@muxoai/sdk 1.4.3 → 1.4.5

package/dist/server.js

@@ -10,6 +10,7 @@ import { MuxoStore } from "./store.js";
 import { managedProviderConnectionList, managedProviderConnectionRequest, managedProviderConnectionUnlink, managedResource, managedResourceAction, } from "./provisioning-managed.js";
 import { DEFAULT_WORKSPACE_POLICY, describePolicyInPlainEnglish, sanitizePolicyPatch, } from "./policy.js";
 import { parseNaturalLanguageMemoryInstruction } from "./providers/supermemory.js";
+import { getMuxoSkill, listMuxoSkills, renderMuxoSkillMarkdown, } from "./skills-catalog.js";
 import { MUXO_VERSION } from "./version.js";
 import { fetchMuxoConnectLinkMetadata, isStripeProjectsExclusiveProvider, normalizeStripeProjectsProviderSlug, parseComposioWebhookEnvelope, submitMuxoConnectLink, verifyComposioWebhookSignature, wrapMuxoConnectUrl, } from "./composio-catalog.js";
 import { isConsolePath, renderApprovalPageHtml, renderConsoleHtml, renderLandingHtml, renderOAuthCallbackPageHtml, renderOAuthConnectPageHtml, renderOAuthConsentHtml, } from "./ui/console-html.js";
@@ -119,6 +120,7 @@ Set or inspect them via MCP \`get_run_context({ action: "set_guardrail", prompt:
   - \`muxo://governance/policy\` — Active guardrails, kill-switch status, trust score, and \`llmPolicyBrief\`
   - \`muxo://context\` — Live workspace context, active guardrails, provisioned resources, and \`llmSystemPrompt\`
   - \`muxo://memory/graph\` — Active Supermemory defaults and bi-temporal knowledge graph facts
+  - \`muxo://skills\` & \`muxo://skills/{skillSlug}\` — Governed domain & workflow skills catalog (140+ app, cloud provisioning, and multi-app workflow \`SKILL.md\` playbooks)
 - **MCP Prompts (\`prompts/list\` & \`prompts/get\`)**:
   - \`context\` — Inject workspace memory, active defaults, and guardrail summary
   - \`policy_guardrails\` — Inject the active \`llmSystemDirective\`, risk-lane matrix, and optional dry-run policy simulation for \`tool_slug\`
@@ -134,6 +136,16 @@ Teach preferences in plain English and Muxo auto-fills matching tool inputs on e
 - "What do you remember?"
 
 \`plan_action\` recalls workspace memory before governance checks and reports \`memoryContext.autoFilledInput\` plus \`activeDefaults\` so callers can see exactly which parameters were filled from memory.
+
+## Natural-Language Saga Playbooks, Temporal Rollbacks, Cedar, OTel & One-Shot Harness Config
+
+Pass plain English to \`POST /api/v1/do\` or MCP \`get_run_context({ prompt: "..." })\`:
+- **Playbooks**: "Run the fullstack cloud bootstrap playbook", "Create playbook daily-seo-slack that runs instant.seo.audit and app.slack.send_message" (\`GET/POST /api/v1/playbooks\`, \`POST /api/v1/playbooks/:slug/run\`)
+- **Temporal Workflows ("latest" supported)**: "Rollback the latest workflow because staging healthcheck failed", "Show Temporal history for latest workflow" (\`POST /api/v1/workflows/latest/rollback\`, \`GET /api/v1/workflows/latest/history\`)
+- **Time-Travel & BFS Memory Graph**: "Show my knowledge graph as of 2026-10-20T00:00:00Z within 2 hops of workspace" (\`GET /api/v1/memory/graph?as_of=...&focal_entity=...&max_hops=2\`)
+- **AWS Cedar 4.0 & OPA Rego v1**: "Compile our guardrails to AWS Cedar", "Evaluate Cedar policy for resource.turso.database with DROP TABLE users" (\`GET /api/v1/governance/cedar\`, \`POST /api/v1/governance/cedar/evaluate\`)
+- **OTel GenAI & FinOps ROI**: "Export OpenTelemetry traces", "What is our ROI and engineering hours saved?" (\`GET /api/v1/telemetry/otlp\`, \`GET /api/v1/analytics/roi\`)
+- **One-Shot Harness Configurator**: "Configure harness preset strict-production" (\`GET/POST /api/v1/harness/configure\`, presets: \`startup-builder\`, \`strict-production\`, \`read-only-auditor\`, \`finops-byok-zero-cost\`).
 `;
 }
 async function readBody(req) {
@@ -708,7 +720,10 @@ export function createMuxoServer(customConfig) {
                         },
                         "/api/v1/byok/{provider}": { delete: { summary: "Delete a BYOK provider key from the vault" } },
                         "/api/v1/tools": { get: { summary: "Search unified catalogue across instant.*, app.*, and resource.*" } },
-                        "/api/v1/tools/{slug}": { get: { summary: "Inspect tool schema, risk level, credit cost, and LLM context URL" } },
+                        "/api/v1/tools/{slug}": { get: { summary: "Inspect tool schema, risk level, credit cost, domainSkill pitfalls, and LLM context URL" } },
+                        "/api/v1/skills": { get: { summary: "List governed domain, cloud provisioning, and multi-app workflow skills" } },
+                        "/api/v1/skills/{slug}": { get: { summary: "Inspect governed domain or workflow skill definition and SKILL.md markdown" } },
+                        "/skills/{slug}/SKILL.md": { get: { summary: "Download governed SKILL.md markdown bundle for any app, cloud provider, or workflow" } },
                         "/api/v1/connections": {
                             get: { summary: "List connected OAuth accounts and cloud providers" },
                             post: { summary: "Start managed OAuth connection handoff" },
@@ -825,9 +840,25 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 res.end(renderSkillMarkdown(config.baseUrl));
                 return;
             }
+            const publicSkillMatch = pathname.match(/^\/skills\/([^/]+?)(?:\/SKILL\.md|\.md)$/i);
+            if (publicSkillMatch && req.method === "GET") {
+                const slug = decodeURIComponent(publicSkillMatch[1]);
+                const md = renderMuxoSkillMarkdown(slug, config.baseUrl);
+                if (!md) {
+                    sendJson(res, 404, {
+                        ok: false,
+                        code: "SKILL_NOT_FOUND",
+                        error: `Skill not found: ${slug}`,
+                    });
+                    return;
+                }
+                res.writeHead(200, { "Content-Type": "text/markdown; charset=utf-8" });
+                res.end(md);
+                return;
+            }
             if (pathname === "/llms.txt" && req.method === "GET") {
                 res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
-                res.end(`# Muxo\n> Unified agent execution across Connected Apps, Instant Tools, Cloud Infrastructure, Workspace Memory, and Safety Guardrails.\n\n- Skill Document: ${config.baseUrl}/skill.md\n- Auth Guide: ${config.baseUrl}/auth.md\n- OpenAPI 3.1 Spec: ${config.baseUrl}/api/openapi.json\n- MCP Endpoint: ${config.baseUrl}/mcp\n- OAuth Callback Handoff: ${config.baseUrl}/oauth/callback\n- Plugin Marketplace (Codex/OpenAI): ${config.baseUrl}/.agents/plugins/marketplace.json\n- Plugin Marketplace (Claude/Droid): ${config.baseUrl}/.claude-plugin/marketplace.json\n- Console (app.muxo.ai): ${config.baseUrl}/\n- Landing & Provider Canvas (muxo.ai): ${config.baseUrl}/landing\n- Documentation (docs.muxo.ai): ${config.docsUrl}\n\n## Agent-Native Policy, Context & Governance Interface\n- MCP Control Plane (\`get_run_context\`): \`action: "recall" | "remember" | "forget" | "set_guardrail" | "reset_guardrails" | "check_policy" | "governance_status" | "kill_switch" | "scan_context"\`\n- Strict /v1 Organization Brief: \`get_organization({ company_context: { required: false } })\` returns accepted workspace policy facts + learned defaults in \`company_context.packet\`\n- Dry-Run Policy Simulator: \`POST ${config.baseUrl}/api/v1/guardrails/check\` (\`{ "tool_slug": "...", "input": { ... } }\`) or MCP \`get_run_context({ action: "check_policy", tool_slug, input })\`\n- Guardrails & Policy Brief: \`GET/POST ${config.baseUrl}/api/v1/guardrails\`, \`POST ${config.baseUrl}/api/v1/guardrails/reset\`, \`GET ${config.baseUrl}/api/v1/governance\` (includes \`llmPolicyBrief\`)\n- MCP Resources: \`muxo://policy/brief\`, \`muxo://governance/policy\`, \`muxo://context\`, \`muxo://memory/graph\`\n- MCP Prompts: \`context\`, \`policy_guardrails\`, \`governed_execution\`, \`security_audit\`\n`);
+                res.end(`# Muxo\n> Unified agent execution across Connected Apps, Instant Tools, Cloud Infrastructure, Workspace Memory, and Safety Guardrails.\n\n- Skill Document: ${config.baseUrl}/skill.md\n- Domain & Workflow Skills Catalog: ${config.baseUrl}/api/v1/skills (or ${config.baseUrl}/skills/<slug>/SKILL.md)\n- Auth Guide: ${config.baseUrl}/auth.md\n- OpenAPI 3.1 Spec: ${config.baseUrl}/api/openapi.json\n- MCP Endpoint: ${config.baseUrl}/mcp\n- OAuth Callback Handoff: ${config.baseUrl}/oauth/callback\n- Plugin Marketplace (Codex/OpenAI): ${config.baseUrl}/.agents/plugins/marketplace.json\n- Plugin Marketplace (Claude/Droid): ${config.baseUrl}/.claude-plugin/marketplace.json\n- Console (app.muxo.ai): ${config.baseUrl}/\n- Landing & Provider Canvas (muxo.ai): ${config.baseUrl}/landing\n- Documentation (docs.muxo.ai): ${config.docsUrl}\n\n## Agent-Native Policy, Context & Governance Interface\n- MCP Control Plane (\`get_run_context\`): \`action: "recall" | "remember" | "forget" | "set_guardrail" | "reset_guardrails" | "check_policy" | "governance_status" | "kill_switch" | "scan_context" | "skills" | "get_skill" | "reconcile_run"\`\n- Strict /v1 Organization Brief: \`get_organization({ company_context: { required: false } })\` returns accepted workspace policy facts + learned defaults in \`company_context.packet\`\n- Dry-Run Policy Simulator: \`POST ${config.baseUrl}/api/v1/guardrails/check\` (\`{ "tool_slug": "...", "input": { ... } }\`) or MCP \`get_run_context({ action: "check_policy", tool_slug, input })\`\n- Guardrails & Policy Brief: \`GET/POST ${config.baseUrl}/api/v1/guardrails\`, \`POST ${config.baseUrl}/api/v1/guardrails/reset\`, \`GET ${config.baseUrl}/api/v1/governance\` (includes \`llmPolicyBrief\`)\n- MCP Resources: \`muxo://policy/brief\`, \`muxo://governance/policy\`, \`muxo://context\`, \`muxo://memory/graph\`, \`muxo://skills\`, \`muxo://skills/{skillSlug}\`\n- MCP Prompts: \`context\`, \`policy_guardrails\`, \`governed_execution\`, \`security_audit\`\n`);
                 return;
             }
             // Serve Installable Muxo Plugin Manifests & Metadata (Portable OpenAI Agent Plugins + Codex + Claude + Cursor)
@@ -3014,6 +3045,13 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 sendJson(res, 200, cancelled);
                 return;
             }
+            const runReconcileMatch = pathname.match(/^\/api\/v1\/runs\/([^/]+)\/reconcile$/);
+            if (runReconcileMatch && (req.method === "GET" || req.method === "POST")) {
+                const runOrPlanId = decodeURIComponent(runReconcileMatch[1]);
+                const report = engine.reconcileRun(ctx, runOrPlanId);
+                sendJson(res, 200, report);
+                return;
+            }
             const runGetMatch = pathname.match(/^\/api\/v1\/runs\/([^/]+)$/);
             if (runGetMatch && req.method === "GET") {
                 const runId = decodeURIComponent(runGetMatch[1]);
@@ -3052,8 +3090,11 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
             }
             if (pathname === "/api/v1/byok" && req.method === "POST") {
                 const body = JSON.parse((await readBody(req)) || "{}");
-                const provider = String(body.provider || "").trim();
-                const secretKey = String(body.secretKey || body.apiKey || body.key || "").trim();
+                const provider = String(body.providerSlug || body.provider_slug || body.provider || "").trim();
+                const secretKey = String(body.secretKey || body.secret_key || body.apiKey || body.api_key || body.key || "").trim();
+                const mcpGatewayUrl = body.mcpGatewayUrl || body.mcp_gateway_url
+                    ? String(body.mcpGatewayUrl || body.mcp_gateway_url).trim()
+                    : null;
                 if (!provider || !secretKey) {
                     sendJson(res, 400, {
                         ok: false,
@@ -3061,7 +3102,9 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                     });
                     return;
                 }
-                const record = store.setByokKey(ctx.workspace.id, provider, secretKey);
+                const record = store.setByokKey(ctx.workspace.id, provider, secretKey, {
+                    mcpGatewayUrl,
+                });
                 sendJson(res, 201, {
                     ok: true,
                     key: record,
@@ -3636,8 +3679,44 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 sendJson(res, 200, { ok: true, ...otel });
                 return;
             }
+            if (pathname === "/api/v1/skills" && req.method === "GET") {
+                const category = url.searchParams.get("category") || undefined;
+                const provider = url.searchParams.get("provider") || undefined;
+                const query = url.searchParams.get("q") ||
+                    url.searchParams.get("query") ||
+                    undefined;
+                const skills = listMuxoSkills({ category, provider, query }, config.baseUrl);
+                sendJson(res, 200, {
+                    ok: true,
+                    count: skills.length,
+                    skills,
+                });
+                return;
+            }
+            const apiSkillMatch = pathname.match(/^\/api\/v1\/skills\/([^/]+)$/);
+            if (apiSkillMatch && req.method === "GET") {
+                const slug = decodeURIComponent(apiSkillMatch[1]).replace(/\.md$/i, "");
+                const skill = getMuxoSkill(slug, config.baseUrl);
+                const markdown = renderMuxoSkillMarkdown(slug, config.baseUrl);
+                if (!skill || !markdown) {
+                    sendJson(res, 404, {
+                        ok: false,
+                        code: "SKILL_NOT_FOUND",
+                        error: `Skill not found: ${slug}`,
+                    });
+                    return;
+                }
+                sendJson(res, 200, {
+                    ok: true,
+                    skill,
+                    markdown,
+                    skillUrl: `${config.baseUrl}/skills/${skill.slug}/SKILL.md`,
+                    mcpResourceUri: `muxo://skills/${skill.slug}`,
+                });
+                return;
+            }
             if (pathname === "/api/v1/playbooks" && req.method === "GET") {
-                const playbooks = engine.listCommercialPlaybooks();
+                const playbooks = engine.listCommercialPlaybooks(ctx);
                 sendJson(res, 200, {
                     ok: true,
                     count: playbooks.length,
@@ -3645,13 +3724,22 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 });
                 return;
             }
+            if (pathname === "/api/v1/playbooks" && req.method === "POST") {
+                const body = JSON.parse((await readBody(req)) || "{}");
+                const created = engine.createCustomPlaybook(ctx, {
+                    prompt: body.prompt || body.instruction || body.description || "",
+                    input: body,
+                });
+                sendJson(res, 201, created);
+                return;
+            }
             const playbookRunMatch = pathname.match(/^\/api\/v1\/playbooks\/([^/]+)\/run$/);
             if ((playbookRunMatch || pathname === "/api/v1/playbooks/run") &&
                 req.method === "POST") {
                 const body = JSON.parse((await readBody(req)) || "{}");
                 const slug = playbookRunMatch
                     ? decodeURIComponent(playbookRunMatch[1])
-                    : String(body.slug || body.playbook || "");
+                    : String(body.slug || body.playbook || body.prompt || "");
                 const result = engine.runCommercialPlaybook(ctx, {
                     slug,
                     input: body.input && typeof body.input === "object"
@@ -3661,6 +3749,30 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 sendJson(res, 201, result);
                 return;
             }
+            if ((pathname === "/api/v1/harness/configure" ||
+                pathname === "/api/v1/harness/presets") &&
+                (req.method === "GET" || req.method === "POST")) {
+                const body = req.method === "POST"
+                    ? JSON.parse((await readBody(req)) || "{}")
+                    : {};
+                const preset = body.preset ||
+                    url.searchParams.get("preset") ||
+                    null;
+                const harness = body.harness ||
+                    url.searchParams.get("harness") ||
+                    null;
+                const prompt = body.prompt ||
+                    body.instruction ||
+                    url.searchParams.get("prompt") ||
+                    null;
+                const configured = await engine.configureHarness(ctx, {
+                    preset: preset ? String(preset) : null,
+                    harness: harness ? String(harness) : null,
+                    prompt: prompt ? String(prompt) : null,
+                });
+                sendJson(res, 200, configured);
+                return;
+            }
             if ((pathname === "/api/v1/analytics/roi" ||
                 pathname === "/api/v1/billing/roi") &&
                 req.method === "GET") {

package/dist/skills-catalog.d.ts

@@ -0,0 +1,66 @@
+export type MuxoSkillCategory = "governance" | "app_automation" | "cloud_infrastructure" | "workflow";
+export interface MuxoSkillDefinition {
+    slug: string;
+    name: string;
+    title: string;
+    description: string;
+    category: MuxoSkillCategory;
+    lane: "composio_sdk" | "stripe_projects" | "composio_instant" | "hybrid";
+    providerSlug: string;
+    providerName: string;
+    requiresMcp: string[];
+    mcpServerUrl: string;
+    recommendedTools: string[];
+    workflowSteps: string[];
+    pitfalls: string[];
+    stripeProjectsOverride?: {
+        enforced: boolean;
+        canonicalToolSlug: string;
+        reason: string;
+    };
+    sourceRepo: string;
+}
+export interface MuxoMcpSkillBundle {
+    name: string;
+    description: string;
+    version: string;
+    uri: string;
+    frontmatter: {
+        name: string;
+        description: string;
+    };
+    content: string;
+    files: Array<{
+        path: string;
+        uri: string;
+        mimeType: string;
+        content: string;
+    }>;
+}
+export declare function transpileAwesomeClaudeSkillToMuxo(rawMarkdown: string, baseUrl?: string): string;
+export declare function listMuxoSkills(filter?: {
+    category?: string;
+    provider?: string;
+    query?: string;
+}, baseUrl?: string): MuxoSkillDefinition[];
+export declare function getMuxoSkill(slug: string, baseUrl?: string): MuxoSkillDefinition | null;
+export declare function renderMuxoSkillMarkdown(slug: string, baseUrl?: string): string | null;
+export interface MuxoDomainSkillHint {
+    slug: string;
+    title: string;
+    category: MuxoSkillCategory;
+    lane: string;
+    mcpResourceUri: string;
+    skillUrl: string;
+    recommendedTools: string[];
+    pitfalls: string[];
+    stripeProjectsOverride?: {
+        enforced: boolean;
+        canonicalToolSlug: string;
+        reason: string;
+    };
+}
+export declare function getProviderSkillHint(toolOrProviderSlug: string, baseUrl?: string): MuxoDomainSkillHint | null;
+export declare function buildMuxoMcpSkillBundles(baseUrl?: string, options?: {
+    includeAll?: boolean;
+}): MuxoMcpSkillBundle[];