@agenticmail/enterprise 0.5.327 → 0.5.329

package/src/db/proxy.ts

@@ -1,39 +0,0 @@
-/**
- * Database Adapter Proxy — Hot-Swap Support
- *
- * Creates a transparent JS Proxy wrapper around any DatabaseAdapter.
- * All method calls delegate to the current underlying adapter.
- * When swapped via __swap(), all existing references seamlessly
- * use the new adapter — no restart required.
- */
-
-import type { DatabaseAdapter } from './adapter.js';
-
-export interface DbProxy extends DatabaseAdapter {
-  /** Swap the underlying adapter. Returns the previous one. */
-  __swap(adapter: DatabaseAdapter): DatabaseAdapter;
-  /** Access the current underlying adapter. */
-  __target: DatabaseAdapter;
-}
-
-export function createDbProxy(initial: DatabaseAdapter): DbProxy {
-  let target = initial;
-
-  const proxy = new Proxy({} as any, {
-    get(_, prop) {
-      if (prop === '__swap') {
-        return (newAdapter: DatabaseAdapter) => {
-          const old = target;
-          target = newAdapter;
-          return old;
-        };
-      }
-      if (prop === '__target') return target;
-
-      const val = (target as any)[prop];
-      return typeof val === 'function' ? val.bind(target) : val;
-    },
-  });
-
-  return proxy as DbProxy;
-}

package/src/db/resolve-driver.ts

@@ -1,29 +0,0 @@
-/**
- * Resolve a native driver module using multiple strategies.
- * Works even when running from npx cache where ESM import() can't find
- * packages installed in cwd.
- */
-
-import { createRequire } from 'module';
-import { join } from 'path';
-
-export async function resolveDriver(name: string, errorMessage: string): Promise<any> {
-  // 1. Standard ESM import
-  try { return await import(name); } catch {}
-
-  // 2. CJS require from cwd (covers npm install in user's directory)
-  try {
-    const req = createRequire(join(process.cwd(), 'index.js'));
-    return req(name);
-  } catch {}
-
-  // 3. CJS require from global prefix
-  try {
-    const { execSync } = await import('child_process');
-    const globalPrefix = execSync('npm prefix -g', { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
-    const req = createRequire(join(globalPrefix, 'lib', 'node_modules', '.package-lock.json'));
-    return req(name);
-  } catch {}
-
-  throw new Error(errorMessage);
-}

package/src/db/sql-schema.ts

@@ -1,124 +0,0 @@
-/**
- * Shared SQL schema for Postgres, MySQL, SQLite, CockroachDB, etc.
- * Each adapter translates these to dialect-specific DDL.
- */
-
-export const TABLES = {
-  company: `
-    CREATE TABLE IF NOT EXISTS company_settings (
-      id TEXT PRIMARY KEY DEFAULT 'default',
-      name TEXT NOT NULL,
-      domain TEXT,
-      subdomain TEXT NOT NULL UNIQUE,
-      smtp_host TEXT,
-      smtp_port INTEGER,
-      smtp_user TEXT,
-      smtp_pass TEXT,
-      dkim_private_key TEXT,
-      logo_url TEXT,
-      primary_color TEXT DEFAULT '#6366f1',
-      sso_config TEXT DEFAULT '{}',
-      plan TEXT NOT NULL DEFAULT 'self-hosted',
-      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-      updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
-    )`,
-
-  agents: `
-    CREATE TABLE IF NOT EXISTS agents (
-      id TEXT PRIMARY KEY,
-      name TEXT NOT NULL UNIQUE,
-      email TEXT NOT NULL UNIQUE,
-      role TEXT NOT NULL DEFAULT 'assistant',
-      status TEXT NOT NULL DEFAULT 'active',
-      metadata TEXT DEFAULT '{}',
-      created_by TEXT NOT NULL,
-      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-      updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
-    )`,
-
-  users: `
-    CREATE TABLE IF NOT EXISTS users (
-      id TEXT PRIMARY KEY,
-      email TEXT NOT NULL UNIQUE,
-      name TEXT NOT NULL,
-      role TEXT NOT NULL DEFAULT 'member',
-      password_hash TEXT,
-      sso_provider TEXT,
-      sso_subject TEXT,
-      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-      updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-      last_login_at TIMESTAMP
-    )`,
-
-  audit_log: `
-    CREATE TABLE IF NOT EXISTS audit_log (
-      id TEXT PRIMARY KEY,
-      timestamp TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-      actor TEXT NOT NULL,
-      actor_type TEXT NOT NULL DEFAULT 'user',
-      action TEXT NOT NULL,
-      resource TEXT NOT NULL,
-      details TEXT DEFAULT '{}',
-      ip TEXT
-    )`,
-
-  api_keys: `
-    CREATE TABLE IF NOT EXISTS api_keys (
-      id TEXT PRIMARY KEY,
-      name TEXT NOT NULL,
-      key_hash TEXT NOT NULL,
-      key_prefix TEXT NOT NULL,
-      scopes TEXT NOT NULL DEFAULT '[]',
-      created_by TEXT NOT NULL,
-      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-      last_used_at TIMESTAMP,
-      expires_at TIMESTAMP,
-      revoked INTEGER NOT NULL DEFAULT 0
-    )`,
-
-  email_rules: `
-    CREATE TABLE IF NOT EXISTS email_rules (
-      id TEXT PRIMARY KEY,
-      name TEXT NOT NULL,
-      agent_id TEXT,
-      conditions TEXT NOT NULL DEFAULT '{}',
-      actions TEXT NOT NULL DEFAULT '{}',
-      priority INTEGER NOT NULL DEFAULT 0,
-      enabled INTEGER NOT NULL DEFAULT 1,
-      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-      updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
-    )`,
-
-  retention_policy: `
-    CREATE TABLE IF NOT EXISTS retention_policy (
-      id TEXT PRIMARY KEY DEFAULT 'default',
-      enabled INTEGER NOT NULL DEFAULT 0,
-      retain_days INTEGER NOT NULL DEFAULT 365,
-      exclude_tags TEXT DEFAULT '[]',
-      archive_first INTEGER NOT NULL DEFAULT 1
-    )`,
-
-  // Indexes
-  indexes: [
-    'CREATE INDEX IF NOT EXISTS idx_agents_status ON agents(status)',
-    'CREATE INDEX IF NOT EXISTS idx_agents_name ON agents(name)',
-    'CREATE INDEX IF NOT EXISTS idx_users_email ON users(email)',
-    'CREATE INDEX IF NOT EXISTS idx_users_sso ON users(sso_provider, sso_subject)',
-    'CREATE INDEX IF NOT EXISTS idx_audit_timestamp ON audit_log(timestamp)',
-    'CREATE INDEX IF NOT EXISTS idx_audit_actor ON audit_log(actor)',
-    'CREATE INDEX IF NOT EXISTS idx_audit_action ON audit_log(action)',
-    'CREATE INDEX IF NOT EXISTS idx_api_keys_hash ON api_keys(key_hash)',
-    'CREATE INDEX IF NOT EXISTS idx_api_keys_prefix ON api_keys(key_prefix)',
-    'CREATE INDEX IF NOT EXISTS idx_email_rules_agent ON email_rules(agent_id)',
-  ],
-};
-
-export function getAllCreateStatements(): string[] {
-  const stmts: string[] = [];
-  for (const [key, value] of Object.entries(TABLES)) {
-    if (key === 'indexes') continue;
-    stmts.push(value as string);
-  }
-  stmts.push(...TABLES.indexes);
-  return stmts;
-}

package/src/db/sqlite.ts

@@ -1,493 +0,0 @@
-/**
- * SQLite Database Adapter
- * 
- * For development, small teams, or self-hosted single-server deployments.
- * Uses better-sqlite3 for sync performance.
- */
-
-import { randomUUID, createHash } from 'crypto';
-import {
-  DatabaseAdapter, DatabaseConfig,
-  Agent, AgentInput, User, UserInput,
-  AuditEvent, AuditFilters, ApiKey, ApiKeyInput,
-  EmailRule, RetentionPolicy, CompanySettings,
-} from './adapter.js';
-import { getAllCreateStatements } from './sql-schema.js';
-
-let Database: any;
-
-async function getSqlite() {
-  if (!Database) {
-    try {
-      const { resolveDriver } = await import("./resolve-driver.js"); const mod = await resolveDriver("better-sqlite3", "SQLite driver not found. Install it: npm install better-sqlite3");
-      Database = mod.default;
-    } catch {
-      throw new Error('SQLite driver not found. Install it: npm install better-sqlite3');
-    }
-  }
-  return Database;
-}
-
-export class SqliteAdapter extends DatabaseAdapter {
-  readonly type = 'sqlite' as const;
-  private db: any = null;
-
-  async connect(config: DatabaseConfig): Promise<void> {
-    const Db = await getSqlite();
-    const path = config.connectionString || config.database || './agenticmail-enterprise.db';
-    this.db = new Db(path);
-    this.db.pragma('journal_mode = WAL');
-    this.db.pragma('foreign_keys = ON');
-  }
-
-  async disconnect(): Promise<void> {
-    if (this.db) this.db.close();
-  }
-
-  isConnected(): boolean {
-    return this.db !== null;
-  }
-
-  async migrate(): Promise<void> {
-    const stmts = getAllCreateStatements();
-    const tx = this.db.transaction(() => {
-      for (const stmt of stmts) this.db.exec(stmt);
-      // Seed defaults
-      this.db.prepare(
-        `INSERT OR IGNORE INTO retention_policy (id) VALUES ('default')`
-      ).run();
-      this.db.prepare(
-        `INSERT OR IGNORE INTO company_settings (id, name, subdomain) VALUES ('default', 'My Company', 'my-company')`
-      ).run();
-      // Add permissions column if missing
-      try { this.db.exec(`ALTER TABLE users ADD COLUMN permissions TEXT DEFAULT '"*"'`); } catch { /* exists */ }
-      try { this.db.exec(`ALTER TABLE users ADD COLUMN must_reset_password INTEGER DEFAULT 0`); } catch { /* exists */ }
-      try { this.db.exec(`ALTER TABLE users ADD COLUMN is_active INTEGER DEFAULT 1`); } catch { /* exists */ }
-      try { this.db.exec(`ALTER TABLE users ADD COLUMN client_org_id TEXT`); } catch { /* exists */ }
-      try { this.db.exec(`ALTER TABLE agents ADD COLUMN billing_rate REAL DEFAULT 0`); } catch { /* exists */ }
-      // ─── Client Organizations ────────────────────────────
-      this.db.exec(`
-        CREATE TABLE IF NOT EXISTS client_organizations (
-          id TEXT PRIMARY KEY,
-          name TEXT NOT NULL,
-          slug TEXT NOT NULL UNIQUE,
-          contact_name TEXT,
-          contact_email TEXT,
-          description TEXT,
-          is_active INTEGER DEFAULT 1,
-          settings TEXT DEFAULT '{}',
-          created_at TEXT DEFAULT (datetime('now')),
-          updated_at TEXT DEFAULT (datetime('now'))
-        );
-      `);
-      try { this.db.exec(`ALTER TABLE client_organizations ADD COLUMN billing_rate_per_agent REAL DEFAULT 0`); } catch { /* exists */ }
-      try { this.db.exec(`ALTER TABLE client_organizations ADD COLUMN currency TEXT DEFAULT 'USD'`); } catch { /* exists */ }
-      try { this.db.exec(`ALTER TABLE agents ADD COLUMN client_org_id TEXT REFERENCES client_organizations(id)`); } catch { /* exists */ }
-      this.db.exec(`CREATE TABLE IF NOT EXISTS org_billing_records (
-        id TEXT PRIMARY KEY, org_id TEXT NOT NULL, agent_id TEXT, month TEXT NOT NULL,
-        revenue REAL DEFAULT 0, token_cost REAL DEFAULT 0, input_tokens INTEGER DEFAULT 0,
-        output_tokens INTEGER DEFAULT 0, notes TEXT, created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-        updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP, UNIQUE(org_id, agent_id, month)
-      )`);
-      this.db.exec(`
-        CREATE TABLE IF NOT EXISTS agent_knowledge_access (
-          id TEXT PRIMARY KEY,
-          agent_id TEXT NOT NULL,
-          knowledge_base_id TEXT NOT NULL,
-          access_type TEXT NOT NULL DEFAULT 'read',
-          created_at TEXT DEFAULT (datetime('now')),
-          UNIQUE(agent_id, knowledge_base_id)
-        );
-      `);
-    });
-    tx();
-  }
-
-  // ─── Engine Integration ──────────────────────────────────
-
-  getEngineDB() {
-    if (!this.db) return null;
-    const db = this.db;
-    return {
-      run: async (sql: string, params?: any[]) => { db.prepare(sql).run(...(params || [])); },
-      get: async <T = any>(sql: string, params?: any[]): Promise<T | undefined> => {
-        return db.prepare(sql).get(...(params || [])) as T | undefined;
-      },
-      all: async <T = any>(sql: string, params?: any[]): Promise<T[]> => {
-        return db.prepare(sql).all(...(params || [])) as T[];
-      },
-    };
-  }
-
-  // ─── Company ─────────────────────────────────────────────
-
-  async getSettings(): Promise<CompanySettings> {
-    const r = this.db.prepare('SELECT * FROM company_settings WHERE id = ?').get('default');
-    return r ? this.mapSettings(r) : null!;
-  }
-
-  async updateSettings(updates: Partial<CompanySettings>): Promise<CompanySettings> {
-    const map: Record<string, string> = {
-      name: 'name', domain: 'domain', subdomain: 'subdomain',
-      smtpHost: 'smtp_host', smtpPort: 'smtp_port', smtpUser: 'smtp_user',
-      smtpPass: 'smtp_pass', dkimPrivateKey: 'dkim_private_key',
-      logoUrl: 'logo_url', primaryColor: 'primary_color', plan: 'plan',
-      deploymentKeyHash: 'deployment_key_hash',
-      domainRegistrationId: 'domain_registration_id',
-      domainDnsChallenge: 'domain_dns_challenge',
-      domainVerifiedAt: 'domain_verified_at',
-      domainRegisteredAt: 'domain_registered_at',
-      domainStatus: 'domain_status',
-    };
-    const sets: string[] = [];
-    const vals: any[] = [];
-    for (const [key, col] of Object.entries(map)) {
-      if ((updates as any)[key] !== undefined) {
-        sets.push(`${col} = ?`);
-        vals.push((updates as any)[key]);
-      }
-    }
-    if (updates.ssoConfig !== undefined) {
-      sets.push('sso_config = ?');
-      vals.push(JSON.stringify(updates.ssoConfig));
-    }
-    if (updates.toolSecurityConfig !== undefined) {
-      sets.push('tool_security_config = ?');
-      vals.push(JSON.stringify(updates.toolSecurityConfig));
-    }
-    if (updates.firewallConfig !== undefined) {
-      sets.push('firewall_config = ?');
-      vals.push(JSON.stringify(updates.firewallConfig));
-    }
-    if (updates.modelPricingConfig !== undefined) {
-      sets.push('model_pricing_config = ?');
-      vals.push(JSON.stringify(updates.modelPricingConfig));
-    }
-    if (updates.securityConfig !== undefined) {
-      sets.push('security_config = ?');
-      vals.push(JSON.stringify(updates.securityConfig));
-    }
-    sets.push("updated_at = datetime('now')");
-    vals.push('default');
-    this.db.prepare(`UPDATE company_settings SET ${sets.join(', ')} WHERE id = ?`).run(...vals);
-    return this.getSettings();
-  }
-
-  // ─── Agents ──────────────────────────────────────────────
-
-  async createAgent(input: AgentInput): Promise<Agent> {
-    const id = input.id || randomUUID();
-    const email = input.email || `${input.name.toLowerCase().replace(/\s+/g, '-')}@localhost`;
-    this.db.prepare(
-      `INSERT INTO agents (id, name, email, role, metadata, created_by) VALUES (?, ?, ?, ?, ?, ?)`
-    ).run(id, input.name, email, input.role || 'assistant', JSON.stringify(input.metadata || {}), input.createdBy);
-    return (await this.getAgent(id))!;
-  }
-
-  async getAgent(id: string): Promise<Agent | null> {
-    const r = this.db.prepare('SELECT * FROM agents WHERE id = ?').get(id);
-    return r ? this.mapAgent(r) : null;
-  }
-
-  async getAgentByName(name: string): Promise<Agent | null> {
-    const r = this.db.prepare('SELECT * FROM agents WHERE name = ?').get(name);
-    return r ? this.mapAgent(r) : null;
-  }
-
-  async listAgents(opts?: { status?: string; limit?: number; offset?: number }): Promise<Agent[]> {
-    let q = 'SELECT * FROM agents';
-    const params: any[] = [];
-    if (opts?.status) { q += ' WHERE status = ?'; params.push(opts.status); }
-    q += ' ORDER BY created_at DESC';
-    if (opts?.limit) q += ` LIMIT ${opts.limit}`;
-    if (opts?.offset) q += ` OFFSET ${opts.offset}`;
-    return this.db.prepare(q).all(...params).map((r: any) => this.mapAgent(r));
-  }
-
-  async updateAgent(id: string, updates: Partial<Agent>): Promise<Agent> {
-    const fields: string[] = [];
-    const vals: any[] = [];
-    for (const [key, col] of Object.entries({ name: 'name', email: 'email', role: 'role', status: 'status' })) {
-      if ((updates as any)[key] !== undefined) { fields.push(`${col} = ?`); vals.push((updates as any)[key]); }
-    }
-    if (updates.metadata) { fields.push('metadata = ?'); vals.push(JSON.stringify(updates.metadata)); }
-    fields.push("updated_at = datetime('now')");
-    vals.push(id);
-    this.db.prepare(`UPDATE agents SET ${fields.join(', ')} WHERE id = ?`).run(...vals);
-    return (await this.getAgent(id))!;
-  }
-
-  async archiveAgent(id: string): Promise<void> {
-    this.db.prepare("UPDATE agents SET status = 'archived', updated_at = datetime('now') WHERE id = ?").run(id);
-  }
-
-  async deleteAgent(id: string): Promise<void> {
-    this.db.prepare('DELETE FROM agents WHERE id = ?').run(id);
-  }
-
-  async countAgents(status?: string): Promise<number> {
-    const r = status
-      ? this.db.prepare('SELECT COUNT(*) as c FROM agents WHERE status = ?').get(status)
-      : this.db.prepare('SELECT COUNT(*) as c FROM agents').get();
-    return r.c;
-  }
-
-  // ─── Users ───────────────────────────────────────────────
-
-  async createUser(input: UserInput): Promise<User> {
-    const id = randomUUID();
-    let passwordHash: string | null = null;
-    if (input.password) {
-      const { default: bcrypt } = await import('bcryptjs');
-      passwordHash = await bcrypt.hash(input.password, 12);
-    }
-    this.db.prepare(
-      `INSERT INTO users (id, email, name, role, password_hash, sso_provider, sso_subject)
-       VALUES (?, ?, ?, ?, ?, ?, ?)`
-    ).run(id, input.email, input.name, input.role, passwordHash, input.ssoProvider || null, input.ssoSubject || null);
-    return (await this.getUser(id))!;
-  }
-
-  async getUser(id: string): Promise<User | null> {
-    const r = this.db.prepare('SELECT * FROM users WHERE id = ?').get(id);
-    return r ? this.mapUser(r) : null;
-  }
-
-  async getUserByEmail(email: string): Promise<User | null> {
-    const r = this.db.prepare('SELECT * FROM users WHERE email = ?').get(email);
-    return r ? this.mapUser(r) : null;
-  }
-
-  async getUserBySso(provider: string, subject: string): Promise<User | null> {
-    const r = this.db.prepare('SELECT * FROM users WHERE sso_provider = ? AND sso_subject = ?').get(provider, subject);
-    return r ? this.mapUser(r) : null;
-  }
-
-  async listUsers(opts?: { limit?: number; offset?: number }): Promise<User[]> {
-    let q = 'SELECT * FROM users ORDER BY created_at DESC';
-    if (opts?.limit) q += ` LIMIT ${opts.limit}`;
-    if (opts?.offset) q += ` OFFSET ${opts.offset}`;
-    return this.db.prepare(q).all().map((r: any) => this.mapUser(r));
-  }
-
-  async updateUser(id: string, updates: Partial<User>): Promise<User> {
-    const fields: string[] = [];
-    const vals: any[] = [];
-    for (const key of ['email', 'name', 'role']) {
-      if ((updates as any)[key] !== undefined) { fields.push(`${key} = ?`); vals.push((updates as any)[key]); }
-    }
-    fields.push("updated_at = datetime('now')");
-    vals.push(id);
-    this.db.prepare(`UPDATE users SET ${fields.join(', ')} WHERE id = ?`).run(...vals);
-    return (await this.getUser(id))!;
-  }
-
-  async deleteUser(id: string): Promise<void> {
-    this.db.prepare('DELETE FROM users WHERE id = ?').run(id);
-  }
-
-  // ─── Audit ───────────────────────────────────────────────
-
-  async logEvent(event: Omit<AuditEvent, 'id' | 'timestamp'>): Promise<void> {
-    this.db.prepare(
-      `INSERT INTO audit_log (id, actor, actor_type, action, resource, details, ip) VALUES (?, ?, ?, ?, ?, ?, ?)`
-    ).run(randomUUID(), event.actor, event.actorType, event.action, event.resource,
-      JSON.stringify(event.details || {}), event.ip || null);
-  }
-
-  async queryAudit(filters: AuditFilters): Promise<{ events: AuditEvent[]; total: number }> {
-    const where: string[] = [];
-    const params: any[] = [];
-    if (filters.actor) { where.push('actor = ?'); params.push(filters.actor); }
-    if (filters.action) { where.push('action = ?'); params.push(filters.action); }
-    if (filters.resource) { where.push('resource LIKE ?'); params.push(`%${filters.resource}%`); }
-    if (filters.from) { where.push('timestamp >= ?'); params.push(filters.from.toISOString()); }
-    if (filters.to) { where.push('timestamp <= ?'); params.push(filters.to.toISOString()); }
-    const wc = where.length > 0 ? `WHERE ${where.join(' AND ')}` : '';
-    const total = this.db.prepare(`SELECT COUNT(*) as c FROM audit_log ${wc}`).get(...params).c;
-    let q = `SELECT * FROM audit_log ${wc} ORDER BY timestamp DESC`;
-    if (filters.limit) q += ` LIMIT ${filters.limit}`;
-    if (filters.offset) q += ` OFFSET ${filters.offset}`;
-    const rows = this.db.prepare(q).all(...params);
-    return {
-      events: rows.map((r: any) => ({
-        id: r.id, timestamp: new Date(r.timestamp), actor: r.actor, actorType: r.actor_type,
-        action: r.action, resource: r.resource, details: JSON.parse(r.details || '{}'), ip: r.ip,
-      })),
-      total,
-    };
-  }
-
-  // ─── API Keys ────────────────────────────────────────────
-
-  async createApiKey(input: ApiKeyInput): Promise<{ key: ApiKey; plaintext: string }> {
-    const id = randomUUID();
-    const plaintext = `ek_${randomUUID().replace(/-/g, '')}`;
-    const keyHash = createHash('sha256').update(plaintext).digest('hex');
-    const keyPrefix = plaintext.substring(0, 11);
-    this.db.prepare(
-      `INSERT INTO api_keys (id, name, key_hash, key_prefix, scopes, created_by, expires_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?)`
-    ).run(id, input.name, keyHash, keyPrefix, JSON.stringify(input.scopes), input.createdBy, input.expiresAt?.toISOString() || null);
-    return { key: (await this.getApiKey(id))!, plaintext };
-  }
-
-  async getApiKey(id: string): Promise<ApiKey | null> {
-    const r = this.db.prepare('SELECT * FROM api_keys WHERE id = ?').get(id);
-    return r ? this.mapApiKey(r) : null;
-  }
-
-  async validateApiKey(plaintext: string): Promise<ApiKey | null> {
-    const keyHash = createHash('sha256').update(plaintext).digest('hex');
-    const r = this.db.prepare('SELECT * FROM api_keys WHERE key_hash = ? AND revoked = 0').get(keyHash);
-    if (!r) return null;
-    const key = this.mapApiKey(r);
-    if (key.expiresAt && new Date() > key.expiresAt) return null;
-    this.db.prepare("UPDATE api_keys SET last_used_at = datetime('now') WHERE id = ?").run(key.id);
-    return key;
-  }
-
-  async listApiKeys(opts?: { createdBy?: string }): Promise<ApiKey[]> {
-    let q = 'SELECT * FROM api_keys WHERE revoked = 0';
-    const params: any[] = [];
-    if (opts?.createdBy) { q += ' AND created_by = ?'; params.push(opts.createdBy); }
-    q += ' ORDER BY created_at DESC';
-    return this.db.prepare(q).all(...params).map((r: any) => this.mapApiKey(r));
-  }
-
-  async revokeApiKey(id: string): Promise<void> {
-    this.db.prepare('UPDATE api_keys SET revoked = 1 WHERE id = ?').run(id);
-  }
-
-  // ─── Rules ───────────────────────────────────────────────
-
-  async createRule(rule: Omit<EmailRule, 'id' | 'createdAt' | 'updatedAt'>): Promise<EmailRule> {
-    const id = randomUUID();
-    this.db.prepare(
-      `INSERT INTO email_rules (id, name, agent_id, conditions, actions, priority, enabled)
-       VALUES (?, ?, ?, ?, ?, ?, ?)`
-    ).run(id, rule.name, rule.agentId || null, JSON.stringify(rule.conditions), JSON.stringify(rule.actions),
-      rule.priority, rule.enabled ? 1 : 0);
-    const r = this.db.prepare('SELECT * FROM email_rules WHERE id = ?').get(id);
-    return this.mapRule(r);
-  }
-
-  async getRules(agentId?: string): Promise<EmailRule[]> {
-    let q = 'SELECT * FROM email_rules';
-    const params: any[] = [];
-    if (agentId) { q += ' WHERE agent_id = ? OR agent_id IS NULL'; params.push(agentId); }
-    q += ' ORDER BY priority DESC';
-    return this.db.prepare(q).all(...params).map((r: any) => this.mapRule(r));
-  }
-
-  async updateRule(id: string, updates: Partial<EmailRule>): Promise<EmailRule> {
-    const fields: string[] = [];
-    const vals: any[] = [];
-    if (updates.name !== undefined) { fields.push('name = ?'); vals.push(updates.name); }
-    if (updates.conditions) { fields.push('conditions = ?'); vals.push(JSON.stringify(updates.conditions)); }
-    if (updates.actions) { fields.push('actions = ?'); vals.push(JSON.stringify(updates.actions)); }
-    if (updates.priority !== undefined) { fields.push('priority = ?'); vals.push(updates.priority); }
-    if (updates.enabled !== undefined) { fields.push('enabled = ?'); vals.push(updates.enabled ? 1 : 0); }
-    fields.push("updated_at = datetime('now')");
-    vals.push(id);
-    this.db.prepare(`UPDATE email_rules SET ${fields.join(', ')} WHERE id = ?`).run(...vals);
-    const r = this.db.prepare('SELECT * FROM email_rules WHERE id = ?').get(id);
-    return this.mapRule(r);
-  }
-
-  async deleteRule(id: string): Promise<void> {
-    this.db.prepare('DELETE FROM email_rules WHERE id = ?').run(id);
-  }
-
-  // ─── Retention ───────────────────────────────────────────
-
-  async getRetentionPolicy(): Promise<RetentionPolicy> {
-    const r = this.db.prepare('SELECT * FROM retention_policy WHERE id = ?').get('default');
-    if (!r) return { enabled: false, retainDays: 365, archiveFirst: true };
-    return { enabled: !!r.enabled, retainDays: r.retain_days, excludeTags: JSON.parse(r.exclude_tags || '[]'), archiveFirst: !!r.archive_first };
-  }
-
-  async setRetentionPolicy(policy: RetentionPolicy): Promise<void> {
-    this.db.prepare(
-      `UPDATE retention_policy SET enabled = ?, retain_days = ?, exclude_tags = ?, archive_first = ? WHERE id = 'default'`
-    ).run(policy.enabled ? 1 : 0, policy.retainDays, JSON.stringify(policy.excludeTags || []), policy.archiveFirst ? 1 : 0);
-  }
-
-  // ─── Stats ───────────────────────────────────────────────
-
-  async getStats() {
-    return {
-      totalAgents: this.db.prepare('SELECT COUNT(*) as c FROM agents').get().c,
-      activeAgents: this.db.prepare("SELECT COUNT(*) as c FROM agents WHERE status = 'active'").get().c,
-      totalUsers: this.db.prepare('SELECT COUNT(*) as c FROM users').get().c,
-      totalEmails: 0,
-      totalAuditEvents: this.db.prepare('SELECT COUNT(*) as c FROM audit_log').get().c,
-    };
-  }
-
-  // ─── Mappers ─────────────────────────────────────────────
-
-  private mapAgent(r: any): Agent {
-    return {
-      id: r.id, name: r.name, email: r.email, role: r.role, status: r.status,
-      metadata: typeof r.metadata === 'string' ? JSON.parse(r.metadata) : r.metadata,
-      createdAt: new Date(r.created_at), updatedAt: new Date(r.updated_at), createdBy: r.created_by,
-      client_org_id: r.client_org_id || null,
-    };
-  }
-
-  private mapUser(r: any): User {
-    return {
-      id: r.id, email: r.email, name: r.name, role: r.role,
-      passwordHash: r.password_hash, ssoProvider: r.sso_provider, ssoSubject: r.sso_subject,
-      totpSecret: r.totp_secret, totpEnabled: !!r.totp_enabled, totpBackupCodes: r.totp_backup_codes,
-      permissions: r.permissions != null ? (typeof r.permissions === 'string' ? (() => { try { return JSON.parse(r.permissions); } catch { return '*'; } })() : r.permissions) : '*',
-      mustResetPassword: !!r.must_reset_password,
-      isActive: r.is_active !== 0 && r.is_active !== false,
-      clientOrgId: r.client_org_id || null,
-      createdAt: new Date(r.created_at), updatedAt: new Date(r.updated_at),
-      lastLoginAt: r.last_login_at ? new Date(r.last_login_at) : undefined,
-    };
-  }
-
-  private mapApiKey(r: any): ApiKey {
-    return {
-      id: r.id, name: r.name, keyHash: r.key_hash, keyPrefix: r.key_prefix,
-      scopes: typeof r.scopes === 'string' ? JSON.parse(r.scopes) : r.scopes,
-      createdBy: r.created_by, createdAt: new Date(r.created_at),
-      lastUsedAt: r.last_used_at ? new Date(r.last_used_at) : undefined,
-      expiresAt: r.expires_at ? new Date(r.expires_at) : undefined,
-      revoked: !!r.revoked,
-    };
-  }
-
-  private mapRule(r: any): EmailRule {
-    return {
-      id: r.id, name: r.name, agentId: r.agent_id,
-      conditions: typeof r.conditions === 'string' ? JSON.parse(r.conditions) : r.conditions,
-      actions: typeof r.actions === 'string' ? JSON.parse(r.actions) : r.actions,
-      priority: r.priority, enabled: !!r.enabled,
-      createdAt: new Date(r.created_at), updatedAt: new Date(r.updated_at),
-    };
-  }
-
-  private mapSettings(r: any): CompanySettings {
-    return {
-      id: r.id, name: r.name, domain: r.domain, subdomain: r.subdomain,
-      smtpHost: r.smtp_host, smtpPort: r.smtp_port, smtpUser: r.smtp_user, smtpPass: r.smtp_pass,
-      dkimPrivateKey: r.dkim_private_key, logoUrl: r.logo_url, primaryColor: r.primary_color,
-      ssoConfig: r.sso_config ? (typeof r.sso_config === 'string' ? JSON.parse(r.sso_config) : r.sso_config) : undefined,
-      toolSecurityConfig: r.tool_security_config ? (typeof r.tool_security_config === 'string' ? JSON.parse(r.tool_security_config) : r.tool_security_config) : {},
-      firewallConfig: r.firewall_config ? (typeof r.firewall_config === 'string' ? JSON.parse(r.firewall_config) : r.firewall_config) : {},
-      modelPricingConfig: r.model_pricing_config ? (typeof r.model_pricing_config === 'string' ? JSON.parse(r.model_pricing_config) : r.model_pricing_config) : {},
-      securityConfig: r.security_config ? (typeof r.security_config === 'string' ? JSON.parse(r.security_config) : r.security_config) : {},
-      plan: r.plan, createdAt: new Date(r.created_at), updatedAt: new Date(r.updated_at),
-      deploymentKeyHash: r.deployment_key_hash,
-      domainRegistrationId: r.domain_registration_id,
-      domainDnsChallenge: r.domain_dns_challenge,
-      domainVerifiedAt: r.domain_verified_at || undefined,
-      domainRegisteredAt: r.domain_registered_at || undefined,
-      domainStatus: r.domain_status || 'unregistered',
-    };
-  }
-}