@muxoai/sdk 1.3.0 → 1.4.3

package/dist/oauth.js

@@ -0,0 +1,134 @@
+import { MCP_TOOLS_OAUTH_SCOPE } from "./mcp-schema.js";
+/** Shared OAuth 2.1 (PKCE + consent) helpers for the Node server and the edge worker. */
+export const DEFAULT_OAUTH_SCOPE = `${MCP_TOOLS_OAUTH_SCOPE} muxo:mcp muxo:read muxo:execute muxo:provision`;
+export const PKCE_VERIFIER_PATTERN = /^[A-Za-z0-9._~-]{43,128}$/;
+export const OAUTH_CODE_TTL_MS = 10 * 60 * 1000;
+/** API keys minted through OAuth do not expire; this is the advisory lifetime clients see. */
+export const OAUTH_ACCESS_TOKEN_TTL_SECONDS = 2_592_000;
+export const LOOPBACK_CLIENT_NAME = "An app on this computer";
+const BLOCKED_REDIRECT_SCHEMES = new Set(["javascript:", "data:", "file:", "vbscript:", "about:", "blob:", "ftp:"]);
+export function base64UrlEncode(bytes) {
+    let binary = "";
+    for (const b of bytes)
+        binary += String.fromCharCode(b);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export async function pkceS256(verifier) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+    return base64UrlEncode(new Uint8Array(digest));
+}
+export function timingSafeEqualText(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+/** Checks a token-endpoint code_verifier against the challenge stored with the authorization code. */
+export async function verifyPkce(verifier, challenge, method) {
+    if (!PKCE_VERIFIER_PATTERN.test(verifier))
+        return "missing";
+    const computed = method === "S256" ? await pkceS256(verifier) : verifier;
+    return timingSafeEqualText(computed, challenge) ? "ok" : "mismatch";
+}
+export function oauthClientName(redirect, clientId) {
+    const host = redirect.hostname.toLowerCase();
+    if (host === "chatgpt.com" || host.endsWith(".chatgpt.com") || host.endsWith(".openai.com"))
+        return "ChatGPT";
+    if (host === "claude.ai" || host.endsWith(".claude.ai") || host.endsWith(".anthropic.com"))
+        return "Claude";
+    if (host === "127.0.0.1" || host === "localhost" || host === "[::1]")
+        return LOOPBACK_CLIENT_NAME;
+    if (redirect.protocol !== "https:" && redirect.protocol !== "http:")
+        return redirect.protocol.replace(/:$/, "");
+    return clientId.length <= 64 && /^[\w.-]+$/.test(clientId) && !clientId.startsWith("muxo_dcr_") ? clientId : host;
+}
+/** Name of the workspace API key minted for an OAuth connection, as listed in the console. */
+export function oauthConnectionKeyName(clientName) {
+    return `${clientName === LOOPBACK_CLIENT_NAME ? "Local app" : clientName} connection`;
+}
+/** Origin shown on the consent screen; app-scheme redirects have no origin, so show the scheme. */
+export function oauthRedirectOrigin(redirectUri) {
+    const target = new URL(redirectUri);
+    return target.origin === "null" ? target.protocol : target.origin;
+}
+export function parseAuthorizeRequest(params) {
+    const responseType = params.get("response_type");
+    if (responseType && responseType !== "code")
+        return { error: "Only response_type=code is supported." };
+    const redirectUri = (params.get("redirect_uri") || "").trim();
+    if (!redirectUri || redirectUri.length > 2048)
+        return { error: "A valid redirect_uri is required." };
+    let redirect;
+    try {
+        redirect = new URL(redirectUri);
+    }
+    catch {
+        return { error: "redirect_uri is not a valid URL." };
+    }
+    const loopback = ["127.0.0.1", "localhost", "[::1]"].includes(redirect.hostname);
+    if (redirect.hash ||
+        BLOCKED_REDIRECT_SCHEMES.has(redirect.protocol) ||
+        (redirect.protocol === "http:" && !loopback)) {
+        return { error: "redirect_uri must use https, a loopback http address, or an app scheme." };
+    }
+    const clientId = (params.get("client_id") || "muxo-mcp-client").trim().slice(0, 256);
+    const codeChallenge = (params.get("code_challenge") || "").trim() || null;
+    const rawMethod = (params.get("code_challenge_method") || "").trim();
+    if (codeChallenge && !PKCE_VERIFIER_PATTERN.test(codeChallenge)) {
+        return { error: "code_challenge is malformed." };
+    }
+    if (rawMethod && rawMethod !== "S256" && rawMethod !== "plain") {
+        return { error: "code_challenge_method must be S256 or plain." };
+    }
+    return {
+        clientId,
+        clientName: oauthClientName(redirect, clientId),
+        redirectUri,
+        state: (params.get("state") || "").slice(0, 1024),
+        codeChallenge,
+        codeChallengeMethod: codeChallenge ? (rawMethod === "S256" ? "S256" : "plain") : null,
+        scope: (params.get("scope") || DEFAULT_OAUTH_SCOPE).slice(0, 512),
+    };
+}
+/** Parses a token-endpoint body (form or JSON) and HTTP Basic client credentials into one parameter set. */
+export function parseOAuthFormBody(rawBody, contentType, authorizationHeader) {
+    const params = new URLSearchParams();
+    if (contentType.includes("application/json")) {
+        let body = {};
+        try {
+            const parsed = JSON.parse(rawBody || "{}");
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+                body = parsed;
+        }
+        catch {
+            body = {};
+        }
+        for (const [k, v] of Object.entries(body))
+            if (typeof v === "string")
+                params.set(k, v);
+    }
+    else {
+        for (const [k, v] of new URLSearchParams(rawBody))
+            params.set(k, v);
+    }
+    const basic = authorizationHeader.match(/^basic\s+(.+)$/i);
+    if (basic && !params.get("client_id")) {
+        try {
+            const decoded = atob(basic[1].trim());
+            params.set("client_id", decodeURIComponent(decoded.split(":")[0] || ""));
+        }
+        catch {
+            // Public clients do not need client credentials, so a malformed header is ignored.
+        }
+    }
+    return params;
+}
+export function oauthSecretToken(prefix) {
+    const bytes = new Uint8Array(24);
+    crypto.getRandomValues(bytes);
+    return `${prefix}_${Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("")}`;
+}

package/dist/oss-suite.d.ts

@@ -0,0 +1,217 @@
+/**
+ * Unified Open-Source & Commercial Enterprise Suite (Runtime-Agnostic: Node.js + Cloudflare Workers):
+ * 1. AWS Cedar & Open Policy Agent (OPA / Rego) Policy-as-Code Compiler & Evaluator
+ * 2. OpenTelemetry (OTel GenAI / MCP Semantic Conventions) OTLP JSON & Langfuse Trace Exporter
+ * 3. Turnkey Commercial Business Saga Playbooks (backed by Temporal-compatible DurableWorkflows)
+ * 4. FinOps & Commercial ROI Unit-Economics Analytics
+ */
+import { type DurableWorkflow } from "./durable-workflow.js";
+import type { ActionPlan, ByokKeyRecord, ExecutionReceipt, ExecutionRun, GovernancePolicy, HumanFriendlyExplanation, ProviderLane, ProvisionedResource, RiskLevel, TemporalGraphFact, Workspace } from "./types.js";
+export interface CompiledPolicyAsCodeBundle {
+    workspaceId: string;
+    workspaceSlug: string;
+    generatedAt: string;
+    engines: ["aws-cedar-4.x", "open-policy-agent-rego-v1"];
+    cedarSchemaVersion: "4.0";
+    cedarPolicyText: string;
+    opaRegoText: string;
+    statements: Array<{
+        id: string;
+        effect: "permit" | "forbid";
+        description: string;
+        statement: string;
+    }>;
+    cedar: {
+        schemaNamespace: "Muxo";
+        statementsCount: number;
+        policyText: string;
+        statements: Array<{
+            id: string;
+            effect: "permit" | "forbid";
+            description: string;
+            statement: string;
+        }>;
+    };
+    opa: {
+        packageName: "muxo.authz";
+        rulesCount: number;
+        regoText: string;
+    };
+    plainEnglishSummary: string[];
+    explanation: HumanFriendlyExplanation;
+}
+export interface PolicyAsCodeEvaluationResult {
+    workspaceId: string;
+    toolSlug: string;
+    riskLevel: RiskLevel;
+    creditCost: number;
+    allowed: boolean;
+    decision: "ALLOW" | "DENY" | "REQUIRE_APPROVAL";
+    policyDecision: "allow" | "deny" | "require_approval";
+    cedarResult: {
+        decision: "ALLOW" | "DENY";
+        determiningPolicies: string[];
+        errors: string[];
+    };
+    opaResult: {
+        allow: boolean;
+        decision: "allow" | "deny" | "review";
+        denyReasons: string[];
+        reviewReasons: string[];
+    };
+    matchedStatements: string[];
+    remediationForLlm: string;
+    compiledBundle: CompiledPolicyAsCodeBundle;
+}
+export declare function compileWorkspacePolicyToCedarAndRego(policy: GovernancePolicy, workspace: Pick<Workspace, "id" | "slug" | "name">): CompiledPolicyAsCodeBundle;
+export declare function evaluateCedarAndOpaPolicy(params: {
+    policy: GovernancePolicy;
+    workspace: Pick<Workspace, "id" | "slug" | "name">;
+    toolSlug: string;
+    input?: Record<string, unknown>;
+    riskLevel?: RiskLevel;
+    creditCost?: number;
+    lane?: string;
+}): PolicyAsCodeEvaluationResult;
+export interface OtelSpanAttribute {
+    key: string;
+    value: {
+        stringValue?: string;
+        intValue?: number;
+        boolValue?: boolean;
+    };
+}
+export interface OtelTraceExportBundle {
+    workspaceId: string;
+    workspaceSlug: string;
+    exportedAt: string;
+    protocol: "OTLP/HTTP-JSON-v1";
+    semanticConventions: ["gen_ai.1.29.0", "mcp.2026-07-28", "muxo.governance.v5"];
+    w3cTraceParent: string;
+    w3cTraceContextSample: string;
+    spansCount: number;
+    otlpPayload: {
+        resourceSpans: OtelTraceExportBundle["resourceSpans"];
+    };
+    resourceSpans: Array<{
+        resource: {
+            attributes: OtelSpanAttribute[];
+        };
+        scopeSpans: Array<{
+            scope: {
+                name: string;
+                version: string;
+            };
+            spans: Array<{
+                traceId: string;
+                spanId: string;
+                parentSpanId?: string;
+                traceparent: string;
+                name: string;
+                kind: "SPAN_KIND_SERVER" | "SPAN_KIND_CLIENT";
+                startTimeUnixNano: string;
+                endTimeUnixNano: string;
+                status: {
+                    code: "STATUS_CODE_OK" | "STATUS_CODE_ERROR";
+                    message?: string;
+                };
+                attributes: OtelSpanAttribute[];
+            }>;
+        }>;
+    }>;
+    langfuseBatch: Array<{
+        id: string;
+        type: "trace-create" | "span-create";
+        timestamp: string;
+        body: Record<string, unknown>;
+    }>;
+}
+export declare function buildOtelTraceExport(params: {
+    workspace: Pick<Workspace, "id" | "slug" | "name" | "tier">;
+    runs: ExecutionRun[];
+    receipts: ExecutionReceipt[];
+    plans?: ActionPlan[];
+    version?: string;
+}): OtelTraceExportBundle;
+export interface CommercialPlaybookDefinition {
+    slug: "fullstack-cloud-bootstrap" | "competitor-seo-growth-brief" | "incident-containment-audit" | "customer-release-readiness";
+    name: string;
+    persona: "Engineering & DevOps" | "Marketing & Growth" | "SecOps & Compliance" | "Product & Founders";
+    summary: string;
+    commercialValue: string;
+    estimatedMinutesSaved: number;
+    creditCost: number;
+    defaultProvider: string;
+    defaultServiceRef: string;
+    steps: Array<{
+        name: string;
+        toolSlug: string;
+        primitive: "step.do" | "step.waitForEvent";
+        compensationAction?: string;
+        description: string;
+    }>;
+}
+export declare const MUXO_COMMERCIAL_PLAYBOOKS: CommercialPlaybookDefinition[];
+export declare function getCommercialPlaybook(slug: string): CommercialPlaybookDefinition | null;
+export declare function buildPlaybookSagaExecution(params: {
+    id: string;
+    workspaceId: string;
+    workspaceSlug: string;
+    playbook: CommercialPlaybookDefinition;
+    input?: Record<string, unknown>;
+}): {
+    playbook: CommercialPlaybookDefinition;
+    workflow: DurableWorkflow;
+    temporalFact: {
+        subject: string;
+        predicate: string;
+        object: string;
+        summary: string;
+        episodeId: string;
+    };
+};
+export interface CommercialRoiReport {
+    workspaceId: string;
+    workspaceSlug: string;
+    workspaceName: string;
+    tier: string;
+    generatedAt: string;
+    unitEconomics: {
+        creditsBalance: number;
+        totalRunsAnalyzed: number;
+        succeededRunsCount: number;
+        byokZeroCreditRunsCount: number;
+        managedFundedRunsCount: number;
+        totalCreditsConsumed: number;
+        byokCreditsSaved: number;
+        byokDollarsSavedUsd: number;
+        estimatedEngineeringMinutesSaved: number;
+        estimatedEngineeringHoursSaved: number;
+        estimatedLaborValueSavedUsd: number;
+        preventedPolicyViolationsCount: number;
+        activeCloudResourcesCount: number;
+        activeBiTemporalFactsCount: number;
+        configuredByokProviders: string[];
+    };
+    laneBreakdown: Record<ProviderLane, {
+        runsCount: number;
+        creditsConsumed: number;
+        estimatedMinutesSaved: number;
+    }>;
+    recommendations: Array<{
+        id: string;
+        category: "byok_savings" | "cloud_consolidation" | "governance_safety" | "playbook_automation";
+        title: string;
+        impact: string;
+        actionCommand: string;
+    }>;
+    explanation: HumanFriendlyExplanation;
+}
+export declare function buildCommercialRoiReport(params: {
+    workspace: Workspace;
+    runs: ExecutionRun[];
+    plans?: ActionPlan[];
+    resources: ProvisionedResource[];
+    byokKeys: ByokKeyRecord[];
+    temporalFacts: TemporalGraphFact[];
+}): CommercialRoiReport;