@agenticmail/enterprise 0.5.326 → 0.5.328

package/src/engine/db-adapter.ts

@@ -1,1156 +0,0 @@
-/**
- * Engine Database Adapter
- *
- * Extends the base DatabaseAdapter with engine-specific persistence.
- * Works with SQLite, Postgres, MySQL, Turso — anything that speaks SQL.
- *
- * MongoDB and DynamoDB would need their own implementations.
- */
-
-import type { ManagedAgent, AgentState, StateTransition, AgentUsage, LifecycleEvent } from './lifecycle.js';
-
-/** Safe JSON parse — returns fallback on malformed data instead of throwing */
-function sj(val: any, fallback: any = {}): any {
-  if (val == null) return fallback;
-  if (typeof val === 'object') return val; // Postgres JSON/JSONB returns parsed objects
-  if (typeof val !== 'string') return fallback;
-  try { return JSON.parse(val); } catch { return fallback; }
-}
-import type { AgentPermissionProfile } from './skills.js';
-import type { Organization, OrgPlan } from './tenant.js';
-import type { ApprovalRequest, ApprovalPolicy } from './approvals.js';
-import type { KnowledgeBase, KBDocument, KBChunk } from './knowledge.js';
-import type { ActivityEvent, ToolCallRecord, ConversationEntry } from './activity.js';
-import {
-  ENGINE_TABLES,
-  MIGRATIONS,
-  MIGRATIONS_TABLE,
-  MIGRATIONS_TABLE_POSTGRES,
-  sqliteToPostgres,
-  sqliteToMySQL,
-  type Migration,
-  type DynamicTableDef,
-} from './db-schema.js';
-
-// ─── Types ──────────────────────────────────────────────
-
-export interface EngineDB {
-  // Execute raw SQL (adapter-specific)
-  run(sql: string, params?: any[]): Promise<void>;
-  get<T = any>(sql: string, params?: any[]): Promise<T | undefined>;
-  all<T = any>(sql: string, params?: any[]): Promise<T[]>;
-}
-
-// ─── Engine Database Layer ──────────────────────────────
-
-export class EngineDatabase {
-  private db: EngineDB;
-  private dialect: 'sqlite' | 'postgres' | 'mysql' | 'mongodb' | 'dynamodb' | 'turso';
-  /** Raw driver handle for NoSQL migrations (MongoClient db, DynamoDB client, etc.) */
-  private rawDriver?: any;
-
-  constructor(db: EngineDB, dialect: 'sqlite' | 'postgres' | 'mysql' | 'mongodb' | 'dynamodb' | 'turso' = 'sqlite', rawDriver?: any) {
-    this.db = db;
-    this.dialect = dialect;
-    this.rawDriver = rawDriver;
-  }
-
-  // ─── Migration System ─────────────────────────────────
-
-  /**
-   * Run all pending migrations in order.
-   * Creates the migration tracking table first, then applies any unapplied migrations.
-   */
-  async migrate(): Promise<{ applied: number; total: number }> {
-    // Create migration tracking table
-    const trackingDDL = this.dialect === 'postgres' ? MIGRATIONS_TABLE_POSTGRES : MIGRATIONS_TABLE;
-    for (const stmt of this.splitStatements(trackingDDL)) {
-      await this.db.run(stmt);
-    }
-
-    // Get already-applied versions
-    const applied = await this.db.all<{ version: number }>('SELECT version FROM engine_migrations ORDER BY version');
-    const appliedSet = new Set(applied.map(r => r.version));
-
-    let count = 0;
-    for (const migration of MIGRATIONS) {
-      if (appliedSet.has(migration.version)) continue;
-
-      // Pick the right SQL for the dialect
-      if ((this.dialect === 'mongodb' || this.dialect === 'dynamodb') && migration.nosql) {
-        await migration.nosql(this.rawDriver, this.dialect);
-      } else {
-        const sql = this.getSqlForDialect(migration);
-        if (sql) {
-          for (const stmt of this.splitStatements(sql)) {
-            try {
-              await this.db.run(stmt);
-            } catch (e: any) {
-              // Ignore "duplicate column" errors from ALTER TABLE on fresh DBs
-              // where the column already exists in the CREATE TABLE schema.
-              if (e?.message?.includes('duplicate column')) continue;
-              throw e;
-            }
-          }
-        }
-      }
-
-      // Record migration
-      await this.db.run(
-        'INSERT INTO engine_migrations (version, name) VALUES (?, ?)',
-        [migration.version, migration.name]
-      );
-      count++;
-    }
-
-    // Post-migration: ensure critical tables exist (handles partial first-install or re-install scenarios)
-    const settingsDDL = this.dialect === 'postgres'
-      ? `CREATE TABLE IF NOT EXISTS engine_settings (key TEXT PRIMARY KEY, value TEXT, updated_at TIMESTAMP DEFAULT NOW())`
-      : `CREATE TABLE IF NOT EXISTS engine_settings (key TEXT PRIMARY KEY, value TEXT, updated_at TEXT DEFAULT (datetime('now')))`;
-    try { await this.db.run(settingsDDL); } catch { /* ok — may already exist */ }
-
-    // Post-migration: fix version columns that were incorrectly created as BOOLEAN on Postgres
-    if (this.dialect === 'postgres') {
-      try {
-        const boolVersionCols = await this.db.all<any>(
-          `SELECT table_name FROM information_schema.columns WHERE column_name = 'version' AND data_type = 'boolean' AND table_schema = 'public'`
-        );
-        for (const row of boolVersionCols) {
-          try {
-            await this.db.run(`ALTER TABLE ${row.table_name} ALTER COLUMN version DROP DEFAULT`);
-            await this.db.run(`ALTER TABLE ${row.table_name} ALTER COLUMN version TYPE INTEGER USING CASE WHEN version THEN 1 ELSE 0 END`);
-            await this.db.run(`ALTER TABLE ${row.table_name} ALTER COLUMN version SET DEFAULT 1`);
-            console.log(`[engine] Fixed version column type on ${row.table_name}: BOOLEAN → INTEGER`);
-          } catch (e: any) {
-            console.error(`[engine] Failed to fix version column on ${row.table_name}:`, e.message);
-          }
-        }
-      } catch { /* ignore */ }
-    }
-
-    // Auto-seed community skills on first run or when empty
-    await this.seedCommunitySkills();
-
-    return { applied: count, total: MIGRATIONS.length };
-  }
-
-  /**
-   * Seed community_skill_index with all MCP integration skills.
-   * Uses INSERT ... ON CONFLICT DO NOTHING so it's safe to re-run.
-   * Only seeds if the table has fewer entries than the seed data.
-   */
-  private async seedCommunitySkills(): Promise<void> {
-    try {
-      const countRow = await this.db.get<any>('SELECT COUNT(*) as c FROM community_skill_index');
-      const existingCount = countRow?.c || 0;
-
-      // Load seed data (compiled into dist by bundler)
-      const { SEED_SKILLS } = await import('../agent-tools/tools/integrations/_seed-data.js');
-      if (!SEED_SKILLS?.length) return;
-      await this._doSeed(SEED_SKILLS, existingCount);
-    } catch (e: any) {
-      console.warn(`[engine] Community skill seeding failed: ${e.message}`);
-    }
-  }
-
-  private async _doSeed(seedData: any[], existingCount: number): Promise<void> {
-    if (existingCount >= seedData.length) return; // Already seeded
-
-    let seeded = 0;
-    for (const skill of seedData) {
-      try {
-        const onConflict = this.dialect === 'postgres'
-          ? 'ON CONFLICT (id) DO NOTHING'
-          : 'ON CONFLICT(id) DO NOTHING';
-
-        await this.db.run(
-          `INSERT INTO community_skill_index (id, name, description, version, author, repository, license, category, risk, tags, tools, verified, featured)
-           VALUES (?, ?, ?, '1.0.0', 'agenticmail', 'https://github.com/agenticmail/enterprise', 'MIT', ?, 'medium', '[]', ?, 1, 0)
-           ${onConflict}`,
-          [
-            skill.id,
-            skill.name,
-            `${skill.name} integration — ${skill.toolCount} tools for ${skill.category} workflows`,
-            skill.category,
-            JSON.stringify(skill.tools),
-          ]
-        );
-        seeded++;
-      } catch { /* skip duplicates */ }
-    }
-    if (seeded > 0) console.log(`[engine] Seeded ${seeded} community skills (${seedData.length} total available)`);
-  }
-
-  /**
-   * Register and create a dynamic table at runtime.
-   * Used by plugins, skills, or engine extensions that need their own storage.
-   * Table name is auto-prefixed with `ext_` to avoid collisions with core tables.
-   */
-  async createDynamicTable(def: DynamicTableDef): Promise<void> {
-    const prefixedName = def.name.startsWith('ext_') ? def.name : `ext_${def.name}`;
-
-    if (this.dialect === 'mongodb' && def.mongoSetup) {
-      await def.mongoSetup(this.rawDriver);
-      return;
-    }
-    if (this.dialect === 'dynamodb' && def.dynamoSetup) {
-      await def.dynamoSetup(this.rawDriver);
-      return;
-    }
-
-    // SQL-based: pick dialect-specific DDL or auto-convert
-    let ddl: string;
-    if (this.dialect === 'postgres' && def.postgres) {
-      ddl = def.postgres;
-    } else if (this.dialect === 'mysql' && def.mysql) {
-      ddl = def.mysql;
-    } else if (this.dialect === 'postgres') {
-      ddl = sqliteToPostgres(def.sql);
-    } else if (this.dialect === 'mysql') {
-      ddl = sqliteToMySQL(def.sql);
-    } else {
-      ddl = def.sql;
-    }
-
-    // Replace the table name with prefixed version
-    ddl = ddl.replace(new RegExp(`\\b${def.name}\\b`, 'g'), prefixedName);
-
-    for (const stmt of this.splitStatements(ddl)) {
-      await this.db.run(stmt);
-    }
-
-    // Create any additional indexes
-    if (def.indexes) {
-      for (const idx of def.indexes) {
-        const prefixedIdx = idx.replace(new RegExp(`\\b${def.name}\\b`, 'g'), prefixedName);
-        await this.db.run(prefixedIdx);
-      }
-    }
-  }
-
-  /**
-   * Run arbitrary SQL — for custom queries on dynamic tables.
-   * Returns rows for SELECT, void for mutations.
-   */
-  async query<T = any>(sql: string, params?: any[]): Promise<T[]> {
-    return this.db.all<T>(sql, params);
-  }
-
-  async get<T = any>(sql: string, params?: any[]): Promise<T | undefined> {
-    return this.db.get<T>(sql, params);
-  }
-
-  async getSettings(): Promise<Record<string, any>> {
-    const rows = await this.db.all<any>('SELECT key, value FROM engine_settings', []);
-    const result: Record<string, any> = {};
-    for (const row of rows) {
-      try { result[row.key] = JSON.parse(row.value); } catch { result[row.key] = row.value; }
-    }
-    return result;
-  }
-
-  async execute(sql: string, params?: any[]): Promise<void> {
-    return this.db.run(sql, params);
-  }
-
-  /** Alias for execute() — used by SessionManager and other components */
-  async run(sql: string, params?: any[]): Promise<void> {
-    return this.db.run(sql, params);
-  }
-
-  /**
-   * List all dynamic (ext_*) tables currently in the database.
-   */
-  async listDynamicTables(): Promise<string[]> {
-    if (this.dialect === 'postgres') {
-      const rows = await this.db.all<{ tablename: string }>(
-        "SELECT tablename FROM pg_tables WHERE schemaname = 'public' AND tablename LIKE 'ext_%'"
-      );
-      return rows.map(r => r.tablename);
-    } else if (this.dialect === 'mysql') {
-      const rows = await this.db.all<{ table_name: string }>(
-        "SELECT table_name FROM information_schema.tables WHERE table_schema = DATABASE() AND table_name LIKE 'ext_%'"
-      );
-      return rows.map(r => r.table_name);
-    } else {
-      // SQLite / Turso
-      const rows = await this.db.all<{ name: string }>(
-        "SELECT name FROM sqlite_master WHERE type='table' AND name LIKE 'ext_%'"
-      );
-      return rows.map(r => r.name);
-    }
-  }
-
-  // ─── Helpers ────────────────────────────────────────
-
-  private splitStatements(sql: string): string[] {
-    return sql.split(';').map(s => s.trim()).filter(s => s.length > 0);
-  }
-
-  private getSqlForDialect(migration: Migration): string | undefined {
-    if (this.dialect === 'postgres' && migration.postgres) return migration.postgres;
-    if (this.dialect === 'mysql' && migration.mysql) return migration.mysql;
-    if (this.dialect === 'postgres' && migration.sql) return sqliteToPostgres(migration.sql);
-    if (this.dialect === 'mysql' && migration.sql) return sqliteToMySQL(migration.sql);
-    return migration.sql;
-  }
-
-  // ─── Managed Agents ─────────────────────────────────
-
-  async upsertManagedAgent(agent: ManagedAgent): Promise<void> {
-    // Strip budgetConfig from config blob — it lives in its own column (budget_config)
-    const configToWrite = { ...(agent.config as any) };
-    delete configToWrite.budgetConfig;
-
-    await this.db.run(`
-      INSERT INTO managed_agents (id, org_id, name, display_name, state, config, health, usage, budget_config, permission_profile_id, version, last_deployed_at, last_health_check_at, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(id) DO UPDATE SET
-        state = excluded.state,
-        config = excluded.config,
-        health = excluded.health,
-        permission_profile_id = excluded.permission_profile_id,
-        version = excluded.version,
-        last_deployed_at = excluded.last_deployed_at,
-        last_health_check_at = excluded.last_health_check_at,
-        updated_at = excluded.updated_at
-    `, [
-      agent.id, agent.orgId, agent.config.name, agent.config.displayName,
-      agent.state, JSON.stringify(configToWrite), JSON.stringify(agent.health),
-      JSON.stringify(agent.usage), JSON.stringify(agent.budgetConfig || {}),
-      agent.config.permissionProfileId,
-      agent.version, agent.lastDeployedAt || null, agent.lastHealthCheckAt || null,
-      agent.createdAt, agent.updatedAt,
-    ]);
-  }
-
-  async getManagedAgent(id: string): Promise<ManagedAgent | null> {
-    const row = await this.db.get<any>('SELECT * FROM managed_agents WHERE id = ?', [id]);
-    return row ? this.rowToManagedAgent(row) : null;
-  }
-
-  async getManagedAgentsByOrg(orgId: string): Promise<ManagedAgent[]> {
-    const rows = await this.db.all<any>('SELECT * FROM managed_agents WHERE org_id = ? ORDER BY created_at DESC', [orgId]);
-    return rows.map(r => this.rowToManagedAgent(r));
-  }
-
-  async getManagedAgentsByState(state: AgentState): Promise<ManagedAgent[]> {
-    const rows = await this.db.all<any>('SELECT * FROM managed_agents WHERE state = ?', [state]);
-    return rows.map(r => this.rowToManagedAgent(r));
-  }
-
-  async getAllManagedAgents(): Promise<ManagedAgent[]> {
-    const rows = await this.db.all<any>('SELECT * FROM managed_agents ORDER BY created_at DESC');
-    return rows.map(r => this.rowToManagedAgent(r));
-  }
-
-  async deleteManagedAgent(id: string): Promise<void> {
-    await this.db.run('DELETE FROM managed_agents WHERE id = ?', [id]);
-  }
-
-  async countManagedAgents(orgId: string, state?: AgentState): Promise<number> {
-    const sql = state
-      ? 'SELECT COUNT(*) as count FROM managed_agents WHERE org_id = ? AND state = ?'
-      : 'SELECT COUNT(*) as count FROM managed_agents WHERE org_id = ?';
-    const row = await this.db.get<any>(sql, state ? [orgId, state] : [orgId]);
-    return row?.count || 0;
-  }
-
-  // ─── State History ──────────────────────────────────
-
-  async addStateTransition(agentId: string, transition: StateTransition): Promise<void> {
-    await this.db.run(`
-      INSERT INTO agent_state_history (id, agent_id, from_state, to_state, reason, triggered_by, error, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-    `, [
-      crypto.randomUUID(), agentId, transition.from, transition.to,
-      transition.reason, transition.triggeredBy, transition.error || null, transition.timestamp,
-    ]);
-  }
-
-  async getStateHistory(agentId: string, limit: number = 50): Promise<StateTransition[]> {
-    const rows = await this.db.all<any>(
-      'SELECT * FROM agent_state_history WHERE agent_id = ? ORDER BY created_at DESC LIMIT ?',
-      [agentId, limit]
-    );
-    return rows.map(r => ({
-      from: r.from_state, to: r.to_state, reason: r.reason,
-      triggeredBy: r.triggered_by, timestamp: r.created_at, error: r.error,
-    }));
-  }
-
-  // ─── Permission Profiles ────────────────────────────
-
-  async upsertPermissionProfile(orgId: string, profile: AgentPermissionProfile): Promise<void> {
-    await this.db.run(`
-      INSERT INTO permission_profiles (id, org_id, name, description, config, is_preset, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, false, ?, ?)
-      ON CONFLICT(id) DO UPDATE SET
-        name = excluded.name, description = excluded.description,
-        config = excluded.config, updated_at = excluded.updated_at
-    `, [
-      profile.id, orgId, profile.name, profile.description || null,
-      JSON.stringify(profile), profile.createdAt, profile.updatedAt,
-    ]);
-  }
-
-  async getPermissionProfile(id: string): Promise<AgentPermissionProfile | null> {
-    const row = await this.db.get<any>('SELECT * FROM permission_profiles WHERE id = ?', [id]);
-    return row ? sj(row.config) : null;
-  }
-
-  async getPermissionProfilesByOrg(orgId: string): Promise<AgentPermissionProfile[]> {
-    const rows = await this.db.all<any>('SELECT config FROM permission_profiles WHERE org_id = ? ORDER BY name', [orgId]);
-    return rows.map(r => sj(r.config));
-  }
-
-  async getAllPermissionProfiles(): Promise<AgentPermissionProfile[]> {
-    const rows = await this.db.all<any>('SELECT config FROM permission_profiles ORDER BY name');
-    return rows.map(r => sj(r.config));
-  }
-
-  async deletePermissionProfile(id: string): Promise<void> {
-    await this.db.run('DELETE FROM permission_profiles WHERE id = ?', [id]);
-  }
-
-  // ─── Organizations ──────────────────────────────────
-
-  async upsertOrganization(org: Organization): Promise<void> {
-    await this.db.run(`
-      INSERT INTO organizations (id, name, slug, plan, limits, usage, settings, sso_config, allowed_domains, billing, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(id) DO UPDATE SET
-        name = excluded.name, slug = excluded.slug, plan = excluded.plan,
-        limits = excluded.limits, usage = excluded.usage, settings = excluded.settings,
-        sso_config = excluded.sso_config, allowed_domains = excluded.allowed_domains,
-        billing = excluded.billing, updated_at = excluded.updated_at
-    `, [
-      org.id, org.name, org.slug, org.plan,
-      JSON.stringify(org.limits), JSON.stringify(org.usage),
-      JSON.stringify(org.settings), org.ssoConfig ? JSON.stringify(org.ssoConfig) : null,
-      JSON.stringify(org.allowedDomains), org.billing ? JSON.stringify(org.billing) : null,
-      org.createdAt, org.updatedAt,
-    ]);
-  }
-
-  async getOrganization(id: string): Promise<Organization | null> {
-    const row = await this.db.get<any>('SELECT * FROM organizations WHERE id = ?', [id]);
-    return row ? this.rowToOrg(row) : null;
-  }
-
-  async getOrganizationBySlug(slug: string): Promise<Organization | null> {
-    const row = await this.db.get<any>('SELECT * FROM organizations WHERE slug = ?', [slug]);
-    return row ? this.rowToOrg(row) : null;
-  }
-
-  async listOrganizations(): Promise<Organization[]> {
-    const rows = await this.db.all<any>('SELECT * FROM organizations ORDER BY created_at DESC');
-    return rows.map(r => this.rowToOrg(r));
-  }
-
-  async deleteOrganization(id: string): Promise<void> {
-    await this.db.run('DELETE FROM organizations WHERE id = ?', [id]);
-  }
-
-  // ─── Knowledge Bases ────────────────────────────────
-
-  async upsertKnowledgeBase(kb: KnowledgeBase): Promise<void> {
-    await this.db.run(`
-      INSERT INTO knowledge_bases (id, org_id, name, description, agent_ids, config, stats, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(id) DO UPDATE SET
-        name = excluded.name, description = excluded.description,
-        agent_ids = excluded.agent_ids, config = excluded.config,
-        stats = excluded.stats, updated_at = excluded.updated_at
-    `, [
-      kb.id, kb.orgId, kb.name, kb.description || null,
-      JSON.stringify(kb.agentIds), JSON.stringify(kb.config),
-      JSON.stringify(kb.stats), kb.createdAt, kb.updatedAt,
-    ]);
-  }
-
-  async getKnowledgeBase(id: string): Promise<KnowledgeBase | null> {
-    const row = await this.db.get<any>('SELECT * FROM knowledge_bases WHERE id = ?', [id]);
-    if (!row) return null;
-    const kb: any = {
-      id: row.id, orgId: row.org_id, name: row.name, description: row.description,
-      agentIds: sj(row.agent_ids), clientOrgId: row.client_org_id || null, config: sj(row.config),
-      stats: sj(row.stats), createdAt: row.created_at, updatedAt: row.updated_at,
-      documents: [],
-    };
-    // Load documents
-    kb.documents = await this.getKBDocuments(id);
-    return kb;
-  }
-
-  async getKnowledgeBasesByOrg(orgId: string): Promise<KnowledgeBase[]> {
-    const rows = await this.db.all<any>('SELECT * FROM knowledge_bases WHERE org_id = ? ORDER BY name', [orgId]);
-    return rows.map(r => ({
-      id: r.id, orgId: r.org_id, name: r.name, description: r.description,
-      agentIds: sj(r.agent_ids), clientOrgId: r.client_org_id || null, config: sj(r.config),
-      stats: sj(r.stats), createdAt: r.created_at, updatedAt: r.updated_at,
-      documents: [], // Loaded on demand
-    }));
-  }
-
-  async deleteKnowledgeBase(id: string): Promise<void> {
-    await this.db.run('DELETE FROM knowledge_bases WHERE id = ?', [id]);
-  }
-
-  // ─── KB Documents & Chunks ──────────────────────────
-
-  async insertKBDocument(doc: KBDocument): Promise<void> {
-    await this.db.run(`
-      INSERT INTO kb_documents (id, knowledge_base_id, name, source_type, source_url, mime_type, size, metadata, status, error, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `, [
-      doc.id, doc.knowledgeBaseId, doc.name, doc.sourceType,
-      doc.sourceUrl || null, doc.mimeType, doc.size,
-      JSON.stringify(doc.metadata), doc.status, doc.error || null,
-      doc.createdAt, doc.updatedAt,
-    ]);
-
-    // Insert chunks
-    for (const chunk of doc.chunks) {
-      await this.db.run(`
-        INSERT INTO kb_chunks (id, document_id, content, token_count, position, embedding, metadata)
-        VALUES (?, ?, ?, ?, ?, ?, ?)
-      `, [
-        chunk.id, doc.id, chunk.content, chunk.tokenCount,
-        chunk.position, chunk.embedding ? Buffer.from(new Float32Array(chunk.embedding).buffer) : null,
-        JSON.stringify(chunk.metadata),
-      ]);
-    }
-  }
-
-  async getKBDocuments(kbId: string): Promise<KBDocument[]> {
-    const docs = await this.db.all<any>('SELECT * FROM kb_documents WHERE knowledge_base_id = ?', [kbId]);
-    const result: KBDocument[] = [];
-    for (const d of docs) {
-      const chunks = await this.db.all<any>('SELECT * FROM kb_chunks WHERE document_id = ? ORDER BY position', [d.id]);
-      result.push({
-        id: d.id, knowledgeBaseId: d.knowledge_base_id, name: d.name,
-        sourceType: d.source_type, sourceUrl: d.source_url, mimeType: d.mime_type,
-        size: d.size, metadata: sj(d.metadata), status: d.status, error: d.error,
-        createdAt: d.created_at, updatedAt: d.updated_at,
-        chunks: chunks.map((c: any) => ({
-          id: c.id, documentId: c.document_id, content: c.content,
-          tokenCount: c.token_count, position: c.position,
-          embedding: c.embedding ? Array.from(new Float32Array(c.embedding)) : undefined,
-          metadata: sj(c.metadata),
-        })),
-      });
-    }
-    return result;
-  }
-
-  async deleteKBDocument(docId: string): Promise<void> {
-    await this.db.run('DELETE FROM kb_documents WHERE id = ?', [docId]);
-  }
-
-  // ─── Tool Calls (Activity) ──────────────────────────
-
-  async insertToolCall(record: ToolCallRecord): Promise<void> {
-    await this.db.run(`
-      INSERT INTO tool_calls (id, agent_id, org_id, session_id, tool_id, tool_name, parameters, result, timing, cost, permission, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `, [
-      record.id, record.agentId, record.orgId, record.sessionId || null,
-      record.toolId, record.toolName, JSON.stringify(record.parameters),
-      record.result ? JSON.stringify(record.result) : null,
-      JSON.stringify(record.timing), record.cost ? JSON.stringify(record.cost) : null,
-      JSON.stringify(record.permission), record.timing.startedAt,
-    ]);
-  }
-
-  async updateToolCallResult(id: string, result: ToolCallRecord['result'], timing: ToolCallRecord['timing'], cost?: ToolCallRecord['cost']): Promise<void> {
-    await this.db.run(
-      'UPDATE tool_calls SET result = ?, timing = ?, cost = ? WHERE id = ?',
-      [JSON.stringify(result), JSON.stringify(timing), cost ? JSON.stringify(cost) : null, id]
-    );
-  }
-
-  async getToolCalls(opts: { agentId?: string; orgId?: string; toolId?: string; since?: string; limit?: number }): Promise<ToolCallRecord[]> {
-    const conditions: string[] = [];
-    const params: any[] = [];
-    if (opts.agentId) { conditions.push('agent_id = ?'); params.push(opts.agentId); }
-    if (opts.orgId) { conditions.push('org_id = ?'); params.push(opts.orgId); }
-    if (opts.toolId) { conditions.push('tool_id = ?'); params.push(opts.toolId); }
-    if (opts.since) { conditions.push('created_at >= ?'); params.push(opts.since); }
-    const where = conditions.length > 0 ? 'WHERE ' + conditions.join(' AND ') : '';
-    params.push(opts.limit || 50);
-    const rows = await this.db.all<any>(`SELECT * FROM tool_calls ${where} ORDER BY created_at DESC LIMIT ?`, params);
-    return rows.map(r => ({
-      id: r.id, agentId: r.agent_id, orgId: r.org_id, sessionId: r.session_id,
-      toolId: r.tool_id, toolName: r.tool_name, parameters: sj(r.parameters || '{}'),
-      result: r.result ? sj(r.result) : undefined,
-      timing: sj(r.timing), cost: r.cost ? sj(r.cost) : undefined,
-      permission: sj(r.permission),
-    }));
-  }
-
-  // ─── Activity Events ────────────────────────────────
-
-  async insertActivityEvent(event: ActivityEvent): Promise<void> {
-    await this.db.run(`
-      INSERT INTO activity_events (id, agent_id, org_id, session_id, type, data, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?)
-    `, [event.id, event.agentId, event.orgId, event.sessionId || null, event.type, JSON.stringify(event.data), event.timestamp]);
-  }
-
-  async getActivityEvents(opts: { agentId?: string; orgId?: string; types?: string[]; since?: string; limit?: number }): Promise<ActivityEvent[]> {
-    const conditions: string[] = [];
-    const params: any[] = [];
-    if (opts.agentId) { conditions.push('agent_id = ?'); params.push(opts.agentId); }
-    if (opts.orgId) { conditions.push('org_id = ?'); params.push(opts.orgId); }
-    if (opts.types?.length) { conditions.push(`type IN (${opts.types.map(() => '?').join(',')})`); params.push(...opts.types); }
-    if (opts.since) { conditions.push('created_at >= ?'); params.push(opts.since); }
-    const where = conditions.length > 0 ? 'WHERE ' + conditions.join(' AND ') : '';
-    params.push(opts.limit || 50);
-    const rows = await this.db.all<any>(`SELECT * FROM activity_events ${where} ORDER BY created_at DESC LIMIT ?`, params);
-    return rows.map(r => ({
-      id: r.id, agentId: r.agent_id, orgId: r.org_id, sessionId: r.session_id,
-      type: r.type, data: sj(r.data), timestamp: r.created_at,
-    }));
-  }
-
-  // ─── Conversations ──────────────────────────────────
-
-  async insertConversation(entry: ConversationEntry): Promise<void> {
-    await this.db.run(`
-      INSERT INTO conversations (id, agent_id, session_id, role, content, channel, token_count, tool_calls, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `, [
-      entry.id, entry.agentId, entry.sessionId, entry.role,
-      entry.content, entry.channel || null, entry.tokenCount,
-      entry.toolCalls ? JSON.stringify(entry.toolCalls) : null, entry.timestamp,
-    ]);
-  }
-
-  async getConversation(sessionId: string, limit: number = 50): Promise<ConversationEntry[]> {
-    const rows = await this.db.all<any>(
-      'SELECT * FROM conversations WHERE session_id = ? ORDER BY created_at ASC LIMIT ?',
-      [sessionId, limit]
-    );
-    return rows.map(r => ({
-      id: r.id, agentId: r.agent_id, sessionId: r.session_id, role: r.role,
-      content: r.content, channel: r.channel, tokenCount: r.token_count,
-      toolCalls: r.tool_calls ? sj(r.tool_calls) : undefined, timestamp: r.created_at,
-    }));
-  }
-
-  // ─── Approval Requests ──────────────────────────────
-
-  async insertApprovalRequest(req: ApprovalRequest, orgId: string): Promise<void> {
-    await this.db.run(`
-      INSERT INTO approval_requests (id, agent_id, agent_name, org_id, tool_id, tool_name, reason, risk_level, side_effects, parameters, context, status, decision, expires_at, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `, [
-      req.id, req.agentId, req.agentName, orgId, req.toolId, req.toolName,
-      req.reason, req.riskLevel, JSON.stringify(req.sideEffects),
-      req.parameters ? JSON.stringify(req.parameters) : null, req.context || null,
-      req.status, req.decision ? JSON.stringify(req.decision) : null,
-      req.expiresAt, req.createdAt,
-    ]);
-  }
-
-  async updateApprovalRequest(id: string, status: string, decision?: any): Promise<void> {
-    await this.db.run(
-      'UPDATE approval_requests SET status = ?, decision = ? WHERE id = ?',
-      [status, decision ? JSON.stringify(decision) : null, id]
-    );
-  }
-
-  async getApprovalRequests(opts: { orgId?: string; status?: string; agentId?: string; limit?: number }): Promise<ApprovalRequest[]> {
-    const conditions: string[] = [];
-    const params: any[] = [];
-    if (opts.orgId) { conditions.push('org_id = ?'); params.push(opts.orgId); }
-    if (opts.status) { conditions.push('status = ?'); params.push(opts.status); }
-    if (opts.agentId) { conditions.push('agent_id = ?'); params.push(opts.agentId); }
-    const where = conditions.length > 0 ? 'WHERE ' + conditions.join(' AND ') : '';
-    params.push(opts.limit || 50);
-    const rows = await this.db.all<any>(`SELECT * FROM approval_requests ${where} ORDER BY created_at DESC LIMIT ?`, params);
-    return rows.map(r => ({
-      id: r.id, agentId: r.agent_id, agentName: r.agent_name, toolId: r.tool_id,
-      toolName: r.tool_name, reason: r.reason, riskLevel: r.risk_level,
-      sideEffects: sj(r.side_effects), parameters: r.parameters ? sj(r.parameters) : undefined,
-      context: r.context, status: r.status,
-      decision: r.decision ? sj(r.decision) : undefined,
-      createdAt: r.created_at, expiresAt: r.expires_at,
-    }));
-  }
-
-  // ─── Approval Policies ──────────────────────────────
-
-  async upsertApprovalPolicy(orgId: string, policy: ApprovalPolicy): Promise<void> {
-    await this.db.run(`
-      INSERT INTO approval_policies (id, org_id, name, description, triggers, approvers, timeout, notify, enabled, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(id) DO UPDATE SET
-        name = excluded.name, description = excluded.description,
-        triggers = excluded.triggers, approvers = excluded.approvers,
-        timeout = excluded.timeout, notify = excluded.notify,
-        enabled = excluded.enabled, updated_at = excluded.updated_at
-    `, [
-      policy.id, orgId, policy.name, policy.description || null,
-      JSON.stringify(policy.triggers), JSON.stringify(policy.approvers),
-      JSON.stringify(policy.timeout), JSON.stringify(policy.notify),
-      policy.enabled ? 1 : 0, new Date().toISOString(), new Date().toISOString(),
-    ]);
-  }
-
-  async getApprovalPolicies(orgId: string): Promise<ApprovalPolicy[]> {
-    const rows = await this.db.all<any>('SELECT * FROM approval_policies WHERE org_id = ? ORDER BY name', [orgId]);
-    return rows.map(r => ({
-      id: r.id, name: r.name, description: r.description,
-      triggers: sj(r.triggers), approvers: sj(r.approvers),
-      timeout: sj(r.timeout), notify: sj(r.notify),
-      enabled: !!r.enabled,
-    }));
-  }
-
-  async getAllApprovalPolicies(): Promise<ApprovalPolicy[]> {
-    const rows = await this.db.all<any>('SELECT * FROM approval_policies WHERE enabled = TRUE ORDER BY name');
-    return rows.map(r => ({
-      id: r.id, name: r.name, description: r.description,
-      triggers: sj(r.triggers), approvers: sj(r.approvers),
-      timeout: sj(r.timeout), notify: sj(r.notify),
-      enabled: !!r.enabled,
-    }));
-  }
-
-  async deleteApprovalPolicy(id: string): Promise<void> {
-    await this.db.run('DELETE FROM approval_policies WHERE id = ?', [id]);
-  }
-
-  // ─── SSO Integrations ─────────────────────────────
-
-  async upsertSsoIntegration(integration: {
-    id: string; orgId: string; providerType: string; name: string;
-    enabled: boolean; config: Record<string, any>; metadataUrl?: string;
-  }): Promise<void> {
-    await this.db.run(`
-      INSERT INTO sso_integrations (id, org_id, provider_type, name, enabled, config, metadata_url, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(id) DO UPDATE SET
-        name = excluded.name, enabled = excluded.enabled,
-        config = excluded.config, metadata_url = excluded.metadata_url,
-        updated_at = excluded.updated_at
-    `, [
-      integration.id, integration.orgId, integration.providerType,
-      integration.name, integration.enabled ? 1 : 0,
-      JSON.stringify(integration.config), integration.metadataUrl || null,
-      new Date().toISOString(), new Date().toISOString(),
-    ]);
-  }
-
-  async getSsoIntegration(id: string): Promise<any | null> {
-    const row = await this.db.get<any>('SELECT * FROM sso_integrations WHERE id = ?', [id]);
-    return row ? this.rowToSso(row) : null;
-  }
-
-  async getSsoIntegrationsByOrg(orgId: string): Promise<any[]> {
-    const rows = await this.db.all<any>('SELECT * FROM sso_integrations WHERE org_id = ? ORDER BY name', [orgId]);
-    return rows.map(r => this.rowToSso(r));
-  }
-
-  async getSsoIntegrationByType(orgId: string, providerType: string): Promise<any | null> {
-    const row = await this.db.get<any>('SELECT * FROM sso_integrations WHERE org_id = ? AND provider_type = ? AND enabled = TRUE', [orgId, providerType]);
-    return row ? this.rowToSso(row) : null;
-  }
-
-  async deleteSsoIntegration(id: string): Promise<void> {
-    await this.db.run('DELETE FROM sso_integrations WHERE id = ?', [id]);
-  }
-
-  private rowToSso(row: any) {
-    return {
-      id: row.id, orgId: row.org_id, providerType: row.provider_type,
-      name: row.name, enabled: !!row.enabled, config: sj(row.config),
-      metadataUrl: row.metadata_url, createdAt: row.created_at, updatedAt: row.updated_at,
-    };
-  }
-
-  // ─── OIDC State Tracking ─────────────────────────
-
-  async saveOidcState(state: string, providerId: string, opts: {
-    redirectUri?: string; nonce?: string; codeVerifier?: string; ttlSeconds?: number;
-  }): Promise<void> {
-    const expiresAt = new Date(Date.now() + (opts.ttlSeconds || 600) * 1000).toISOString();
-    await this.db.run(`
-      INSERT INTO oidc_states (state, provider_id, redirect_uri, nonce, code_verifier, created_at, expires_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?)
-    `, [state, providerId, opts.redirectUri || null, opts.nonce || null, opts.codeVerifier || null, new Date().toISOString(), expiresAt]);
-  }
-
-  async getOidcState(state: string): Promise<{
-    state: string; providerId: string; redirectUri?: string; nonce?: string; codeVerifier?: string; expiresAt: string;
-  } | null> {
-    const row = await this.db.get<any>('SELECT * FROM oidc_states WHERE state = ?', [state]);
-    if (!row) return null;
-    // Check expiry
-    if (new Date(row.expires_at) < new Date()) {
-      await this.db.run('DELETE FROM oidc_states WHERE state = ?', [state]);
-      return null;
-    }
-    return {
-      state: row.state, providerId: row.provider_id, redirectUri: row.redirect_uri,
-      nonce: row.nonce, codeVerifier: row.code_verifier, expiresAt: row.expires_at,
-    };
-  }
-
-  async deleteOidcState(state: string): Promise<void> {
-    await this.db.run('DELETE FROM oidc_states WHERE state = ?', [state]);
-  }
-
-  async cleanupExpiredOidcStates(): Promise<void> {
-    await this.db.run('DELETE FROM oidc_states WHERE expires_at < ?', [new Date().toISOString()]);
-  }
-
-  // ─── Deploy Credentials ─────────────────────────
-
-  async upsertDeployCredential(cred: {
-    id: string; orgId: string; name: string; targetType: string;
-    config: Record<string, any>; createdBy: string;
-  }): Promise<void> {
-    await this.db.run(`
-      INSERT INTO deploy_credentials (id, org_id, name, target_type, config, created_by, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(id) DO UPDATE SET
-        name = excluded.name, target_type = excluded.target_type,
-        config = excluded.config, updated_at = excluded.updated_at
-    `, [
-      cred.id, cred.orgId, cred.name, cred.targetType,
-      JSON.stringify(cred.config), cred.createdBy,
-      new Date().toISOString(), new Date().toISOString(),
-    ]);
-  }
-
-  async getDeployCredential(id: string): Promise<any | null> {
-    const row = await this.db.get<any>('SELECT * FROM deploy_credentials WHERE id = ?', [id]);
-    return row ? this.rowToDeployCred(row) : null;
-  }
-
-  async getDeployCredentialsByOrg(orgId: string): Promise<any[]> {
-    const rows = await this.db.all<any>('SELECT * FROM deploy_credentials WHERE org_id = ? ORDER BY name', [orgId]);
-    return rows.map(r => this.rowToDeployCred(r));
-  }
-
-  async getDeployCredentialsByType(orgId: string, targetType: string): Promise<any[]> {
-    const rows = await this.db.all<any>('SELECT * FROM deploy_credentials WHERE org_id = ? AND target_type = ?', [orgId, targetType]);
-    return rows.map(r => this.rowToDeployCred(r));
-  }
-
-  async deleteDeployCredential(id: string): Promise<void> {
-    await this.db.run('DELETE FROM deploy_credentials WHERE id = ?', [id]);
-  }
-
-  private rowToDeployCred(row: any) {
-    return {
-      id: row.id, orgId: row.org_id, name: row.name, targetType: row.target_type,
-      config: sj(row.config), createdBy: row.created_by,
-      createdAt: row.created_at, updatedAt: row.updated_at,
-    };
-  }
-
-  // ─── Aggregate Stats ───────────────────────────────
-
-  async getEngineStats(orgId: string): Promise<{
-    totalManagedAgents: number;
-    runningAgents: number;
-    totalToolCallsToday: number;
-    totalActivityToday: number;
-    pendingApprovals: number;
-    totalKnowledgeBases: number;
-  }> {
-    const today = new Date().toISOString().split('T')[0];
-
-    const [agents, running, toolCalls, activity, approvals, kbs] = await Promise.all([
-      this.db.get<any>('SELECT COUNT(*) as c FROM managed_agents WHERE org_id = ?', [orgId]),
-      this.db.get<any>('SELECT COUNT(*) as c FROM managed_agents WHERE org_id = ? AND state = ?', [orgId, 'running']),
-      this.db.get<any>('SELECT COUNT(*) as c FROM tool_calls WHERE org_id = ? AND created_at >= ?', [orgId, today]),
-      this.db.get<any>('SELECT COUNT(*) as c FROM activity_events WHERE org_id = ? AND created_at >= ?', [orgId, today]),
-      this.db.get<any>('SELECT COUNT(*) as c FROM approval_requests WHERE org_id = ? AND status = ?', [orgId, 'pending']),
-      this.db.get<any>('SELECT COUNT(*) as c FROM knowledge_bases WHERE org_id = ?', [orgId]),
-    ]);
-
-    return {
-      totalManagedAgents: agents?.c || 0,
-      runningAgents: running?.c || 0,
-      totalToolCallsToday: toolCalls?.c || 0,
-      totalActivityToday: activity?.c || 0,
-      pendingApprovals: approvals?.c || 0,
-      totalKnowledgeBases: kbs?.c || 0,
-    };
-  }
-
-  /**
-   * Cleanup old data based on retention
-   */
-  async cleanup(retainDays: number): Promise<{ toolCalls: number; events: number; conversations: number }> {
-    const cutoff = new Date(Date.now() - retainDays * 86_400_000).toISOString();
-
-    const tc = await this.db.get<any>('SELECT COUNT(*) as c FROM tool_calls WHERE created_at < ?', [cutoff]);
-    const ev = await this.db.get<any>('SELECT COUNT(*) as c FROM activity_events WHERE created_at < ?', [cutoff]);
-    const cv = await this.db.get<any>('SELECT COUNT(*) as c FROM conversations WHERE created_at < ?', [cutoff]);
-
-    await this.db.run('DELETE FROM tool_calls WHERE created_at < ?', [cutoff]);
-    await this.db.run('DELETE FROM activity_events WHERE created_at < ?', [cutoff]);
-    await this.db.run('DELETE FROM conversations WHERE created_at < ?', [cutoff]);
-
-    return {
-      toolCalls: tc?.c || 0,
-      events: ev?.c || 0,
-      conversations: cv?.c || 0,
-    };
-  }
-
-  // ─── Community Skill Index ──────────────────────────
-
-  async upsertCommunitySkill(skill: {
-    id: string; name: string; description: string; version: string;
-    author: string; repository: string; license: string;
-    category?: string; risk?: string; icon?: string;
-    tags?: string[]; tools?: any[]; configSchema?: Record<string, any>;
-    minEngineVersion?: string; homepage?: string;
-    downloads?: number; rating?: number; ratingCount?: number;
-    verified?: boolean; featured?: boolean;
-  }): Promise<void> {
-    const now = new Date().toISOString();
-    await this.db.run(`
-      INSERT INTO community_skill_index (id, name, description, version, author, repository, license, category, risk, icon, tags, tools, config_schema, min_engine_version, homepage, downloads, rating, rating_count, verified, featured, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(id) DO UPDATE SET
-        name = excluded.name, description = excluded.description, version = excluded.version,
-        author = excluded.author, repository = excluded.repository, license = excluded.license,
-        category = excluded.category, risk = excluded.risk, icon = excluded.icon,
-        tags = excluded.tags, tools = excluded.tools, config_schema = excluded.config_schema,
-        min_engine_version = excluded.min_engine_version, homepage = excluded.homepage,
-        downloads = excluded.downloads, rating = excluded.rating, rating_count = excluded.rating_count,
-        verified = excluded.verified, featured = excluded.featured,
-        updated_at = excluded.updated_at
-    `, [
-      skill.id, skill.name, skill.description, skill.version,
-      skill.author, skill.repository, skill.license,
-      skill.category || null, skill.risk || 'medium', skill.icon || null,
-      JSON.stringify(skill.tags || []), JSON.stringify(skill.tools || []),
-      JSON.stringify(skill.configSchema || {}), skill.minEngineVersion || null,
-      skill.homepage || null, skill.downloads || 0, skill.rating || 0,
-      skill.ratingCount || 0, skill.verified ? 1 : 0, skill.featured ? 1 : 0,
-      now, now,
-    ]);
-  }
-
-  async getCommunitySkill(id: string): Promise<any | null> {
-    const row = await this.db.get<any>('SELECT * FROM community_skill_index WHERE id = ?', [id]);
-    return row ? this.rowToCommunitySkill(row) : null;
-  }
-
-  async getAllCommunitySkills(opts?: {
-    category?: string; risk?: string; tag?: string; author?: string;
-    verified?: boolean; featured?: boolean;
-    search?: string; sortBy?: string; order?: string;
-    limit?: number; offset?: number;
-  }): Promise<{ skills: any[]; total: number }> {
-    const conditions: string[] = [];
-    const params: any[] = [];
-
-    if (opts?.category) { conditions.push('category = ?'); params.push(opts.category); }
-    if (opts?.risk) { conditions.push('risk = ?'); params.push(opts.risk); }
-    if (opts?.author) { conditions.push('author = ?'); params.push(opts.author); }
-    if (opts?.verified !== undefined) { conditions.push('verified = ?'); params.push(opts.verified ? 1 : 0); }
-    if (opts?.featured !== undefined) { conditions.push('featured = ?'); params.push(opts.featured ? 1 : 0); }
-    if (opts?.tag) { conditions.push("tags LIKE ?"); params.push(`%"${opts.tag}"%`); }
-    if (opts?.search) {
-      conditions.push('(name LIKE ? OR description LIKE ? OR author LIKE ?)');
-      const q = `%${opts.search}%`;
-      params.push(q, q, q);
-    }
-
-    const where = conditions.length > 0 ? 'WHERE ' + conditions.join(' AND ') : '';
-    const sortCol = opts?.sortBy === 'popular' ? 'downloads' : opts?.sortBy === 'rating' ? 'rating' : opts?.sortBy === 'name' ? 'name' : 'created_at';
-    const sortOrder = opts?.order === 'asc' ? 'ASC' : 'DESC';
-    const limit = opts?.limit || 50;
-    const offset = opts?.offset || 0;
-
-    const countRow = await this.db.get<any>(`SELECT COUNT(*) as c FROM community_skill_index ${where}`, params);
-    const rows = await this.db.all<any>(
-      `SELECT * FROM community_skill_index ${where} ORDER BY ${sortCol} ${sortOrder} LIMIT ? OFFSET ?`,
-      [...params, limit, offset],
-    );
-
-    return { skills: rows.map((r: any) => this.rowToCommunitySkill(r)), total: countRow?.c || 0 };
-  }
-
-  async deleteCommunitySkill(id: string): Promise<void> {
-    await this.db.run('DELETE FROM community_skill_index WHERE id = ?', [id]);
-  }
-
-  async incrementDownloads(skillId: string): Promise<void> {
-    await this.db.run('UPDATE community_skill_index SET downloads = downloads + 1 WHERE id = ?', [skillId]);
-  }
-
-  // ─── Community Skill Installed ──────────────────────
-
-  async upsertInstalledSkill(install: {
-    id: string; orgId: string; skillId: string; version: string;
-    enabled: boolean; config: Record<string, any>; installedBy: string;
-  }): Promise<void> {
-    const now = new Date().toISOString();
-    await this.db.run(`
-      INSERT INTO community_skill_installed (id, org_id, skill_id, version, enabled, config, installed_by, installed_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(id) DO UPDATE SET
-        version = excluded.version, enabled = excluded.enabled,
-        config = excluded.config, updated_at = excluded.updated_at
-    `, [
-      install.id, install.orgId, install.skillId, install.version,
-      install.enabled ? 1 : 0, JSON.stringify(install.config),
-      install.installedBy, now, now,
-    ]);
-  }
-
-  async getInstalledSkill(orgId: string, skillId: string): Promise<any | null> {
-    const row = await this.db.get<any>(
-      'SELECT * FROM community_skill_installed WHERE org_id = ? AND skill_id = ?',
-      [orgId, skillId],
-    );
-    return row ? this.rowToInstalledSkill(row) : null;
-  }
-
-  async getInstalledSkillsByOrg(orgId: string): Promise<any[]> {
-    const rows = await this.db.all<any>(
-      'SELECT * FROM community_skill_installed WHERE org_id = ? ORDER BY installed_at DESC',
-      [orgId],
-    );
-    return rows.map((r: any) => this.rowToInstalledSkill(r));
-  }
-
-  async deleteInstalledSkill(orgId: string, skillId: string): Promise<void> {
-    await this.db.run(
-      'DELETE FROM community_skill_installed WHERE org_id = ? AND skill_id = ?',
-      [orgId, skillId],
-    );
-  }
-
-  // ─── Community Skill Reviews ────────────────────────
-
-  async insertReview(review: {
-    id: string; skillId: string; userId: string; userName?: string;
-    rating: number; reviewText?: string;
-  }): Promise<void> {
-    // Check if user already reviewed this skill — update instead of duplicate
-    const existing = await this.db.get<any>(
-      'SELECT id FROM community_skill_reviews WHERE skill_id = ? AND user_id = ?',
-      [review.skillId, review.userId],
-    );
-    if (existing) {
-      await this.db.run(`
-        UPDATE community_skill_reviews SET rating = ?, review_text = ?, user_name = ?, created_at = ? WHERE id = ?
-      `, [review.rating, review.reviewText || null, review.userName || null, new Date().toISOString(), existing.id]);
-    } else {
-      await this.db.run(`
-        INSERT INTO community_skill_reviews (id, skill_id, org_id, user_id, user_name, rating, review_text, created_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-      `, [
-        review.id, review.skillId, 'global', review.userId, review.userName || null,
-        review.rating, review.reviewText || null, new Date().toISOString(),
-      ]);
-    }
-  }
-
-  async getReviews(skillId: string, limit: number = 50): Promise<any[]> {
-    const rows = await this.db.all<any>(
-      'SELECT * FROM community_skill_reviews WHERE skill_id = ? ORDER BY created_at DESC LIMIT ?',
-      [skillId, limit],
-    );
-    return rows.map((r: any) => ({
-      id: r.id, skillId: r.skill_id, userId: r.user_id,
-      userName: r.user_name || undefined, rating: r.rating,
-      reviewText: r.review_text, createdAt: r.created_at,
-    }));
-  }
-
-  async getAverageRating(skillId: string): Promise<{ avg: number; count: number }> {
-    const row = await this.db.get<any>(
-      'SELECT AVG(rating) as avg, COUNT(*) as count FROM community_skill_reviews WHERE skill_id = ?',
-      [skillId],
-    );
-    return { avg: row?.avg || 0, count: row?.count || 0 };
-  }
-
-  // ─── Row Mappers ────────────────────────────────────
-
-  private rowToCommunitySkill(row: any) {
-    return {
-      id: row.id, name: row.name, description: row.description, version: row.version,
-      author: row.author, repository: row.repository, license: row.license,
-      category: row.category, risk: row.risk, icon: row.icon,
-      tags: sj(row.tags || '[]'), tools: sj(row.tools || '[]'),
-      configSchema: sj(row.config_schema || '{}'),
-      minEngineVersion: row.min_engine_version, homepage: row.homepage,
-      downloads: row.downloads, rating: row.rating, ratingCount: row.rating_count,
-      verified: !!row.verified, featured: !!row.featured,
-      createdAt: row.created_at, updatedAt: row.updated_at,
-    };
-  }
-
-  private rowToInstalledSkill(row: any) {
-    return {
-      id: row.id, orgId: row.org_id, skillId: row.skill_id, version: row.version,
-      enabled: !!row.enabled, config: sj(row.config || '{}'),
-      installedBy: row.installed_by, installedAt: row.installed_at, updatedAt: row.updated_at,
-    };
-  }
-
-  private rowToManagedAgent(row: any): ManagedAgent {
-    const config = sj(row.config);
-    const agent: ManagedAgent = {
-      id: row.id,
-      name: row.display_name || row.name || config?.displayName || config?.name || row.id,
-      displayName: row.display_name || config?.displayName || config?.name,
-      display_name: row.display_name || config?.displayName || config?.name,
-      orgId: row.org_id,
-      config,
-      state: row.state,
-      stateHistory: [], // Loaded separately via getStateHistory
-      health: sj(row.health || '{}'),
-      usage: sj(row.usage || '{}'),
-      createdAt: row.created_at,
-      updatedAt: row.updated_at,
-      lastDeployedAt: row.last_deployed_at,
-      lastHealthCheckAt: row.last_health_check_at,
-      version: row.version,
-    };
-    // Map client_org_id
-    if (row.client_org_id) {
-      (agent as any).client_org_id = row.client_org_id;
-    }
-    // Read budgetConfig from dedicated column (not config JSON)
-    const bc = sj(row.budget_config || '{}');
-    if (bc && Object.keys(bc).length > 0) {
-      agent.budgetConfig = bc;
-    } else if ((config as any)?.budgetConfig) {
-      // Fallback: migrate from config JSON if budget_config column is empty
-      agent.budgetConfig = (config as any).budgetConfig;
-    }
-    return agent;
-  }
-
-  private rowToOrg(row: any): Organization {
-    return {
-      id: row.id,
-      name: row.name,
-      slug: row.slug,
-      plan: row.plan as OrgPlan,
-      limits: sj(row.limits || '{}'),
-      usage: sj(row.usage || '{}'),
-      settings: sj(row.settings || '{}'),
-      ssoConfig: row.sso_config ? sj(row.sso_config) : undefined,
-      allowedDomains: sj(row.allowed_domains || '[]'),
-      billing: row.billing ? sj(row.billing) : undefined,
-      createdAt: row.created_at,
-      updatedAt: row.updated_at,
-    };
-  }
-}