0] || null;
+    }
+    deleteByokKey(workspaceId, providerInput) {
+        const { provider } = this.normalizeByokProvider(providerInput);
+        const res = this.db
+            .prepare("DELETE FROM byok_keys WHERE workspace_id = ? AND provider = ?")
+            .run(workspaceId, provider);
+        return Number(res.changes || 0) > 0;
+    }
+    listByokKeys(workspaceId) {
+        const rows = this.db
+            .prepare("SELECT provider, category, env_var_name, key_preview, updated_at FROM byok_keys WHERE workspace_id = ? ORDER BY updated_at DESC")
+            .all(workspaceId);
+        const configuredMap = new Map();
+        for (const r of rows) {
+            const p = String(r.provider);
+            configuredMap.set(p, {
+                provider: p,
+                providerSlug: p,
+                category: String(r.category),
+                envVarName: String(r.env_var_name),
+                keyPreview: String(r.key_preview),
+                configured: true,
+                updatedAt: String(r.updated_at),
+            });
+        }
+        const result = [];
+        for (const [slug, meta] of Object.entries(BYOK_PROVIDER_CATALOG)) {
+            const existing = configuredMap.get(slug);
+            if (existing) {
+                result.push(existing);
+                configuredMap.delete(slug);
+            }
+            else {
+                result.push({
+                    provider: slug,
+                    providerSlug: slug,
+                    category: meta.category,
+                    envVarName: meta.envVarName,
+                    keyPreview: "",
+                    configured: false,
+                    updatedAt: "",
+                });
+            }
+        }
+        for (const extra of configuredMap.values()) {
+            result.push(extra);
+        }
+        return result;
+    }
+    hasByokForLane(workspaceId, lane, toolSlug) {
+        const slug = (toolSlug || "").toLowerCase();
+        if (slug.startsWith("billing."))
+            return false;
+        if (lane === "composio_sdk") {
+            return Boolean(this.getByokKey(workspaceId, "composio"));
+        }
+        if (lane === "composio_instant") {
+            if (this.getByokKey(workspaceId, "composio"))
+                return true;
+            if ((slug.includes("scrape") || slug.includes("crawl") || slug.includes("seo")) &&
+                this.getByokKey(workspaceId, "firecrawl")) {
+                return true;
+            }
+            if (slug.includes("search") && this.getByokKey(workspaceId, "exa")) {
+                return true;
+            }
+            return false;
+        }
+        if (lane === "stripe_projects") {
+            return Boolean(this.getByokKey(workspaceId, "stripe"));
+        }
+        return false;
+    }
+    // --- Plans ---
+    createPlan(params) {
+        const id = `plan_${crypto.randomBytes(8).toString("hex")}`;
+        const now = new Date();
+        const expires = new Date(now.getTime() + 60 * 60 * 1000);
+        this.db
+            .prepare(`INSERT INTO plans (
+          id, workspace_id, actor_id, tool_slug, upstream_slug, lane, risk_level,
+          input_json, reason, credit_cost, approval_status, approved_by, approved_at,
+          run_id, decision_record_json, memory_context_json, created_at, expires_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?)`)
+            .run(id, params.workspaceId, params.actorId, params.toolSlug, params.upstreamSlug, params.lane, params.riskLevel, JSON.stringify(params.input || {}), params.reason, params.creditCost, params.approvalStatus, params.approvalStatus === "auto_approved" ? "policy:auto" : null, params.approvalStatus === "auto_approved" ? now.toISOString() : null, params.decisionRecord ? JSON.stringify(params.decisionRecord) : null, params.memoryContext ? JSON.stringify(params.memoryContext) : null, now.toISOString(), expires.toISOString());
+        return this.getPlan(params.workspaceId, id);
+    }
+    getPlan(workspaceId, planId) {
+        const row = this.db
+            .prepare("SELECT * FROM plans WHERE id = ? AND workspace_id = ?")
+            .get(planId, workspaceId);
+        return row ? this.mapPlan(row) : null;
+    }
+    getPlanById(planId) {
+        const row = this.db
+            .prepare("SELECT * FROM plans WHERE id = ?")
+            .get(planId);
+        return row ? this.mapPlan(row) : null;
+    }
+    listPlans(workspaceId, limit = 50) {
+        const rows = this.db
+            .prepare("SELECT * FROM plans WHERE workspace_id = ? ORDER BY created_at DESC LIMIT ?")
+            .all(workspaceId, limit);
+        return rows.map((r) => this.mapPlan(r));
+    }
+    updatePlanApproval(params) {
+        const now = new Date().toISOString();
+        this.db
+            .prepare(`UPDATE plans
+         SET approval_status = ?, approved_by = ?, approved_at = ?
+         WHERE id = ? AND workspace_id = ?`)
+            .run(params.approvalStatus, params.approvedBy, now, params.planId, params.workspaceId);
+        return this.getPlan(params.workspaceId, params.planId);
+    }
+    // --- Runs & Cryptographic Receipts ---
+    createRun(plan, actorId) {
+        const id = `run_${crypto.randomBytes(8).toString("hex")}`;
+        const now = new Date().toISOString();
+        this.db
+            .prepare(`INSERT INTO runs (
+          id, plan_id, workspace_id, actor_id, tool_slug, lane, risk_level,
+          status, input_json, output_json, error, actions_metered, credits_metered,
+          duration_ms, receipt_id, started_at, completed_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, 'running', ?, NULL, NULL, 0, 0, NULL, NULL, ?, NULL)`)
+            .run(id, plan.id, plan.workspaceId, actorId, plan.toolSlug, plan.lane, plan.riskLevel, JSON.stringify(plan.input), now);
+        this.db
+            .prepare("UPDATE plans SET run_id = ?, approval_status = 'executed' WHERE id = ?")
+            .run(id, plan.id);
+        return this.getRun(plan.workspaceId, id);
+    }
+    finalizeRun(params) {
+        const run = this.getRun(params.workspaceId, params.runId);
+        if (!run)
+            throw new Error(`Run ${params.runId} not found`);
+        const now = new Date().toISOString();
+        if (params.actionsMetered > 0 || params.creditsMetered > 0) {
+            const ws = this.getWorkspace(params.workspaceId);
+            const newActionsUsed = ws.monthlyActionsUsed + params.actionsMetered;
+            const newCreditsBalance = Math.max(0, ws.creditsBalance - params.creditsMetered);
+            this.db
+                .prepare(`UPDATE workspaces
+           SET monthly_actions_used = ?, credits_balance = ?, updated_at = ?
+           WHERE id = ?`)
+                .run(newActionsUsed, newCreditsBalance, now, params.workspaceId);
+            const byokUsed = params.creditsMetered === 0 &&
+                this.hasByokForLane(params.workspaceId, run.lane, run.toolSlug);
+            const settlement = this.computeSupplierSettlement(run.lane, run.toolSlug, params.creditsMetered, byokUsed ? "settled_by_customer_byok" : "settled_by_muxo_master_wallet", params.workspaceId);
+            this.addLedgerEntry({
+                workspaceId: params.workspaceId,
+                kind: "run_deduction",
+                actionsDelta: -params.actionsMetered,
+                creditsDelta: -params.creditsMetered,
+                balanceAfter: newCreditsBalance,
+                referenceId: run.id,
+                description: byokUsed
+                    ? `Executed ${run.toolSlug} (${run.lane}) — BYOK 0-credit execution (Customer's own ${settlement.supplierName} key)`
+                    : `Executed ${run.toolSlug} (${run.lane}) — User paid Muxo ${params.creditsMetered} credits ($${(settlement.userRetailChargeCents / 100).toFixed(2)}) -> Muxo paid ${settlement.supplierName} ($${(settlement.supplierWholesalePayableCents / 100).toFixed(2)})`,
+            });
+        }
+        const receipt = this.issueReceipt({
+            run,
+            status: params.status,
+            output: params.output ?? null,
+            actionsMetered: params.actionsMetered,
+            creditsMetered: params.creditsMetered,
+            decisionRecord: params.decisionRecord ?? null,
+            issuedAt: now,
+        });
+        this.db
+            .prepare(`UPDATE runs
+         SET status = ?, output_json = ?, error = ?, actions_metered = ?,
+             credits_metered = ?, duration_ms = ?, receipt_id = ?, completed_at = ?
+         WHERE id = ? AND workspace_id = ?`)
+            .run(params.status, params.output ? JSON.stringify(params.output) : null, params.error ?? null, params.actionsMetered, params.creditsMetered, params.durationMs, receipt.id, now, params.runId, params.workspaceId);
+        return {
+            run: this.getRun(params.workspaceId, params.runId),
+            receipt,
+        };
+    }
+    cancelRun(params) {
+        const run = this.getRun(params.workspaceId, params.runId);
+        if (!run)
+            throw new Error(`Run ${params.runId} not found`);
+        const now = new Date().toISOString();
+        const cancellation = {
+            cancelled: true,
+            cancelledBy: params.cancelledBy,
+            cancelledAt: now,
+            previousStatus: run.status,
+            supersedesReceiptId: run.receiptId,
+            ...(params.reason ? { reason: params.reason } : {}),
+        };
+        const receipt = this.issueReceipt({
+            run,
+            status: "cancelled",
+            output: cancellation,
+            actionsMetered: 0,
+            creditsMetered: 0,
+            decisionRecord: null,
+            issuedAt: now,
+        });
+        this.db
+            .prepare(`UPDATE runs
+         SET status = 'cancelled', output_json = COALESCE(output_json, ?), error = ?,
+             receipt_id = ?, completed_at = COALESCE(completed_at, ?),
+             duration_ms = COALESCE(duration_ms, ?)
+         WHERE id = ? AND workspace_id = ?`)
+            .run(JSON.stringify(cancellation), params.reason || "Cancelled by operator", receipt.id, now, Math.max(0, Date.now() - new Date(run.startedAt).getTime()), run.id, params.workspaceId);
+        return { run: this.getRun(params.workspaceId, run.id), receipt };
+    }
+    issueReceipt(params) {
+        const id = `rcpt_${crypto.randomBytes(8).toString("hex")}`;
+        const lastReceipt = this.db
+            .prepare("SELECT receipt_hash FROM receipts WHERE workspace_id = ? ORDER BY issued_at DESC, rowid DESC LIMIT 1")
+            .get(params.run.workspaceId);
+        const prevReceiptHash = lastReceipt?.receipt_hash || "genesis_0000000000000000";
+        const inputHash = crypto
+            .createHash("sha256")
+            .update(JSON.stringify(params.run.input || {}))
+            .digest("hex");
+        const outputHash = crypto
+            .createHash("sha256")
+            .update(JSON.stringify(params.output || {}))
+            .digest("hex");
+        const canonicalPayload = [
+            id,
+            params.run.id,
+            params.run.planId,
+            params.run.workspaceId,
+            params.run.actorId,
+            params.run.toolSlug,
+            params.run.lane,
+            params.run.riskLevel,
+            params.status,
+            String(params.actionsMetered),
+            String(params.creditsMetered),
+            inputHash,
+            outputHash,
+            prevReceiptHash,
+            params.issuedAt,
+        ].join("|");
+        const receiptHash = crypto.createHash("sha256").update(canonicalPayload).digest("hex");
+        const signature = crypto
+            .createHmac("sha256", this.vaultKey)
+            .update(receiptHash)
+            .digest("hex");
+        this.db
+            .prepare(`INSERT INTO receipts (
+          id, run_id, plan_id, workspace_id, actor_id, tool_slug, lane, risk_level,
+          status, actions_metered, credits_metered, input_hash, output_hash,
+          prev_receipt_hash, receipt_hash, signature, decision_record_json, issued_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(id, params.run.id, params.run.planId, params.run.workspaceId, params.run.actorId, params.run.toolSlug, params.run.lane, params.run.riskLevel, params.status, params.actionsMetered, params.creditsMetered, inputHash, outputHash, prevReceiptHash, receiptHash, signature, params.decisionRecord ? JSON.stringify(params.decisionRecord) : null, params.issuedAt);
+        return this.getReceipt(params.run.workspaceId, id);
+    }
+    verifyReceipt(receipt) {
+        const canonicalPayload = [
+            receipt.id,
+            receipt.runId,
+            receipt.planId,
+            receipt.workspaceId,
+            receipt.actorId,
+            receipt.toolSlug,
+            receipt.lane,
+            receipt.riskLevel,
+            receipt.status,
+            String(receipt.actionsMetered),
+            String(receipt.creditsMetered),
+            receipt.inputHash,
+            receipt.outputHash,
+            receipt.prevReceiptHash,
+            receipt.issuedAt,
+        ].join("|");
+        const expectedHash = crypto.createHash("sha256").update(canonicalPayload).digest("hex");
+        if (expectedHash !== receipt.receiptHash)
+            return false;
+        const expectedSig = crypto
+            .createHmac("sha256", this.vaultKey)
+            .update(expectedHash)
+            .digest("hex");
+        return expectedSig === receipt.signature;
+    }
+    getRun(workspaceId, runId) {
+        const row = this.db
+            .prepare("SELECT * FROM runs WHERE id = ? AND workspace_id = ?")
+            .get(runId, workspaceId);
+        return row ? this.mapRun(row) : null;
+    }
+    listRuns(workspaceId, limit = 50) {
+        const rows = this.db
+            .prepare("SELECT * FROM runs WHERE workspace_id = ? ORDER BY started_at DESC LIMIT ?")
+            .all(workspaceId, limit);
+        return rows.map((r) => this.mapRun(r));
+    }
+    getReceipt(workspaceId, receiptIdOrRunId) {
+        // A cancelled run has both its original and its cancellation receipt; prefer an exact
+        // receipt id match, otherwise the newest receipt for the run.
+        const row = this.db
+            .prepare(`SELECT * FROM receipts WHERE workspace_id = ? AND (id = ? OR run_id = ?)
+         ORDER BY CASE WHEN id = ? THEN 0 ELSE 1 END, issued_at DESC, rowid DESC LIMIT 1`)
+            .get(workspaceId, receiptIdOrRunId, receiptIdOrRunId, receiptIdOrRunId);
+        return row ? this.mapReceipt(row) : null;
+    }
+    listReceipts(workspaceId, limit = 50) {
+        const rows = this.db
+            .prepare("SELECT * FROM receipts WHERE workspace_id = ? ORDER BY issued_at DESC, rowid DESC LIMIT ?")
+            .all(workspaceId, limit);
+        return rows.map((r) => this.mapReceipt(r));
+    }
+    // --- Billing & Credit Ledger ---
+    markStripeEventProcessed(eventId) {
+        const existing = this.db
+            .prepare("SELECT event_id FROM processed_stripe_events WHERE event_id = ?")
+            .get(eventId);
+        if (existing)
+            return false;
+        this.db
+            .prepare("INSERT INTO processed_stripe_events (event_id, processed_at) VALUES (?, ?)")
+            .run(eventId, new Date().toISOString());
+        return true;
+    }
+    upgradeWorkspaceToStarter(params) {
+        if (!this.markStripeEventProcessed(`upgrade:${params.referenceId}`)) {
+            return this.getWorkspace(params.workspaceId);
+        }
+        const ws = this.getWorkspace(params.workspaceId);
+        if (!ws)
+            throw new Error(`Workspace ${params.workspaceId} not found`);
+        const now = new Date().toISOString();
+        const bonus = params.bonusCredits !== undefined ? Number(params.bonusCredits) : 1000;
+        const newCredits = ws.creditsBalance + bonus;
+        this.db
+            .prepare(`UPDATE workspaces
+         SET tier = 'starter',
+             monthly_actions_limit = 5000,
+             credits_balance = ?,
+             stripe_customer_id = COALESCE(?, stripe_customer_id),
+             stripe_subscription_id = COALESCE(?, stripe_subscription_id),
+             updated_at = ?
+         WHERE id = ?`)
+            .run(newCredits, params.stripeCustomerId ?? null, params.stripeSubscriptionId ?? null, now, params.workspaceId);
+        this.addLedgerEntry({
+            workspaceId: params.workspaceId,
+            kind: "subscription_upgrade",
+            actionsDelta: 4000,
+            creditsDelta: bonus,
+            balanceAfter: newCredits,
+            referenceId: params.referenceId,
+            description: `Upgraded to Starter Plan ($29/mo — 5,000 actions/mo + ${bonus} credits)`,
+        });
+        return this.getWorkspace(params.workspaceId);
+    }
+    addWorkspaceCredits(params) {
+        if (!this.markStripeEventProcessed(`credits:${params.referenceId}`)) {
+            return this.getWorkspace(params.workspaceId);
+        }
+        const ws = this.getWorkspace(params.workspaceId);
+        if (!ws)
+            throw new Error(`Workspace ${params.workspaceId} not found`);
+        const now = new Date().toISOString();
+        const newCredits = ws.creditsBalance + params.credits;
+        this.db
+            .prepare("UPDATE workspaces SET credits_balance = ?, updated_at = ? WHERE id = ?")
+            .run(newCredits, now, params.workspaceId);
+        this.addLedgerEntry({
+            workspaceId: params.workspaceId,
+            kind: "credit_topup",
+            actionsDelta: 0,
+            creditsDelta: params.credits,
+            balanceAfter: newCredits,
+            referenceId: params.referenceId,
+            description: params.description,
+        });
+        return this.getWorkspace(params.workspaceId);
+    }
+    addLedgerEntry(params) {
+        const id = `led_${crypto.randomBytes(8).toString("hex")}`;
+        const now = new Date().toISOString();
+        this.db
+            .prepare(`INSERT INTO ledger_entries (
+          id, workspace_id, kind, actions_delta, credits_delta,
+          balance_after, reference_id, description, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(id, params.workspaceId, params.kind, params.actionsDelta, params.creditsDelta, params.balanceAfter, params.referenceId, params.description, now);
+        return {
+            id,
+            workspaceId: params.workspaceId,
+            kind: params.kind,
+            actionsDelta: params.actionsDelta,
+            creditsDelta: params.creditsDelta,
+            balanceAfter: params.balanceAfter,
+            referenceId: params.referenceId,
+            description: params.description,
+            createdAt: now,
+        };
+    }
+    computeSupplierSettlement(lane, toolSlug, creditCost, settlementStatus = "settled_by_muxo_master_wallet", workspaceId) {
+        const useByok = settlementStatus === "settled_by_customer_byok" ||
+            settlementStatus === "planned_customer_byok" ||
+            (Number(creditCost || 0) === 0 && workspaceId
+                ? this.hasByokForLane(workspaceId, lane, toolSlug)
+                : false);
+        const upstreamProvider = toolSlug.split(".")[1] || lane;
+        if (useByok) {
+            const isPlanned = settlementStatus === "planned_muxo_master_wallet" ||
+                settlementStatus === "planned_customer_byok";
+            return {
+                fundingMode: "byok",
+                supplier: lane,
+                supplierName: "Customer BYOK Upstream Key (0% Muxo Markup)",
+                upstreamProvider,
+                userChargeCredits: 0,
+                userRetailChargeCents: 0,
+                supplierWholesalePayableCents: 0,
+                muxoNetMarginCents: 0,
+                settlementStatus: isPlanned
+                    ? "planned_customer_byok"
+                    : "settled_by_customer_byok",
+                masterAccountRef: "customer_byok_vault",
+            };
+        }
+        const userChargeCredits = Math.max(0, Number(creditCost || 0));
+        const userRetailChargeCents = Math.round(userChargeCredits * 100) / 100;
+        const supplierWholesalePayableCents = Math.round(userRetailChargeCents * 0.6 * 100) / 100;
+        const muxoNetMarginCents = Math.round((userRetailChargeCents - supplierWholesalePayableCents) * 100) / 100;
+        const supplierMeta = {
+            composio_instant: {
+                supplierName: "Composio Instant Wholesale Wallet",
+                masterAccountRef: "muxo_master_composio_wallet",
+            },
+            composio_sdk: {
+                supplierName: "Composio Managed OAuth Gateway",
+                masterAccountRef: "muxo_master_composio_sdk_account",
+            },
+            stripe_projects: {
+                supplierName: "Stripe Projects Master Infrastructure Account",
+                masterAccountRef: "muxo_master_stripe_projects_account",
+            },
+        };
+        const meta = supplierMeta[lane] || supplierMeta.composio_instant;
+        return {
+            fundingMode: "muxo_funded",
+            supplier: lane,
+            supplierName: meta.supplierName,
+            upstreamProvider,
+            userChargeCredits,
+            userRetailChargeCents,
+            supplierWholesalePayableCents,
+            muxoNetMarginCents,
+            settlementStatus,
+            masterAccountRef: meta.masterAccountRef,
+        };
+    }
+    getSupplierSettlementSummary(workspaceId) {
+        const ws = this.getWorkspace(workspaceId);
+        const ledger = this.listLedgerEntries(workspaceId, 500);
+        const runs = this.listRuns(workspaceId, 500).filter((r) => r.status === "succeeded");
+        const byokProviders = this.listByokKeys(workspaceId)
+            .filter((k) => k.configured)
+            .map((k) => k.provider);
+        const totalCreditsPurchasedOrGranted = ledger
+            .filter((e) => e.creditsDelta > 0)
+            .reduce((acc, e) => acc + e.creditsDelta, 0);
+        const bySupplier = {
+            composio_instant: {
+                runsCount: 0,
+                creditsConsumed: 0,
+                userRetailSpendCents: 0,
+                supplierWholesalePaidCents: 0,
+                muxoNetMarginCents: 0,
+            },
+            composio_sdk: {
+                runsCount: 0,
+                creditsConsumed: 0,
+                userRetailSpendCents: 0,
+                supplierWholesalePaidCents: 0,
+                muxoNetMarginCents: 0,
+            },
+            stripe_projects: {
+                runsCount: 0,
+                creditsConsumed: 0,
+                userRetailSpendCents: 0,
+                supplierWholesalePaidCents: 0,
+                muxoNetMarginCents: 0,
+            },
+        };
+        let totalCreditsConsumed = 0;
+        let totalUserRetailSpendCents = 0;
+        let totalSupplierWholesalePaidCents = 0;
+        let totalMuxoNetMarginCents = 0;
+        for (const run of runs) {
+            const s = this.computeSupplierSettlement(run.lane, run.toolSlug, run.creditsMetered, run.creditsMetered === 0 && this.hasByokForLane(workspaceId, run.lane, run.toolSlug)
+                ? "settled_by_customer_byok"
+                : "settled_by_muxo_master_wallet", workspaceId);
+            const bucket = bySupplier[run.lane] || bySupplier.composio_instant;
+            bucket.runsCount += 1;
+            bucket.creditsConsumed += s.userChargeCredits;
+            bucket.userRetailSpendCents =
+                Math.round((bucket.userRetailSpendCents + s.userRetailChargeCents) * 100) / 100;
+            bucket.supplierWholesalePaidCents =
+                Math.round((bucket.supplierWholesalePaidCents + s.supplierWholesalePayableCents) * 100) / 100;
+            bucket.muxoNetMarginCents =
+                Math.round((bucket.muxoNetMarginCents + s.muxoNetMarginCents) * 100) / 100;
+            totalCreditsConsumed += s.userChargeCredits;
+            totalUserRetailSpendCents =
+                Math.round((totalUserRetailSpendCents + s.userRetailChargeCents) * 100) / 100;
+            totalSupplierWholesalePaidCents =
+                Math.round((totalSupplierWholesalePaidCents + s.supplierWholesalePayableCents) * 100) / 100;
+            totalMuxoNetMarginCents =
+                Math.round((totalMuxoNetMarginCents + s.muxoNetMarginCents) * 100) / 100;
+        }
+        return {
+            workspaceId,
+            fundingModel: "user_pays_muxo_muxo_pays_suppliers",
+            activeFundingMode: byokProviders.length > 0 ? "byok_hybrid" : "muxo_funded",
+            byokProviders,
+            creditPriceCents: 1,
+            totalCreditsPurchasedOrGranted,
+            totalCreditsConsumed,
+            currentCreditsBalance: ws?.creditsBalance ?? 0,
+            totalUserRetailSpendCents,
+            totalSupplierWholesalePaidCents,
+            totalMuxoNetMarginCents,
+            bySupplier,
+            masterWalletProtection: {
+                status: process.env.MUXO_MASTER_WALLET_DEPLETED === "true"
+                    ? "failover_active"
+                    : "healthy",
+                zeroChargeOnFailure: true,
+                instantFailoverMode: "zero_cost_native_edge",
+                paidProvisioningPolicy: "muxo_master_wallet_or_customer_stripe_byok",
+                retailToWholesaleCoverageRatio: totalSupplierWholesalePaidCents > 0
+                    ? Math.round((totalUserRetailSpendCents / totalSupplierWholesalePaidCents) * 100) / 100
+                    : 1.67,
+            },
+        };
+    }
+    listLedgerEntries(workspaceId, limit = 50) {
+        const rows = this.db
+            .prepare("SELECT * FROM ledger_entries WHERE workspace_id = ? ORDER BY created_at DESC LIMIT ?")
+            .all(workspaceId, limit);
+        return rows.map((r) => {
+            const kind = String(r.kind);
+            const refId = r.reference_id ? String(r.reference_id) : null;
+            const creditsDelta = Number(r.credits_delta);
+            let supplierSettlement = null;
+            if (kind === "run_deduction" && refId) {
+                const run = this.getRun(workspaceId, refId);
+                if (run) {
+                    const isByokEntry = creditsDelta === 0 &&
+                        (String(r.description || "").includes("BYOK") ||
+                            this.hasByokForLane(workspaceId, run.lane, run.toolSlug));
+                    supplierSettlement = this.computeSupplierSettlement(run.lane, run.toolSlug, Math.abs(creditsDelta), isByokEntry
+                        ? "settled_by_customer_byok"
+                        : "settled_by_muxo_master_wallet", workspaceId);
+                }
+            }
+            return {
+                id: String(r.id),
+                workspaceId: String(r.workspace_id),
+                kind,
+                actionsDelta: Number(r.actions_delta),
+                creditsDelta,
+                balanceAfter: Number(r.balance_after),
+                referenceId: refId,
+                description: String(r.description),
+                supplierSettlement,
+                createdAt: String(r.created_at),
+            };
+        });
+    }
+    // --- Supermemory Local Index ---
+    saveMemoryRecord(params) {
+        const id = `mem_${crypto.randomBytes(8).toString("hex")}`;
+        const now = new Date().toISOString();
+        this.db
+            .prepare(`INSERT INTO memories (
+          id, workspace_id, namespace, document_id, title, content, kind, metadata_json, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(id, params.workspaceId, params.namespace, params.documentId, params.title, params.content, params.kind, JSON.stringify(params.metadata || {}), now);
+        return {
+            id,
+            workspaceId: params.workspaceId,
+            namespace: params.namespace,
+            documentId: params.documentId,
+            title: params.title,
+            content: params.content,
+            kind: params.kind,
+            metadata: params.metadata || {},
+            createdAt: now,
+        };
+    }
+    listMemoryRecords(workspaceId, limit = 30) {
+        const rows = this.db
+            .prepare("SELECT * FROM memories WHERE workspace_id = ? ORDER BY created_at DESC LIMIT ?")
+            .all(workspaceId, limit);
+        return rows.map((r) => ({
+            id: String(r.id),
+            workspaceId: String(r.workspace_id),
+            namespace: String(r.namespace),
+            documentId: String(r.document_id),
+            title: String(r.title),
+            content: String(r.content),
+            kind: String(r.kind),
+            metadata: JSON.parse(String(r.metadata_json || "{}")),
+            createdAt: String(r.created_at),
+        }));
+    }
+    deleteMemoryRecord(workspaceId, idOrDocId) {
+        const row = this.db
+            .prepare("SELECT * FROM memories WHERE workspace_id = ? AND (id = ? OR document_id = ?)")
+            .get(workspaceId, idOrDocId, idOrDocId);
+        if (!row)
+            return null;
+        this.db
+            .prepare("DELETE FROM memories WHERE id = ? AND workspace_id = ?")
+            .run(String(row.id), workspaceId);
+        // Also mark any temporal facts sourced from this memory record as invalidated (valid_to = now)
+        const now = new Date().toISOString();
+        this.db
+            .prepare(`UPDATE temporal_facts
+         SET valid_to = ?
+         WHERE workspace_id = ?
+           AND valid_to IS NULL
+           AND (source_reference_id = ? OR source_reference_id = ? OR id = ?)`)
+            .run(now, workspaceId, String(row.id), String(row.document_id), idOrDocId);
+        return {
+            id: String(row.id),
+            workspaceId: String(row.workspace_id),
+            namespace: String(row.namespace),
+            documentId: String(row.document_id),
+            title: String(row.title),
+            content: String(row.content),
+            kind: String(row.kind),
+            metadata: JSON.parse(String(row.metadata_json || "{}")),
+            createdAt: String(row.created_at),
+        };
+    }
+    // --- Bi-Temporal Resource & Fact Lineage (Zero-Dependency Graphiti Alternative) ---
+    upsertTemporalFact(params) {
+        const now = new Date().toISOString();
+        const subject = params.subject.trim();
+        const predicate = params.predicate.trim().toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+        const object = params.object.trim();
+        const confidence = params.confidence !== undefined ? Number(params.confidence) : 0.95;
+        const sourceKind = params.sourceKind || "fact";
+        // Check if an active fact already exists for (workspace_id, subject, predicate)
+        const activeRow = this.db
+            .prepare(`SELECT * FROM temporal_facts
+         WHERE workspace_id = ? AND subject = ? AND predicate = ? AND valid_to IS NULL
+         ORDER BY created_at DESC LIMIT 1`)
+            .get(params.workspaceId, subject, predicate);
+        if (activeRow && String(activeRow.object) === object) {
+            // Same object is still valid — update summary/confidence/metadata in place
+            const existingId = String(activeRow.id);
+            this.db
+                .prepare(`UPDATE temporal_facts
+           SET summary = ?, confidence = ?, metadata_json = ?, source_reference_id = COALESCE(?, source_reference_id)
+           WHERE id = ?`)
+                .run(params.summary, confidence, JSON.stringify(params.metadata || {}), params.sourceReferenceId ?? null, existingId);
+            return this.mapTemporalFact({
+                ...activeRow,
+                summary: params.summary,
+                confidence,
+                metadata_json: JSON.stringify(params.metadata || {}),
+                source_reference_id: params.sourceReferenceId ?? activeRow.source_reference_id,
+            });
+        }
+        const newId = `tf_${crypto.randomBytes(8).toString("hex")}`;
+        if (activeRow && params.supersedeExisting !== false) {
+            this.db
+                .prepare(`UPDATE temporal_facts
+           SET valid_to = ?, superseded_by_id = ?
+           WHERE id = ? AND workspace_id = ?`)
+                .run(now, newId, String(activeRow.id), params.workspaceId);
+        }
+        this.db
+            .prepare(`INSERT INTO temporal_facts (
+          id, workspace_id, subject, predicate, object, summary, confidence,
+          valid_from, valid_to, superseded_by_id, source_kind, source_reference_id,
+          metadata_json, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, ?, ?, ?, ?)`)
+            .run(newId, params.workspaceId, subject, predicate, object, params.summary, confidence, now, sourceKind, params.sourceReferenceId ?? null, JSON.stringify(params.metadata || {}), now);
+        return {
+            id: newId,
+            workspaceId: params.workspaceId,
+            subject,
+            predicate,
+            object,
+            summary: params.summary,
+            confidence,
+            validFrom: now,
+            validTo: null,
+            supersededById: null,
+            sourceKind,
+            sourceReferenceId: params.sourceReferenceId ?? null,
+            metadata: params.metadata || {},
+            createdAt: now,
+        };
+    }
+    listTemporalFacts(workspaceId, opts) {
+        const limit = Math.min(200, Math.max(1, Number(opts?.limit || 50)));
+        const includeHistorical = Boolean(opts?.includeHistorical);
+        const rows = this.db
+            .prepare(includeHistorical
+            ? `SELECT * FROM temporal_facts WHERE workspace_id = ? ORDER BY created_at DESC LIMIT ?`
+            : `SELECT * FROM temporal_facts WHERE workspace_id = ? AND valid_to IS NULL ORDER BY created_at DESC LIMIT ?`)
+            .all(workspaceId, limit);
+        let facts = rows.map((r) => this.mapTemporalFact(r));
+        if (opts?.subject) {
+            const subj = opts.subject.toLowerCase();
+            facts = facts.filter((f) => f.subject.toLowerCase().includes(subj));
+        }
+        if (opts?.predicate) {
+            const pred = opts.predicate.toUpperCase();
+            facts = facts.filter((f) => f.predicate.toUpperCase().includes(pred));
+        }
+        if (opts?.query && opts.query.trim()) {
+            const tokens = opts.query
+                .toLowerCase()
+                .split(/\s+/)
+                .filter((t) => t.length >= 2);
+            if (tokens.length > 0) {
+                facts = facts.filter((f) => {
+                    const hay = `${f.subject} ${f.predicate} ${f.object} ${f.summary}`.toLowerCase();
+                    return tokens.some((tok) => hay.includes(tok));
+                });
+            }
+        }
+        return facts;
+    }
+    forgetMatchingMemoryRecords(workspaceId, query) {
+        const trimmed = query.trim().toLowerCase();
+        if (!trimmed) {
+            return { deletedMemories: [], invalidatedFacts: [] };
+        }
+        const tokens = trimmed.split(/\s+/).filter((t) => t.length >= 2);
+        const allMemories = this.listMemoryRecords(workspaceId, 200);
+        const matchingMemories = allMemories.filter((m) => {
+            const hay = `${m.title} ${m.content} ${m.kind}`.toLowerCase();
+            return (hay.includes(trimmed) ||
+                (tokens.length > 0 && tokens.every((tok) => hay.includes(tok))));
+        });
+        // Snapshot before deleting: deleteMemoryRecord retires sourced facts itself,
+        // and those must still be reported as invalidated.
+        const activeFacts = this.listTemporalFacts(workspaceId, {
+            includeHistorical: false,
+            limit: 200,
+        });
+        const deletedMemories = [];
+        for (const mem of matchingMemories) {
+            const deleted = this.deleteMemoryRecord(workspaceId, mem.id);
+            if (deleted)
+                deletedMemories.push(deleted);
+        }
+        const deletedSourceIds = new Set(deletedMemories.flatMap((m) => [m.id, m.documentId]));
+        const matchingFacts = activeFacts.filter((f) => {
+            const hay = `${f.subject} ${f.predicate} ${f.object} ${f.summary}`.toLowerCase();
+            return (hay.includes(trimmed) ||
+                (tokens.length > 0 && tokens.every((tok) => hay.includes(tok))) ||
+                Boolean(f.sourceReferenceId && deletedSourceIds.has(f.sourceReferenceId)));
+        });
+        const now = new Date().toISOString();
+        const invalidatedFacts = [];
+        for (const fact of matchingFacts) {
+            this.db
+                .prepare(`UPDATE temporal_facts SET valid_to = ? WHERE id = ? AND workspace_id = ?`)
+                .run(now, fact.id, workspaceId);
+            invalidatedFacts.push({
+                ...fact,
+                validTo: now,
+            });
+        }
+        return {
+            deletedMemories,
+            invalidatedFacts,
+        };
+    }
+    mapTemporalFact(row) {
+        return {
+            id: String(row.id),
+            workspaceId: String(row.workspace_id),
+            subject: String(row.subject),
+            predicate: String(row.predicate),
+            object: String(row.object),
+            summary: String(row.summary),
+            confidence: Number(row.confidence ?? 0.95),
+            validFrom: String(row.valid_from),
+            validTo: row.valid_to ? String(row.valid_to) : null,
+            supersededById: row.superseded_by_id ? String(row.superseded_by_id) : null,
+            sourceKind: String(row.source_kind || "fact"),
+            sourceReferenceId: row.source_reference_id
+                ? String(row.source_reference_id)
+                : null,
+            metadata: JSON.parse(String(row.metadata_json || "{}")),
+            createdAt: String(row.created_at),
+        };
+    }
+    // --- Autonomous Agent Onboarding (agents.composio.dev pattern) ---
+    createAutonomousAgentSignup(params) {
+        const suffix = crypto.randomBytes(4).toString("hex");
+        const agentName = (params?.agentName || `Autonomous Agent ${suffix}`).trim();
+        const email = `agent+${suffix}@agents.muxo.ai`;
+        const password = crypto.randomBytes(16).toString("hex");
+        const created = this.registerUser({
+            email,
+            name: agentName,
+            password,
+            workspaceName: `${agentName} Workspace`,
+        });
+        const keyRes = this.createApiKey({
+            workspaceId: created.workspace.id,
+            name: params?.harness
+                ? `${params.harness} Autonomous Key`
+                : "Autonomous Agent Key",
+            environment: "live",
+        });
+        return {
+            user: created.user,
+            workspace: created.workspace,
+            apiKey: keyRes.secretKey,
+            apiKeyRecord: keyRes.record,
+        };
+    }
+    getLatestClaimForWorkspace(workspaceId) {
+        const row = this.db
+            .prepare(`SELECT * FROM agent_claims
+         WHERE workspace_id = ?
+         ORDER BY created_at DESC
+         LIMIT 1`)
+            .get(workspaceId);
+        if (!row)
+            return null;
+        return {
+            claimSlug: String(row.claim_slug),
+            targetEmail: String(row.target_email),
+            status: String(row.status),
+            claimedAt: row.claimed_at ? String(row.claimed_at) : null,
+            expiresAt: String(row.expires_at),
+        };
+    }
+    /**
+     * Creates a claim link for a workspace. A claim minted without an email (at agent signup)
+     * stays unusable until the agent names the owner; naming one reuses that same link.
+     */
+    createAgentClaim(params) {
+        const targetEmail = (params.email || "").trim().toLowerCase();
+        const now = new Date();
+        const expires = new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000);
+        const unbound = targetEmail
+            ? this.db
+                .prepare(`SELECT claim_slug FROM agent_claims
+             WHERE workspace_id = ? AND status = 'invited' AND target_email = ''
+             ORDER BY created_at DESC LIMIT 1`)
+                .get(params.workspaceId)
+            : undefined;
+        const claimSlug = unbound?.claim_slug || crypto.randomBytes(24).toString("base64url");
+        if (unbound) {
+            this.db
+                .prepare("UPDATE agent_claims SET target_email = ?, expires_at = ? WHERE claim_slug = ?")
+                .run(targetEmail, expires.toISOString(), claimSlug);
+        }
+        else {
+            this.db
+                .prepare(`INSERT INTO agent_claims (
+            claim_slug, workspace_id, target_email, status, claimed_at, expires_at, created_at
+          ) VALUES (?, ?, ?, 'invited', NULL, ?, ?)`)
+                .run(claimSlug, params.workspaceId, targetEmail, expires.toISOString(), now.toISOString());
+        }
+        return {
+            claimSlug,
+            claimUrl: `${params.baseUrl.replace(/\/$/, "")}/claim/${claimSlug}`,
+            targetEmail,
+            status: "invited",
+            expiresAt: expires.toISOString(),
+        };
+    }
+    /** Returns a claim only while it can still be accepted (invited and not expired). */
+    getOpenAgentClaim(claimSlug) {
+        const row = this.db
+            .prepare("SELECT * FROM agent_claims WHERE claim_slug = ?")
+            .get(claimSlug);
+        if (!row || String(row.status) !== "invited" || !row.target_email)
+            return null;
+        if (Date.parse(String(row.expires_at)) <= Date.now())
+            return null;
+        const workspace = this.getWorkspace(String(row.workspace_id));
+        if (!workspace)
+            return null;
+        return {
+            claimSlug,
+            workspace,
+            targetEmail: String(row.target_email),
+            status: "invited",
+            expiresAt: String(row.expires_at),
+        };
+    }
+    /** Transfers workspace ownership to the verified claimer and closes the claim. */
+    acceptAgentClaim(claimSlug, userId) {
+        const claim = this.getOpenAgentClaim(claimSlug);
+        if (!claim || !this.getUser(userId))
+            return null;
+        const now = new Date().toISOString();
+        this.db.exec("BEGIN");
+        try {
+            const closed = this.db
+                .prepare("UPDATE agent_claims SET status = 'claimed', claimed_at = ? WHERE claim_slug = ? AND status = 'invited'")
+                .run(now, claimSlug);
+            if (closed.changes === 0) {
+                this.db.exec("ROLLBACK");
+                return null;
+            }
+            this.db
+                .prepare("UPDATE workspaces SET owner_user_id = ?, updated_at = ? WHERE id = ?")
+                .run(userId, now, claim.workspace.id);
+            this.db
+                .prepare("UPDATE users SET workspace_id = ?, role = 'owner' WHERE id = ?")
+                .run(claim.workspace.id, userId);
+            this.ensureWorkspaceMembership({ workspaceId: claim.workspace.id, userId, role: "owner" });
+            this.db.exec("COMMIT");
+        }
+        catch (err) {
+            this.db.exec("ROLLBACK");
+            throw err;
+        }
+        return this.getWorkspace(claim.workspace.id);
+    }
+    // --- Row Mappers ---
+    mapUser(row) {
+        return {
+            id: String(row.id),
+            email: String(row.email),
+            name: String(row.name),
+            workspaceId: String(row.workspace_id),
+            role: String(row.role),
+            createdAt: String(row.created_at),
+        };
+    }
+    mapWorkspace(row) {
+        return {
+            id: String(row.id),
+            name: String(row.name),
+            slug: String(row.slug),
+            ownerUserId: String(row.owner_user_id),
+            tier: String(row.tier),
+            monthlyActionsLimit: Number(row.monthly_actions_limit),
+            monthlyActionsUsed: Number(row.monthly_actions_used),
+            creditsBalance: Number(row.credits_balance),
+            stripeCustomerId: row.stripe_customer_id ? String(row.stripe_customer_id) : null,
+            stripeSubscriptionId: row.stripe_subscription_id
+                ? String(row.stripe_subscription_id)
+                : null,
+            projectsEnvName: String(row.projects_env_name),
+            policy: JSON.parse(String(row.policy_json || "{}")),
+            createdAt: String(row.created_at),
+            updatedAt: String(row.updated_at),
+        };
+    }
+    mapConnection(row) {
+        return {
+            id: String(row.id),
+            workspaceId: String(row.workspace_id),
+            lane: String(row.lane),
+            providerSlug: String(row.provider_slug),
+            providerName: String(row.provider_name),
+            status: String(row.status),
+            externalAccountId: row.external_account_id ? String(row.external_account_id) : null,
+            redirectUrl: row.redirect_url ? String(row.redirect_url) : null,
+            metadata: JSON.parse(String(row.metadata_json || "{}")),
+            updatedAt: String(row.updated_at),
+            createdAt: String(row.created_at),
+        };
+    }
+    mapResource(row) {
+        return {
+            id: String(row.id),
+            workspaceId: String(row.workspace_id),
+            resourceName: String(row.resource_name),
+            providerSlug: String(row.provider_slug),
+            providerName: String(row.provider_name),
+            serviceSlug: String(row.service_slug),
+            planSlug: row.plan_slug ? String(row.plan_slug) : null,
+            status: String(row.status),
+            envVarKeys: JSON.parse(String(row.env_var_keys_json || "[]")),
+            externalResourceId: row.external_resource_id
+                ? String(row.external_resource_id)
+                : null,
+            metadata: JSON.parse(String(row.metadata_json || "{}")),
+            createdAt: String(row.created_at),
+            updatedAt: String(row.updated_at),
+        };
+    }
+    mapPlan(row) {
+        const lane = String(row.lane);
+        const toolSlug = String(row.tool_slug);
+        const creditCost = Number(row.credit_cost);
+        const approvalStatus = String(row.approval_status);
+        return {
+            id: String(row.id),
+            workspaceId: String(row.workspace_id),
+            actorId: String(row.actor_id),
+            toolSlug,
+            upstreamSlug: String(row.upstream_slug),
+            lane,
+            riskLevel: String(row.risk_level),
+            input: JSON.parse(String(row.input_json || "{}")),
+            reason: String(row.reason),
+            creditCost,
+            approvalStatus,
+            approvedBy: row.approved_by ? String(row.approved_by) : null,
+            approvedAt: row.approved_at ? String(row.approved_at) : null,
+            runId: row.run_id ? String(row.run_id) : null,
+            decisionRecord: row.decision_record_json
+                ? JSON.parse(String(row.decision_record_json))
+                : null,
+            memoryContext: row.memory_context_json
+                ? JSON.parse(String(row.memory_context_json))
+                : null,
+            supplierSettlement: this.computeSupplierSettlement(lane, toolSlug, creditCost, approvalStatus === "executed"
+                ? "settled_by_muxo_master_wallet"
+                : "planned_muxo_master_wallet", String(row.workspace_id)),
+            createdAt: String(row.created_at),
+            expiresAt: String(row.expires_at),
+        };
+    }
+    mapRun(row) {
+        return {
+            id: String(row.id),
+            planId: String(row.plan_id),
+            workspaceId: String(row.workspace_id),
+            actorId: String(row.actor_id),
+            toolSlug: String(row.tool_slug),
+            lane: String(row.lane),
+            riskLevel: String(row.risk_level),
+            status: String(row.status),
+            input: JSON.parse(String(row.input_json || "{}")),
+            output: row.output_json ? JSON.parse(String(row.output_json)) : null,
+            error: row.error ? String(row.error) : null,
+            errorMessage: row.error ? String(row.error) : null,
+            actionsMetered: Number(row.actions_metered),
+            creditsMetered: Number(row.credits_metered),
+            durationMs: row.duration_ms !== null ? Number(row.duration_ms) : null,
+            receiptId: row.receipt_id ? String(row.receipt_id) : null,
+            startedAt: String(row.started_at),
+            completedAt: row.completed_at ? String(row.completed_at) : null,
+        };
+    }
+    mapReceipt(row) {
+        const lane = String(row.lane);
+        const toolSlug = String(row.tool_slug);
+        const creditsMetered = Number(row.credits_metered);
+        return {
+            id: String(row.id),
+            runId: String(row.run_id),
+            planId: String(row.plan_id),
+            workspaceId: String(row.workspace_id),
+            actorId: String(row.actor_id),
+            toolSlug,
+            lane,
+            riskLevel: String(row.risk_level),
+            status: String(row.status),
+            actionsMetered: Number(row.actions_metered),
+            creditsMetered,
+            inputHash: String(row.input_hash),
+            outputHash: String(row.output_hash),
+            prevReceiptHash: String(row.prev_receipt_hash),
+            receiptHash: String(row.receipt_hash),
+            signature: String(row.signature),
+            decisionRecord: row.decision_record_json
+                ? JSON.parse(String(row.decision_record_json))
+                : null,
+            supplierSettlement: this.computeSupplierSettlement(lane, toolSlug, creditsMetered, "settled_by_muxo_master_wallet", String(row.workspace_id)),
+            issuedAt: String(row.issued_at),
+        };
+    }
+}