@agenticmail/enterprise 0.3.2 → 0.4.0

package/src/engine/routes.ts

@@ -1,21 +1,88 @@
 /**
- * Engine API Routes
+ * Engine API Routes — Orchestrator
  *
- * REST endpoints for the complete enterprise engine.
+ * Mounts domain-specific sub-routers on the engine Hono app.
  * Mounted at /api/engine/* on the enterprise server.
+ *
+ * Sub-apps handle domain-specific route groups:
+ *   - dlp-routes.ts           → /dlp/*
+ *   - guardrail-routes.ts     → /guardrails/*, /anomaly-rules/*
+ *   - journal-routes.ts       → /journal/*
+ *   - communication-routes.ts → /messages/*, /tasks/*
+ *   - compliance-routes.ts    → /compliance/*
+ *   - catalog-routes.ts       → /skills/*, /souls/*, /profiles/*, /permissions/*, /config/*
+ *   - agent-routes.ts         → /agents/*, /usage/*, /budget/*, /bridge/*
+ *   - knowledge-routes.ts     → /knowledge-bases/*
+ *   - org-approval-routes.ts  → /orgs/*, /approvals/*, /escalation-chains/*
+ *   - activity-routes.ts      → /activity/*, /stats/*
+ *   - deploy-schema-routes.ts → /deploy-credentials/*, /schema/*
+ *   - community-routes.ts    → /community/*
+ *   - workforce-routes.ts    → /workforce/*
+ *   - policy-routes.ts       → /policies/*
+ *   - memory-routes.ts       → /memory/*
+ *   - onboarding-routes.ts   → /onboarding/*
+ *   - vault-routes.ts        → /vault/*
+ *   - storage-routes.ts      → /storage/*
+ *   - policy-import-routes.ts→ /policies/import/*
  */
 
 import { Hono } from 'hono';
-import { PermissionEngine, BUILTIN_SKILLS, PRESET_PROFILES } from './skills.js';
-import { AgentConfigGenerator, type AgentConfig } from './agent-config.js';
+import type { AppEnv } from '../types/hono-env.js';
+import { PermissionEngine, BUILTIN_SKILLS, PRESET_PROFILES, SKILL_SUITES } from './skills.js';
+import { AgentConfigGenerator } from './agent-config.js';
 import { DeploymentEngine } from './deployer.js';
 import { ApprovalEngine } from './approvals.js';
 import { AgentLifecycleManager } from './lifecycle.js';
 import { KnowledgeBaseEngine } from './knowledge.js';
 import { TenantManager } from './tenant.js';
 import { ActivityTracker } from './activity.js';
-
-const engine = new Hono();
+import { DLPEngine } from './dlp.js';
+import { AgentCommunicationBus } from './communication.js';
+import { GuardrailEngine } from './guardrails.js';
+import { ActionJournal } from './journal.js';
+import { ComplianceReporter } from './compliance.js';
+import {
+  getSoulTemplates,
+  getSoulTemplatesByCategory,
+  getSoulTemplate,
+  searchSoulTemplates,
+  SOUL_CATEGORIES,
+} from './soul-library.js';
+import { createDlpRoutes } from './dlp-routes.js';
+import { createGuardrailRoutes, createAnomalyRoutes } from './guardrail-routes.js';
+import { createJournalRoutes } from './journal-routes.js';
+import { createCommunicationRoutes, createTaskRoutes } from './communication-routes.js';
+import { createComplianceRoutes } from './compliance-routes.js';
+import { createCatalogRoutes } from './catalog-routes.js';
+import { createAgentRoutes } from './agent-routes.js';
+import { createKnowledgeRoutes } from './knowledge-routes.js';
+import { createOrgApprovalRoutes } from './org-approval-routes.js';
+import { createActivityRoutes } from './activity-routes.js';
+import { createDeploySchemaRoutes } from './deploy-schema-routes.js';
+import { CommunitySkillRegistry } from './community-registry.js';
+import { createCommunityRoutes } from './community-routes.js';
+import { WorkforceManager } from './workforce.js';
+import { createWorkforceRoutes } from './workforce-routes.js';
+import { OrgPolicyEngine } from './org-policies.js';
+import { AgentMemoryManager } from './agent-memory.js';
+import { OnboardingManager } from './onboarding.js';
+import { createPolicyRoutes } from './policy-routes.js';
+import { KnowledgeContributionManager } from './knowledge-contribution.js';
+import { createKnowledgeContributionRoutes } from './knowledge-contribution-routes.js';
+import { SkillAutoUpdater } from './skill-updater.js';
+import { createSkillUpdaterRoutes } from './skill-updater-routes.js';
+import { createMemoryRoutes } from './memory-routes.js';
+import { createOnboardingRoutes } from './onboarding-routes.js';
+import { SecureVault } from './vault.js';
+import { StorageManager } from './storage-manager.js';
+import { PolicyImporter } from './policy-import.js';
+import { createVaultRoutes } from './vault-routes.js';
+import { createStorageRoutes } from './storage-routes.js';
+import { createPolicyImportRoutes } from './policy-import-routes.js';
+import { createOAuthConnectRoutes } from './oauth-connect-routes.js';
+import type { DatabaseAdapter } from '../db/adapter.js';
+
+const engine = new Hono<AppEnv>();
 
 // ─── Shared Instances ───────────────────────────────────
 
@@ -27,6 +94,26 @@ const lifecycle = new AgentLifecycleManager({ permissions: permissionEngine });
 const knowledgeBase = new KnowledgeBaseEngine();
 const tenants = new TenantManager();
 const activity = new ActivityTracker();
+const dlp = new DLPEngine();
+const commBus = new AgentCommunicationBus();
+const guardrails = new GuardrailEngine({
+  stopAgent: async (agentId, by, reason) => { await lifecycle.stop(agentId, by, reason); },
+});
+const journal = new ActionJournal();
+const compliance = new ComplianceReporter();
+const communityRegistry = new CommunitySkillRegistry({ permissions: permissionEngine });
+const workforce = new WorkforceManager({ lifecycle, guardrails });
+const policyEngine = new OrgPolicyEngine();
+const memoryManager = new AgentMemoryManager();
+const onboarding = new OnboardingManager({ policyEngine, memoryManager });
+const vault = new SecureVault();
+const storageManager = new StorageManager({ vault });
+const policyImporter = new PolicyImporter({ policyEngine, storageManager });
+const knowledgeContribution = new KnowledgeContributionManager({ memoryCallback: async (agentId: string) => memoryManager.queryMemories({ agentId }) });
+const skillUpdater = new SkillAutoUpdater({ registry: communityRegistry });
+
+// Wire onboarding into guardrails for onboarding gate checks
+guardrails.setOnboardingManager(onboarding);
 
 // Wire lifecycle events into activity tracker
 lifecycle.onEvent((event) => {
@@ -38,491 +125,161 @@ lifecycle.onEvent((event) => {
   });
 });
 
-// ─── Skills Catalog ─────────────────────────────────────
-
-engine.get('/skills', (c) => {
-  return c.json({ skills: BUILTIN_SKILLS, categories: [...new Set(BUILTIN_SKILLS.map(s => s.category))], total: BUILTIN_SKILLS.length });
-});
-
-engine.get('/skills/by-category', (c) => {
-  const grouped: Record<string, typeof BUILTIN_SKILLS> = {};
-  for (const skill of BUILTIN_SKILLS) {
-    if (!grouped[skill.category]) grouped[skill.category] = [];
-    grouped[skill.category].push(skill);
-  }
-  return c.json({ categories: grouped });
-});
-
-engine.get('/skills/:id', (c) => {
-  const skill = BUILTIN_SKILLS.find(s => s.id === c.req.param('id'));
-  if (!skill) return c.json({ error: 'Skill not found' }, 404);
-  return c.json({ skill });
-});
-
-// ─── Permission Profiles ────────────────────────────────
-
-engine.get('/profiles/presets', (c) => c.json({ presets: PRESET_PROFILES }));
-
-engine.get('/profiles/:agentId', (c) => {
-  const profile = permissionEngine.getProfile(c.req.param('agentId'));
-  if (!profile) return c.json({ error: 'No profile assigned' }, 404);
-  return c.json({ profile });
-});
-
-engine.put('/profiles/:agentId', async (c) => {
-  const agentId = c.req.param('agentId');
-  const profile = await c.req.json();
-  profile.id = profile.id || agentId;
-  profile.updatedAt = new Date().toISOString();
-  if (!profile.createdAt) profile.createdAt = profile.updatedAt;
-  permissionEngine.setProfile(agentId, profile);
-  return c.json({ success: true, profile });
-});
-
-engine.post('/profiles/:agentId/apply-preset', async (c) => {
-  const agentId = c.req.param('agentId');
-  const { presetName } = await c.req.json();
-  const preset = PRESET_PROFILES.find(p => p.name === presetName);
-  if (!preset) return c.json({ error: 'Preset not found' }, 404);
-  const profile = { ...preset, id: agentId, createdAt: new Date().toISOString(), updatedAt: new Date().toISOString() };
-  permissionEngine.setProfile(agentId, profile as any);
-  return c.json({ success: true, profile });
-});
-
-engine.post('/permissions/check', async (c) => {
-  const { agentId, toolId } = await c.req.json();
-  return c.json(permissionEngine.checkPermission(agentId, toolId));
-});
-
-engine.get('/permissions/:agentId/tools', (c) => {
-  const tools = permissionEngine.getAvailableTools(c.req.param('agentId'));
-  return c.json({ tools, total: tools.length });
-});
-
-engine.get('/permissions/:agentId/policy', (c) => {
-  return c.json(permissionEngine.generateToolPolicy(c.req.param('agentId')));
-});
-
-// ─── Agent Lifecycle ────────────────────────────────────
-
-engine.post('/agents', async (c) => {
-  const { orgId, config, createdBy } = await c.req.json();
-  try {
-    const agent = await lifecycle.createAgent(orgId, config, createdBy);
-    return c.json({ agent }, 201);
-  } catch (e: any) {
-    return c.json({ error: e.message }, 400);
-  }
-});
-
-engine.get('/agents', (c) => {
-  const orgId = c.req.query('orgId');
-  if (!orgId) return c.json({ error: 'orgId required' }, 400);
-  const agents = lifecycle.getAgentsByOrg(orgId);
-  return c.json({ agents, total: agents.length });
-});
-
-engine.get('/agents/:id', (c) => {
-  const agent = lifecycle.getAgent(c.req.param('id'));
-  if (!agent) return c.json({ error: 'Agent not found' }, 404);
-  return c.json({ agent });
-});
-
-engine.patch('/agents/:id/config', async (c) => {
-  const { updates, updatedBy } = await c.req.json();
-  try {
-    const agent = await lifecycle.updateConfig(c.req.param('id'), updates, updatedBy);
-    return c.json({ agent });
-  } catch (e: any) {
-    return c.json({ error: e.message }, 400);
-  }
-});
-
-engine.post('/agents/:id/deploy', async (c) => {
-  const { deployedBy } = await c.req.json();
-  try {
-    const agent = await lifecycle.deploy(c.req.param('id'), deployedBy);
-    return c.json({ agent });
-  } catch (e: any) {
-    return c.json({ error: e.message }, 400);
-  }
-});
-
-engine.post('/agents/:id/stop', async (c) => {
-  const { stoppedBy, reason } = await c.req.json();
-  try {
-    const agent = await lifecycle.stop(c.req.param('id'), stoppedBy, reason);
-    return c.json({ agent });
-  } catch (e: any) {
-    return c.json({ error: e.message }, 400);
-  }
-});
-
-engine.post('/agents/:id/restart', async (c) => {
-  const { restartedBy } = await c.req.json();
-  try {
-    const agent = await lifecycle.restart(c.req.param('id'), restartedBy);
-    return c.json({ agent });
-  } catch (e: any) {
-    return c.json({ error: e.message }, 400);
-  }
-});
-
-engine.post('/agents/:id/hot-update', async (c) => {
-  const { updates, updatedBy } = await c.req.json();
-  try {
-    const agent = await lifecycle.hotUpdate(c.req.param('id'), updates, updatedBy);
-    return c.json({ agent });
-  } catch (e: any) {
-    return c.json({ error: e.message }, 400);
-  }
-});
-
-engine.delete('/agents/:id', async (c) => {
-  const { destroyedBy } = await c.req.json().catch(() => ({ destroyedBy: 'unknown' }));
-  try {
-    await lifecycle.destroy(c.req.param('id'), destroyedBy);
-    return c.json({ success: true });
-  } catch (e: any) {
-    return c.json({ error: e.message }, 400);
-  }
-});
-
-engine.get('/agents/:id/usage', (c) => {
-  const agent = lifecycle.getAgent(c.req.param('id'));
-  if (!agent) return c.json({ error: 'Agent not found' }, 404);
-  return c.json({ usage: agent.usage, health: agent.health, state: agent.state });
-});
-
-engine.get('/usage/:orgId', (c) => {
-  return c.json(lifecycle.getOrgUsage(c.req.param('orgId')));
-});
-
-// ─── Config Generation ──────────────────────────────────
-
-engine.post('/config/workspace', async (c) => {
-  const config: AgentConfig = await c.req.json();
-  return c.json({ files: configGen.generateWorkspace(config) });
-});
-
-engine.post('/config/gateway', async (c) => {
-  const config: AgentConfig = await c.req.json();
-  return c.json({ config: configGen.generateGatewayConfig(config) });
-});
-
-engine.post('/config/docker-compose', async (c) => {
-  const config: AgentConfig = await c.req.json();
-  return c.json({ compose: configGen.generateDockerCompose(config) });
-});
-
-engine.post('/config/systemd', async (c) => {
-  const config: AgentConfig = await c.req.json();
-  return c.json({ unit: configGen.generateSystemdUnit(config) });
-});
-
-engine.post('/config/deploy-script', async (c) => {
-  const config: AgentConfig = await c.req.json();
-  return c.json({ script: configGen.generateVPSDeployScript(config) });
-});
-
-// ─── Knowledge Base ─────────────────────────────────────
-
-engine.post('/knowledge-bases', async (c) => {
-  const { orgId, name, description, agentIds, config } = await c.req.json();
-  const kb = knowledgeBase.createKnowledgeBase(orgId, { name, description, agentIds, config });
-  return c.json({ knowledgeBase: kb }, 201);
-});
-
-engine.get('/knowledge-bases', (c) => {
-  const orgId = c.req.query('orgId');
-  const agentId = c.req.query('agentId');
-  if (agentId) return c.json({ knowledgeBases: knowledgeBase.getKnowledgeBasesForAgent(agentId) });
-  if (orgId) return c.json({ knowledgeBases: knowledgeBase.getKnowledgeBasesByOrg(orgId) });
-  return c.json({ error: 'orgId or agentId required' }, 400);
-});
-
-engine.get('/knowledge-bases/:id', (c) => {
-  const kb = knowledgeBase.getKnowledgeBase(c.req.param('id'));
-  if (!kb) return c.json({ error: 'Knowledge base not found' }, 404);
-  return c.json({ knowledgeBase: kb });
-});
-
-engine.post('/knowledge-bases/:id/documents', async (c) => {
-  const { name, content, sourceType, sourceUrl, mimeType, metadata } = await c.req.json();
-  try {
-    const doc = await knowledgeBase.ingestDocument(c.req.param('id'), { name, content, sourceType, sourceUrl, mimeType, metadata });
-    return c.json({ document: doc }, 201);
-  } catch (e: any) {
-    return c.json({ error: e.message }, 400);
-  }
-});
-
-engine.delete('/knowledge-bases/:kbId/documents/:docId', (c) => {
-  const ok = knowledgeBase.deleteDocument(c.req.param('kbId'), c.req.param('docId'));
-  return ok ? c.json({ success: true }) : c.json({ error: 'Not found' }, 404);
-});
-
-engine.post('/knowledge-bases/search', async (c) => {
-  const { agentId, query, kbIds, maxResults, minScore } = await c.req.json();
-  const results = await knowledgeBase.search(agentId, query, { kbIds, maxResults, minScore });
-  return c.json({ results, total: results.length });
-});
-
-engine.post('/knowledge-bases/context', async (c) => {
-  const { agentId, query, maxTokens } = await c.req.json();
-  const context = await knowledgeBase.getContext(agentId, query, maxTokens);
-  return c.json({ context });
-});
-
-engine.delete('/knowledge-bases/:id', (c) => {
-  const ok = knowledgeBase.deleteKnowledgeBase(c.req.param('id'));
-  return ok ? c.json({ success: true }) : c.json({ error: 'Not found' }, 404);
-});
-
-// ─── Organizations (Tenants) ────────────────────────────
-
-engine.post('/orgs', async (c) => {
-  const { name, slug, plan, adminEmail, settings } = await c.req.json();
-  try {
-    const org = tenants.createOrg({ name, slug, plan: plan || 'free', adminEmail, settings });
-    return c.json({ org }, 201);
-  } catch (e: any) {
-    return c.json({ error: e.message }, 400);
-  }
-});
-
-engine.get('/orgs', (c) => c.json({ orgs: tenants.listOrgs() }));
-
-engine.get('/orgs/:id', (c) => {
-  const org = tenants.getOrg(c.req.param('id'));
-  if (!org) return c.json({ error: 'Org not found' }, 404);
-  return c.json({ org });
-});
-
-engine.get('/orgs/slug/:slug', (c) => {
-  const org = tenants.getOrgBySlug(c.req.param('slug'));
-  if (!org) return c.json({ error: 'Org not found' }, 404);
-  return c.json({ org });
-});
-
-engine.post('/orgs/:id/check-limit', async (c) => {
-  const { resource, currentCount } = await c.req.json();
-  try {
-    return c.json(tenants.checkLimit(c.req.param('id'), resource, currentCount));
-  } catch (e: any) {
-    return c.json({ error: e.message }, 400);
-  }
-});
-
-engine.post('/orgs/:id/check-feature', async (c) => {
-  const { feature } = await c.req.json();
-  return c.json({ allowed: tenants.hasFeature(c.req.param('id'), feature) });
-});
-
-engine.post('/orgs/:id/change-plan', async (c) => {
-  const { plan } = await c.req.json();
-  try {
-    const org = tenants.changePlan(c.req.param('id'), plan);
-    return c.json({ org });
-  } catch (e: any) {
-    return c.json({ error: e.message }, 400);
-  }
-});
-
-// ─── Approvals ──────────────────────────────────────────
-
-engine.get('/approvals/pending', (c) => {
-  const agentId = c.req.query('agentId');
-  const requests = approvals.getPendingRequests(agentId || undefined);
-  return c.json({ requests, total: requests.length });
-});
-
-engine.get('/approvals/history', (c) => {
-  const agentId = c.req.query('agentId');
-  const limit = parseInt(c.req.query('limit') || '25');
-  const offset = parseInt(c.req.query('offset') || '0');
-  return c.json(approvals.getHistory({ agentId: agentId || undefined, limit, offset }));
-});
-
-engine.get('/approvals/:id', (c) => {
-  const request = approvals.getRequest(c.req.param('id'));
-  if (!request) return c.json({ error: 'Not found' }, 404);
-  return c.json({ request });
-});
-
-engine.post('/approvals/:id/decide', async (c) => {
-  const { action, reason, by } = await c.req.json();
-  const result = approvals.decide(c.req.param('id'), { action, reason, by });
-  if (!result) return c.json({ error: 'Not found or already decided' }, 404);
-  return c.json({ request: result });
-});
-
-engine.get('/approvals/policies', (c) => c.json({ policies: approvals.getPolicies() }));
-
-engine.post('/approvals/policies', async (c) => {
-  const policy = await c.req.json();
-  policy.id = policy.id || crypto.randomUUID();
-  approvals.addPolicy(policy);
-  return c.json({ success: true, policy });
-});
-
-engine.delete('/approvals/policies/:id', (c) => {
-  approvals.removePolicy(c.req.param('id'));
-  return c.json({ success: true });
-});
-
-// ─── Activity & Monitoring ──────────────────────────────
-
-engine.get('/activity/events', (c) => {
-  const events = activity.getEvents({
-    agentId: c.req.query('agentId') || undefined,
-    orgId: c.req.query('orgId') || undefined,
-    since: c.req.query('since') || undefined,
-    limit: parseInt(c.req.query('limit') || '50'),
-  });
-  return c.json({ events, total: events.length });
-});
-
-engine.get('/activity/tool-calls', (c) => {
-  const calls = activity.getToolCalls({
-    agentId: c.req.query('agentId') || undefined,
-    orgId: c.req.query('orgId') || undefined,
-    toolId: c.req.query('toolId') || undefined,
-    limit: parseInt(c.req.query('limit') || '50'),
+// Wire lifecycle into communication bus for agent email registry
+commBus.setLifecycle(lifecycle);
+
+// Wire birthday automation — sends a birthday email to each agent on their DOB
+lifecycle.setBirthdaySender(async (agent) => {
+  const dob = agent.config?.identity?.dateOfBirth;
+  if (!dob) return;
+  const age = AgentConfigGenerator.deriveAge(dob);
+  const name = agent.config.displayName || agent.config.name;
+  const ordinal = age % 10 === 1 && age !== 11 ? 'st' : age % 10 === 2 && age !== 12 ? 'nd' : age % 10 === 3 && age !== 13 ? 'rd' : 'th';
+  await commBus.sendMessage({
+    orgId: agent.orgId,
+    fromAgentId: 'system',
+    toAgentId: agent.id,
+    subject: `Happy Birthday, ${name}!`,
+    content: `Happy ${age}${ordinal} birthday, ${name}! Wishing you a wonderful day full of great conversations and accomplishments. Here's to another year of excellence!`,
+    priority: 'normal',
+    metadata: { type: 'birthday', age, dateOfBirth: dob },
   });
-  return c.json({ toolCalls: calls, total: calls.length });
-});
-
-engine.get('/activity/conversation/:sessionId', (c) => {
-  const entries = activity.getConversation(c.req.param('sessionId'));
-  return c.json({ entries, total: entries.length });
-});
-
-engine.get('/activity/timeline/:agentId/:date', (c) => {
-  const timeline = activity.getTimeline(c.req.param('agentId'), c.req.param('date'));
-  return c.json({ timeline });
 });
+lifecycle.startBirthdayScheduler();
+
+// ─── Auth Context Extraction ────────────────────────────
+// When engine routes are called via the server proxy, auth context
+// is forwarded as custom headers. Extract into Hono context.
+engine.use('*', async (c, next) => {
+  const userId = c.req.header('X-User-Id');
+  const userRole = c.req.header('X-User-Role');
+  const authType = c.req.header('X-Auth-Type');
+  const requestId = c.req.header('X-Request-Id');
+  if (userId) c.set('userId', userId);
+  if (userRole) c.set('userRole', userRole);
+  if (authType) c.set('authType', authType);
+  if (requestId) c.set('requestId', requestId);
+  await next();
+});
+
+// ─── Mount Sub-Apps ─────────────────────────────────────
+
+engine.route('/dlp', createDlpRoutes(dlp));
+engine.route('/guardrails', createGuardrailRoutes(guardrails, {
+  getWorkforceOffDuty: (agentId) => workforce.isOffDuty(agentId),
+}));
+engine.route('/anomaly-rules', createAnomalyRoutes(guardrails));
+engine.route('/journal', createJournalRoutes(journal));
+engine.route('/messages', createCommunicationRoutes(commBus));
+engine.route('/tasks', createTaskRoutes(commBus));
+engine.route('/compliance', createComplianceRoutes(compliance));
+
+engine.route('/', createCatalogRoutes({
+  skills: BUILTIN_SKILLS,
+  presets: PRESET_PROFILES,
+  permissions: permissionEngine,
+  configGen,
+  soulLib: { getSoulTemplates, getSoulTemplatesByCategory, getSoulTemplate, searchSoulTemplates, SOUL_CATEGORIES },
+  suites: SKILL_SUITES,
+}));
+
+engine.route('/', createAgentRoutes({
+  lifecycle,
+  permissions: permissionEngine,
+  getAdminDb: () => _adminDb,
+}));
+
+engine.route('/', createKnowledgeRoutes(knowledgeBase));
+
+engine.route('/', createOrgApprovalRoutes({
+  tenants,
+  approvals,
+}));
+
+engine.route('/', createActivityRoutes({
+  activity,
+  tenants,
+  lifecycle,
+}));
+
+engine.route('/', createDeploySchemaRoutes(() => _engineDb, () => vault));
+
+engine.route('/community', createCommunityRoutes(communityRegistry));
+engine.route('/workforce', createWorkforceRoutes(workforce, { lifecycle }));
+engine.route('/policies', createPolicyRoutes(policyEngine));
+engine.route('/memory', createMemoryRoutes(memoryManager));
+engine.route('/onboarding', createOnboardingRoutes(onboarding));
+engine.route('/vault', createVaultRoutes(vault, dlp));
+engine.route('/storage', createStorageRoutes(storageManager));
+engine.route('/policies', createPolicyImportRoutes(policyImporter));
+engine.route('/knowledge-contribution', createKnowledgeContributionRoutes(knowledgeContribution));
+engine.route('/skill-updates', createSkillUpdaterRoutes(skillUpdater));
+engine.route('/oauth', createOAuthConnectRoutes(vault));
+
+// ─── setEngineDb ────────────────────────────────────────
 
-engine.get('/activity/stats', (c) => {
-  const orgId = c.req.query('orgId');
-  return c.json(activity.getStats(orgId || undefined));
-});
-
-// SSE endpoint for real-time events
-engine.get('/activity/stream', (c) => {
-  const orgId = c.req.query('orgId');
-  const agentId = c.req.query('agentId');
-
-  const stream = new ReadableStream({
-    start(controller) {
-      const encoder = new TextEncoder();
-      const send = (data: string) => {
-        try { controller.enqueue(encoder.encode(`data: ${data}\n\n`)); }
-        catch { unsubscribe(); }
-      };
-
-      // Send heartbeat every 30s
-      const heartbeat = setInterval(() => send(JSON.stringify({ type: 'heartbeat' })), 30_000);
-
-      const unsubscribe = activity.subscribe((event) => {
-        if (orgId && event.orgId !== orgId) return;
-        if (agentId && event.agentId !== agentId) return;
-        send(JSON.stringify(event));
-      });
-
-      // Cleanup on close
-      c.req.raw.signal.addEventListener('abort', () => {
-        unsubscribe();
-        clearInterval(heartbeat);
-      });
-    },
-  });
-
-  return new Response(stream, {
-    headers: {
-      'Content-Type': 'text/event-stream',
-      'Cache-Control': 'no-cache',
-      'Connection': 'keep-alive',
-    },
-  });
-});
-
-// ─── Engine Stats (Dashboard Overview) ──────────────────
-
-engine.get('/stats/:orgId', (c) => {
-  const orgId = c.req.param('orgId');
-  const org = tenants.getOrg(orgId);
-  const agents = lifecycle.getAgentsByOrg(orgId);
-  const orgUsage = lifecycle.getOrgUsage(orgId);
-  const realTimeStats = activity.getStats(orgId);
-
-  return c.json({
-    org: org ? { name: org.name, plan: org.plan, limits: org.limits, usage: org.usage } : null,
-    agents: {
-      total: agents.length,
-      byState: agents.reduce((acc, a) => { acc[a.state] = (acc[a.state] || 0) + 1; return acc; }, {} as Record<string, number>),
-    },
-    usage: orgUsage,
-    realTime: realTimeStats,
-  });
-});
-
-// ─── Dynamic Tables ────────────────────────────────────
-
-/**
- * POST /schema/tables — Create a dynamic table at runtime.
- * Body: { name, sql, postgres?, mysql?, indexes? }
- * Tables are prefixed with `ext_` automatically.
- *
- * Requires an EngineDatabase instance wired in via setEngineDb().
- */
 let _engineDb: import('./db-adapter.js').EngineDatabase | null = null;
+let _adminDb: DatabaseAdapter | null = null;
 
-export function setEngineDb(db: import('./db-adapter.js').EngineDatabase) {
+export async function setEngineDb(
+  db: import('./db-adapter.js').EngineDatabase,
+  adminDb?: DatabaseAdapter,
+) {
   _engineDb = db;
+  if (adminDb) _adminDb = adminDb;
+
+  // Cascade DB to all engine modules for persistent storage
+  await Promise.all([
+    lifecycle.setDb(db),
+    approvals.setDb(db),
+    knowledgeBase.setDb(db),
+    activity.setDb(db),
+    tenants.setDb(db),
+    permissionEngine.setDb(db),
+    dlp.setDb(db),
+    commBus.setDb(db),
+    guardrails.setDb(db),
+    journal.setDb(db),
+    compliance.setDb(db),
+    communityRegistry.setDb(db),
+    workforce.setDb(db),
+    policyEngine.setDb(db),
+    memoryManager.setDb(db),
+    onboarding.setDb(db),
+    vault.setDb(db),
+    storageManager.setDb(db),
+    policyImporter.setDb(db),
+  ]);
+  guardrails.startAnomalyDetection();
+  workforce.startScheduler();
+  knowledgeContribution.startScheduler();
+  skillUpdater.startScheduler();
+
+  // Load community skills from the local community-skills/ directory (if running from git clone)
+  import('path').then(async (path) => {
+    const communityDir = path.resolve(import.meta.dirname || '.', '../../community-skills');
+    const { loaded, errors } = await communityRegistry.loadFromDirectory(communityDir);
+    if (loaded > 0) console.log(`[community] Loaded ${loaded} community skills from directory`);
+    if (errors.length > 0) console.warn(`[community] ${errors.length} skills failed validation`);
+  }).catch(() => { /* community-skills/ dir may not exist in npm installs */ });
+
+  // Start periodic sync from the central GitHub repo (agenticmail/enterprise).
+  // This is how npm-installed deployments get new community skills automatically
+  // without needing an npm update or server restart. Syncs every 6 hours.
+  communityRegistry.startPeriodicSync();
+
+  // Ensure a default org exists for single-tenant / self-hosted deployments
+  await tenants.createDefaultOrg().catch(() => {});
 }
 
-engine.post('/schema/tables', async (c) => {
-  if (!_engineDb) return c.json({ error: 'Engine database not initialized' }, 503);
-  try {
-    const def = await c.req.json();
-    if (!def.name || !def.sql) return c.json({ error: 'name and sql are required' }, 400);
-    await _engineDb.createDynamicTable(def);
-    const prefixed = def.name.startsWith('ext_') ? def.name : `ext_${def.name}`;
-    return c.json({ ok: true, table: prefixed });
-  } catch (e: any) {
-    return c.json({ error: e.message }, 500);
-  }
-});
+// ─── Agent Runtime (optional — mounted when runtime is started) ──
 
-engine.get('/schema/tables', async (c) => {
-  if (!_engineDb) return c.json({ error: 'Engine database not initialized' }, 503);
-  const tables = await _engineDb.listDynamicTables();
-  return c.json({ tables });
-});
+let _runtimeApp: import('hono').Hono | null = null;
 
-engine.post('/schema/query', async (c) => {
-  if (!_engineDb) return c.json({ error: 'Engine database not initialized' }, 503);
-  try {
-    const { sql, params } = await c.req.json();
-    if (!sql) return c.json({ error: 'sql is required' }, 400);
-    // Only allow SELECT on ext_ tables for safety
-    const trimmed = sql.trim().toUpperCase();
-    if (trimmed.startsWith('SELECT')) {
-      const rows = await _engineDb.query(sql, params);
-      return c.json({ rows });
-    } else {
-      // INSERT/UPDATE/DELETE — verify it targets ext_ tables
-      if (!trimmed.includes('EXT_')) {
-        return c.json({ error: 'Mutations only allowed on ext_* tables' }, 403);
-      }
-      await _engineDb.execute(sql, params);
-      return c.json({ ok: true });
-    }
-  } catch (e: any) {
-    return c.json({ error: e.message }, 500);
-  }
-});
+export function mountRuntimeApp(app: import('hono').Hono): void {
+  _runtimeApp = app;
+  engine.route('/runtime', app);
+}
 
 export { engine as engineRoutes };
-export { permissionEngine, configGen, deployer, approvals, lifecycle, knowledgeBase, tenants, activity };
+export { permissionEngine, configGen, deployer, approvals, lifecycle, knowledgeBase, tenants, activity, dlp, commBus, guardrails, journal, compliance, communityRegistry, workforce, policyEngine, memoryManager, onboarding, vault, storageManager, policyImporter, knowledgeContribution, skillUpdater };