@agenticmail/enterprise 0.3.2 → 0.4.0

package/dist/chunk-SGBTJHEF.js

@@ -0,0 +1,2287 @@
+// src/engine/db-schema.ts
+var ENGINE_TABLES = `
+-- Managed agents (the deployed AI employees)
+CREATE TABLE IF NOT EXISTS managed_agents (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  display_name TEXT NOT NULL,
+  state TEXT NOT NULL DEFAULT 'draft',
+  config JSON NOT NULL,
+  health JSON NOT NULL DEFAULT '{}',
+  usage JSON NOT NULL DEFAULT '{}',
+  permission_profile_id TEXT,
+  version INTEGER NOT NULL DEFAULT 1,
+  last_deployed_at TEXT,
+  last_health_check_at TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_managed_agents_org ON managed_agents(org_id);
+CREATE INDEX IF NOT EXISTS idx_managed_agents_state ON managed_agents(state);
+
+-- State transition history
+CREATE TABLE IF NOT EXISTS agent_state_history (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  from_state TEXT NOT NULL,
+  to_state TEXT NOT NULL,
+  reason TEXT NOT NULL,
+  triggered_by TEXT NOT NULL,
+  error TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  FOREIGN KEY (agent_id) REFERENCES managed_agents(id) ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS idx_state_history_agent ON agent_state_history(agent_id);
+CREATE INDEX IF NOT EXISTS idx_state_history_time ON agent_state_history(created_at);
+
+-- Permission profiles
+CREATE TABLE IF NOT EXISTS permission_profiles (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  description TEXT,
+  config JSON NOT NULL,
+  is_preset INTEGER NOT NULL DEFAULT 0,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_permission_profiles_org ON permission_profiles(org_id);
+
+-- Organizations (tenants)
+CREATE TABLE IF NOT EXISTS organizations (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  slug TEXT NOT NULL UNIQUE,
+  plan TEXT NOT NULL DEFAULT 'free',
+  limits JSON NOT NULL DEFAULT '{}',
+  usage JSON NOT NULL DEFAULT '{}',
+  settings JSON NOT NULL DEFAULT '{}',
+  sso_config JSON,
+  allowed_domains JSON NOT NULL DEFAULT '[]',
+  billing JSON,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_organizations_slug ON organizations(slug);
+
+-- Knowledge bases
+CREATE TABLE IF NOT EXISTS knowledge_bases (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  description TEXT,
+  agent_ids JSON NOT NULL DEFAULT '[]',
+  config JSON NOT NULL DEFAULT '{}',
+  stats JSON NOT NULL DEFAULT '{}',
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_knowledge_bases_org ON knowledge_bases(org_id);
+
+-- Knowledge base documents
+CREATE TABLE IF NOT EXISTS kb_documents (
+  id TEXT PRIMARY KEY,
+  knowledge_base_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  source_type TEXT NOT NULL,
+  source_url TEXT,
+  mime_type TEXT NOT NULL DEFAULT 'text/plain',
+  size INTEGER NOT NULL DEFAULT 0,
+  metadata JSON NOT NULL DEFAULT '{}',
+  status TEXT NOT NULL DEFAULT 'processing',
+  error TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+  FOREIGN KEY (knowledge_base_id) REFERENCES knowledge_bases(id) ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS idx_kb_documents_kb ON kb_documents(knowledge_base_id);
+
+-- Knowledge base chunks (for RAG)
+CREATE TABLE IF NOT EXISTS kb_chunks (
+  id TEXT PRIMARY KEY,
+  document_id TEXT NOT NULL,
+  content TEXT NOT NULL,
+  token_count INTEGER NOT NULL DEFAULT 0,
+  position INTEGER NOT NULL DEFAULT 0,
+  embedding BLOB,
+  metadata JSON NOT NULL DEFAULT '{}',
+  FOREIGN KEY (document_id) REFERENCES kb_documents(id) ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS idx_kb_chunks_doc ON kb_chunks(document_id);
+
+-- Tool call records (activity tracking)
+CREATE TABLE IF NOT EXISTS tool_calls (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  session_id TEXT,
+  tool_id TEXT NOT NULL,
+  tool_name TEXT NOT NULL,
+  parameters JSON,
+  result JSON,
+  timing JSON NOT NULL,
+  cost JSON,
+  permission JSON NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_tool_calls_agent ON tool_calls(agent_id);
+CREATE INDEX IF NOT EXISTS idx_tool_calls_org ON tool_calls(org_id);
+CREATE INDEX IF NOT EXISTS idx_tool_calls_time ON tool_calls(created_at);
+CREATE INDEX IF NOT EXISTS idx_tool_calls_tool ON tool_calls(tool_id);
+
+-- Activity events (real-time stream)
+CREATE TABLE IF NOT EXISTS activity_events (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  session_id TEXT,
+  type TEXT NOT NULL,
+  data JSON NOT NULL DEFAULT '{}',
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_activity_agent ON activity_events(agent_id);
+CREATE INDEX IF NOT EXISTS idx_activity_org ON activity_events(org_id);
+CREATE INDEX IF NOT EXISTS idx_activity_type ON activity_events(type);
+CREATE INDEX IF NOT EXISTS idx_activity_time ON activity_events(created_at);
+
+-- Conversation entries
+CREATE TABLE IF NOT EXISTS conversations (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  session_id TEXT NOT NULL,
+  role TEXT NOT NULL,
+  content TEXT NOT NULL,
+  channel TEXT,
+  token_count INTEGER NOT NULL DEFAULT 0,
+  tool_calls JSON,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_conversations_agent ON conversations(agent_id);
+CREATE INDEX IF NOT EXISTS idx_conversations_session ON conversations(session_id);
+
+-- Approval requests
+CREATE TABLE IF NOT EXISTS approval_requests (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  agent_name TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  tool_id TEXT NOT NULL,
+  tool_name TEXT NOT NULL,
+  reason TEXT NOT NULL,
+  risk_level TEXT NOT NULL,
+  side_effects JSON NOT NULL DEFAULT '[]',
+  parameters JSON,
+  context TEXT,
+  status TEXT NOT NULL DEFAULT 'pending',
+  decision JSON,
+  expires_at TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_approvals_org ON approval_requests(org_id);
+CREATE INDEX IF NOT EXISTS idx_approvals_status ON approval_requests(status);
+CREATE INDEX IF NOT EXISTS idx_approvals_agent ON approval_requests(agent_id);
+
+-- Approval policies
+CREATE TABLE IF NOT EXISTS approval_policies (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  description TEXT,
+  triggers JSON NOT NULL,
+  approvers JSON NOT NULL,
+  timeout JSON NOT NULL,
+  notify JSON NOT NULL DEFAULT '{}',
+  enabled INTEGER NOT NULL DEFAULT 1,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_approval_policies_org ON approval_policies(org_id);
+`;
+var ENGINE_TABLES_POSTGRES = ENGINE_TABLES.replace(/JSON/g, "JSONB").replace(/INTEGER NOT NULL DEFAULT 0/g, "INTEGER NOT NULL DEFAULT 0").replace(/datetime\('now'\)/g, "NOW()").replace(/INTEGER NOT NULL DEFAULT 1/g, "BOOLEAN NOT NULL DEFAULT TRUE").replace(/is_preset INTEGER NOT NULL DEFAULT 0/g, "is_preset BOOLEAN NOT NULL DEFAULT FALSE");
+var MIGRATIONS_TABLE = `
+CREATE TABLE IF NOT EXISTS engine_migrations (
+  version INTEGER PRIMARY KEY,
+  name TEXT NOT NULL,
+  applied_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+`;
+var MIGRATIONS_TABLE_POSTGRES = MIGRATIONS_TABLE.replace(/datetime\('now'\)/g, "NOW()");
+var MIGRATIONS = [
+  {
+    version: 1,
+    name: "initial_schema",
+    sql: ENGINE_TABLES,
+    postgres: ENGINE_TABLES_POSTGRES
+  },
+  {
+    version: 2,
+    name: "sso_and_deploy_credentials",
+    sql: `
+-- SSO integrations (SAML, OIDC configs per org)
+CREATE TABLE IF NOT EXISTS sso_integrations (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  provider_type TEXT NOT NULL,
+  name TEXT NOT NULL,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  config JSON NOT NULL DEFAULT '{}',
+  metadata_url TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_sso_org ON sso_integrations(org_id);
+CREATE INDEX IF NOT EXISTS idx_sso_type ON sso_integrations(provider_type);
+
+-- Deploy credentials (encrypted tokens for Docker/SSH/Fly/Railway)
+CREATE TABLE IF NOT EXISTS deploy_credentials (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  target_type TEXT NOT NULL,
+  config JSON NOT NULL DEFAULT '{}',
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_deploy_creds_org ON deploy_credentials(org_id);
+CREATE INDEX IF NOT EXISTS idx_deploy_creds_type ON deploy_credentials(target_type);
+
+-- OIDC state tracking (prevents replay attacks)
+CREATE TABLE IF NOT EXISTS oidc_states (
+  state TEXT PRIMARY KEY,
+  provider_id TEXT NOT NULL,
+  redirect_uri TEXT,
+  nonce TEXT,
+  code_verifier TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  expires_at TEXT NOT NULL
+);
+    `,
+    postgres: `
+CREATE TABLE IF NOT EXISTS sso_integrations (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  provider_type TEXT NOT NULL,
+  name TEXT NOT NULL,
+  enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  config JSONB NOT NULL DEFAULT '{}',
+  metadata_url TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_sso_org ON sso_integrations(org_id);
+CREATE INDEX IF NOT EXISTS idx_sso_type ON sso_integrations(provider_type);
+
+CREATE TABLE IF NOT EXISTS deploy_credentials (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  target_type TEXT NOT NULL,
+  config JSONB NOT NULL DEFAULT '{}',
+  created_by TEXT NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_deploy_creds_org ON deploy_credentials(org_id);
+CREATE INDEX IF NOT EXISTS idx_deploy_creds_type ON deploy_credentials(target_type);
+
+CREATE TABLE IF NOT EXISTS oidc_states (
+  state TEXT PRIMARY KEY,
+  provider_id TEXT NOT NULL,
+  redirect_uri TEXT,
+  nonce TEXT,
+  code_verifier TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  expires_at TIMESTAMPTZ NOT NULL
+);
+    `
+  },
+  {
+    version: 3,
+    name: "autonomous_employee_trust",
+    sql: `
+-- Per-agent budget config (extends managed_agents)
+ALTER TABLE managed_agents ADD COLUMN budget_config JSON DEFAULT '{}';
+
+-- Budget alerts log
+CREATE TABLE IF NOT EXISTS budget_alerts (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  agent_id TEXT NOT NULL,
+  alert_type TEXT NOT NULL,
+  budget_type TEXT NOT NULL,
+  current_value REAL NOT NULL,
+  limit_value REAL NOT NULL,
+  acknowledged INTEGER NOT NULL DEFAULT 0,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_budget_alerts_org ON budget_alerts(org_id);
+CREATE INDEX IF NOT EXISTS idx_budget_alerts_agent ON budget_alerts(agent_id);
+
+-- Escalation chains (multi-level approval workflows)
+CREATE TABLE IF NOT EXISTS escalation_chains (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  description TEXT,
+  levels JSON NOT NULL,
+  fallback_action TEXT NOT NULL DEFAULT 'deny',
+  enabled INTEGER NOT NULL DEFAULT 1,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_escalation_org ON escalation_chains(org_id);
+
+-- Escalation tracking on approval requests
+ALTER TABLE approval_requests ADD COLUMN escalation_chain_id TEXT;
+ALTER TABLE approval_requests ADD COLUMN escalation_level INTEGER DEFAULT 0;
+ALTER TABLE approval_requests ADD COLUMN escalation_history JSON DEFAULT '[]';
+
+-- DLP rules
+CREATE TABLE IF NOT EXISTS dlp_rules (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  description TEXT,
+  pattern_type TEXT NOT NULL,
+  pattern TEXT NOT NULL,
+  action TEXT NOT NULL DEFAULT 'block',
+  applies_to TEXT NOT NULL DEFAULT 'both',
+  severity TEXT NOT NULL DEFAULT 'high',
+  enabled INTEGER NOT NULL DEFAULT 1,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_dlp_rules_org ON dlp_rules(org_id);
+
+-- DLP violations log
+CREATE TABLE IF NOT EXISTS dlp_violations (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  agent_id TEXT NOT NULL,
+  rule_id TEXT NOT NULL,
+  tool_id TEXT NOT NULL,
+  action_taken TEXT NOT NULL,
+  match_context TEXT,
+  direction TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_dlp_violations_org ON dlp_violations(org_id);
+CREATE INDEX IF NOT EXISTS idx_dlp_violations_agent ON dlp_violations(agent_id);
+
+-- Agent-to-agent messages
+CREATE TABLE IF NOT EXISTS agent_messages (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  from_agent_id TEXT NOT NULL,
+  to_agent_id TEXT NOT NULL,
+  type TEXT NOT NULL DEFAULT 'message',
+  subject TEXT,
+  content TEXT NOT NULL,
+  metadata JSON NOT NULL DEFAULT '{}',
+  status TEXT NOT NULL DEFAULT 'pending',
+  parent_id TEXT,
+  priority TEXT NOT NULL DEFAULT 'normal',
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_agent_messages_org ON agent_messages(org_id);
+CREATE INDEX IF NOT EXISTS idx_agent_messages_to ON agent_messages(to_agent_id);
+CREATE INDEX IF NOT EXISTS idx_agent_messages_from ON agent_messages(from_agent_id);
+CREATE INDEX IF NOT EXISTS idx_agent_messages_status ON agent_messages(status);
+
+-- Interventions (pause/resume/kill records)
+CREATE TABLE IF NOT EXISTS interventions (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  agent_id TEXT NOT NULL,
+  type TEXT NOT NULL,
+  reason TEXT NOT NULL,
+  triggered_by TEXT NOT NULL,
+  metadata JSON NOT NULL DEFAULT '{}',
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_interventions_org ON interventions(org_id);
+CREATE INDEX IF NOT EXISTS idx_interventions_agent ON interventions(agent_id);
+
+-- Anomaly detection rules
+CREATE TABLE IF NOT EXISTS anomaly_rules (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  description TEXT,
+  rule_type TEXT NOT NULL,
+  config JSON NOT NULL,
+  action TEXT NOT NULL DEFAULT 'alert',
+  enabled INTEGER NOT NULL DEFAULT 1,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_anomaly_rules_org ON anomaly_rules(org_id);
+
+-- Action journal (for rollback)
+CREATE TABLE IF NOT EXISTS action_journal (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  agent_id TEXT NOT NULL,
+  session_id TEXT,
+  tool_id TEXT NOT NULL,
+  tool_name TEXT NOT NULL,
+  action_type TEXT NOT NULL,
+  forward_data JSON NOT NULL,
+  reverse_data JSON,
+  reversible INTEGER NOT NULL DEFAULT 0,
+  reversed INTEGER NOT NULL DEFAULT 0,
+  reversed_at TEXT,
+  reversed_by TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_action_journal_org ON action_journal(org_id);
+CREATE INDEX IF NOT EXISTS idx_action_journal_agent ON action_journal(agent_id);
+CREATE INDEX IF NOT EXISTS idx_action_journal_reversible ON action_journal(reversible);
+
+-- Compliance reports
+CREATE TABLE IF NOT EXISTS compliance_reports (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  type TEXT NOT NULL,
+  title TEXT NOT NULL,
+  parameters JSON NOT NULL DEFAULT '{}',
+  status TEXT NOT NULL DEFAULT 'generating',
+  data JSON,
+  format TEXT NOT NULL DEFAULT 'json',
+  generated_by TEXT NOT NULL,
+  error TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_compliance_reports_org ON compliance_reports(org_id);
+CREATE INDEX IF NOT EXISTS idx_compliance_reports_type ON compliance_reports(type);
+    `
+  },
+  {
+    version: 4,
+    name: "communication_topology",
+    sql: `
+-- Add direction and channel columns to agent_messages for traffic classification
+ALTER TABLE agent_messages ADD COLUMN direction TEXT DEFAULT 'internal';
+ALTER TABLE agent_messages ADD COLUMN channel TEXT DEFAULT 'direct';
+CREATE INDEX IF NOT EXISTS idx_agent_messages_direction ON agent_messages(direction);
+CREATE INDEX IF NOT EXISTS idx_agent_messages_channel ON agent_messages(channel);
+    `
+  },
+  {
+    version: 5,
+    name: "communication_task_fields_and_compliance",
+    sql: `
+-- Add task lifecycle columns to agent_messages
+ALTER TABLE agent_messages ADD COLUMN deadline TEXT;
+ALTER TABLE agent_messages ADD COLUMN claimed_at TEXT;
+ALTER TABLE agent_messages ADD COLUMN completed_at TEXT;
+
+-- Add completed_at to compliance reports
+ALTER TABLE compliance_reports ADD COLUMN completed_at TEXT;
+    `
+  },
+  {
+    version: 6,
+    name: "community_skill_registry",
+    sql: `
+-- Community skill index (global marketplace catalog)
+CREATE TABLE IF NOT EXISTS community_skill_index (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  description TEXT NOT NULL,
+  version TEXT NOT NULL DEFAULT '1.0.0',
+  author TEXT NOT NULL,
+  repository TEXT NOT NULL,
+  license TEXT NOT NULL DEFAULT 'MIT',
+  category TEXT,
+  risk TEXT DEFAULT 'medium',
+  icon TEXT,
+  tags JSON NOT NULL DEFAULT '[]',
+  tools JSON NOT NULL DEFAULT '[]',
+  config_schema JSON NOT NULL DEFAULT '{}',
+  min_engine_version TEXT,
+  homepage TEXT,
+  downloads INTEGER NOT NULL DEFAULT 0,
+  rating REAL NOT NULL DEFAULT 0,
+  rating_count INTEGER NOT NULL DEFAULT 0,
+  verified INTEGER NOT NULL DEFAULT 0,
+  featured INTEGER NOT NULL DEFAULT 0,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_csi_category ON community_skill_index(category);
+CREATE INDEX IF NOT EXISTS idx_csi_author ON community_skill_index(author);
+CREATE INDEX IF NOT EXISTS idx_csi_featured ON community_skill_index(featured);
+CREATE INDEX IF NOT EXISTS idx_csi_verified ON community_skill_index(verified);
+CREATE INDEX IF NOT EXISTS idx_csi_downloads ON community_skill_index(downloads);
+
+-- Per-org installed community skills
+CREATE TABLE IF NOT EXISTS community_skill_installed (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  skill_id TEXT NOT NULL,
+  version TEXT NOT NULL,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  config JSON NOT NULL DEFAULT '{}',
+  installed_by TEXT NOT NULL,
+  installed_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_csinst_org ON community_skill_installed(org_id);
+CREATE INDEX IF NOT EXISTS idx_csinst_skill ON community_skill_installed(skill_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_csinst_org_skill ON community_skill_installed(org_id, skill_id);
+
+-- Reviews and ratings for community skills (global, not org-scoped)
+CREATE TABLE IF NOT EXISTS community_skill_reviews (
+  id TEXT PRIMARY KEY,
+  skill_id TEXT NOT NULL,
+  org_id TEXT NOT NULL DEFAULT 'global',
+  user_id TEXT NOT NULL,
+  user_name TEXT,
+  rating INTEGER NOT NULL CHECK (rating >= 1 AND rating <= 5),
+  review_text TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_csrev_skill ON community_skill_reviews(skill_id);
+    `
+  },
+  {
+    version: 7,
+    name: "domain_registration",
+    sql: `
+ALTER TABLE company_settings ADD COLUMN deployment_key_hash TEXT;
+ALTER TABLE company_settings ADD COLUMN domain_registration_id TEXT;
+ALTER TABLE company_settings ADD COLUMN domain_dns_challenge TEXT;
+ALTER TABLE company_settings ADD COLUMN domain_verified_at TEXT;
+ALTER TABLE company_settings ADD COLUMN domain_registered_at TEXT;
+ALTER TABLE company_settings ADD COLUMN domain_status TEXT DEFAULT 'unregistered';
+    `,
+    postgres: `
+ALTER TABLE company_settings ADD COLUMN IF NOT EXISTS deployment_key_hash TEXT;
+ALTER TABLE company_settings ADD COLUMN IF NOT EXISTS domain_registration_id TEXT;
+ALTER TABLE company_settings ADD COLUMN IF NOT EXISTS domain_dns_challenge TEXT;
+ALTER TABLE company_settings ADD COLUMN IF NOT EXISTS domain_verified_at TIMESTAMPTZ;
+ALTER TABLE company_settings ADD COLUMN IF NOT EXISTS domain_registered_at TIMESTAMPTZ;
+ALTER TABLE company_settings ADD COLUMN IF NOT EXISTS domain_status TEXT DEFAULT 'unregistered';
+    `,
+    mysql: `
+ALTER TABLE company_settings ADD COLUMN deployment_key_hash TEXT;
+ALTER TABLE company_settings ADD COLUMN domain_registration_id VARCHAR(255);
+ALTER TABLE company_settings ADD COLUMN domain_dns_challenge TEXT;
+ALTER TABLE company_settings ADD COLUMN domain_verified_at DATETIME;
+ALTER TABLE company_settings ADD COLUMN domain_registered_at DATETIME;
+ALTER TABLE company_settings ADD COLUMN domain_status VARCHAR(20) DEFAULT 'unregistered';
+    `,
+    nosql: async () => {
+    }
+  },
+  {
+    version: 8,
+    name: "workforce_management",
+    sql: `
+-- Work schedules (per-agent shift configuration)
+CREATE TABLE IF NOT EXISTS work_schedules (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL UNIQUE,
+  org_id TEXT NOT NULL,
+  timezone TEXT NOT NULL DEFAULT 'UTC',
+  schedule_type TEXT NOT NULL DEFAULT 'standard',
+  config JSON NOT NULL DEFAULT '{}',
+  enforce_clock_in INTEGER NOT NULL DEFAULT 1,
+  enforce_clock_out INTEGER NOT NULL DEFAULT 1,
+  auto_wake_enabled INTEGER NOT NULL DEFAULT 1,
+  off_hours_action TEXT NOT NULL DEFAULT 'pause',
+  grace_period_minutes INTEGER NOT NULL DEFAULT 5,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_work_schedules_agent ON work_schedules(agent_id);
+CREATE INDEX IF NOT EXISTS idx_work_schedules_org ON work_schedules(org_id);
+
+-- Clock records (audit trail for clock-in/out events)
+CREATE TABLE IF NOT EXISTS clock_records (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  type TEXT NOT NULL,
+  triggered_by TEXT NOT NULL,
+  scheduled_at TEXT,
+  actual_at TEXT NOT NULL,
+  reason TEXT,
+  metadata JSON NOT NULL DEFAULT '{}',
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_clock_records_agent ON clock_records(agent_id);
+CREATE INDEX IF NOT EXISTS idx_clock_records_org ON clock_records(org_id);
+CREATE INDEX IF NOT EXISTS idx_clock_records_type ON clock_records(type);
+CREATE INDEX IF NOT EXISTS idx_clock_records_time ON clock_records(created_at);
+
+-- Task queue (work continuity between sessions)
+CREATE TABLE IF NOT EXISTS task_queue (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  type TEXT NOT NULL DEFAULT 'continue',
+  title TEXT NOT NULL,
+  description TEXT,
+  context JSON NOT NULL DEFAULT '{}',
+  priority TEXT NOT NULL DEFAULT 'normal',
+  status TEXT NOT NULL DEFAULT 'queued',
+  source TEXT NOT NULL DEFAULT 'system',
+  scheduled_for TEXT,
+  started_at TEXT,
+  completed_at TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_task_queue_agent ON task_queue(agent_id);
+CREATE INDEX IF NOT EXISTS idx_task_queue_org ON task_queue(org_id);
+CREATE INDEX IF NOT EXISTS idx_task_queue_status ON task_queue(status);
+    `,
+    postgres: `
+CREATE TABLE IF NOT EXISTS work_schedules (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL UNIQUE,
+  org_id TEXT NOT NULL,
+  timezone TEXT NOT NULL DEFAULT 'UTC',
+  schedule_type TEXT NOT NULL DEFAULT 'standard',
+  config JSONB NOT NULL DEFAULT '{}',
+  enforce_clock_in BOOLEAN NOT NULL DEFAULT TRUE,
+  enforce_clock_out BOOLEAN NOT NULL DEFAULT TRUE,
+  auto_wake_enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  off_hours_action TEXT NOT NULL DEFAULT 'pause',
+  grace_period_minutes INTEGER NOT NULL DEFAULT 5,
+  enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_work_schedules_agent ON work_schedules(agent_id);
+CREATE INDEX IF NOT EXISTS idx_work_schedules_org ON work_schedules(org_id);
+
+CREATE TABLE IF NOT EXISTS clock_records (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  type TEXT NOT NULL,
+  triggered_by TEXT NOT NULL,
+  scheduled_at TIMESTAMPTZ,
+  actual_at TIMESTAMPTZ NOT NULL,
+  reason TEXT,
+  metadata JSONB NOT NULL DEFAULT '{}',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_clock_records_agent ON clock_records(agent_id);
+CREATE INDEX IF NOT EXISTS idx_clock_records_org ON clock_records(org_id);
+CREATE INDEX IF NOT EXISTS idx_clock_records_type ON clock_records(type);
+CREATE INDEX IF NOT EXISTS idx_clock_records_time ON clock_records(created_at);
+
+CREATE TABLE IF NOT EXISTS task_queue (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  type TEXT NOT NULL DEFAULT 'continue',
+  title TEXT NOT NULL,
+  description TEXT,
+  context JSONB NOT NULL DEFAULT '{}',
+  priority TEXT NOT NULL DEFAULT 'normal',
+  status TEXT NOT NULL DEFAULT 'queued',
+  source TEXT NOT NULL DEFAULT 'system',
+  scheduled_for TIMESTAMPTZ,
+  started_at TIMESTAMPTZ,
+  completed_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_task_queue_agent ON task_queue(agent_id);
+CREATE INDEX IF NOT EXISTS idx_task_queue_org ON task_queue(org_id);
+CREATE INDEX IF NOT EXISTS idx_task_queue_status ON task_queue(status);
+    `
+  },
+  {
+    version: 9,
+    name: "guardrails_policies_memory_onboarding",
+    sql: `
+-- Organization policies (the "employee handbook" for AI agents)
+CREATE TABLE IF NOT EXISTS org_policies (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  category TEXT NOT NULL,
+  description TEXT,
+  content TEXT NOT NULL,
+  priority INTEGER NOT NULL DEFAULT 0,
+  version INTEGER NOT NULL DEFAULT 1,
+  enforcement TEXT NOT NULL DEFAULT 'mandatory',
+  applies_to JSON NOT NULL DEFAULT '["*"]',
+  tags JSON NOT NULL DEFAULT '[]',
+  enabled INTEGER NOT NULL DEFAULT 1,
+  created_by TEXT NOT NULL DEFAULT 'system',
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_org_policies_org ON org_policies(org_id);
+CREATE INDEX IF NOT EXISTS idx_org_policies_category ON org_policies(category);
+
+-- Agent memory entries (persistent learning and growth)
+CREATE TABLE IF NOT EXISTS agent_memory (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  category TEXT NOT NULL,
+  title TEXT NOT NULL,
+  content TEXT NOT NULL,
+  source TEXT NOT NULL DEFAULT 'interaction',
+  importance TEXT NOT NULL DEFAULT 'normal',
+  confidence REAL NOT NULL DEFAULT 1.0,
+  access_count INTEGER NOT NULL DEFAULT 0,
+  last_accessed_at TEXT,
+  expires_at TEXT,
+  tags JSON NOT NULL DEFAULT '[]',
+  metadata JSON NOT NULL DEFAULT '{}',
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_agent_memory_agent ON agent_memory(agent_id);
+CREATE INDEX IF NOT EXISTS idx_agent_memory_org ON agent_memory(org_id);
+CREATE INDEX IF NOT EXISTS idx_agent_memory_category ON agent_memory(category);
+
+-- Onboarding records (tracking policy acknowledgment per agent)
+CREATE TABLE IF NOT EXISTS onboarding_records (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  policy_id TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  acknowledged_at TEXT,
+  memory_entry_id TEXT,
+  verification_hash TEXT,
+  metadata JSON NOT NULL DEFAULT '{}',
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_onboarding_agent ON onboarding_records(agent_id);
+CREATE INDEX IF NOT EXISTS idx_onboarding_policy ON onboarding_records(policy_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_onboarding_agent_policy ON onboarding_records(agent_id, policy_id);
+
+-- Extended guardrail rules (superset of anomaly_rules with more categories)
+CREATE TABLE IF NOT EXISTS guardrail_rules (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  description TEXT,
+  category TEXT NOT NULL,
+  rule_type TEXT NOT NULL,
+  conditions JSON NOT NULL DEFAULT '{}',
+  action TEXT NOT NULL DEFAULT 'alert',
+  severity TEXT NOT NULL DEFAULT 'medium',
+  cooldown_minutes INTEGER NOT NULL DEFAULT 0,
+  last_triggered_at TEXT,
+  trigger_count INTEGER NOT NULL DEFAULT 0,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  created_by TEXT NOT NULL DEFAULT 'system',
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_guardrail_rules_org ON guardrail_rules(org_id);
+CREATE INDEX IF NOT EXISTS idx_guardrail_rules_category ON guardrail_rules(category);
+    `,
+    postgres: `
+CREATE TABLE IF NOT EXISTS org_policies (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  category TEXT NOT NULL,
+  description TEXT,
+  content TEXT NOT NULL,
+  priority INTEGER NOT NULL DEFAULT 0,
+  version INTEGER NOT NULL DEFAULT 1,
+  enforcement TEXT NOT NULL DEFAULT 'mandatory',
+  applies_to JSONB NOT NULL DEFAULT '["*"]',
+  tags JSONB NOT NULL DEFAULT '[]',
+  enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  created_by TEXT NOT NULL DEFAULT 'system',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_org_policies_org ON org_policies(org_id);
+CREATE INDEX IF NOT EXISTS idx_org_policies_category ON org_policies(category);
+
+CREATE TABLE IF NOT EXISTS agent_memory (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  category TEXT NOT NULL,
+  title TEXT NOT NULL,
+  content TEXT NOT NULL,
+  source TEXT NOT NULL DEFAULT 'interaction',
+  importance TEXT NOT NULL DEFAULT 'normal',
+  confidence REAL NOT NULL DEFAULT 1.0,
+  access_count INTEGER NOT NULL DEFAULT 0,
+  last_accessed_at TIMESTAMPTZ,
+  expires_at TIMESTAMPTZ,
+  tags JSONB NOT NULL DEFAULT '[]',
+  metadata JSONB NOT NULL DEFAULT '{}',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_agent_memory_agent ON agent_memory(agent_id);
+CREATE INDEX IF NOT EXISTS idx_agent_memory_org ON agent_memory(org_id);
+CREATE INDEX IF NOT EXISTS idx_agent_memory_category ON agent_memory(category);
+
+CREATE TABLE IF NOT EXISTS onboarding_records (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  policy_id TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  acknowledged_at TIMESTAMPTZ,
+  memory_entry_id TEXT,
+  verification_hash TEXT,
+  metadata JSONB NOT NULL DEFAULT '{}',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_onboarding_agent ON onboarding_records(agent_id);
+CREATE INDEX IF NOT EXISTS idx_onboarding_policy ON onboarding_records(policy_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_onboarding_agent_policy ON onboarding_records(agent_id, policy_id);
+
+CREATE TABLE IF NOT EXISTS guardrail_rules (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  description TEXT,
+  category TEXT NOT NULL,
+  rule_type TEXT NOT NULL,
+  conditions JSONB NOT NULL DEFAULT '{}',
+  action TEXT NOT NULL DEFAULT 'alert',
+  severity TEXT NOT NULL DEFAULT 'medium',
+  cooldown_minutes INTEGER NOT NULL DEFAULT 0,
+  last_triggered_at TIMESTAMPTZ,
+  trigger_count INTEGER NOT NULL DEFAULT 0,
+  enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  created_by TEXT NOT NULL DEFAULT 'system',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_guardrail_rules_org ON guardrail_rules(org_id);
+CREATE INDEX IF NOT EXISTS idx_guardrail_rules_category ON guardrail_rules(category);
+    `
+  },
+  {
+    version: 10,
+    name: "vault_storage_policy_import",
+    sql: `
+-- Vault entries (encrypted secrets at rest)
+CREATE TABLE IF NOT EXISTS vault_entries (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  category TEXT NOT NULL DEFAULT 'custom',
+  encrypted_value TEXT NOT NULL,
+  metadata JSON NOT NULL DEFAULT '{}',
+  created_by TEXT NOT NULL DEFAULT 'system',
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+  rotated_at TEXT,
+  expires_at TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_vault_org ON vault_entries(org_id);
+CREATE INDEX IF NOT EXISTS idx_vault_category ON vault_entries(category);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_vault_org_name ON vault_entries(org_id, name);
+
+-- Vault audit log (tracks every secret access for compliance)
+CREATE TABLE IF NOT EXISTS vault_audit_log (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  vault_entry_id TEXT,
+  action TEXT NOT NULL,
+  actor TEXT NOT NULL,
+  ip TEXT,
+  metadata JSON NOT NULL DEFAULT '{}',
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_vault_audit_org ON vault_audit_log(org_id);
+CREATE INDEX IF NOT EXISTS idx_vault_audit_entry ON vault_audit_log(vault_entry_id);
+
+-- Org storage configurations
+CREATE TABLE IF NOT EXISTS org_storage_config (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  storage_type TEXT NOT NULL DEFAULT 'local',
+  config JSON NOT NULL DEFAULT '{}',
+  vault_credential_id TEXT,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  created_by TEXT NOT NULL DEFAULT 'system',
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_org_storage_org ON org_storage_config(org_id);
+
+-- Storage objects metadata
+CREATE TABLE IF NOT EXISTS storage_objects (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  storage_key TEXT NOT NULL,
+  original_name TEXT NOT NULL,
+  content_type TEXT NOT NULL DEFAULT 'application/octet-stream',
+  size INTEGER NOT NULL DEFAULT 0,
+  related_type TEXT,
+  related_id TEXT,
+  metadata JSON NOT NULL DEFAULT '{}',
+  created_by TEXT NOT NULL DEFAULT 'system',
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_storage_objects_org ON storage_objects(org_id);
+CREATE INDEX IF NOT EXISTS idx_storage_objects_related ON storage_objects(related_type, related_id);
+
+-- Policy import job tracking
+CREATE TABLE IF NOT EXISTS policy_import_jobs (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  format TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  progress JSON NOT NULL DEFAULT '{}',
+  errors JSON NOT NULL DEFAULT '[]',
+  policy_ids JSON NOT NULL DEFAULT '[]',
+  created_by TEXT NOT NULL DEFAULT 'system',
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  completed_at TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_import_jobs_org ON policy_import_jobs(org_id);
+    `,
+    postgres: `
+CREATE TABLE IF NOT EXISTS vault_entries (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  category TEXT NOT NULL DEFAULT 'custom',
+  encrypted_value TEXT NOT NULL,
+  metadata JSONB NOT NULL DEFAULT '{}',
+  created_by TEXT NOT NULL DEFAULT 'system',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  rotated_at TIMESTAMPTZ,
+  expires_at TIMESTAMPTZ
+);
+CREATE INDEX IF NOT EXISTS idx_vault_org ON vault_entries(org_id);
+CREATE INDEX IF NOT EXISTS idx_vault_category ON vault_entries(category);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_vault_org_name ON vault_entries(org_id, name);
+
+CREATE TABLE IF NOT EXISTS vault_audit_log (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  vault_entry_id TEXT,
+  action TEXT NOT NULL,
+  actor TEXT NOT NULL,
+  ip TEXT,
+  metadata JSONB NOT NULL DEFAULT '{}',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_vault_audit_org ON vault_audit_log(org_id);
+CREATE INDEX IF NOT EXISTS idx_vault_audit_entry ON vault_audit_log(vault_entry_id);
+
+CREATE TABLE IF NOT EXISTS org_storage_config (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  storage_type TEXT NOT NULL DEFAULT 'local',
+  config JSONB NOT NULL DEFAULT '{}',
+  vault_credential_id TEXT,
+  enabled BOOLEAN NOT NULL DEFAULT TRUE,
+  created_by TEXT NOT NULL DEFAULT 'system',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_org_storage_org ON org_storage_config(org_id);
+
+CREATE TABLE IF NOT EXISTS storage_objects (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  storage_key TEXT NOT NULL,
+  original_name TEXT NOT NULL,
+  content_type TEXT NOT NULL DEFAULT 'application/octet-stream',
+  size INTEGER NOT NULL DEFAULT 0,
+  related_type TEXT,
+  related_id TEXT,
+  metadata JSONB NOT NULL DEFAULT '{}',
+  created_by TEXT NOT NULL DEFAULT 'system',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_storage_objects_org ON storage_objects(org_id);
+CREATE INDEX IF NOT EXISTS idx_storage_objects_related ON storage_objects(related_type, related_id);
+
+CREATE TABLE IF NOT EXISTS policy_import_jobs (
+  id TEXT PRIMARY KEY,
+  org_id TEXT NOT NULL,
+  format TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  progress JSONB NOT NULL DEFAULT '{}',
+  errors JSONB NOT NULL DEFAULT '[]',
+  policy_ids JSONB NOT NULL DEFAULT '[]',
+  created_by TEXT NOT NULL DEFAULT 'system',
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  completed_at TIMESTAMPTZ
+);
+CREATE INDEX IF NOT EXISTS idx_import_jobs_org ON policy_import_jobs(org_id);
+    `
+  },
+  {
+    version: 11,
+    name: "reviews_global_add_user_name",
+    sql: `ALTER TABLE community_skill_reviews ADD COLUMN user_name TEXT;`,
+    postgres: `ALTER TABLE community_skill_reviews ADD COLUMN IF NOT EXISTS user_name TEXT;`
+  },
+  {
+    version: 12,
+    name: "tool_security_config",
+    sql: `ALTER TABLE company_settings ADD COLUMN tool_security_config TEXT DEFAULT '{}';`,
+    postgres: `ALTER TABLE company_settings ADD COLUMN IF NOT EXISTS tool_security_config TEXT DEFAULT '{}';`,
+    mysql: `ALTER TABLE company_settings ADD COLUMN tool_security_config TEXT DEFAULT '{}';`,
+    nosql: async () => {
+    }
+  },
+  {
+    version: 13,
+    name: "firewall_config",
+    sql: `ALTER TABLE company_settings ADD COLUMN firewall_config TEXT DEFAULT '{}';`,
+    postgres: `ALTER TABLE company_settings ADD COLUMN IF NOT EXISTS firewall_config TEXT DEFAULT '{}';`,
+    mysql: `ALTER TABLE company_settings ADD COLUMN firewall_config TEXT DEFAULT '{}';`,
+    nosql: async () => {
+    }
+  },
+  {
+    version: 14,
+    name: "agent_runtime_sessions",
+    sql: `
+-- Agent runtime sessions (standalone agent execution)
+CREATE TABLE IF NOT EXISTS agent_sessions (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  org_id TEXT NOT NULL DEFAULT 'default',
+  status TEXT NOT NULL DEFAULT 'active',
+  token_count INTEGER DEFAULT 0,
+  turn_count INTEGER DEFAULT 0,
+  parent_session_id TEXT,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_agent_sessions_agent ON agent_sessions(agent_id);
+CREATE INDEX IF NOT EXISTS idx_agent_sessions_status ON agent_sessions(status);
+CREATE INDEX IF NOT EXISTS idx_agent_sessions_parent ON agent_sessions(parent_session_id);
+
+-- Agent session messages (conversation history per session)
+CREATE TABLE IF NOT EXISTS agent_session_messages (
+  id TEXT PRIMARY KEY,
+  session_id TEXT NOT NULL,
+  role TEXT NOT NULL,
+  content TEXT NOT NULL,
+  tool_calls TEXT,
+  tool_results TEXT,
+  created_at INTEGER NOT NULL,
+  FOREIGN KEY (session_id) REFERENCES agent_sessions(id) ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS idx_session_messages_session ON agent_session_messages(session_id);
+CREATE INDEX IF NOT EXISTS idx_session_messages_time ON agent_session_messages(created_at);
+    `,
+    postgres: `
+CREATE TABLE IF NOT EXISTS agent_sessions (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  org_id TEXT NOT NULL DEFAULT 'default',
+  status TEXT NOT NULL DEFAULT 'active',
+  token_count INTEGER DEFAULT 0,
+  turn_count INTEGER DEFAULT 0,
+  parent_session_id TEXT,
+  created_at BIGINT NOT NULL,
+  updated_at BIGINT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_agent_sessions_agent ON agent_sessions(agent_id);
+CREATE INDEX IF NOT EXISTS idx_agent_sessions_status ON agent_sessions(status);
+CREATE INDEX IF NOT EXISTS idx_agent_sessions_parent ON agent_sessions(parent_session_id);
+
+CREATE TABLE IF NOT EXISTS agent_session_messages (
+  id TEXT PRIMARY KEY,
+  session_id TEXT NOT NULL,
+  role TEXT NOT NULL,
+  content TEXT NOT NULL,
+  tool_calls TEXT,
+  tool_results TEXT,
+  created_at BIGINT NOT NULL,
+  FOREIGN KEY (session_id) REFERENCES agent_sessions(id) ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS idx_session_messages_session ON agent_session_messages(session_id);
+CREATE INDEX IF NOT EXISTS idx_session_messages_time ON agent_session_messages(created_at);
+    `
+  },
+  {
+    version: 15,
+    name: "long_running_sessions",
+    sql: `
+-- Add heartbeat tracking to agent sessions
+ALTER TABLE agent_sessions ADD COLUMN last_heartbeat_at INTEGER;
+ALTER TABLE agent_sessions ADD COLUMN cost_usd REAL DEFAULT 0;
+CREATE INDEX IF NOT EXISTS idx_agent_sessions_heartbeat ON agent_sessions(last_heartbeat_at);
+
+-- Persistent follow-ups (survive restarts)
+CREATE TABLE IF NOT EXISTS agent_followups (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  session_id TEXT,
+  message TEXT NOT NULL,
+  execute_at INTEGER NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  created_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_agent_followups_status ON agent_followups(status);
+CREATE INDEX IF NOT EXISTS idx_agent_followups_execute ON agent_followups(execute_at);
+CREATE INDEX IF NOT EXISTS idx_agent_followups_agent ON agent_followups(agent_id);
+    `,
+    postgres: `
+ALTER TABLE agent_sessions ADD COLUMN IF NOT EXISTS last_heartbeat_at BIGINT;
+ALTER TABLE agent_sessions ADD COLUMN IF NOT EXISTS cost_usd DOUBLE PRECISION DEFAULT 0;
+CREATE INDEX IF NOT EXISTS idx_agent_sessions_heartbeat ON agent_sessions(last_heartbeat_at);
+
+CREATE TABLE IF NOT EXISTS agent_followups (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL,
+  session_id TEXT,
+  message TEXT NOT NULL,
+  execute_at BIGINT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  created_at BIGINT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_agent_followups_status ON agent_followups(status);
+CREATE INDEX IF NOT EXISTS idx_agent_followups_execute ON agent_followups(execute_at);
+CREATE INDEX IF NOT EXISTS idx_agent_followups_agent ON agent_followups(agent_id);
+    `,
+    mysql: `
+ALTER TABLE agent_sessions ADD COLUMN last_heartbeat_at BIGINT;
+ALTER TABLE agent_sessions ADD COLUMN cost_usd DOUBLE DEFAULT 0;
+CREATE INDEX idx_agent_sessions_heartbeat ON agent_sessions(last_heartbeat_at);
+
+CREATE TABLE IF NOT EXISTS agent_followups (
+  id VARCHAR(255) PRIMARY KEY,
+  agent_id VARCHAR(255) NOT NULL,
+  session_id VARCHAR(255),
+  message TEXT NOT NULL,
+  execute_at BIGINT NOT NULL,
+  status VARCHAR(50) NOT NULL DEFAULT 'pending',
+  created_at BIGINT NOT NULL
+);
+CREATE INDEX idx_agent_followups_status ON agent_followups(status);
+CREATE INDEX idx_agent_followups_execute ON agent_followups(execute_at);
+CREATE INDEX idx_agent_followups_agent ON agent_followups(agent_id);
+    `
+  },
+  {
+    version: 16,
+    name: "model_pricing_config",
+    sql: `ALTER TABLE company_settings ADD COLUMN model_pricing_config TEXT DEFAULT '{}';`,
+    postgres: `ALTER TABLE company_settings ADD COLUMN IF NOT EXISTS model_pricing_config TEXT DEFAULT '{}';`,
+    mysql: `ALTER TABLE company_settings ADD COLUMN model_pricing_config TEXT DEFAULT '{}';`,
+    nosql: async () => {
+    }
+  }
+];
+function sqliteToPostgres(sql) {
+  return sql.replace(/JSON/g, "JSONB").replace(/datetime\('now'\)/g, "NOW()").replace(/INTEGER NOT NULL DEFAULT 1(?!\d)/g, "BOOLEAN NOT NULL DEFAULT TRUE").replace(/INTEGER NOT NULL DEFAULT 0(?!\d)/g, "INTEGER NOT NULL DEFAULT 0");
+}
+function sqliteToMySQL(sql) {
+  return sql.replace(/TEXT PRIMARY KEY/g, "VARCHAR(255) PRIMARY KEY").replace(/TEXT NOT NULL UNIQUE/g, "VARCHAR(255) NOT NULL UNIQUE").replace(/TEXT NOT NULL DEFAULT/g, "VARCHAR(255) NOT NULL DEFAULT").replace(/BLOB/g, "LONGBLOB").replace(/datetime\('now'\)/g, "NOW()").replace(/INTEGER NOT NULL DEFAULT 1/g, "TINYINT(1) NOT NULL DEFAULT 1").replace(/ON CONFLICT\(.*?\) DO UPDATE SET/g, "ON DUPLICATE KEY UPDATE");
+}
+
+// src/engine/db-adapter.ts
+var EngineDatabase = class {
+  db;
+  dialect;
+  /** Raw driver handle for NoSQL migrations (MongoClient db, DynamoDB client, etc.) */
+  rawDriver;
+  constructor(db, dialect = "sqlite", rawDriver) {
+    this.db = db;
+    this.dialect = dialect;
+    this.rawDriver = rawDriver;
+  }
+  // ─── Migration System ─────────────────────────────────
+  /**
+   * Run all pending migrations in order.
+   * Creates the migration tracking table first, then applies any unapplied migrations.
+   */
+  async migrate() {
+    const trackingDDL = this.dialect === "postgres" ? MIGRATIONS_TABLE_POSTGRES : MIGRATIONS_TABLE;
+    for (const stmt of this.splitStatements(trackingDDL)) {
+      await this.db.run(stmt);
+    }
+    const applied = await this.db.all("SELECT version FROM engine_migrations ORDER BY version");
+    const appliedSet = new Set(applied.map((r) => r.version));
+    let count = 0;
+    for (const migration of MIGRATIONS) {
+      if (appliedSet.has(migration.version)) continue;
+      if ((this.dialect === "mongodb" || this.dialect === "dynamodb") && migration.nosql) {
+        await migration.nosql(this.rawDriver, this.dialect);
+      } else {
+        const sql = this.getSqlForDialect(migration);
+        if (sql) {
+          for (const stmt of this.splitStatements(sql)) {
+            try {
+              await this.db.run(stmt);
+            } catch (e) {
+              if (e?.message?.includes("duplicate column")) continue;
+              throw e;
+            }
+          }
+        }
+      }
+      await this.db.run(
+        "INSERT INTO engine_migrations (version, name) VALUES (?, ?)",
+        [migration.version, migration.name]
+      );
+      count++;
+    }
+    return { applied: count, total: MIGRATIONS.length };
+  }
+  /**
+   * Register and create a dynamic table at runtime.
+   * Used by plugins, skills, or engine extensions that need their own storage.
+   * Table name is auto-prefixed with `ext_` to avoid collisions with core tables.
+   */
+  async createDynamicTable(def) {
+    const prefixedName = def.name.startsWith("ext_") ? def.name : `ext_${def.name}`;
+    if (this.dialect === "mongodb" && def.mongoSetup) {
+      await def.mongoSetup(this.rawDriver);
+      return;
+    }
+    if (this.dialect === "dynamodb" && def.dynamoSetup) {
+      await def.dynamoSetup(this.rawDriver);
+      return;
+    }
+    let ddl;
+    if (this.dialect === "postgres" && def.postgres) {
+      ddl = def.postgres;
+    } else if (this.dialect === "mysql" && def.mysql) {
+      ddl = def.mysql;
+    } else if (this.dialect === "postgres") {
+      ddl = sqliteToPostgres(def.sql);
+    } else if (this.dialect === "mysql") {
+      ddl = sqliteToMySQL(def.sql);
+    } else {
+      ddl = def.sql;
+    }
+    ddl = ddl.replace(new RegExp(`\\b${def.name}\\b`, "g"), prefixedName);
+    for (const stmt of this.splitStatements(ddl)) {
+      await this.db.run(stmt);
+    }
+    if (def.indexes) {
+      for (const idx of def.indexes) {
+        const prefixedIdx = idx.replace(new RegExp(`\\b${def.name}\\b`, "g"), prefixedName);
+        await this.db.run(prefixedIdx);
+      }
+    }
+  }
+  /**
+   * Run arbitrary SQL — for custom queries on dynamic tables.
+   * Returns rows for SELECT, void for mutations.
+   */
+  async query(sql, params) {
+    return this.db.all(sql, params);
+  }
+  async execute(sql, params) {
+    return this.db.run(sql, params);
+  }
+  /**
+   * List all dynamic (ext_*) tables currently in the database.
+   */
+  async listDynamicTables() {
+    if (this.dialect === "postgres") {
+      const rows = await this.db.all(
+        "SELECT tablename FROM pg_tables WHERE schemaname = 'public' AND tablename LIKE 'ext_%'"
+      );
+      return rows.map((r) => r.tablename);
+    } else if (this.dialect === "mysql") {
+      const rows = await this.db.all(
+        "SELECT table_name FROM information_schema.tables WHERE table_schema = DATABASE() AND table_name LIKE 'ext_%'"
+      );
+      return rows.map((r) => r.table_name);
+    } else {
+      const rows = await this.db.all(
+        "SELECT name FROM sqlite_master WHERE type='table' AND name LIKE 'ext_%'"
+      );
+      return rows.map((r) => r.name);
+    }
+  }
+  // ─── Helpers ────────────────────────────────────────
+  splitStatements(sql) {
+    return sql.split(";").map((s) => s.trim()).filter((s) => s.length > 0);
+  }
+  getSqlForDialect(migration) {
+    if (this.dialect === "postgres" && migration.postgres) return migration.postgres;
+    if (this.dialect === "mysql" && migration.mysql) return migration.mysql;
+    if (this.dialect === "postgres" && migration.sql) return sqliteToPostgres(migration.sql);
+    if (this.dialect === "mysql" && migration.sql) return sqliteToMySQL(migration.sql);
+    return migration.sql;
+  }
+  // ─── Managed Agents ─────────────────────────────────
+  async upsertManagedAgent(agent) {
+    await this.db.run(`
+      INSERT INTO managed_agents (id, org_id, name, display_name, state, config, health, usage, permission_profile_id, version, last_deployed_at, last_health_check_at, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        state = excluded.state,
+        config = excluded.config,
+        health = excluded.health,
+        usage = excluded.usage,
+        permission_profile_id = excluded.permission_profile_id,
+        version = excluded.version,
+        last_deployed_at = excluded.last_deployed_at,
+        last_health_check_at = excluded.last_health_check_at,
+        updated_at = excluded.updated_at
+    `, [
+      agent.id,
+      agent.orgId,
+      agent.config.name,
+      agent.config.displayName,
+      agent.state,
+      JSON.stringify(agent.config),
+      JSON.stringify(agent.health),
+      JSON.stringify(agent.usage),
+      agent.config.permissionProfileId,
+      agent.version,
+      agent.lastDeployedAt || null,
+      agent.lastHealthCheckAt || null,
+      agent.createdAt,
+      agent.updatedAt
+    ]);
+  }
+  async getManagedAgent(id) {
+    const row = await this.db.get("SELECT * FROM managed_agents WHERE id = ?", [id]);
+    return row ? this.rowToManagedAgent(row) : null;
+  }
+  async getManagedAgentsByOrg(orgId) {
+    const rows = await this.db.all("SELECT * FROM managed_agents WHERE org_id = ? ORDER BY created_at DESC", [orgId]);
+    return rows.map((r) => this.rowToManagedAgent(r));
+  }
+  async getManagedAgentsByState(state) {
+    const rows = await this.db.all("SELECT * FROM managed_agents WHERE state = ?", [state]);
+    return rows.map((r) => this.rowToManagedAgent(r));
+  }
+  async getAllManagedAgents() {
+    const rows = await this.db.all("SELECT * FROM managed_agents ORDER BY created_at DESC");
+    return rows.map((r) => this.rowToManagedAgent(r));
+  }
+  async deleteManagedAgent(id) {
+    await this.db.run("DELETE FROM managed_agents WHERE id = ?", [id]);
+  }
+  async countManagedAgents(orgId, state) {
+    const sql = state ? "SELECT COUNT(*) as count FROM managed_agents WHERE org_id = ? AND state = ?" : "SELECT COUNT(*) as count FROM managed_agents WHERE org_id = ?";
+    const row = await this.db.get(sql, state ? [orgId, state] : [orgId]);
+    return row?.count || 0;
+  }
+  // ─── State History ──────────────────────────────────
+  async addStateTransition(agentId, transition) {
+    await this.db.run(`
+      INSERT INTO agent_state_history (id, agent_id, from_state, to_state, reason, triggered_by, error, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    `, [
+      crypto.randomUUID(),
+      agentId,
+      transition.from,
+      transition.to,
+      transition.reason,
+      transition.triggeredBy,
+      transition.error || null,
+      transition.timestamp
+    ]);
+  }
+  async getStateHistory(agentId, limit = 50) {
+    const rows = await this.db.all(
+      "SELECT * FROM agent_state_history WHERE agent_id = ? ORDER BY created_at DESC LIMIT ?",
+      [agentId, limit]
+    );
+    return rows.map((r) => ({
+      from: r.from_state,
+      to: r.to_state,
+      reason: r.reason,
+      triggeredBy: r.triggered_by,
+      timestamp: r.created_at,
+      error: r.error
+    }));
+  }
+  // ─── Permission Profiles ────────────────────────────
+  async upsertPermissionProfile(orgId, profile) {
+    await this.db.run(`
+      INSERT INTO permission_profiles (id, org_id, name, description, config, is_preset, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, 0, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        name = excluded.name, description = excluded.description,
+        config = excluded.config, updated_at = excluded.updated_at
+    `, [
+      profile.id,
+      orgId,
+      profile.name,
+      profile.description || null,
+      JSON.stringify(profile),
+      profile.createdAt,
+      profile.updatedAt
+    ]);
+  }
+  async getPermissionProfile(id) {
+    const row = await this.db.get("SELECT * FROM permission_profiles WHERE id = ?", [id]);
+    return row ? JSON.parse(row.config) : null;
+  }
+  async getPermissionProfilesByOrg(orgId) {
+    const rows = await this.db.all("SELECT config FROM permission_profiles WHERE org_id = ? ORDER BY name", [orgId]);
+    return rows.map((r) => JSON.parse(r.config));
+  }
+  async deletePermissionProfile(id) {
+    await this.db.run("DELETE FROM permission_profiles WHERE id = ?", [id]);
+  }
+  // ─── Organizations ──────────────────────────────────
+  async upsertOrganization(org) {
+    await this.db.run(`
+      INSERT INTO organizations (id, name, slug, plan, limits, usage, settings, sso_config, allowed_domains, billing, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        name = excluded.name, slug = excluded.slug, plan = excluded.plan,
+        limits = excluded.limits, usage = excluded.usage, settings = excluded.settings,
+        sso_config = excluded.sso_config, allowed_domains = excluded.allowed_domains,
+        billing = excluded.billing, updated_at = excluded.updated_at
+    `, [
+      org.id,
+      org.name,
+      org.slug,
+      org.plan,
+      JSON.stringify(org.limits),
+      JSON.stringify(org.usage),
+      JSON.stringify(org.settings),
+      org.ssoConfig ? JSON.stringify(org.ssoConfig) : null,
+      JSON.stringify(org.allowedDomains),
+      org.billing ? JSON.stringify(org.billing) : null,
+      org.createdAt,
+      org.updatedAt
+    ]);
+  }
+  async getOrganization(id) {
+    const row = await this.db.get("SELECT * FROM organizations WHERE id = ?", [id]);
+    return row ? this.rowToOrg(row) : null;
+  }
+  async getOrganizationBySlug(slug) {
+    const row = await this.db.get("SELECT * FROM organizations WHERE slug = ?", [slug]);
+    return row ? this.rowToOrg(row) : null;
+  }
+  async listOrganizations() {
+    const rows = await this.db.all("SELECT * FROM organizations ORDER BY created_at DESC");
+    return rows.map((r) => this.rowToOrg(r));
+  }
+  async deleteOrganization(id) {
+    await this.db.run("DELETE FROM organizations WHERE id = ?", [id]);
+  }
+  // ─── Knowledge Bases ────────────────────────────────
+  async upsertKnowledgeBase(kb) {
+    await this.db.run(`
+      INSERT INTO knowledge_bases (id, org_id, name, description, agent_ids, config, stats, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        name = excluded.name, description = excluded.description,
+        agent_ids = excluded.agent_ids, config = excluded.config,
+        stats = excluded.stats, updated_at = excluded.updated_at
+    `, [
+      kb.id,
+      kb.orgId,
+      kb.name,
+      kb.description || null,
+      JSON.stringify(kb.agentIds),
+      JSON.stringify(kb.config),
+      JSON.stringify(kb.stats),
+      kb.createdAt,
+      kb.updatedAt
+    ]);
+  }
+  async getKnowledgeBase(id) {
+    const row = await this.db.get("SELECT * FROM knowledge_bases WHERE id = ?", [id]);
+    if (!row) return null;
+    const kb = {
+      id: row.id,
+      orgId: row.org_id,
+      name: row.name,
+      description: row.description,
+      agentIds: JSON.parse(row.agent_ids),
+      config: JSON.parse(row.config),
+      stats: JSON.parse(row.stats),
+      createdAt: row.created_at,
+      updatedAt: row.updated_at,
+      documents: []
+    };
+    kb.documents = await this.getKBDocuments(id);
+    return kb;
+  }
+  async getKnowledgeBasesByOrg(orgId) {
+    const rows = await this.db.all("SELECT * FROM knowledge_bases WHERE org_id = ? ORDER BY name", [orgId]);
+    return rows.map((r) => ({
+      id: r.id,
+      orgId: r.org_id,
+      name: r.name,
+      description: r.description,
+      agentIds: JSON.parse(r.agent_ids),
+      config: JSON.parse(r.config),
+      stats: JSON.parse(r.stats),
+      createdAt: r.created_at,
+      updatedAt: r.updated_at,
+      documents: []
+      // Loaded on demand
+    }));
+  }
+  async deleteKnowledgeBase(id) {
+    await this.db.run("DELETE FROM knowledge_bases WHERE id = ?", [id]);
+  }
+  // ─── KB Documents & Chunks ──────────────────────────
+  async insertKBDocument(doc) {
+    await this.db.run(`
+      INSERT INTO kb_documents (id, knowledge_base_id, name, source_type, source_url, mime_type, size, metadata, status, error, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `, [
+      doc.id,
+      doc.knowledgeBaseId,
+      doc.name,
+      doc.sourceType,
+      doc.sourceUrl || null,
+      doc.mimeType,
+      doc.size,
+      JSON.stringify(doc.metadata),
+      doc.status,
+      doc.error || null,
+      doc.createdAt,
+      doc.updatedAt
+    ]);
+    for (const chunk of doc.chunks) {
+      await this.db.run(`
+        INSERT INTO kb_chunks (id, document_id, content, token_count, position, embedding, metadata)
+        VALUES (?, ?, ?, ?, ?, ?, ?)
+      `, [
+        chunk.id,
+        doc.id,
+        chunk.content,
+        chunk.tokenCount,
+        chunk.position,
+        chunk.embedding ? Buffer.from(new Float32Array(chunk.embedding).buffer) : null,
+        JSON.stringify(chunk.metadata)
+      ]);
+    }
+  }
+  async getKBDocuments(kbId) {
+    const docs = await this.db.all("SELECT * FROM kb_documents WHERE knowledge_base_id = ?", [kbId]);
+    const result = [];
+    for (const d of docs) {
+      const chunks = await this.db.all("SELECT * FROM kb_chunks WHERE document_id = ? ORDER BY position", [d.id]);
+      result.push({
+        id: d.id,
+        knowledgeBaseId: d.knowledge_base_id,
+        name: d.name,
+        sourceType: d.source_type,
+        sourceUrl: d.source_url,
+        mimeType: d.mime_type,
+        size: d.size,
+        metadata: JSON.parse(d.metadata),
+        status: d.status,
+        error: d.error,
+        createdAt: d.created_at,
+        updatedAt: d.updated_at,
+        chunks: chunks.map((c) => ({
+          id: c.id,
+          documentId: c.document_id,
+          content: c.content,
+          tokenCount: c.token_count,
+          position: c.position,
+          embedding: c.embedding ? Array.from(new Float32Array(c.embedding)) : void 0,
+          metadata: JSON.parse(c.metadata)
+        }))
+      });
+    }
+    return result;
+  }
+  async deleteKBDocument(docId) {
+    await this.db.run("DELETE FROM kb_documents WHERE id = ?", [docId]);
+  }
+  // ─── Tool Calls (Activity) ──────────────────────────
+  async insertToolCall(record) {
+    await this.db.run(`
+      INSERT INTO tool_calls (id, agent_id, org_id, session_id, tool_id, tool_name, parameters, result, timing, cost, permission, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `, [
+      record.id,
+      record.agentId,
+      record.orgId,
+      record.sessionId || null,
+      record.toolId,
+      record.toolName,
+      JSON.stringify(record.parameters),
+      record.result ? JSON.stringify(record.result) : null,
+      JSON.stringify(record.timing),
+      record.cost ? JSON.stringify(record.cost) : null,
+      JSON.stringify(record.permission),
+      record.timing.startedAt
+    ]);
+  }
+  async updateToolCallResult(id, result, timing, cost) {
+    await this.db.run(
+      "UPDATE tool_calls SET result = ?, timing = ?, cost = ? WHERE id = ?",
+      [JSON.stringify(result), JSON.stringify(timing), cost ? JSON.stringify(cost) : null, id]
+    );
+  }
+  async getToolCalls(opts) {
+    const conditions = [];
+    const params = [];
+    if (opts.agentId) {
+      conditions.push("agent_id = ?");
+      params.push(opts.agentId);
+    }
+    if (opts.orgId) {
+      conditions.push("org_id = ?");
+      params.push(opts.orgId);
+    }
+    if (opts.toolId) {
+      conditions.push("tool_id = ?");
+      params.push(opts.toolId);
+    }
+    if (opts.since) {
+      conditions.push("created_at >= ?");
+      params.push(opts.since);
+    }
+    const where = conditions.length > 0 ? "WHERE " + conditions.join(" AND ") : "";
+    params.push(opts.limit || 50);
+    const rows = await this.db.all(`SELECT * FROM tool_calls ${where} ORDER BY created_at DESC LIMIT ?`, params);
+    return rows.map((r) => ({
+      id: r.id,
+      agentId: r.agent_id,
+      orgId: r.org_id,
+      sessionId: r.session_id,
+      toolId: r.tool_id,
+      toolName: r.tool_name,
+      parameters: JSON.parse(r.parameters || "{}"),
+      result: r.result ? JSON.parse(r.result) : void 0,
+      timing: JSON.parse(r.timing),
+      cost: r.cost ? JSON.parse(r.cost) : void 0,
+      permission: JSON.parse(r.permission)
+    }));
+  }
+  // ─── Activity Events ────────────────────────────────
+  async insertActivityEvent(event) {
+    await this.db.run(`
+      INSERT INTO activity_events (id, agent_id, org_id, session_id, type, data, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+    `, [event.id, event.agentId, event.orgId, event.sessionId || null, event.type, JSON.stringify(event.data), event.timestamp]);
+  }
+  async getActivityEvents(opts) {
+    const conditions = [];
+    const params = [];
+    if (opts.agentId) {
+      conditions.push("agent_id = ?");
+      params.push(opts.agentId);
+    }
+    if (opts.orgId) {
+      conditions.push("org_id = ?");
+      params.push(opts.orgId);
+    }
+    if (opts.types?.length) {
+      conditions.push(`type IN (${opts.types.map(() => "?").join(",")})`);
+      params.push(...opts.types);
+    }
+    if (opts.since) {
+      conditions.push("created_at >= ?");
+      params.push(opts.since);
+    }
+    const where = conditions.length > 0 ? "WHERE " + conditions.join(" AND ") : "";
+    params.push(opts.limit || 50);
+    const rows = await this.db.all(`SELECT * FROM activity_events ${where} ORDER BY created_at DESC LIMIT ?`, params);
+    return rows.map((r) => ({
+      id: r.id,
+      agentId: r.agent_id,
+      orgId: r.org_id,
+      sessionId: r.session_id,
+      type: r.type,
+      data: JSON.parse(r.data),
+      timestamp: r.created_at
+    }));
+  }
+  // ─── Conversations ──────────────────────────────────
+  async insertConversation(entry) {
+    await this.db.run(`
+      INSERT INTO conversations (id, agent_id, session_id, role, content, channel, token_count, tool_calls, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `, [
+      entry.id,
+      entry.agentId,
+      entry.sessionId,
+      entry.role,
+      entry.content,
+      entry.channel || null,
+      entry.tokenCount,
+      entry.toolCalls ? JSON.stringify(entry.toolCalls) : null,
+      entry.timestamp
+    ]);
+  }
+  async getConversation(sessionId, limit = 50) {
+    const rows = await this.db.all(
+      "SELECT * FROM conversations WHERE session_id = ? ORDER BY created_at ASC LIMIT ?",
+      [sessionId, limit]
+    );
+    return rows.map((r) => ({
+      id: r.id,
+      agentId: r.agent_id,
+      sessionId: r.session_id,
+      role: r.role,
+      content: r.content,
+      channel: r.channel,
+      tokenCount: r.token_count,
+      toolCalls: r.tool_calls ? JSON.parse(r.tool_calls) : void 0,
+      timestamp: r.created_at
+    }));
+  }
+  // ─── Approval Requests ──────────────────────────────
+  async insertApprovalRequest(req, orgId) {
+    await this.db.run(`
+      INSERT INTO approval_requests (id, agent_id, agent_name, org_id, tool_id, tool_name, reason, risk_level, side_effects, parameters, context, status, decision, expires_at, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `, [
+      req.id,
+      req.agentId,
+      req.agentName,
+      orgId,
+      req.toolId,
+      req.toolName,
+      req.reason,
+      req.riskLevel,
+      JSON.stringify(req.sideEffects),
+      req.parameters ? JSON.stringify(req.parameters) : null,
+      req.context || null,
+      req.status,
+      req.decision ? JSON.stringify(req.decision) : null,
+      req.expiresAt,
+      req.createdAt
+    ]);
+  }
+  async updateApprovalRequest(id, status, decision) {
+    await this.db.run(
+      "UPDATE approval_requests SET status = ?, decision = ? WHERE id = ?",
+      [status, decision ? JSON.stringify(decision) : null, id]
+    );
+  }
+  async getApprovalRequests(opts) {
+    const conditions = [];
+    const params = [];
+    if (opts.orgId) {
+      conditions.push("org_id = ?");
+      params.push(opts.orgId);
+    }
+    if (opts.status) {
+      conditions.push("status = ?");
+      params.push(opts.status);
+    }
+    if (opts.agentId) {
+      conditions.push("agent_id = ?");
+      params.push(opts.agentId);
+    }
+    const where = conditions.length > 0 ? "WHERE " + conditions.join(" AND ") : "";
+    params.push(opts.limit || 50);
+    const rows = await this.db.all(`SELECT * FROM approval_requests ${where} ORDER BY created_at DESC LIMIT ?`, params);
+    return rows.map((r) => ({
+      id: r.id,
+      agentId: r.agent_id,
+      agentName: r.agent_name,
+      toolId: r.tool_id,
+      toolName: r.tool_name,
+      reason: r.reason,
+      riskLevel: r.risk_level,
+      sideEffects: JSON.parse(r.side_effects),
+      parameters: r.parameters ? JSON.parse(r.parameters) : void 0,
+      context: r.context,
+      status: r.status,
+      decision: r.decision ? JSON.parse(r.decision) : void 0,
+      createdAt: r.created_at,
+      expiresAt: r.expires_at
+    }));
+  }
+  // ─── Approval Policies ──────────────────────────────
+  async upsertApprovalPolicy(orgId, policy) {
+    await this.db.run(`
+      INSERT INTO approval_policies (id, org_id, name, description, triggers, approvers, timeout, notify, enabled, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        name = excluded.name, description = excluded.description,
+        triggers = excluded.triggers, approvers = excluded.approvers,
+        timeout = excluded.timeout, notify = excluded.notify,
+        enabled = excluded.enabled, updated_at = excluded.updated_at
+    `, [
+      policy.id,
+      orgId,
+      policy.name,
+      policy.description || null,
+      JSON.stringify(policy.triggers),
+      JSON.stringify(policy.approvers),
+      JSON.stringify(policy.timeout),
+      JSON.stringify(policy.notify),
+      policy.enabled ? 1 : 0,
+      (/* @__PURE__ */ new Date()).toISOString(),
+      (/* @__PURE__ */ new Date()).toISOString()
+    ]);
+  }
+  async getApprovalPolicies(orgId) {
+    const rows = await this.db.all("SELECT * FROM approval_policies WHERE org_id = ? ORDER BY name", [orgId]);
+    return rows.map((r) => ({
+      id: r.id,
+      name: r.name,
+      description: r.description,
+      triggers: JSON.parse(r.triggers),
+      approvers: JSON.parse(r.approvers),
+      timeout: JSON.parse(r.timeout),
+      notify: JSON.parse(r.notify),
+      enabled: !!r.enabled
+    }));
+  }
+  async getAllApprovalPolicies() {
+    const rows = await this.db.all("SELECT * FROM approval_policies WHERE enabled = 1 ORDER BY name");
+    return rows.map((r) => ({
+      id: r.id,
+      name: r.name,
+      description: r.description,
+      triggers: JSON.parse(r.triggers),
+      approvers: JSON.parse(r.approvers),
+      timeout: JSON.parse(r.timeout),
+      notify: JSON.parse(r.notify),
+      enabled: !!r.enabled
+    }));
+  }
+  async deleteApprovalPolicy(id) {
+    await this.db.run("DELETE FROM approval_policies WHERE id = ?", [id]);
+  }
+  // ─── SSO Integrations ─────────────────────────────
+  async upsertSsoIntegration(integration) {
+    await this.db.run(`
+      INSERT INTO sso_integrations (id, org_id, provider_type, name, enabled, config, metadata_url, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        name = excluded.name, enabled = excluded.enabled,
+        config = excluded.config, metadata_url = excluded.metadata_url,
+        updated_at = excluded.updated_at
+    `, [
+      integration.id,
+      integration.orgId,
+      integration.providerType,
+      integration.name,
+      integration.enabled ? 1 : 0,
+      JSON.stringify(integration.config),
+      integration.metadataUrl || null,
+      (/* @__PURE__ */ new Date()).toISOString(),
+      (/* @__PURE__ */ new Date()).toISOString()
+    ]);
+  }
+  async getSsoIntegration(id) {
+    const row = await this.db.get("SELECT * FROM sso_integrations WHERE id = ?", [id]);
+    return row ? this.rowToSso(row) : null;
+  }
+  async getSsoIntegrationsByOrg(orgId) {
+    const rows = await this.db.all("SELECT * FROM sso_integrations WHERE org_id = ? ORDER BY name", [orgId]);
+    return rows.map((r) => this.rowToSso(r));
+  }
+  async getSsoIntegrationByType(orgId, providerType) {
+    const row = await this.db.get("SELECT * FROM sso_integrations WHERE org_id = ? AND provider_type = ? AND enabled = 1", [orgId, providerType]);
+    return row ? this.rowToSso(row) : null;
+  }
+  async deleteSsoIntegration(id) {
+    await this.db.run("DELETE FROM sso_integrations WHERE id = ?", [id]);
+  }
+  rowToSso(row) {
+    return {
+      id: row.id,
+      orgId: row.org_id,
+      providerType: row.provider_type,
+      name: row.name,
+      enabled: !!row.enabled,
+      config: JSON.parse(row.config),
+      metadataUrl: row.metadata_url,
+      createdAt: row.created_at,
+      updatedAt: row.updated_at
+    };
+  }
+  // ─── OIDC State Tracking ─────────────────────────
+  async saveOidcState(state, providerId, opts) {
+    const expiresAt = new Date(Date.now() + (opts.ttlSeconds || 600) * 1e3).toISOString();
+    await this.db.run(`
+      INSERT INTO oidc_states (state, provider_id, redirect_uri, nonce, code_verifier, created_at, expires_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+    `, [state, providerId, opts.redirectUri || null, opts.nonce || null, opts.codeVerifier || null, (/* @__PURE__ */ new Date()).toISOString(), expiresAt]);
+  }
+  async getOidcState(state) {
+    const row = await this.db.get("SELECT * FROM oidc_states WHERE state = ?", [state]);
+    if (!row) return null;
+    if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) {
+      await this.db.run("DELETE FROM oidc_states WHERE state = ?", [state]);
+      return null;
+    }
+    return {
+      state: row.state,
+      providerId: row.provider_id,
+      redirectUri: row.redirect_uri,
+      nonce: row.nonce,
+      codeVerifier: row.code_verifier,
+      expiresAt: row.expires_at
+    };
+  }
+  async deleteOidcState(state) {
+    await this.db.run("DELETE FROM oidc_states WHERE state = ?", [state]);
+  }
+  async cleanupExpiredOidcStates() {
+    await this.db.run("DELETE FROM oidc_states WHERE expires_at < ?", [(/* @__PURE__ */ new Date()).toISOString()]);
+  }
+  // ─── Deploy Credentials ─────────────────────────
+  async upsertDeployCredential(cred) {
+    await this.db.run(`
+      INSERT INTO deploy_credentials (id, org_id, name, target_type, config, created_by, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        name = excluded.name, target_type = excluded.target_type,
+        config = excluded.config, updated_at = excluded.updated_at
+    `, [
+      cred.id,
+      cred.orgId,
+      cred.name,
+      cred.targetType,
+      JSON.stringify(cred.config),
+      cred.createdBy,
+      (/* @__PURE__ */ new Date()).toISOString(),
+      (/* @__PURE__ */ new Date()).toISOString()
+    ]);
+  }
+  async getDeployCredential(id) {
+    const row = await this.db.get("SELECT * FROM deploy_credentials WHERE id = ?", [id]);
+    return row ? this.rowToDeployCred(row) : null;
+  }
+  async getDeployCredentialsByOrg(orgId) {
+    const rows = await this.db.all("SELECT * FROM deploy_credentials WHERE org_id = ? ORDER BY name", [orgId]);
+    return rows.map((r) => this.rowToDeployCred(r));
+  }
+  async getDeployCredentialsByType(orgId, targetType) {
+    const rows = await this.db.all("SELECT * FROM deploy_credentials WHERE org_id = ? AND target_type = ?", [orgId, targetType]);
+    return rows.map((r) => this.rowToDeployCred(r));
+  }
+  async deleteDeployCredential(id) {
+    await this.db.run("DELETE FROM deploy_credentials WHERE id = ?", [id]);
+  }
+  rowToDeployCred(row) {
+    return {
+      id: row.id,
+      orgId: row.org_id,
+      name: row.name,
+      targetType: row.target_type,
+      config: JSON.parse(row.config),
+      createdBy: row.created_by,
+      createdAt: row.created_at,
+      updatedAt: row.updated_at
+    };
+  }
+  // ─── Aggregate Stats ───────────────────────────────
+  async getEngineStats(orgId) {
+    const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
+    const [agents, running, toolCalls, activity, approvals, kbs] = await Promise.all([
+      this.db.get("SELECT COUNT(*) as c FROM managed_agents WHERE org_id = ?", [orgId]),
+      this.db.get("SELECT COUNT(*) as c FROM managed_agents WHERE org_id = ? AND state = ?", [orgId, "running"]),
+      this.db.get("SELECT COUNT(*) as c FROM tool_calls WHERE org_id = ? AND created_at >= ?", [orgId, today]),
+      this.db.get("SELECT COUNT(*) as c FROM activity_events WHERE org_id = ? AND created_at >= ?", [orgId, today]),
+      this.db.get("SELECT COUNT(*) as c FROM approval_requests WHERE org_id = ? AND status = ?", [orgId, "pending"]),
+      this.db.get("SELECT COUNT(*) as c FROM knowledge_bases WHERE org_id = ?", [orgId])
+    ]);
+    return {
+      totalManagedAgents: agents?.c || 0,
+      runningAgents: running?.c || 0,
+      totalToolCallsToday: toolCalls?.c || 0,
+      totalActivityToday: activity?.c || 0,
+      pendingApprovals: approvals?.c || 0,
+      totalKnowledgeBases: kbs?.c || 0
+    };
+  }
+  /**
+   * Cleanup old data based on retention
+   */
+  async cleanup(retainDays) {
+    const cutoff = new Date(Date.now() - retainDays * 864e5).toISOString();
+    const tc = await this.db.get("SELECT COUNT(*) as c FROM tool_calls WHERE created_at < ?", [cutoff]);
+    const ev = await this.db.get("SELECT COUNT(*) as c FROM activity_events WHERE created_at < ?", [cutoff]);
+    const cv = await this.db.get("SELECT COUNT(*) as c FROM conversations WHERE created_at < ?", [cutoff]);
+    await this.db.run("DELETE FROM tool_calls WHERE created_at < ?", [cutoff]);
+    await this.db.run("DELETE FROM activity_events WHERE created_at < ?", [cutoff]);
+    await this.db.run("DELETE FROM conversations WHERE created_at < ?", [cutoff]);
+    return {
+      toolCalls: tc?.c || 0,
+      events: ev?.c || 0,
+      conversations: cv?.c || 0
+    };
+  }
+  // ─── Community Skill Index ──────────────────────────
+  async upsertCommunitySkill(skill) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    await this.db.run(`
+      INSERT INTO community_skill_index (id, name, description, version, author, repository, license, category, risk, icon, tags, tools, config_schema, min_engine_version, homepage, downloads, rating, rating_count, verified, featured, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        name = excluded.name, description = excluded.description, version = excluded.version,
+        author = excluded.author, repository = excluded.repository, license = excluded.license,
+        category = excluded.category, risk = excluded.risk, icon = excluded.icon,
+        tags = excluded.tags, tools = excluded.tools, config_schema = excluded.config_schema,
+        min_engine_version = excluded.min_engine_version, homepage = excluded.homepage,
+        downloads = excluded.downloads, rating = excluded.rating, rating_count = excluded.rating_count,
+        verified = excluded.verified, featured = excluded.featured,
+        updated_at = excluded.updated_at
+    `, [
+      skill.id,
+      skill.name,
+      skill.description,
+      skill.version,
+      skill.author,
+      skill.repository,
+      skill.license,
+      skill.category || null,
+      skill.risk || "medium",
+      skill.icon || null,
+      JSON.stringify(skill.tags || []),
+      JSON.stringify(skill.tools || []),
+      JSON.stringify(skill.configSchema || {}),
+      skill.minEngineVersion || null,
+      skill.homepage || null,
+      skill.downloads || 0,
+      skill.rating || 0,
+      skill.ratingCount || 0,
+      skill.verified ? 1 : 0,
+      skill.featured ? 1 : 0,
+      now,
+      now
+    ]);
+  }
+  async getCommunitySkill(id) {
+    const row = await this.db.get("SELECT * FROM community_skill_index WHERE id = ?", [id]);
+    return row ? this.rowToCommunitySkill(row) : null;
+  }
+  async getAllCommunitySkills(opts) {
+    const conditions = [];
+    const params = [];
+    if (opts?.category) {
+      conditions.push("category = ?");
+      params.push(opts.category);
+    }
+    if (opts?.risk) {
+      conditions.push("risk = ?");
+      params.push(opts.risk);
+    }
+    if (opts?.author) {
+      conditions.push("author = ?");
+      params.push(opts.author);
+    }
+    if (opts?.verified !== void 0) {
+      conditions.push("verified = ?");
+      params.push(opts.verified ? 1 : 0);
+    }
+    if (opts?.featured !== void 0) {
+      conditions.push("featured = ?");
+      params.push(opts.featured ? 1 : 0);
+    }
+    if (opts?.tag) {
+      conditions.push("tags LIKE ?");
+      params.push(`%"${opts.tag}"%`);
+    }
+    if (opts?.search) {
+      conditions.push("(name LIKE ? OR description LIKE ? OR author LIKE ?)");
+      const q = `%${opts.search}%`;
+      params.push(q, q, q);
+    }
+    const where = conditions.length > 0 ? "WHERE " + conditions.join(" AND ") : "";
+    const sortCol = opts?.sortBy === "popular" ? "downloads" : opts?.sortBy === "rating" ? "rating" : opts?.sortBy === "name" ? "name" : "created_at";
+    const sortOrder = opts?.order === "asc" ? "ASC" : "DESC";
+    const limit = opts?.limit || 50;
+    const offset = opts?.offset || 0;
+    const countRow = await this.db.get(`SELECT COUNT(*) as c FROM community_skill_index ${where}`, params);
+    const rows = await this.db.all(
+      `SELECT * FROM community_skill_index ${where} ORDER BY ${sortCol} ${sortOrder} LIMIT ? OFFSET ?`,
+      [...params, limit, offset]
+    );
+    return { skills: rows.map((r) => this.rowToCommunitySkill(r)), total: countRow?.c || 0 };
+  }
+  async deleteCommunitySkill(id) {
+    await this.db.run("DELETE FROM community_skill_index WHERE id = ?", [id]);
+  }
+  async incrementDownloads(skillId) {
+    await this.db.run("UPDATE community_skill_index SET downloads = downloads + 1 WHERE id = ?", [skillId]);
+  }
+  // ─── Community Skill Installed ──────────────────────
+  async upsertInstalledSkill(install) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    await this.db.run(`
+      INSERT INTO community_skill_installed (id, org_id, skill_id, version, enabled, config, installed_by, installed_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        version = excluded.version, enabled = excluded.enabled,
+        config = excluded.config, updated_at = excluded.updated_at
+    `, [
+      install.id,
+      install.orgId,
+      install.skillId,
+      install.version,
+      install.enabled ? 1 : 0,
+      JSON.stringify(install.config),
+      install.installedBy,
+      now,
+      now
+    ]);
+  }
+  async getInstalledSkill(orgId, skillId) {
+    const row = await this.db.get(
+      "SELECT * FROM community_skill_installed WHERE org_id = ? AND skill_id = ?",
+      [orgId, skillId]
+    );
+    return row ? this.rowToInstalledSkill(row) : null;
+  }
+  async getInstalledSkillsByOrg(orgId) {
+    const rows = await this.db.all(
+      "SELECT * FROM community_skill_installed WHERE org_id = ? ORDER BY installed_at DESC",
+      [orgId]
+    );
+    return rows.map((r) => this.rowToInstalledSkill(r));
+  }
+  async deleteInstalledSkill(orgId, skillId) {
+    await this.db.run(
+      "DELETE FROM community_skill_installed WHERE org_id = ? AND skill_id = ?",
+      [orgId, skillId]
+    );
+  }
+  // ─── Community Skill Reviews ────────────────────────
+  async insertReview(review) {
+    const existing = await this.db.get(
+      "SELECT id FROM community_skill_reviews WHERE skill_id = ? AND user_id = ?",
+      [review.skillId, review.userId]
+    );
+    if (existing) {
+      await this.db.run(`
+        UPDATE community_skill_reviews SET rating = ?, review_text = ?, user_name = ?, created_at = ? WHERE id = ?
+      `, [review.rating, review.reviewText || null, review.userName || null, (/* @__PURE__ */ new Date()).toISOString(), existing.id]);
+    } else {
+      await this.db.run(`
+        INSERT INTO community_skill_reviews (id, skill_id, org_id, user_id, user_name, rating, review_text, created_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+      `, [
+        review.id,
+        review.skillId,
+        "global",
+        review.userId,
+        review.userName || null,
+        review.rating,
+        review.reviewText || null,
+        (/* @__PURE__ */ new Date()).toISOString()
+      ]);
+    }
+  }
+  async getReviews(skillId, limit = 50) {
+    const rows = await this.db.all(
+      "SELECT * FROM community_skill_reviews WHERE skill_id = ? ORDER BY created_at DESC LIMIT ?",
+      [skillId, limit]
+    );
+    return rows.map((r) => ({
+      id: r.id,
+      skillId: r.skill_id,
+      userId: r.user_id,
+      userName: r.user_name || void 0,
+      rating: r.rating,
+      reviewText: r.review_text,
+      createdAt: r.created_at
+    }));
+  }
+  async getAverageRating(skillId) {
+    const row = await this.db.get(
+      "SELECT AVG(rating) as avg, COUNT(*) as count FROM community_skill_reviews WHERE skill_id = ?",
+      [skillId]
+    );
+    return { avg: row?.avg || 0, count: row?.count || 0 };
+  }
+  // ─── Row Mappers ────────────────────────────────────
+  rowToCommunitySkill(row) {
+    return {
+      id: row.id,
+      name: row.name,
+      description: row.description,
+      version: row.version,
+      author: row.author,
+      repository: row.repository,
+      license: row.license,
+      category: row.category,
+      risk: row.risk,
+      icon: row.icon,
+      tags: JSON.parse(row.tags || "[]"),
+      tools: JSON.parse(row.tools || "[]"),
+      configSchema: JSON.parse(row.config_schema || "{}"),
+      minEngineVersion: row.min_engine_version,
+      homepage: row.homepage,
+      downloads: row.downloads,
+      rating: row.rating,
+      ratingCount: row.rating_count,
+      verified: !!row.verified,
+      featured: !!row.featured,
+      createdAt: row.created_at,
+      updatedAt: row.updated_at
+    };
+  }
+  rowToInstalledSkill(row) {
+    return {
+      id: row.id,
+      orgId: row.org_id,
+      skillId: row.skill_id,
+      version: row.version,
+      enabled: !!row.enabled,
+      config: JSON.parse(row.config || "{}"),
+      installedBy: row.installed_by,
+      installedAt: row.installed_at,
+      updatedAt: row.updated_at
+    };
+  }
+  rowToManagedAgent(row) {
+    return {
+      id: row.id,
+      orgId: row.org_id,
+      config: JSON.parse(row.config),
+      state: row.state,
+      stateHistory: [],
+      // Loaded separately via getStateHistory
+      health: JSON.parse(row.health || "{}"),
+      usage: JSON.parse(row.usage || "{}"),
+      createdAt: row.created_at,
+      updatedAt: row.updated_at,
+      lastDeployedAt: row.last_deployed_at,
+      lastHealthCheckAt: row.last_health_check_at,
+      version: row.version
+    };
+  }
+  rowToOrg(row) {
+    return {
+      id: row.id,
+      name: row.name,
+      slug: row.slug,
+      plan: row.plan,
+      limits: JSON.parse(row.limits || "{}"),
+      usage: JSON.parse(row.usage || "{}"),
+      settings: JSON.parse(row.settings || "{}"),
+      ssoConfig: row.sso_config ? JSON.parse(row.sso_config) : void 0,
+      allowedDomains: JSON.parse(row.allowed_domains || "[]"),
+      billing: row.billing ? JSON.parse(row.billing) : void 0,
+      createdAt: row.created_at,
+      updatedAt: row.updated_at
+    };
+  }
+};
+
+export {
+  ENGINE_TABLES,
+  ENGINE_TABLES_POSTGRES,
+  MIGRATIONS_TABLE,
+  MIGRATIONS_TABLE_POSTGRES,
+  MIGRATIONS,
+  sqliteToPostgres,
+  sqliteToMySQL,
+  EngineDatabase
+};