@muxoai/sdk 1.3.0 → 1.4.3

package/dist/store.js

@@ -18,16 +18,58 @@ const DEFAULT_POLICY = {
     allowProvisioning: true,
     maxCreditsPerRun: 250,
 };
+const RECEIPTS_COLUMN_NAMES = [
+    "id",
+    "run_id",
+    "plan_id",
+    "workspace_id",
+    "actor_id",
+    "tool_slug",
+    "lane",
+    "risk_level",
+    "status",
+    "actions_metered",
+    "credits_metered",
+    "input_hash",
+    "output_hash",
+    "prev_receipt_hash",
+    "receipt_hash",
+    "signature",
+    "decision_record_json",
+    "issued_at",
+];
+const RECEIPTS_TABLE_COLUMNS = `
+  id TEXT PRIMARY KEY,
+  run_id TEXT NOT NULL,
+  plan_id TEXT NOT NULL,
+  workspace_id TEXT NOT NULL,
+  actor_id TEXT NOT NULL,
+  tool_slug TEXT NOT NULL,
+  lane TEXT NOT NULL,
+  risk_level TEXT NOT NULL,
+  status TEXT NOT NULL,
+  actions_metered INTEGER NOT NULL,
+  credits_metered INTEGER NOT NULL,
+  input_hash TEXT NOT NULL,
+  output_hash TEXT NOT NULL,
+  prev_receipt_hash TEXT NOT NULL,
+  receipt_hash TEXT NOT NULL,
+  signature TEXT NOT NULL,
+  decision_record_json TEXT,
+  issued_at TEXT NOT NULL
+`;
 export class MuxoStore {
     db;
     vaultKey;
     constructor(dbPath, vaultKey) {
         this.db = new DatabaseSync(dbPath);
+        this.db.exec("PRAGMA busy_timeout = 10000;");
         this.vaultKey = vaultKey;
         this.initSchema();
     }
     initSchema() {
         this.db.exec(`
+      PRAGMA busy_timeout = 10000;
       PRAGMA journal_mode = WAL;
       PRAGMA foreign_keys = ON;
 
@@ -153,26 +195,7 @@ export class MuxoStore {
         completed_at TEXT
       );
 
-      CREATE TABLE IF NOT EXISTS receipts (
-        id TEXT PRIMARY KEY,
-        run_id TEXT NOT NULL UNIQUE,
-        plan_id TEXT NOT NULL,
-        workspace_id TEXT NOT NULL,
-        actor_id TEXT NOT NULL,
-        tool_slug TEXT NOT NULL,
-        lane TEXT NOT NULL,
-        risk_level TEXT NOT NULL,
-        status TEXT NOT NULL,
-        actions_metered INTEGER NOT NULL,
-        credits_metered INTEGER NOT NULL,
-        input_hash TEXT NOT NULL,
-        output_hash TEXT NOT NULL,
-        prev_receipt_hash TEXT NOT NULL,
-        receipt_hash TEXT NOT NULL,
-        signature TEXT NOT NULL,
-        decision_record_json TEXT,
-        issued_at TEXT NOT NULL
-      );
+      CREATE TABLE IF NOT EXISTS receipts (${RECEIPTS_TABLE_COLUMNS});
 
       CREATE TABLE IF NOT EXISTS memories (
         id TEXT PRIMARY KEY,
@@ -186,6 +209,23 @@ export class MuxoStore {
         created_at TEXT NOT NULL
       );
 
+      CREATE TABLE IF NOT EXISTS temporal_facts (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        subject TEXT NOT NULL,
+        predicate TEXT NOT NULL,
+        object TEXT NOT NULL,
+        summary TEXT NOT NULL,
+        confidence REAL NOT NULL DEFAULT 0.95,
+        valid_from TEXT NOT NULL,
+        valid_to TEXT,
+        superseded_by_id TEXT,
+        source_kind TEXT NOT NULL DEFAULT 'fact',
+        source_reference_id TEXT,
+        metadata_json TEXT NOT NULL DEFAULT '{}',
+        created_at TEXT NOT NULL
+      );
+
       CREATE TABLE IF NOT EXISTS agent_claims (
         claim_slug TEXT PRIMARY KEY,
         workspace_id TEXT NOT NULL,
@@ -223,12 +263,42 @@ export class MuxoStore {
         updated_at TEXT NOT NULL,
         PRIMARY KEY (workspace_id, provider)
       );
+
+      CREATE TABLE IF NOT EXISTS workspace_members (
+        id TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        user_id TEXT NOT NULL,
+        role TEXT NOT NULL DEFAULT 'operator',
+        team_name TEXT,
+        joined_via_key_id TEXT,
+        created_at TEXT NOT NULL,
+        UNIQUE(workspace_id, user_id)
+      );
+
+      CREATE TABLE IF NOT EXISTS clerk_users (
+        clerk_user_id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL,
+        created_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS oauth_refresh_tokens (
+        token_hash TEXT PRIMARY KEY,
+        key_id TEXT NOT NULL,
+        workspace_id TEXT NOT NULL,
+        client_id TEXT NOT NULL,
+        scope TEXT NOT NULL,
+        encrypted_access_token TEXT NOT NULL,
+        created_at TEXT NOT NULL
+      );
     `);
         // Backwards-compatible column migrations for existing databases
         for (const stmt of [
             "ALTER TABLE plans ADD COLUMN decision_record_json TEXT",
             "ALTER TABLE plans ADD COLUMN memory_context_json TEXT",
             "ALTER TABLE receipts ADD COLUMN decision_record_json TEXT",
+            "ALTER TABLE api_keys ADD COLUMN team_name TEXT",
+            "ALTER TABLE api_keys ADD COLUMN role TEXT DEFAULT 'operator'",
+            "ALTER TABLE api_keys ADD COLUMN created_by_email TEXT",
         ]) {
             try {
                 this.db.exec(stmt);
@@ -237,6 +307,38 @@ export class MuxoStore {
                 // Column already exists
             }
         }
+        this.migrateReceiptsAllowMultiplePerRun();
+        this.db.exec("CREATE INDEX IF NOT EXISTS idx_receipts_workspace_run ON receipts(workspace_id, run_id)");
+    }
+    /**
+     * Older databases declared receipts.run_id UNIQUE, which blocks cancellation receipts from
+     * superseding a run's original receipt. SQLite cannot drop a constraint, so rebuild the table.
+     */
+    migrateReceiptsAllowMultiplePerRun() {
+        const indexes = this.db.prepare("PRAGMA index_list(receipts)").all();
+        const hasUniqueRunId = indexes.some((idx) => {
+            if (!idx.unique || idx.origin !== "u")
+                return false;
+            const cols = this.db.prepare(`PRAGMA index_info("${idx.name}")`).all();
+            return cols.length === 1 && cols[0].name === "run_id";
+        });
+        if (!hasUniqueRunId)
+            return;
+        const columns = RECEIPTS_COLUMN_NAMES.join(", ");
+        this.db.exec("BEGIN");
+        try {
+            this.db.exec(`
+        CREATE TABLE receipts_migrated (${RECEIPTS_TABLE_COLUMNS});
+        INSERT INTO receipts_migrated (${columns}) SELECT ${columns} FROM receipts ORDER BY rowid;
+        DROP TABLE receipts;
+        ALTER TABLE receipts_migrated RENAME TO receipts;
+      `);
+            this.db.exec("COMMIT");
+        }
+        catch (err) {
+            this.db.exec("ROLLBACK");
+            throw err;
+        }
     }
     // --- Encryption Vault (AES-256-GCM) ---
     encryptSecrets(workspaceId, secrets) {
@@ -332,11 +434,24 @@ export class MuxoStore {
             referenceId: workspaceId,
             description: "Free Plan initial monthly allowance (1,000 actions + 250 trial credits)",
         });
+        this.ensureWorkspaceMembership({
+            workspaceId,
+            userId,
+            role: "owner",
+        });
         const sessionToken = this.createSession(userId, workspaceId);
+        const defaultKey = this.createApiKey({
+            workspaceId,
+            name: "Default Live Key",
+            environment: "live",
+            role: "owner",
+            createdByEmail: params.email.toLowerCase().trim(),
+        });
         return {
             user: this.getUser(userId),
             workspace: this.getWorkspace(workspaceId),
             sessionToken,
+            apiKey: defaultKey.secretKey,
         };
     }
     loginUser(email, password) {
@@ -349,6 +464,11 @@ export class MuxoStore {
             return null;
         const user = this.mapUser(row);
         const workspace = this.getWorkspace(user.workspaceId);
+        this.ensureWorkspaceMembership({
+            workspaceId: workspace.id,
+            userId: user.id,
+            role: user.role,
+        });
         const sessionToken = this.createSession(user.id, workspace.id);
         return { user, workspace, sessionToken };
     }
@@ -362,7 +482,7 @@ export class MuxoStore {
             .run(this.hashToken(rawToken), userId, workspaceId, expires.toISOString(), now.toISOString());
         return rawToken;
     }
-    resolveAuthToken(token) {
+    resolveAuthToken(token, workspaceOverrideId) {
         const trimmed = token.trim();
         if (!trimmed)
             return null;
@@ -400,11 +520,22 @@ export class MuxoStore {
             return null;
         }
         const user = this.getUser(String(sessionRow.user_id));
-        const workspace = this.getWorkspace(String(sessionRow.workspace_id));
-        if (!user || !workspace)
+        if (!user)
+            return null;
+        let targetWorkspaceId = String(sessionRow.workspace_id || user.workspaceId);
+        if (workspaceOverrideId &&
+            workspaceOverrideId.trim() &&
+            this.userCanAccessWorkspace(user.id, workspaceOverrideId.trim())) {
+            targetWorkspaceId = workspaceOverrideId.trim();
+        }
+        else if (user.workspaceId && this.userCanAccessWorkspace(user.id, user.workspaceId)) {
+            targetWorkspaceId = user.workspaceId;
+        }
+        const workspace = this.getWorkspace(targetWorkspaceId);
+        if (!workspace)
             return null;
         return {
-            user,
+            user: { ...user, workspaceId: workspace.id },
             workspace,
             authType: "session",
             actorId: user.id,
@@ -422,6 +553,326 @@ export class MuxoStore {
             .get(workspaceId);
         return row ? this.mapWorkspace(row) : null;
     }
+    ensureWorkspaceMembership(params) {
+        const now = new Date().toISOString();
+        const role = params.role || "operator";
+        const existing = this.db
+            .prepare("SELECT * FROM workspace_members WHERE workspace_id = ? AND user_id = ?")
+            .get(params.workspaceId, params.userId);
+        if (existing) {
+            if (params.teamName || params.role) {
+                this.db
+                    .prepare("UPDATE workspace_members SET role = COALESCE(?, role), team_name = COALESCE(?, team_name) WHERE id = ?")
+                    .run(params.role || null, params.teamName || null, String(existing.id));
+            }
+            return {
+                id: String(existing.id),
+                workspaceId: String(existing.workspace_id),
+                userId: String(existing.user_id),
+                role: (params.role || String(existing.role) || "operator"),
+                teamName: params.teamName ?? (existing.team_name ? String(existing.team_name) : null),
+                joinedViaKeyId: existing.joined_via_key_id ? String(existing.joined_via_key_id) : null,
+                createdAt: String(existing.created_at),
+            };
+        }
+        const id = `wsm_${crypto.randomBytes(8).toString("hex")}`;
+        this.db
+            .prepare(`INSERT INTO workspace_members (
+          id, workspace_id, user_id, role, team_name, joined_via_key_id, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?)`)
+            .run(id, params.workspaceId, params.userId, role, params.teamName || null, params.joinedViaKeyId || null, now);
+        return {
+            id,
+            workspaceId: params.workspaceId,
+            userId: params.userId,
+            role,
+            teamName: params.teamName || null,
+            joinedViaKeyId: params.joinedViaKeyId || null,
+            createdAt: now,
+        };
+    }
+    userCanAccessWorkspace(userId, workspaceId) {
+        const ws = this.getWorkspace(workspaceId);
+        if (!ws)
+            return false;
+        if (ws.ownerUserId === userId)
+            return true;
+        const user = this.getUser(userId);
+        if (user?.workspaceId === workspaceId)
+            return true;
+        const mem = this.db
+            .prepare("SELECT id FROM workspace_members WHERE workspace_id = ? AND user_id = ?")
+            .get(workspaceId, userId);
+        return Boolean(mem);
+    }
+    listUserWorkspaces(userId, activeWorkspaceId) {
+        const user = this.getUser(userId);
+        const currentId = activeWorkspaceId || user?.workspaceId || "";
+        const ownedRows = this.db
+            .prepare("SELECT * FROM workspaces WHERE owner_user_id = ? ORDER BY created_at ASC")
+            .all(userId);
+        const memberRows = this.db
+            .prepare(`SELECT w.*, m.role AS member_role, m.team_name AS member_team_name
+         FROM workspace_members m
+         JOIN workspaces w ON w.id = m.workspace_id
+         WHERE m.user_id = ?
+         ORDER BY m.created_at ASC`)
+            .all(userId);
+        const byId = new Map();
+        for (const r of ownedRows) {
+            const ws = this.mapWorkspace(r);
+            byId.set(ws.id, {
+                id: ws.id,
+                name: ws.name,
+                slug: ws.slug,
+                tier: ws.tier,
+                creditsBalance: ws.creditsBalance,
+                monthlyActionsUsed: ws.monthlyActionsUsed,
+                monthlyActionsLimit: ws.monthlyActionsLimit,
+                role: "owner",
+                teamName: null,
+                isCurrent: ws.id === currentId,
+                createdAt: ws.createdAt,
+            });
+        }
+        for (const r of memberRows) {
+            const ws = this.mapWorkspace(r);
+            const existing = byId.get(ws.id);
+            byId.set(ws.id, {
+                id: ws.id,
+                name: ws.name,
+                slug: ws.slug,
+                tier: ws.tier,
+                creditsBalance: ws.creditsBalance,
+                monthlyActionsUsed: ws.monthlyActionsUsed,
+                monthlyActionsLimit: ws.monthlyActionsLimit,
+                role: existing?.role === "owner" ? "owner" : String(r.member_role || "operator"),
+                teamName: r.member_team_name ? String(r.member_team_name) : existing?.teamName || null,
+                isCurrent: ws.id === currentId,
+                createdAt: ws.createdAt,
+            });
+        }
+        if (currentId && !byId.has(currentId)) {
+            const ws = this.getWorkspace(currentId);
+            if (ws) {
+                byId.set(ws.id, {
+                    id: ws.id,
+                    name: ws.name,
+                    slug: ws.slug,
+                    tier: ws.tier,
+                    creditsBalance: ws.creditsBalance,
+                    monthlyActionsUsed: ws.monthlyActionsUsed,
+                    monthlyActionsLimit: ws.monthlyActionsLimit,
+                    role: ws.ownerUserId === userId ? "owner" : "operator",
+                    teamName: null,
+                    isCurrent: true,
+                    createdAt: ws.createdAt,
+                });
+            }
+        }
+        return Array.from(byId.values());
+    }
+    switchUserWorkspace(userId, workspaceId) {
+        if (!this.userCanAccessWorkspace(userId, workspaceId))
+            return null;
+        const workspace = this.getWorkspace(workspaceId);
+        if (!workspace)
+            return null;
+        this.db
+            .prepare("UPDATE users SET workspace_id = ? WHERE id = ?")
+            .run(workspaceId, userId);
+        this.db
+            .prepare("UPDATE sessions SET workspace_id = ? WHERE user_id = ?")
+            .run(workspaceId, userId);
+        const user = this.getUser(userId);
+        if (!user)
+            return null;
+        return { user, workspace };
+    }
+    createWorkspaceForUser(params) {
+        const now = new Date().toISOString();
+        const workspaceId = `ws_${crypto.randomBytes(8).toString("hex")}`;
+        const cleanName = params.name.trim() || "Team Workspace";
+        const slugBase = cleanName
+            .toLowerCase()
+            .replace(/[^a-z0-9]+/g, "-")
+            .replace(/^-|-$/g, "");
+        const slug = `${slugBase || "ws"}-${crypto.randomBytes(3).toString("hex")}`;
+        const projectsEnvName = `muxo_${workspaceId.slice(3, 11)}`;
+        const starterCredits = 250;
+        this.db
+            .prepare(`INSERT INTO workspaces (
+          id, name, slug, owner_user_id, tier,
+          monthly_actions_limit, monthly_actions_used, credits_balance,
+          stripe_customer_id, stripe_subscription_id, projects_env_name,
+          policy_json, created_at, updated_at
+        ) VALUES (?, ?, ?, ?, 'free', 1000, 0, ?, NULL, NULL, ?, ?, ?, ?)`)
+            .run(workspaceId, cleanName, slug, params.userId, starterCredits, projectsEnvName, JSON.stringify(DEFAULT_POLICY), now, now);
+        this.addLedgerEntry({
+            workspaceId,
+            kind: "plan_grant",
+            actionsDelta: 1000,
+            creditsDelta: starterCredits,
+            balanceAfter: starterCredits,
+            referenceId: workspaceId,
+            description: `Workspace '${cleanName}' initial monthly allowance (1,000 actions + 250 trial credits)`,
+        });
+        const user = this.getUser(params.userId);
+        const keyRes = this.createApiKey({
+            workspaceId,
+            name: params.teamName ? `${params.teamName} — Team Key` : `${cleanName} — Default Key`,
+            environment: "live",
+            teamName: params.teamName || cleanName,
+            role: params.role || "owner",
+            createdByEmail: user?.email || null,
+        });
+        const membership = this.ensureWorkspaceMembership({
+            workspaceId,
+            userId: params.userId,
+            role: "owner",
+            teamName: params.teamName || null,
+            joinedViaKeyId: keyRes.record.id,
+        });
+        if (params.switchActive !== false) {
+            this.switchUserWorkspace(params.userId, workspaceId);
+        }
+        return {
+            workspace: this.getWorkspace(workspaceId),
+            apiKey: keyRes.secretKey,
+            keyRecord: keyRes.record,
+            membership,
+        };
+    }
+    joinWorkspaceWithApiKey(params) {
+        const trimmed = String(params.apiKey || "").trim();
+        if (!trimmed.startsWith("mk_live_") && !trimmed.startsWith("mk_test_")) {
+            return null;
+        }
+        const hash = this.hashToken(trimmed);
+        const row = this.db
+            .prepare("SELECT * FROM api_keys WHERE key_hash = ? AND revoked_at IS NULL")
+            .get(hash);
+        if (!row)
+            return null;
+        const workspace = this.getWorkspace(String(row.workspace_id));
+        if (!workspace)
+            return null;
+        const keyRecord = {
+            id: String(row.id),
+            workspaceId: String(row.workspace_id),
+            name: String(row.name),
+            keyPrefix: String(row.key_prefix),
+            environment: String(row.environment),
+            scopes: JSON.parse(String(row.scopes_json || "[]")),
+            teamName: row.team_name ? String(row.team_name) : null,
+            role: (row.role ? String(row.role) : "operator"),
+            createdByEmail: row.created_by_email ? String(row.created_by_email) : null,
+            lastUsedAt: row.last_used_at ? String(row.last_used_at) : null,
+            revokedAt: row.revoked_at ? String(row.revoked_at) : null,
+            createdAt: String(row.created_at),
+        };
+        let membership = null;
+        let user = null;
+        if (params.userId) {
+            membership = this.ensureWorkspaceMembership({
+                workspaceId: workspace.id,
+                userId: params.userId,
+                role: workspace.ownerUserId === params.userId ? "owner" : (keyRecord.role || "operator"),
+                teamName: keyRecord.teamName || keyRecord.name,
+                joinedViaKeyId: keyRecord.id,
+            });
+            if (params.switchActive !== false) {
+                this.switchUserWorkspace(params.userId, workspace.id);
+            }
+            user = this.getUser(params.userId);
+        }
+        else {
+            user = this.getUser(workspace.ownerUserId);
+        }
+        return {
+            workspace,
+            keyRecord,
+            user,
+            membership,
+        };
+    }
+    onboardTeam(params) {
+        const cleanTeam = params.teamName.trim() || "Engineering Team";
+        const role = params.role || "operator";
+        const mode = params.mode === "dedicated_workspace" ? "dedicated_workspace" : "shared_workspace";
+        const cleanBase = params.baseUrl.replace(/\/$/, "");
+        const env = params.environment === "test" ? "test" : "live";
+        let targetWorkspace;
+        let apiKey;
+        let keyRecord;
+        if (mode === "dedicated_workspace") {
+            const currentWs = this.getWorkspace(params.currentWorkspaceId);
+            const wsName = currentWs ? `${currentWs.name} — ${cleanTeam}` : `${cleanTeam} Workspace`;
+            const created = this.createWorkspaceForUser({
+                userId: params.userId,
+                name: wsName,
+                teamName: cleanTeam,
+                role,
+                switchActive: false,
+            });
+            targetWorkspace = created.workspace;
+            apiKey = created.apiKey;
+            keyRecord = created.keyRecord;
+        }
+        else {
+            const currentWs = this.getWorkspace(params.currentWorkspaceId);
+            if (!currentWs)
+                throw new Error(`Workspace ${params.currentWorkspaceId} not found`);
+            targetWorkspace = currentWs;
+            const createdKey = this.createApiKey({
+                workspaceId: targetWorkspace.id,
+                name: `${cleanTeam} (${role})`,
+                environment: env,
+                scopes: params.scopes,
+                teamName: cleanTeam,
+                role,
+                createdByEmail: params.userEmail || null,
+            });
+            apiKey = createdKey.secretKey;
+            keyRecord = createdKey.record;
+        }
+        let claimUrl = null;
+        if (params.inviteEmail && params.inviteEmail.includes("@")) {
+            const claim = this.createAgentClaim({
+                workspaceId: targetWorkspace.id,
+                email: params.inviteEmail,
+                baseUrl: cleanBase,
+            });
+            claimUrl = claim.claimUrl;
+        }
+        return {
+            mode,
+            workspace: targetWorkspace,
+            teamName: cleanTeam,
+            role,
+            apiKey,
+            keyRecord,
+            claimUrl,
+            consoleUrl: `${cleanBase}/login`,
+            cliSetupCommand: `npx muxo setup --api-key ${apiKey} --url ${cleanBase}`,
+            mcpConfig: {
+                mcpServers: {
+                    muxo: {
+                        url: `${cleanBase}/mcp`,
+                        headers: {
+                            Authorization: `Bearer ${apiKey}`,
+                        },
+                    },
+                },
+            },
+            instructions: [
+                `Share this Team API Key with ${cleanTeam} (${role} access to '${targetWorkspace.name}').`,
+                `Console: Open ${cleanBase}/login, click "Join with a Team API Key", and paste the key (if signed in with Clerk, the workspace is permanently linked to their switcher).`,
+                `CLI & MCP: Run \`npx -y @muxoai/platform setup --api-key ${apiKey}\` to configure Claude Code, Cursor, Windsurf, or Codex in one command.`,
+                `Approvals: Team members can also paste this key directly on any ${cleanBase}/approve/<planId> link to review and approve actions.`,
+            ],
+        };
+    }
     updateWorkspacePolicy(workspaceId, policy) {
         const ws = this.getWorkspace(workspaceId);
         if (!ws)
@@ -443,12 +894,16 @@ export class MuxoStore {
         const rawSecret = `mk_${env}_${id.slice(4)}_${crypto.randomBytes(16).toString("hex")}`;
         const keyPrefix = `${rawSecret.slice(0, 16)}...${rawSecret.slice(-4)}`;
         const scopes = params.scopes || ["tools:read", "tools:execute", "resources:provision"];
+        const teamName = params.teamName ? params.teamName.trim() : null;
+        const role = params.role || "operator";
+        const createdByEmail = params.createdByEmail ? params.createdByEmail.trim() : null;
         const now = new Date().toISOString();
         this.db
             .prepare(`INSERT INTO api_keys (
-          id, workspace_id, name, key_prefix, key_hash, environment, scopes_json, created_at
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
-            .run(id, params.workspaceId, params.name, keyPrefix, this.hashToken(rawSecret), env, JSON.stringify(scopes), now);
+          id, workspace_id, name, key_prefix, key_hash, environment, scopes_json,
+          team_name, role, created_by_email, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(id, params.workspaceId, params.name, keyPrefix, this.hashToken(rawSecret), env, JSON.stringify(scopes), teamName, role, createdByEmail, now);
         return {
             record: {
                 id,
@@ -457,6 +912,9 @@ export class MuxoStore {
                 keyPrefix,
                 environment: env,
                 scopes,
+                teamName,
+                role,
+                createdByEmail,
                 lastUsedAt: null,
                 revokedAt: null,
                 createdAt: now,
@@ -475,6 +933,9 @@ export class MuxoStore {
             keyPrefix: String(r.key_prefix),
             environment: String(r.environment),
             scopes: JSON.parse(String(r.scopes_json || "[]")),
+            teamName: r.team_name ? String(r.team_name) : null,
+            role: (r.role ? String(r.role) : "operator"),
+            createdByEmail: r.created_by_email ? String(r.created_by_email) : null,
             lastUsedAt: r.last_used_at ? String(r.last_used_at) : null,
             revokedAt: r.revoked_at ? String(r.revoked_at) : null,
             createdAt: String(r.created_at),
@@ -485,8 +946,95 @@ export class MuxoStore {
         const res = this.db
             .prepare("UPDATE api_keys SET revoked_at = ? WHERE id = ? AND workspace_id = ?")
             .run(now, keyId, workspaceId);
+        if (res.changes > 0) {
+            this.db.prepare("DELETE FROM oauth_refresh_tokens WHERE key_id = ?").run(keyId);
+        }
         return res.changes > 0;
     }
+    /** Looks up an active workspace API key by its raw secret. */
+    findActiveApiKey(secret) {
+        const row = this.db
+            .prepare("SELECT id, workspace_id FROM api_keys WHERE key_hash = ? AND revoked_at IS NULL")
+            .get(this.hashToken(secret.trim()));
+        return row ? { id: String(row.id), workspaceId: String(row.workspace_id) } : null;
+    }
+    // --- OAuth refresh tokens (hashed; the access token is kept encrypted so refresh can return it) ---
+    saveOAuthRefreshToken(params) {
+        this.db
+            .prepare(`INSERT INTO oauth_refresh_tokens (
+          token_hash, key_id, workspace_id, client_id, scope, encrypted_access_token, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?)`)
+            .run(this.hashToken(params.refreshToken), params.keyId, params.workspaceId, params.clientId, params.scope, this.encryptSecrets(params.workspaceId, { accessToken: params.accessToken }), new Date().toISOString());
+    }
+    getOAuthRefreshToken(refreshToken) {
+        const row = this.db
+            .prepare("SELECT * FROM oauth_refresh_tokens WHERE token_hash = ?")
+            .get(this.hashToken(refreshToken));
+        if (!row)
+            return null;
+        const workspaceId = String(row.workspace_id);
+        let accessToken = "";
+        try {
+            accessToken = this.decryptSecrets(workspaceId, String(row.encrypted_access_token)).accessToken || "";
+        }
+        catch {
+            return null;
+        }
+        return {
+            keyId: String(row.key_id),
+            workspaceId,
+            clientId: String(row.client_id),
+            scope: String(row.scope),
+            accessToken,
+        };
+    }
+    deleteOAuthRefreshToken(refreshToken) {
+        this.db.prepare("DELETE FROM oauth_refresh_tokens WHERE token_hash = ?").run(this.hashToken(refreshToken));
+    }
+    // --- Clerk sign-in ---
+    /**
+     * Maps a verified Clerk session to a local user. Only a verified email can link to an
+     * existing account; otherwise a fresh user and workspace are created so an unverified
+     * address can never take over someone else's account.
+     */
+    provisionClerkUser(clerkUserId, identity, ownerWorkspaceId) {
+        const mappedUser = this.getClerkLinkedUser(clerkUserId);
+        if (mappedUser)
+            return mappedUser;
+        const email = identity.email ? identity.email.trim().toLowerCase() : null;
+        const verifiedEmail = email && identity.emailVerified ? email : null;
+        let user = verifiedEmail ? this.getUserByEmail(verifiedEmail) : null;
+        if (!user) {
+            const displayName = identity.name || (verifiedEmail ? verifiedEmail.split("@")[0] : "Muxo user");
+            const placeholder = `${clerkUserId.toLowerCase()}@clerk.users.muxo.invalid`;
+            user = this.registerUser({
+                email: verifiedEmail || placeholder,
+                name: displayName,
+                password: crypto.randomBytes(24).toString("hex"),
+            }).user;
+        }
+        if (ownerWorkspaceId && verifiedEmail && this.getWorkspace(ownerWorkspaceId)) {
+            this.ensureWorkspaceMembership({ workspaceId: ownerWorkspaceId, userId: user.id, role: "owner" });
+            this.db.prepare("UPDATE users SET workspace_id = ? WHERE id = ?").run(ownerWorkspaceId, user.id);
+            user = this.getUser(user.id);
+        }
+        this.db
+            .prepare("INSERT OR REPLACE INTO clerk_users (clerk_user_id, user_id, created_at) VALUES (?, ?, ?)")
+            .run(clerkUserId, user.id, new Date().toISOString());
+        return user;
+    }
+    getClerkLinkedUser(clerkUserId) {
+        const mapped = this.db
+            .prepare("SELECT user_id FROM clerk_users WHERE clerk_user_id = ?")
+            .get(clerkUserId);
+        return mapped ? this.getUser(mapped.user_id) : null;
+    }
+    getUserByEmail(email) {
+        const row = this.db
+            .prepare("SELECT * FROM users WHERE email = ?")
+            .get(email.trim().toLowerCase());
+        return row ? this.mapUser(row) : null;
+    }
     // --- Connections ---
     upsertConnection(params) {
         const now = new Date().toISOString();
@@ -510,7 +1058,23 @@ export class MuxoStore {
           metadata_json = excluded.metadata_json,
           updated_at = excluded.updated_at`)
             .run(id, params.workspaceId, params.lane, params.providerSlug, params.providerName, params.status, params.externalAccountId ?? null, params.redirectUrl ?? null, JSON.stringify(params.metadata || {}), now, now);
-        return this.getConnection(id);
+        const connRecord = this.getConnection(id);
+        this.upsertTemporalFact({
+            workspaceId: params.workspaceId,
+            subject: `app:${params.providerSlug}`,
+            predicate: "CONNECTION_STATUS",
+            object: `${params.lane}:${params.status}`,
+            summary: `App ${params.providerName} (${params.providerSlug}) connection on ${params.lane} is ${params.status}`,
+            confidence: 1.0,
+            sourceKind: "resource_topology",
+            sourceReferenceId: connRecord.id,
+            metadata: {
+                lane: params.lane,
+                providerSlug: params.providerSlug,
+                status: params.status,
+            },
+        });
+        return connRecord;
     }
     getConnection(id) {
         const row = this.db
@@ -560,14 +1124,46 @@ export class MuxoStore {
           metadata_json = excluded.metadata_json,
           updated_at = excluded.updated_at`)
             .run(id, params.workspaceId, params.resourceName, params.providerSlug, params.providerName, params.serviceSlug, params.planSlug ?? null, params.status, JSON.stringify(envVarKeys), encryptedHex, params.externalResourceId ?? null, JSON.stringify(params.metadata || {}), now, now);
-        return this.getResource(params.workspaceId, params.resourceName);
+        const resRecord = this.getResource(params.workspaceId, params.resourceName);
+        this.upsertTemporalFact({
+            workspaceId: params.workspaceId,
+            subject: `resource:${params.resourceName}`,
+            predicate: "PROVISIONED_ON",
+            object: `${params.serviceSlug}:${params.status}`,
+            summary: `Resource "${params.resourceName}" provisioned on ${params.serviceSlug} (${params.providerName}) with status ${params.status} [${resRecord.envVarKeys.join(", ") || "no env keys"}]`,
+            confidence: 1.0,
+            sourceKind: "resource_topology",
+            sourceReferenceId: resRecord.id,
+            metadata: {
+                providerSlug: params.providerSlug,
+                serviceSlug: params.serviceSlug,
+                planSlug: params.planSlug ?? null,
+                status: params.status,
+                envVarKeys: resRecord.envVarKeys,
+            },
+        });
+        return resRecord;
     }
     getResource(workspaceId, resourceNameOrId) {
         const row = this.db
-            .prepare("SELECT * FROM resources WHERE workspace_id = ? AND (resource_name = ? OR id = ?)")
-            .get(workspaceId, resourceNameOrId, resourceNameOrId);
+            .prepare("SELECT * FROM resources WHERE workspace_id = ? AND (resource_name = ? OR id = ? OR external_resource_id = ?)")
+            .get(workspaceId, resourceNameOrId, resourceNameOrId, resourceNameOrId);
         return row ? this.mapResource(row) : null;
     }
+    findResourceAnyWorkspace(resourceNameOrId) {
+        const row = this.db
+            .prepare("SELECT * FROM resources WHERE id = ? OR external_resource_id = ? OR resource_name = ? LIMIT 1")
+            .get(resourceNameOrId, resourceNameOrId, resourceNameOrId);
+        return row ? this.mapResource(row) : null;
+    }
+    getDecryptedResourceSecrets(workspaceId, resourceNameOrId) {
+        const row = this.db
+            .prepare("SELECT encrypted_secrets_hex FROM resources WHERE workspace_id = ? AND (id = ? OR external_resource_id = ? OR resource_name = ?) LIMIT 1")
+            .get(workspaceId, resourceNameOrId, resourceNameOrId, resourceNameOrId);
+        if (!row)
+            return {};
+        return this.decryptSecrets(workspaceId, row.encrypted_secrets_hex);
+    }
     listResources(workspaceId) {
         const rows = this.db
             .prepare("SELECT * FROM resources WHERE workspace_id = ? ORDER BY updated_at DESC")
@@ -742,6 +1338,12 @@ export class MuxoStore {
             .get(planId, workspaceId);
         return row ? this.mapPlan(row) : null;
     }
+    getPlanById(planId) {
+        const row = this.db
+            .prepare("SELECT * FROM plans WHERE id = ?")
+            .get(planId);
+        return row ? this.mapPlan(row) : null;
+    }
     listPlans(workspaceId, limit = 50) {
         const rows = this.db
             .prepare("SELECT * FROM plans WHERE workspace_id = ? ORDER BY created_at DESC LIMIT ?")
@@ -787,7 +1389,9 @@ export class MuxoStore {
            SET monthly_actions_used = ?, credits_balance = ?, updated_at = ?
            WHERE id = ?`)
                 .run(newActionsUsed, newCreditsBalance, now, params.workspaceId);
-            const settlement = this.computeSupplierSettlement(run.lane, run.toolSlug, params.creditsMetered, "settled_by_muxo_master_wallet");
+            const byokUsed = params.creditsMetered === 0 &&
+                this.hasByokForLane(params.workspaceId, run.lane, run.toolSlug);
+            const settlement = this.computeSupplierSettlement(run.lane, run.toolSlug, params.creditsMetered, byokUsed ? "settled_by_customer_byok" : "settled_by_muxo_master_wallet", params.workspaceId);
             this.addLedgerEntry({
                 workspaceId: params.workspaceId,
                 kind: "run_deduction",
@@ -795,7 +1399,9 @@ export class MuxoStore {
                 creditsDelta: -params.creditsMetered,
                 balanceAfter: newCreditsBalance,
                 referenceId: run.id,
-                description: `Executed ${run.toolSlug} (${run.lane}) — User paid Muxo ${params.creditsMetered} credits ($${(settlement.userRetailChargeCents / 100).toFixed(2)}) -> Muxo paid ${settlement.supplierName} ($${(settlement.supplierWholesalePayableCents / 100).toFixed(2)})`,
+                description: byokUsed
+                    ? `Executed ${run.toolSlug} (${run.lane}) — BYOK 0-credit execution (Customer's own ${settlement.supplierName} key)`
+                    : `Executed ${run.toolSlug} (${run.lane}) — User paid Muxo ${params.creditsMetered} credits ($${(settlement.userRetailChargeCents / 100).toFixed(2)}) -> Muxo paid ${settlement.supplierName} ($${(settlement.supplierWholesalePayableCents / 100).toFixed(2)})`,
             });
         }
         const receipt = this.issueReceipt({
@@ -818,10 +1424,41 @@ export class MuxoStore {
             receipt,
         };
     }
+    cancelRun(params) {
+        const run = this.getRun(params.workspaceId, params.runId);
+        if (!run)
+            throw new Error(`Run ${params.runId} not found`);
+        const now = new Date().toISOString();
+        const cancellation = {
+            cancelled: true,
+            cancelledBy: params.cancelledBy,
+            cancelledAt: now,
+            previousStatus: run.status,
+            supersedesReceiptId: run.receiptId,
+            ...(params.reason ? { reason: params.reason } : {}),
+        };
+        const receipt = this.issueReceipt({
+            run,
+            status: "cancelled",
+            output: cancellation,
+            actionsMetered: 0,
+            creditsMetered: 0,
+            decisionRecord: null,
+            issuedAt: now,
+        });
+        this.db
+            .prepare(`UPDATE runs
+         SET status = 'cancelled', output_json = COALESCE(output_json, ?), error = ?,
+             receipt_id = ?, completed_at = COALESCE(completed_at, ?),
+             duration_ms = COALESCE(duration_ms, ?)
+         WHERE id = ? AND workspace_id = ?`)
+            .run(JSON.stringify(cancellation), params.reason || "Cancelled by operator", receipt.id, now, Math.max(0, Date.now() - new Date(run.startedAt).getTime()), run.id, params.workspaceId);
+        return { run: this.getRun(params.workspaceId, run.id), receipt };
+    }
     issueReceipt(params) {
         const id = `rcpt_${crypto.randomBytes(8).toString("hex")}`;
         const lastReceipt = this.db
-            .prepare("SELECT receipt_hash FROM receipts WHERE workspace_id = ? ORDER BY issued_at DESC LIMIT 1")
+            .prepare("SELECT receipt_hash FROM receipts WHERE workspace_id = ? ORDER BY issued_at DESC, rowid DESC LIMIT 1")
             .get(params.run.workspaceId);
         const prevReceiptHash = lastReceipt?.receipt_hash || "genesis_0000000000000000";
         const inputHash = crypto
@@ -903,14 +1540,17 @@ export class MuxoStore {
         return rows.map((r) => this.mapRun(r));
     }
     getReceipt(workspaceId, receiptIdOrRunId) {
+        // A cancelled run has both its original and its cancellation receipt; prefer an exact
+        // receipt id match, otherwise the newest receipt for the run.
         const row = this.db
-            .prepare("SELECT * FROM receipts WHERE workspace_id = ? AND (id = ? OR run_id = ?)")
-            .get(workspaceId, receiptIdOrRunId, receiptIdOrRunId);
+            .prepare(`SELECT * FROM receipts WHERE workspace_id = ? AND (id = ? OR run_id = ?)
+         ORDER BY CASE WHEN id = ? THEN 0 ELSE 1 END, issued_at DESC, rowid DESC LIMIT 1`)
+            .get(workspaceId, receiptIdOrRunId, receiptIdOrRunId, receiptIdOrRunId);
         return row ? this.mapReceipt(row) : null;
     }
     listReceipts(workspaceId, limit = 50) {
         const rows = this.db
-            .prepare("SELECT * FROM receipts WHERE workspace_id = ? ORDER BY issued_at DESC LIMIT ?")
+            .prepare("SELECT * FROM receipts WHERE workspace_id = ? ORDER BY issued_at DESC, rowid DESC LIMIT ?")
             .all(workspaceId, limit);
         return rows.map((r) => this.mapReceipt(r));
     }
@@ -1004,7 +1644,9 @@ export class MuxoStore {
     computeSupplierSettlement(lane, toolSlug, creditCost, settlementStatus = "settled_by_muxo_master_wallet", workspaceId) {
         const useByok = settlementStatus === "settled_by_customer_byok" ||
             settlementStatus === "planned_customer_byok" ||
-            (workspaceId ? this.hasByokForLane(workspaceId, lane, toolSlug) : false);
+            (Number(creditCost || 0) === 0 && workspaceId
+                ? this.hasByokForLane(workspaceId, lane, toolSlug)
+                : false);
         const upstreamProvider = toolSlug.split(".")[1] || lane;
         if (useByok) {
             const isPlanned = settlementStatus === "planned_muxo_master_wallet" ||
@@ -1127,6 +1769,17 @@ export class MuxoStore {
             totalSupplierWholesalePaidCents,
             totalMuxoNetMarginCents,
             bySupplier,
+            masterWalletProtection: {
+                status: process.env.MUXO_MASTER_WALLET_DEPLETED === "true"
+                    ? "failover_active"
+                    : "healthy",
+                zeroChargeOnFailure: true,
+                instantFailoverMode: "zero_cost_native_edge",
+                paidProvisioningPolicy: "muxo_master_wallet_or_customer_stripe_byok",
+                retailToWholesaleCoverageRatio: totalSupplierWholesalePaidCents > 0
+                    ? Math.round((totalUserRetailSpendCents / totalSupplierWholesalePaidCents) * 100) / 100
+                    : 1.67,
+            },
         };
     }
     listLedgerEntries(workspaceId, limit = 50) {
@@ -1141,7 +1794,12 @@ export class MuxoStore {
             if (kind === "run_deduction" && refId) {
                 const run = this.getRun(workspaceId, refId);
                 if (run) {
-                    supplierSettlement = this.computeSupplierSettlement(run.lane, run.toolSlug, Math.abs(creditsDelta), "settled_by_muxo_master_wallet");
+                    const isByokEntry = creditsDelta === 0 &&
+                        (String(r.description || "").includes("BYOK") ||
+                            this.hasByokForLane(workspaceId, run.lane, run.toolSlug));
+                    supplierSettlement = this.computeSupplierSettlement(run.lane, run.toolSlug, Math.abs(creditsDelta), isByokEntry
+                        ? "settled_by_customer_byok"
+                        : "settled_by_muxo_master_wallet", workspaceId);
                 }
             }
             return {
@@ -1204,6 +1862,15 @@ export class MuxoStore {
         this.db
             .prepare("DELETE FROM memories WHERE id = ? AND workspace_id = ?")
             .run(String(row.id), workspaceId);
+        // Also mark any temporal facts sourced from this memory record as invalidated (valid_to = now)
+        const now = new Date().toISOString();
+        this.db
+            .prepare(`UPDATE temporal_facts
+         SET valid_to = ?
+         WHERE workspace_id = ?
+           AND valid_to IS NULL
+           AND (source_reference_id = ? OR source_reference_id = ? OR id = ?)`)
+            .run(now, workspaceId, String(row.id), String(row.document_id), idOrDocId);
         return {
             id: String(row.id),
             workspaceId: String(row.workspace_id),
@@ -1216,6 +1883,166 @@ export class MuxoStore {
             createdAt: String(row.created_at),
         };
     }
+    // --- Bi-Temporal Resource & Fact Lineage (Zero-Dependency Graphiti Alternative) ---
+    upsertTemporalFact(params) {
+        const now = new Date().toISOString();
+        const subject = params.subject.trim();
+        const predicate = params.predicate.trim().toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+        const object = params.object.trim();
+        const confidence = params.confidence !== undefined ? Number(params.confidence) : 0.95;
+        const sourceKind = params.sourceKind || "fact";
+        // Check if an active fact already exists for (workspace_id, subject, predicate)
+        const activeRow = this.db
+            .prepare(`SELECT * FROM temporal_facts
+         WHERE workspace_id = ? AND subject = ? AND predicate = ? AND valid_to IS NULL
+         ORDER BY created_at DESC LIMIT 1`)
+            .get(params.workspaceId, subject, predicate);
+        if (activeRow && String(activeRow.object) === object) {
+            // Same object is still valid — update summary/confidence/metadata in place
+            const existingId = String(activeRow.id);
+            this.db
+                .prepare(`UPDATE temporal_facts
+           SET summary = ?, confidence = ?, metadata_json = ?, source_reference_id = COALESCE(?, source_reference_id)
+           WHERE id = ?`)
+                .run(params.summary, confidence, JSON.stringify(params.metadata || {}), params.sourceReferenceId ?? null, existingId);
+            return this.mapTemporalFact({
+                ...activeRow,
+                summary: params.summary,
+                confidence,
+                metadata_json: JSON.stringify(params.metadata || {}),
+                source_reference_id: params.sourceReferenceId ?? activeRow.source_reference_id,
+            });
+        }
+        const newId = `tf_${crypto.randomBytes(8).toString("hex")}`;
+        if (activeRow && params.supersedeExisting !== false) {
+            this.db
+                .prepare(`UPDATE temporal_facts
+           SET valid_to = ?, superseded_by_id = ?
+           WHERE id = ? AND workspace_id = ?`)
+                .run(now, newId, String(activeRow.id), params.workspaceId);
+        }
+        this.db
+            .prepare(`INSERT INTO temporal_facts (
+          id, workspace_id, subject, predicate, object, summary, confidence,
+          valid_from, valid_to, superseded_by_id, source_kind, source_reference_id,
+          metadata_json, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, ?, ?, ?, ?)`)
+            .run(newId, params.workspaceId, subject, predicate, object, params.summary, confidence, now, sourceKind, params.sourceReferenceId ?? null, JSON.stringify(params.metadata || {}), now);
+        return {
+            id: newId,
+            workspaceId: params.workspaceId,
+            subject,
+            predicate,
+            object,
+            summary: params.summary,
+            confidence,
+            validFrom: now,
+            validTo: null,
+            supersededById: null,
+            sourceKind,
+            sourceReferenceId: params.sourceReferenceId ?? null,
+            metadata: params.metadata || {},
+            createdAt: now,
+        };
+    }
+    listTemporalFacts(workspaceId, opts) {
+        const limit = Math.min(200, Math.max(1, Number(opts?.limit || 50)));
+        const includeHistorical = Boolean(opts?.includeHistorical);
+        const rows = this.db
+            .prepare(includeHistorical
+            ? `SELECT * FROM temporal_facts WHERE workspace_id = ? ORDER BY created_at DESC LIMIT ?`
+            : `SELECT * FROM temporal_facts WHERE workspace_id = ? AND valid_to IS NULL ORDER BY created_at DESC LIMIT ?`)
+            .all(workspaceId, limit);
+        let facts = rows.map((r) => this.mapTemporalFact(r));
+        if (opts?.subject) {
+            const subj = opts.subject.toLowerCase();
+            facts = facts.filter((f) => f.subject.toLowerCase().includes(subj));
+        }
+        if (opts?.predicate) {
+            const pred = opts.predicate.toUpperCase();
+            facts = facts.filter((f) => f.predicate.toUpperCase().includes(pred));
+        }
+        if (opts?.query && opts.query.trim()) {
+            const tokens = opts.query
+                .toLowerCase()
+                .split(/\s+/)
+                .filter((t) => t.length >= 2);
+            if (tokens.length > 0) {
+                facts = facts.filter((f) => {
+                    const hay = `${f.subject} ${f.predicate} ${f.object} ${f.summary}`.toLowerCase();
+                    return tokens.some((tok) => hay.includes(tok));
+                });
+            }
+        }
+        return facts;
+    }
+    forgetMatchingMemoryRecords(workspaceId, query) {
+        const trimmed = query.trim().toLowerCase();
+        if (!trimmed) {
+            return { deletedMemories: [], invalidatedFacts: [] };
+        }
+        const tokens = trimmed.split(/\s+/).filter((t) => t.length >= 2);
+        const allMemories = this.listMemoryRecords(workspaceId, 200);
+        const matchingMemories = allMemories.filter((m) => {
+            const hay = `${m.title} ${m.content} ${m.kind}`.toLowerCase();
+            return (hay.includes(trimmed) ||
+                (tokens.length > 0 && tokens.every((tok) => hay.includes(tok))));
+        });
+        // Snapshot before deleting: deleteMemoryRecord retires sourced facts itself,
+        // and those must still be reported as invalidated.
+        const activeFacts = this.listTemporalFacts(workspaceId, {
+            includeHistorical: false,
+            limit: 200,
+        });
+        const deletedMemories = [];
+        for (const mem of matchingMemories) {
+            const deleted = this.deleteMemoryRecord(workspaceId, mem.id);
+            if (deleted)
+                deletedMemories.push(deleted);
+        }
+        const deletedSourceIds = new Set(deletedMemories.flatMap((m) => [m.id, m.documentId]));
+        const matchingFacts = activeFacts.filter((f) => {
+            const hay = `${f.subject} ${f.predicate} ${f.object} ${f.summary}`.toLowerCase();
+            return (hay.includes(trimmed) ||
+                (tokens.length > 0 && tokens.every((tok) => hay.includes(tok))) ||
+                Boolean(f.sourceReferenceId && deletedSourceIds.has(f.sourceReferenceId)));
+        });
+        const now = new Date().toISOString();
+        const invalidatedFacts = [];
+        for (const fact of matchingFacts) {
+            this.db
+                .prepare(`UPDATE temporal_facts SET valid_to = ? WHERE id = ? AND workspace_id = ?`)
+                .run(now, fact.id, workspaceId);
+            invalidatedFacts.push({
+                ...fact,
+                validTo: now,
+            });
+        }
+        return {
+            deletedMemories,
+            invalidatedFacts,
+        };
+    }
+    mapTemporalFact(row) {
+        return {
+            id: String(row.id),
+            workspaceId: String(row.workspace_id),
+            subject: String(row.subject),
+            predicate: String(row.predicate),
+            object: String(row.object),
+            summary: String(row.summary),
+            confidence: Number(row.confidence ?? 0.95),
+            validFrom: String(row.valid_from),
+            validTo: row.valid_to ? String(row.valid_to) : null,
+            supersededById: row.superseded_by_id ? String(row.superseded_by_id) : null,
+            sourceKind: String(row.source_kind || "fact"),
+            sourceReferenceId: row.source_reference_id
+                ? String(row.source_reference_id)
+                : null,
+            metadata: JSON.parse(String(row.metadata_json || "{}")),
+            createdAt: String(row.created_at),
+        };
+    }
     // --- Autonomous Agent Onboarding (agents.composio.dev pattern) ---
     createAutonomousAgentSignup(params) {
         const suffix = crypto.randomBytes(4).toString("hex");
@@ -1259,46 +2086,92 @@ export class MuxoStore {
             expiresAt: String(row.expires_at),
         };
     }
+    /**
+     * Creates a claim link for a workspace. A claim minted without an email (at agent signup)
+     * stays unusable until the agent names the owner; naming one reuses that same link.
+     */
     createAgentClaim(params) {
-        const claimSlug = crypto.randomBytes(9).toString("base64url");
+        const targetEmail = (params.email || "").trim().toLowerCase();
         const now = new Date();
         const expires = new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000);
-        this.db
-            .prepare(`INSERT INTO agent_claims (
-          claim_slug, workspace_id, target_email, status, claimed_at, expires_at, created_at
-        ) VALUES (?, ?, ?, 'invited', NULL, ?, ?)`)
-            .run(claimSlug, params.workspaceId, params.email.trim().toLowerCase(), expires.toISOString(), now.toISOString());
+        const unbound = targetEmail
+            ? this.db
+                .prepare(`SELECT claim_slug FROM agent_claims
+             WHERE workspace_id = ? AND status = 'invited' AND target_email = ''
+             ORDER BY created_at DESC LIMIT 1`)
+                .get(params.workspaceId)
+            : undefined;
+        const claimSlug = unbound?.claim_slug || crypto.randomBytes(24).toString("base64url");
+        if (unbound) {
+            this.db
+                .prepare("UPDATE agent_claims SET target_email = ?, expires_at = ? WHERE claim_slug = ?")
+                .run(targetEmail, expires.toISOString(), claimSlug);
+        }
+        else {
+            this.db
+                .prepare(`INSERT INTO agent_claims (
+            claim_slug, workspace_id, target_email, status, claimed_at, expires_at, created_at
+          ) VALUES (?, ?, ?, 'invited', NULL, ?, ?)`)
+                .run(claimSlug, params.workspaceId, targetEmail, expires.toISOString(), now.toISOString());
+        }
         return {
             claimSlug,
             claimUrl: `${params.baseUrl.replace(/\/$/, "")}/claim/${claimSlug}`,
-            targetEmail: params.email.trim().toLowerCase(),
+            targetEmail,
             status: "invited",
             expiresAt: expires.toISOString(),
         };
     }
-    redeemAgentClaim(claimSlug) {
+    /** Returns a claim only while it can still be accepted (invited and not expired). */
+    getOpenAgentClaim(claimSlug) {
         const row = this.db
             .prepare("SELECT * FROM agent_claims WHERE claim_slug = ?")
             .get(claimSlug);
-        if (!row)
+        if (!row || String(row.status) !== "invited" || !row.target_email)
             return null;
-        const now = new Date().toISOString();
-        const workspaceId = String(row.workspace_id);
-        const targetEmail = String(row.target_email);
-        this.db
-            .prepare("UPDATE agent_claims SET status = 'claimed', claimed_at = ? WHERE claim_slug = ?")
-            .run(now, claimSlug);
-        const workspace = this.getWorkspace(workspaceId);
+        if (Date.parse(String(row.expires_at)) <= Date.now())
+            return null;
+        const workspace = this.getWorkspace(String(row.workspace_id));
         if (!workspace)
             return null;
         return {
             claimSlug,
             workspace,
-            targetEmail,
-            status: "claimed",
-            claimedAt: now,
+            targetEmail: String(row.target_email),
+            status: "invited",
+            expiresAt: String(row.expires_at),
         };
     }
+    /** Transfers workspace ownership to the verified claimer and closes the claim. */
+    acceptAgentClaim(claimSlug, userId) {
+        const claim = this.getOpenAgentClaim(claimSlug);
+        if (!claim || !this.getUser(userId))
+            return null;
+        const now = new Date().toISOString();
+        this.db.exec("BEGIN");
+        try {
+            const closed = this.db
+                .prepare("UPDATE agent_claims SET status = 'claimed', claimed_at = ? WHERE claim_slug = ? AND status = 'invited'")
+                .run(now, claimSlug);
+            if (closed.changes === 0) {
+                this.db.exec("ROLLBACK");
+                return null;
+            }
+            this.db
+                .prepare("UPDATE workspaces SET owner_user_id = ?, updated_at = ? WHERE id = ?")
+                .run(userId, now, claim.workspace.id);
+            this.db
+                .prepare("UPDATE users SET workspace_id = ?, role = 'owner' WHERE id = ?")
+                .run(claim.workspace.id, userId);
+            this.ensureWorkspaceMembership({ workspaceId: claim.workspace.id, userId, role: "owner" });
+            this.db.exec("COMMIT");
+        }
+        catch (err) {
+            this.db.exec("ROLLBACK");
+            throw err;
+        }
+        return this.getWorkspace(claim.workspace.id);
+    }
     // --- Row Mappers ---
     mapUser(row) {
         return {
@@ -1410,6 +2283,7 @@ export class MuxoStore {
             input: JSON.parse(String(row.input_json || "{}")),
             output: row.output_json ? JSON.parse(String(row.output_json)) : null,
             error: row.error ? String(row.error) : null,
+            errorMessage: row.error ? String(row.error) : null,
             actionsMetered: Number(row.actions_metered),
             creditsMetered: Number(row.credits_metered),
             durationMs: row.duration_ms !== null ? Number(row.duration_ms) : null,