@agenticmail/enterprise 0.5.336 → 0.5.337

package/dist/postgres-KAERODLZ.js

@@ -0,0 +1,879 @@
+import {
+  getAllCreateStatements
+} from "./chunk-UDEOGAGB.js";
+import {
+  DatabaseAdapter
+} from "./chunk-FLRYMSKY.js";
+import "./chunk-KFQGP6VL.js";
+
+// src/db/postgres.ts
+import { randomUUID, createHash } from "crypto";
+var pg;
+async function getPg() {
+  if (!pg) {
+    const { resolveDriver } = await import("./resolve-driver-VQXMFKLJ.js");
+    pg = await resolveDriver(
+      "pg",
+      "PostgreSQL driver not found. Install it: npm install pg\nFor Supabase/Neon/CockroachDB, the same pg driver works."
+    );
+  }
+  return pg;
+}
+var PostgresAdapter = class extends DatabaseAdapter {
+  type = "postgres";
+  pool = null;
+  ended = false;
+  _directUrl;
+  _connectionString;
+  _isPgBouncer = false;
+  async connect(config) {
+    this.ended = false;
+    const { Pool } = await getPg();
+    const connUrl = config.connectionString ? new URL(config.connectionString) : null;
+    const port = config.port || (connUrl ? connUrl.port : "5432");
+    const hostname = connUrl?.hostname || config.host || "";
+    const isPgBouncer = String(port) === "6543" || String(port) === "5433" || hostname.includes(".pooler.supabase.") || hostname.includes(".pooler.") || connUrl?.searchParams.get("pgbouncer") === "true";
+    this._directUrl = config.directUrl || void 0;
+    this._connectionString = config.connectionString;
+    this._isPgBouncer = isPgBouncer;
+    const envMax = process.env.DB_POOL_MAX ? parseInt(process.env.DB_POOL_MAX, 10) : 0;
+    const defaultMax = isPgBouncer ? 3 : 10;
+    const poolMax = envMax || defaultMax;
+    const idleTimeout = isPgBouncer ? 2e3 : 3e4;
+    this.pool = new Pool({
+      connectionString: config.connectionString,
+      host: config.host,
+      port: config.port,
+      database: config.database,
+      user: config.username,
+      password: config.password,
+      ssl: config.ssl ? { rejectUnauthorized: false } : void 0,
+      max: poolMax,
+      idleTimeoutMillis: idleTimeout,
+      connectionTimeoutMillis: 15e3,
+      // PgBouncer doesn't support prepared statements in transaction mode
+      ...isPgBouncer ? { allowExitOnIdle: true } : {}
+    });
+    this.pool.on("error", (err) => {
+      if (this.ended) return;
+      if (err.code === "XX000" || err.code === "53300" || err.code === "57P01") {
+        console.warn(`[postgres] Pool connection error (${err.code}): ${err.message?.slice(0, 100) || "unknown"} \u2014 will retry`);
+      } else {
+        console.error(`[postgres] Unexpected pool error:`, err.message?.slice(0, 200));
+      }
+    });
+    const client = await this.pool.connect();
+    client.release();
+    console.log(`[postgres] Connected (pool: max=${poolMax}, idle=${idleTimeout}ms, pgbouncer=${isPgBouncer})`);
+  }
+  async disconnect() {
+    this.ended = true;
+    if (this.pool) {
+      try {
+        await this.pool.end();
+      } catch {
+      }
+    }
+  }
+  isConnected() {
+    return this.pool !== null && !this.ended;
+  }
+  /**
+   * Execute a query with automatic retry on transient connection errors.
+   * Retries once after a 500ms delay for: connection limit exceeded (XX000, 53300),
+   * admin shutdown (57P01), connection refused, client already released.
+   */
+  async _query(sql, params) {
+    const RETRYABLE = /* @__PURE__ */ new Set(["XX000", "53300", "57P01", "ECONNREFUSED", "ECONNRESET", "57P03", "25P02"]);
+    for (let attempt = 0; attempt < 3; attempt++) {
+      try {
+        return await this.pool.query(sql, params);
+      } catch (err) {
+        const code = err.code || "";
+        const msg = err.message || "";
+        const isAbortedTx = code === "25P02" || msg.includes("current transaction is aborted");
+        const isRetryable = RETRYABLE.has(code) || msg.includes("remaining connection") || msg.includes("terminating connection") || msg.includes("Connection terminated") || msg.includes("MaxClientsInSessionMode");
+        if ((isRetryable || isAbortedTx) && attempt < 2) {
+          if (isAbortedTx) {
+            try {
+              await this.pool.query("ROLLBACK");
+            } catch {
+            }
+          }
+          await new Promise((r) => setTimeout(r, 500 + Math.random() * 1e3));
+          continue;
+        }
+        throw err;
+      }
+    }
+  }
+  // ─── Engine Integration ──────────────────────────────────
+  getEngineDB() {
+    if (!this.pool || this.ended) return null;
+    const _pool = this.pool;
+    const self = this;
+    const pgSql = (sql) => {
+      let i = 0;
+      return sql.replace(/\?/g, () => `$${++i}`);
+    };
+    return {
+      run: async (sql, params) => {
+        if (self.ended) return;
+        await self._query(pgSql(sql), params);
+      },
+      get: async (sql, params) => {
+        if (self.ended) return void 0;
+        const result = await self._query(pgSql(sql), params);
+        return result.rows[0];
+      },
+      all: async (sql, params) => {
+        if (self.ended) return [];
+        const result = await self._query(pgSql(sql), params);
+        return result.rows;
+      }
+    };
+  }
+  getDialect() {
+    return "postgres";
+  }
+  async migrate() {
+    const stmts = getAllCreateStatements();
+    let directPool = null;
+    let client;
+    if (this._isPgBouncer && this._directUrl) {
+      try {
+        const { Pool } = await getPg();
+        directPool = new Pool({
+          connectionString: this._directUrl,
+          ssl: { rejectUnauthorized: false },
+          max: 1,
+          idleTimeoutMillis: 5e3,
+          connectionTimeoutMillis: 8e3
+        });
+        directPool.on("error", () => {
+        });
+        client = await directPool.connect();
+        console.log("[postgres] Using direct connection for migrations (bypassing PgBouncer)");
+      } catch (err) {
+        if (process.env.DEBUG_DB) console.warn(`[postgres] Direct connection unavailable (${err.message?.slice(0, 80)}), using pooler for migrations`);
+        if (directPool) {
+          try {
+            await directPool.end();
+          } catch {
+          }
+        }
+        directPool = null;
+        client = await this.pool.connect();
+      }
+    } else {
+      client = await this.pool.connect();
+    }
+    try {
+      await client.query("BEGIN");
+      for (const stmt of stmts) {
+        await client.query(stmt);
+      }
+      await client.query(`
+        INSERT INTO retention_policy (id) VALUES ('default')
+        ON CONFLICT (id) DO NOTHING
+      `);
+      await client.query(`
+        ALTER TABLE company_settings ADD COLUMN IF NOT EXISTS org_id TEXT
+      `).catch(() => {
+      });
+      await client.query(`
+        ALTER TABLE company_settings ADD COLUMN IF NOT EXISTS cf_api_token TEXT;
+        ALTER TABLE company_settings ADD COLUMN IF NOT EXISTS cf_account_id TEXT;
+      `).catch(() => {
+      });
+      await client.query(`
+        ALTER TABLE company_settings ADD COLUMN IF NOT EXISTS org_email_config JSONB;
+      `).catch(() => {
+      });
+      await client.query(`
+        ALTER TABLE company_settings ADD COLUMN IF NOT EXISTS platform_capabilities JSONB;
+      `).catch(() => {
+      });
+      await client.query(`
+        ALTER TABLE company_settings ADD COLUMN IF NOT EXISTS branding JSONB;
+      `).catch(() => {
+      });
+      await client.query(`
+        ALTER TABLE users ADD COLUMN IF NOT EXISTS totp_secret TEXT;
+        ALTER TABLE users ADD COLUMN IF NOT EXISTS totp_enabled BOOLEAN DEFAULT FALSE;
+        ALTER TABLE users ADD COLUMN IF NOT EXISTS totp_backup_codes TEXT;
+        ALTER TABLE users ADD COLUMN IF NOT EXISTS permissions JSONB DEFAULT '"*"';
+        ALTER TABLE users ADD COLUMN IF NOT EXISTS must_reset_password BOOLEAN DEFAULT FALSE;
+        ALTER TABLE users ADD COLUMN IF NOT EXISTS is_active BOOLEAN DEFAULT TRUE;
+        ALTER TABLE users ADD COLUMN IF NOT EXISTS client_org_id TEXT;
+        ALTER TABLE agents ADD COLUMN IF NOT EXISTS billing_rate NUMERIC(10,2) DEFAULT 0;
+      `).catch(() => {
+      });
+      await client.query(`
+        CREATE TABLE IF NOT EXISTS client_organizations (
+          id TEXT PRIMARY KEY DEFAULT gen_random_uuid(),
+          name TEXT NOT NULL,
+          slug TEXT NOT NULL UNIQUE,
+          contact_name TEXT,
+          contact_email TEXT,
+          description TEXT,
+          is_active BOOLEAN DEFAULT TRUE,
+          settings JSONB DEFAULT '{}',
+          created_at TIMESTAMP DEFAULT NOW(),
+          updated_at TIMESTAMP DEFAULT NOW()
+        );
+      `);
+      await client.query(`
+        ALTER TABLE client_organizations ADD COLUMN IF NOT EXISTS billing_rate_per_agent NUMERIC(10,2) DEFAULT 0;
+        ALTER TABLE client_organizations ADD COLUMN IF NOT EXISTS currency TEXT DEFAULT 'USD';
+        ALTER TABLE agents ADD COLUMN IF NOT EXISTS client_org_id TEXT REFERENCES client_organizations(id);
+
+        CREATE TABLE IF NOT EXISTS org_billing_records (
+          id TEXT PRIMARY KEY DEFAULT gen_random_uuid(),
+          org_id TEXT NOT NULL REFERENCES client_organizations(id) ON DELETE CASCADE,
+          agent_id TEXT,
+          month TEXT NOT NULL,
+          revenue NUMERIC(10,2) DEFAULT 0,
+          token_cost NUMERIC(10,4) DEFAULT 0,
+          input_tokens BIGINT DEFAULT 0,
+          output_tokens BIGINT DEFAULT 0,
+          notes TEXT,
+          created_at TIMESTAMP DEFAULT NOW(),
+          updated_at TIMESTAMP DEFAULT NOW(),
+          UNIQUE(org_id, agent_id, month)
+        );
+      `).catch(() => {
+      });
+      await client.query(`
+        ALTER TABLE audit_log ADD COLUMN IF NOT EXISTS org_id TEXT;
+      `).catch(() => {
+      });
+      await client.query(`
+        CREATE TABLE IF NOT EXISTS agent_knowledge_access (
+          id TEXT PRIMARY KEY DEFAULT gen_random_uuid(),
+          agent_id TEXT NOT NULL,
+          knowledge_base_id TEXT NOT NULL,
+          access_type TEXT NOT NULL DEFAULT 'read',
+          created_at TIMESTAMP DEFAULT NOW(),
+          UNIQUE(agent_id, knowledge_base_id)
+        );
+      `);
+      await client.query("COMMIT");
+    } catch (err) {
+      await client.query("ROLLBACK");
+      throw err;
+    } finally {
+      client.release();
+      if (directPool) {
+        try {
+          await directPool.end();
+        } catch {
+        }
+      }
+    }
+  }
+  // ─── Company ─────────────────────────────────────────────
+  async getSettings() {
+    const { rows } = await this._query(
+      "SELECT * FROM company_settings WHERE id = $1",
+      ["default"]
+    );
+    return rows[0] ? this.mapSettings(rows[0]) : null;
+  }
+  async updateSettings(updates) {
+    await this.pool.query(
+      `INSERT INTO company_settings (id, name, subdomain) VALUES ('default', '', '')
+       ON CONFLICT (id) DO NOTHING`
+    );
+    const fields = [];
+    const values = [];
+    let i = 1;
+    const map = {
+      name: "name",
+      orgId: "org_id",
+      domain: "domain",
+      subdomain: "subdomain",
+      smtpHost: "smtp_host",
+      smtpPort: "smtp_port",
+      smtpUser: "smtp_user",
+      smtpPass: "smtp_pass",
+      dkimPrivateKey: "dkim_private_key",
+      logoUrl: "logo_url",
+      primaryColor: "primary_color",
+      plan: "plan",
+      deploymentKeyHash: "deployment_key_hash",
+      domainRegistrationId: "domain_registration_id",
+      domainDnsChallenge: "domain_dns_challenge",
+      domainVerifiedAt: "domain_verified_at",
+      domainRegisteredAt: "domain_registered_at",
+      domainStatus: "domain_status",
+      useRootDomain: "use_root_domain",
+      cfApiToken: "cf_api_token",
+      cfAccountId: "cf_account_id",
+      signatureTemplate: "signature_template"
+    };
+    for (const [key, col] of Object.entries(map)) {
+      if (updates[key] !== void 0) {
+        fields.push(`${col} = $${i}`);
+        values.push(updates[key]);
+        i++;
+      }
+    }
+    if (updates.ssoConfig !== void 0) {
+      fields.push(`sso_config = $${i}`);
+      values.push(JSON.stringify(updates.ssoConfig));
+      i++;
+    }
+    if (updates.toolSecurityConfig !== void 0) {
+      fields.push(`tool_security_config = $${i}`);
+      values.push(JSON.stringify(updates.toolSecurityConfig));
+      i++;
+    }
+    if (updates.firewallConfig !== void 0) {
+      fields.push(`firewall_config = $${i}`);
+      values.push(JSON.stringify(updates.firewallConfig));
+      i++;
+    }
+    if (updates.modelPricingConfig !== void 0) {
+      fields.push(`model_pricing_config = $${i}`);
+      values.push(JSON.stringify(updates.modelPricingConfig));
+      i++;
+    }
+    if (updates.securityConfig !== void 0) {
+      fields.push(`security_config = $${i}`);
+      values.push(JSON.stringify(updates.securityConfig));
+      i++;
+    }
+    if (updates.orgEmailConfig !== void 0) {
+      fields.push(`org_email_config = $${i}`);
+      values.push(JSON.stringify(updates.orgEmailConfig));
+      i++;
+    }
+    if (updates.platformCapabilities !== void 0) {
+      fields.push(`platform_capabilities = $${i}`);
+      values.push(JSON.stringify(updates.platformCapabilities));
+      i++;
+    }
+    if (updates.branding !== void 0) {
+      fields.push(`branding = $${i}`);
+      values.push(JSON.stringify(updates.branding));
+      i++;
+    }
+    fields.push(`updated_at = NOW()`);
+    values.push("default");
+    const { rows } = await this.pool.query(
+      `UPDATE company_settings SET ${fields.join(", ")} WHERE id = $${i} RETURNING *`,
+      values
+    );
+    return this.mapSettings(rows[0]);
+  }
+  // ─── Agents ──────────────────────────────────────────────
+  async createAgent(input) {
+    const id = input.id || randomUUID();
+    const email = input.email || `${input.name.toLowerCase().replace(/\s+/g, "-")}@localhost`;
+    const { rows } = await this.pool.query(
+      `INSERT INTO agents (id, name, email, role, metadata, created_by)
+       VALUES ($1, $2, $3, $4, $5, $6) RETURNING *`,
+      [id, input.name, email, input.role || "assistant", JSON.stringify(input.metadata || {}), input.createdBy]
+    );
+    return this.mapAgent(rows[0]);
+  }
+  async getAgent(id) {
+    const { rows } = await this.pool.query("SELECT * FROM agents WHERE id = $1", [id]);
+    return rows[0] ? this.mapAgent(rows[0]) : null;
+  }
+  async getAgentByName(name) {
+    const { rows } = await this.pool.query("SELECT * FROM agents WHERE name = $1", [name]);
+    return rows[0] ? this.mapAgent(rows[0]) : null;
+  }
+  async listAgents(opts) {
+    let q = "SELECT * FROM agents";
+    const params = [];
+    if (opts?.status) {
+      q += " WHERE status = $1";
+      params.push(opts.status);
+    }
+    q += " ORDER BY created_at DESC";
+    if (opts?.limit) {
+      q += ` LIMIT ${opts.limit}`;
+    }
+    if (opts?.offset) {
+      q += ` OFFSET ${opts.offset}`;
+    }
+    const { rows } = await this.pool.query(q, params);
+    return rows.map((r) => this.mapAgent(r));
+  }
+  async updateAgent(id, updates) {
+    const fields = [];
+    const values = [];
+    let i = 1;
+    for (const [key, col] of Object.entries({ name: "name", email: "email", role: "role", status: "status" })) {
+      if (updates[key] !== void 0) {
+        fields.push(`${col} = $${i}`);
+        values.push(updates[key]);
+        i++;
+      }
+    }
+    if (updates.metadata) {
+      fields.push(`metadata = $${i}`);
+      values.push(JSON.stringify(updates.metadata));
+      i++;
+    }
+    if (updates.securityOverrides !== void 0) {
+      fields.push(`security_overrides = $${i}`);
+      values.push(JSON.stringify(updates.securityOverrides));
+      i++;
+    }
+    fields.push("updated_at = NOW()");
+    values.push(id);
+    const { rows } = await this.pool.query(
+      `UPDATE agents SET ${fields.join(", ")} WHERE id = $${i} RETURNING *`,
+      values
+    );
+    return this.mapAgent(rows[0]);
+  }
+  async archiveAgent(id) {
+    await this.pool.query("UPDATE agents SET status = 'archived', updated_at = NOW() WHERE id = $1", [id]);
+  }
+  async deleteAgent(id) {
+    await this.pool.query("DELETE FROM agents WHERE id = $1", [id]);
+  }
+  async countAgents(status) {
+    const q = status ? await this.pool.query("SELECT COUNT(*) FROM agents WHERE status = $1", [status]) : await this.pool.query("SELECT COUNT(*) FROM agents");
+    return parseInt(q.rows[0].count, 10);
+  }
+  // ─── Users ───────────────────────────────────────────────
+  async createUser(input) {
+    const id = randomUUID();
+    let passwordHash = null;
+    if (input.password) {
+      const { default: bcrypt } = await import("bcryptjs");
+      passwordHash = await bcrypt.hash(input.password, 12);
+    }
+    const { rows } = await this.pool.query(
+      `INSERT INTO users (id, email, name, role, password_hash, sso_provider, sso_subject)
+       VALUES ($1, $2, $3, $4, $5, $6, $7) RETURNING *`,
+      [id, input.email, input.name, input.role, passwordHash, input.ssoProvider || null, input.ssoSubject || null]
+    );
+    return this.mapUser(rows[0]);
+  }
+  async getUser(id) {
+    const { rows } = await this.pool.query("SELECT * FROM users WHERE id = $1", [id]);
+    return rows[0] ? this.mapUser(rows[0]) : null;
+  }
+  async getUserByEmail(email) {
+    const { rows } = await this.pool.query("SELECT * FROM users WHERE email = $1", [email]);
+    return rows[0] ? this.mapUser(rows[0]) : null;
+  }
+  async getUserBySso(provider, subject) {
+    const { rows } = await this.pool.query(
+      "SELECT * FROM users WHERE sso_provider = $1 AND sso_subject = $2",
+      [provider, subject]
+    );
+    return rows[0] ? this.mapUser(rows[0]) : null;
+  }
+  async listUsers(opts) {
+    let q = "SELECT * FROM users ORDER BY created_at DESC";
+    if (opts?.limit) q += ` LIMIT ${opts.limit}`;
+    if (opts?.offset) q += ` OFFSET ${opts.offset}`;
+    const { rows } = await this.pool.query(q);
+    return rows.map((r) => this.mapUser(r));
+  }
+  async updateUser(id, updates) {
+    const fields = [];
+    const values = [];
+    let i = 1;
+    for (const key of ["email", "name", "role", "sso_provider", "sso_subject", "totp_secret", "totp_enabled", "totp_backup_codes", "last_login_at"]) {
+      const camelKey = key.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
+      if (updates[camelKey] !== void 0) {
+        fields.push(`${key} = $${i}`);
+        values.push(updates[camelKey]);
+        i++;
+      }
+    }
+    fields.push("updated_at = NOW()");
+    values.push(id);
+    const { rows } = await this.pool.query(
+      `UPDATE users SET ${fields.join(", ")} WHERE id = $${i} RETURNING *`,
+      values
+    );
+    return this.mapUser(rows[0]);
+  }
+  async deleteUser(id) {
+    await this.pool.query("DELETE FROM users WHERE id = $1", [id]);
+  }
+  // ─── Audit ───────────────────────────────────────────────
+  async logEvent(event) {
+    await this.pool.query(
+      `INSERT INTO audit_log (id, actor, actor_type, action, resource, details, ip, org_id)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`,
+      [
+        randomUUID(),
+        event.actor,
+        event.actorType,
+        event.action,
+        event.resource,
+        JSON.stringify(event.details || {}),
+        event.ip || null,
+        event.orgId || null
+      ]
+    );
+  }
+  async queryAudit(filters) {
+    const where = [];
+    const params = [];
+    let i = 1;
+    if (filters.actor) {
+      where.push(`actor = $${i++}`);
+      params.push(filters.actor);
+    }
+    if (filters.action) {
+      where.push(`action = $${i++}`);
+      params.push(filters.action);
+    }
+    if (filters.resource) {
+      where.push(`resource LIKE $${i++}`);
+      params.push(`%${filters.resource}%`);
+    }
+    if (filters.orgId) {
+      where.push(`org_id = $${i++}`);
+      params.push(filters.orgId);
+    }
+    if (filters.from) {
+      where.push(`timestamp >= $${i++}`);
+      params.push(filters.from);
+    }
+    if (filters.to) {
+      where.push(`timestamp <= $${i++}`);
+      params.push(filters.to);
+    }
+    const whereClause = where.length > 0 ? `WHERE ${where.join(" AND ")}` : "";
+    const countResult = await this.pool.query(`SELECT COUNT(*) FROM audit_log ${whereClause}`, params);
+    const total = parseInt(countResult.rows[0].count, 10);
+    let q = `SELECT * FROM audit_log ${whereClause} ORDER BY timestamp DESC`;
+    if (filters.limit) q += ` LIMIT ${filters.limit}`;
+    if (filters.offset) q += ` OFFSET ${filters.offset}`;
+    const { rows } = await this.pool.query(q, params);
+    return {
+      events: rows.map((r) => ({
+        id: r.id,
+        timestamp: r.timestamp,
+        actor: r.actor,
+        actorType: r.actor_type,
+        action: r.action,
+        resource: r.resource,
+        details: typeof r.details === "string" ? JSON.parse(r.details || "{}") : r.details || {},
+        ip: r.ip
+      })),
+      total
+    };
+  }
+  // ─── API Keys ────────────────────────────────────────────
+  async createApiKey(input) {
+    const id = randomUUID();
+    const plaintext = `ek_${randomUUID().replace(/-/g, "")}`;
+    const keyHash = createHash("sha256").update(plaintext).digest("hex");
+    const keyPrefix = plaintext.substring(0, 11);
+    const { rows } = await this.pool.query(
+      `INSERT INTO api_keys (id, name, key_hash, key_prefix, scopes, created_by, expires_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7) RETURNING *`,
+      [id, input.name, keyHash, keyPrefix, JSON.stringify(input.scopes), input.createdBy, input.expiresAt || null]
+    );
+    return { key: this.mapApiKey(rows[0]), plaintext };
+  }
+  async getApiKey(id) {
+    const { rows } = await this.pool.query("SELECT * FROM api_keys WHERE id = $1", [id]);
+    return rows[0] ? this.mapApiKey(rows[0]) : null;
+  }
+  async validateApiKey(plaintext) {
+    const keyHash = createHash("sha256").update(plaintext).digest("hex");
+    const { rows } = await this.pool.query(
+      "SELECT * FROM api_keys WHERE key_hash = $1 AND (revoked IS NULL OR revoked = 0)",
+      [keyHash]
+    );
+    if (!rows[0]) return null;
+    const key = this.mapApiKey(rows[0]);
+    if (key.expiresAt && /* @__PURE__ */ new Date() > key.expiresAt) return null;
+    await this.pool.query("UPDATE api_keys SET last_used_at = NOW() WHERE id = $1", [key.id]);
+    return key;
+  }
+  async listApiKeys(opts) {
+    let q = "SELECT * FROM api_keys WHERE (revoked IS NULL OR revoked = 0)";
+    const params = [];
+    if (opts?.createdBy) {
+      q += " AND created_by = $" + (params.length + 1);
+      params.push(opts.createdBy);
+    }
+    q += " ORDER BY created_at DESC";
+    const { rows } = await this.pool.query(q, params);
+    return rows.map((r) => this.mapApiKey(r));
+  }
+  async revokeApiKey(id) {
+    await this.pool.query("UPDATE api_keys SET revoked = 1 WHERE id = $1", [id]);
+  }
+  // ─── Rules ───────────────────────────────────────────────
+  async createRule(rule) {
+    const id = randomUUID();
+    const { rows } = await this.pool.query(
+      `INSERT INTO email_rules (id, name, agent_id, conditions, actions, priority, enabled)
+       VALUES ($1, $2, $3, $4, $5, $6, $7) RETURNING *`,
+      [
+        id,
+        rule.name,
+        rule.agentId || null,
+        JSON.stringify(rule.conditions),
+        JSON.stringify(rule.actions),
+        rule.priority,
+        rule.enabled ? 1 : 0
+      ]
+    );
+    return this.mapRule(rows[0]);
+  }
+  async getRules(agentId) {
+    let q = "SELECT * FROM email_rules";
+    const params = [];
+    if (agentId) {
+      q += " WHERE agent_id = $1 OR agent_id IS NULL";
+      params.push(agentId);
+    }
+    q += " ORDER BY priority DESC";
+    const { rows } = await this.pool.query(q, params);
+    return rows.map((r) => this.mapRule(r));
+  }
+  async updateRule(id, updates) {
+    const fields = [];
+    const values = [];
+    let i = 1;
+    if (updates.name !== void 0) {
+      fields.push(`name = $${i++}`);
+      values.push(updates.name);
+    }
+    if (updates.conditions) {
+      fields.push(`conditions = $${i++}`);
+      values.push(JSON.stringify(updates.conditions));
+    }
+    if (updates.actions) {
+      fields.push(`actions = $${i++}`);
+      values.push(JSON.stringify(updates.actions));
+    }
+    if (updates.priority !== void 0) {
+      fields.push(`priority = $${i++}`);
+      values.push(updates.priority);
+    }
+    if (updates.enabled !== void 0) {
+      fields.push(`enabled = $${i++}`);
+      values.push(updates.enabled ? 1 : 0);
+    }
+    fields.push("updated_at = NOW()");
+    values.push(id);
+    const { rows } = await this.pool.query(
+      `UPDATE email_rules SET ${fields.join(", ")} WHERE id = $${i} RETURNING *`,
+      values
+    );
+    return this.mapRule(rows[0]);
+  }
+  async deleteRule(id) {
+    await this.pool.query("DELETE FROM email_rules WHERE id = $1", [id]);
+  }
+  // ─── Retention ───────────────────────────────────────────
+  async getRetentionPolicy() {
+    const { rows } = await this.pool.query("SELECT * FROM retention_policy WHERE id = $1", ["default"]);
+    if (!rows[0]) return { enabled: false, retainDays: 365, archiveFirst: true };
+    return {
+      enabled: !!rows[0].enabled,
+      retainDays: rows[0].retain_days,
+      excludeTags: typeof rows[0].exclude_tags === "string" ? JSON.parse(rows[0].exclude_tags || "[]") : rows[0].exclude_tags || [],
+      archiveFirst: !!rows[0].archive_first
+    };
+  }
+  async setRetentionPolicy(policy) {
+    await this.pool.query(
+      `UPDATE retention_policy SET enabled = $1, retain_days = $2, exclude_tags = $3, archive_first = $4
+       WHERE id = 'default'`,
+      [policy.enabled ? 1 : 0, policy.retainDays, JSON.stringify(policy.excludeTags || []), policy.archiveFirst ? 1 : 0]
+    );
+  }
+  // ─── Stats ───────────────────────────────────────────────
+  async getStats() {
+    const [agents, active, users, audit] = await Promise.all([
+      this.pool.query("SELECT COUNT(*) FROM agents"),
+      this.pool.query("SELECT COUNT(*) FROM agents WHERE status = 'active'"),
+      this.pool.query("SELECT COUNT(*) FROM users"),
+      this.pool.query("SELECT COUNT(*) FROM audit_log")
+    ]);
+    return {
+      totalAgents: parseInt(agents.rows[0].count, 10),
+      activeAgents: parseInt(active.rows[0].count, 10),
+      totalUsers: parseInt(users.rows[0].count, 10),
+      totalEmails: 0,
+      // Email count tracked externally via AgenticMail
+      totalAuditEvents: parseInt(audit.rows[0].count, 10)
+    };
+  }
+  // ─── Security Events ─────────────────────────────────────
+  async logSecurityEvent(event) {
+    const id = randomUUID();
+    await this.pool.query(
+      `INSERT INTO security_events (id, event_type, severity, agent_id, details, source_ip) 
+       VALUES ($1, $2, $3, $4, $5, $6)`,
+      [id, event.eventType, event.severity, event.agentId, JSON.stringify(event.details), event.sourceIp]
+    );
+  }
+  async getSecurityEvents(filter = {}) {
+    let query = "SELECT * FROM security_events WHERE 1=1";
+    const params = [];
+    let paramIndex = 1;
+    if (filter.eventType && filter.eventType.length > 0) {
+      query += ` AND event_type = ANY($${paramIndex++})`;
+      params.push(filter.eventType);
+    }
+    if (filter.severity && filter.severity.length > 0) {
+      query += ` AND severity = ANY($${paramIndex++})`;
+      params.push(filter.severity);
+    }
+    if (filter.agentId) {
+      query += ` AND agent_id = $${paramIndex++}`;
+      params.push(filter.agentId);
+    }
+    if (filter.sourceIp) {
+      query += ` AND source_ip = $${paramIndex++}`;
+      params.push(filter.sourceIp);
+    }
+    if (filter.fromDate) {
+      query += ` AND created_at >= $${paramIndex++}`;
+      params.push(filter.fromDate);
+    }
+    if (filter.toDate) {
+      query += ` AND created_at <= $${paramIndex++}`;
+      params.push(filter.toDate);
+    }
+    query += " ORDER BY created_at DESC";
+    if (filter.limit) {
+      query += ` LIMIT ${filter.limit}`;
+    }
+    if (filter.offset) {
+      query += ` OFFSET ${filter.offset}`;
+    }
+    const { rows } = await this.pool.query(query, params);
+    return rows.map((row) => ({
+      id: row.id,
+      eventType: row.event_type,
+      severity: row.severity,
+      agentId: row.agent_id,
+      details: typeof row.details === "string" ? JSON.parse(row.details) : row.details,
+      sourceIp: row.source_ip,
+      timestamp: row.created_at
+    }));
+  }
+  // ─── Mappers ─────────────────────────────────────────────
+  mapAgent(r) {
+    return {
+      id: r.id,
+      name: r.name,
+      email: r.email,
+      role: r.role,
+      status: r.status,
+      metadata: typeof r.metadata === "string" ? JSON.parse(r.metadata) : r.metadata,
+      securityOverrides: r.security_overrides ? typeof r.security_overrides === "string" ? JSON.parse(r.security_overrides) : r.security_overrides : void 0,
+      createdAt: new Date(r.created_at),
+      updatedAt: new Date(r.updated_at),
+      createdBy: r.created_by,
+      client_org_id: r.client_org_id || null
+    };
+  }
+  mapUser(r) {
+    return {
+      id: r.id,
+      email: r.email,
+      name: r.name,
+      role: r.role,
+      passwordHash: r.password_hash,
+      ssoProvider: r.sso_provider,
+      ssoSubject: r.sso_subject,
+      totpSecret: r.totp_secret,
+      totpEnabled: !!r.totp_enabled,
+      totpBackupCodes: r.totp_backup_codes,
+      permissions: r.permissions != null ? typeof r.permissions === "string" ? (() => {
+        try {
+          return JSON.parse(r.permissions);
+        } catch {
+          return "*";
+        }
+      })() : r.permissions : "*",
+      mustResetPassword: !!r.must_reset_password,
+      isActive: r.is_active !== false && r.is_active !== 0,
+      // default true
+      clientOrgId: r.client_org_id || null,
+      createdAt: new Date(r.created_at),
+      updatedAt: new Date(r.updated_at),
+      lastLoginAt: r.last_login_at ? new Date(r.last_login_at) : void 0
+    };
+  }
+  mapApiKey(r) {
+    return {
+      id: r.id,
+      name: r.name,
+      keyHash: r.key_hash,
+      keyPrefix: r.key_prefix,
+      scopes: typeof r.scopes === "string" ? JSON.parse(r.scopes) : r.scopes,
+      createdBy: r.created_by,
+      createdAt: new Date(r.created_at),
+      lastUsedAt: r.last_used_at ? new Date(r.last_used_at) : void 0,
+      expiresAt: r.expires_at ? new Date(r.expires_at) : void 0,
+      revoked: !!r.revoked
+    };
+  }
+  mapRule(r) {
+    return {
+      id: r.id,
+      name: r.name,
+      agentId: r.agent_id,
+      conditions: typeof r.conditions === "string" ? JSON.parse(r.conditions) : r.conditions,
+      actions: typeof r.actions === "string" ? JSON.parse(r.actions) : r.actions,
+      priority: r.priority,
+      enabled: !!r.enabled,
+      createdAt: new Date(r.created_at),
+      updatedAt: new Date(r.updated_at)
+    };
+  }
+  mapSettings(r) {
+    return {
+      id: r.id,
+      orgId: r.org_id || void 0,
+      name: r.name,
+      domain: r.domain,
+      subdomain: r.subdomain,
+      smtpHost: r.smtp_host,
+      smtpPort: r.smtp_port,
+      smtpUser: r.smtp_user,
+      smtpPass: r.smtp_pass,
+      dkimPrivateKey: r.dkim_private_key,
+      logoUrl: r.logo_url,
+      primaryColor: r.primary_color,
+      ssoConfig: r.sso_config ? typeof r.sso_config === "string" ? JSON.parse(r.sso_config) : r.sso_config : void 0,
+      toolSecurityConfig: r.tool_security_config ? typeof r.tool_security_config === "string" ? JSON.parse(r.tool_security_config) : r.tool_security_config : {},
+      firewallConfig: r.firewall_config ? typeof r.firewall_config === "string" ? JSON.parse(r.firewall_config) : r.firewall_config : {},
+      securityConfig: r.security_config ? typeof r.security_config === "string" ? JSON.parse(r.security_config) : r.security_config : {},
+      modelPricingConfig: r.model_pricing_config ? typeof r.model_pricing_config === "string" ? JSON.parse(r.model_pricing_config) : r.model_pricing_config : {},
+      plan: r.plan,
+      createdAt: new Date(r.created_at),
+      updatedAt: new Date(r.updated_at),
+      deploymentKeyHash: r.deployment_key_hash,
+      domainRegistrationId: r.domain_registration_id,
+      domainDnsChallenge: r.domain_dns_challenge,
+      domainVerifiedAt: r.domain_verified_at || void 0,
+      domainRegisteredAt: r.domain_registered_at || void 0,
+      domainStatus: r.domain_status || "unregistered",
+      useRootDomain: r.use_root_domain || false,
+      cfApiToken: r.cf_api_token || void 0,
+      cfAccountId: r.cf_account_id || void 0,
+      orgEmailConfig: r.org_email_config ? typeof r.org_email_config === "string" ? JSON.parse(r.org_email_config) : r.org_email_config : void 0,
+      platformCapabilities: r.platform_capabilities ? typeof r.platform_capabilities === "string" ? JSON.parse(r.platform_capabilities) : r.platform_capabilities : void 0,
+      signatureTemplate: r.signature_template || void 0,
+      branding: r.branding ? typeof r.branding === "string" ? JSON.parse(r.branding) : r.branding : void 0
+    };
+  }
+};
+export {
+  PostgresAdapter
+};