clawfire 0.6.4 → 0.6.6

package/dist/cli.js

@@ -269,7 +269,7 @@ async function runDevServer() {
   const port = portArg ? parseInt(portArg.split("=")[1], 10) : 3e3;
   const apiPort = apiPortArg ? parseInt(apiPortArg.split("=")[1], 10) : 3456;
   const noHotReload = args.includes("--no-hot-reload");
-  const { startDevServer } = await import("./dev-server-7JCKX7OD.js");
+  const { startDevServer } = await import("./dev-server-PQP33VSE.js");
   await startDevServer({
     projectDir,
     port,

package/dist/{dev-server-7JCKX7OD.js → dev-server-PQP33VSE.js}

@@ -1856,8 +1856,9 @@ function generateDashboardHtml(options) {
     }
 
     btn.disabled = true;
-    btn.textContent = 'Setting...';
-    status.style.display = 'none';
+    btn.textContent = 'Setting up...';
+    status.textContent = 'Selecting project, detecting web app, auto-filling config...';
+    status.style.cssText = 'display:block;margin-top:8px;font-size:13px;padding:8px 12px;border-radius:6px;background:#0a0a1c;border:1px solid #3b82f6;color:#93c5fd;';
 
     fetch(API + '/__dev/setup/select-project', {
       method: 'POST',
@@ -1867,8 +1868,11 @@ function generateDashboardHtml(options) {
     .then(function(r) { return r.json(); })
     .then(function(data) {
       if (data.success) {
-        status.textContent = data.message;
-        status.style.cssText = 'display:block;margin-top:8px;font-size:13px;padding:8px 12px;border-radius:6px;background:#0a1a0a;border:1px solid #22c55e;color:#22c55e;';
+        var msg = data.steps ? data.steps.join('\\n') : data.message;
+        status.textContent = msg;
+        status.style.whiteSpace = 'pre-line';
+        status.style.cssText = 'display:block;margin-top:8px;font-size:13px;padding:8px 12px;border-radius:6px;background:#0a1a0a;border:1px solid #22c55e;color:#22c55e;white-space:pre-line;';
+        btn.textContent = 'Done';
         setTimeout(refreshSetupStatus, 1000);
       } else {
         status.textContent = data.message;
@@ -2579,7 +2583,7 @@ function generateDashboardHtml(options) {
 import { execFile as execFile2, spawn } from "child_process";
 import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
 import { resolve as resolve4, join as join3 } from "path";
-import { tmpdir, platform } from "os";
+import { tmpdir, platform, homedir } from "os";
 var FirebaseSetup = class {
   projectDir;
   stateFilePath;
@@ -3004,8 +3008,57 @@ var FirebaseSetup = class {
   }
   // ─── Firestore Database Automation ──────────────────────────────────
   /**
-   * Enable Firestore API via gcloud CLI.
-   * Required before creating a database for the first time.
+   * Read Firebase CLI's stored OAuth token and exchange for access token.
+   * No gcloud CLI needed — uses the token from `firebase login`.
+   */
+  async getFirebaseAccessToken() {
+    const home = homedir();
+    const configPath = join3(home, ".config", "configstore", "firebase-tools.json");
+    if (!existsSync5(configPath)) return null;
+    try {
+      const config = JSON.parse(readFileSync4(configPath, "utf-8"));
+      let refreshToken = null;
+      if (config?.activeAccounts) {
+        const activeEmail = config?.user?.email;
+        if (activeEmail && config.activeAccounts[activeEmail]?.tokens?.refresh_token) {
+          refreshToken = config.activeAccounts[activeEmail].tokens.refresh_token;
+        }
+        if (!refreshToken) {
+          for (const account of Object.values(config.activeAccounts)) {
+            if (account?.tokens?.refresh_token) {
+              refreshToken = account.tokens.refresh_token;
+              break;
+            }
+          }
+        }
+      }
+      if (!refreshToken && config?.tokens?.refresh_token) {
+        refreshToken = config.tokens.refresh_token;
+      }
+      if (!refreshToken) return null;
+      const body = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refreshToken,
+        client_id: "563584335869-fgrhgmd47bqnekij5i8b5pr03ho849e6.apps.googleusercontent.com",
+        client_secret: "j9iVZfS8kkCEFUPaAeJV0sAi"
+      });
+      const res = await fetch("https://oauth2.googleapis.com/token", {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString()
+      });
+      if (res.ok) {
+        const data = await res.json();
+        return data.access_token || null;
+      }
+    } catch {
+    }
+    return null;
+  }
+  /**
+   * Enable Firestore API using Google Service Usage REST API.
+   * Uses Firebase CLI's stored auth token — no gcloud CLI needed.
+   * Falls back to gcloud CLI, then manual URL.
    */
   async enableFirestoreApi() {
     const state = this.loadState();
@@ -3023,24 +3076,46 @@ var FirebaseSetup = class {
     if (!projectId) {
       return { success: false, message: "No project ID found. Select a project first." };
     }
+    try {
+      const accessToken = await this.getFirebaseAccessToken();
+      if (accessToken) {
+        const res = await fetch(
+          `https://serviceusage.googleapis.com/v1/projects/${projectId}/services/firestore.googleapis.com:enable`,
+          {
+            method: "POST",
+            headers: {
+              Authorization: `Bearer ${accessToken}`,
+              "Content-Type": "application/json"
+            }
+          }
+        );
+        if (res.ok) {
+          return { success: true, message: "Firestore API enabled via REST API." };
+        }
+        if (res.status === 409) {
+          return { success: true, message: "Firestore API already enabled." };
+        }
+      }
+    } catch {
+    }
     try {
       await this.execTimeout(
         "gcloud",
         ["services", "enable", "firestore.googleapis.com", "--project", projectId],
         6e4
       );
-      return { success: true, message: "Firestore API enabled." };
+      return { success: true, message: "Firestore API enabled via gcloud." };
     } catch (err) {
       const msg = err instanceof Error ? err.message : "Unknown error";
-      if (msg.includes("ENOENT") || msg.includes("not found") || msg.includes("command not found")) {
-        return {
-          success: false,
-          message: `gcloud CLI not found. Please enable the Firestore API manually:
-https://console.developers.google.com/apis/api/firestore.googleapis.com/overview?project=${projectId}`
-        };
+      if (!(msg.includes("ENOENT") || msg.includes("not found") || msg.includes("command not found"))) {
+        return { success: false, message: `Failed to enable Firestore API: ${msg}` };
       }
-      return { success: false, message: `Failed to enable Firestore API: ${msg}` };
     }
+    return {
+      success: false,
+      message: `Failed to enable Firestore API automatically. Please enable it manually:
+https://console.developers.google.com/apis/api/firestore.googleapis.com/overview?project=${projectId}`
+    };
   }
   /**
    * Create Firestore database via CLI.
@@ -3048,41 +3123,48 @@ https://console.developers.google.com/apis/api/firestore.googleapis.com/overview
    * Handles "ALREADY_EXISTS" gracefully — returns success.
    */
   async createFirestoreDatabase(location = "nam5") {
-    try {
-      await this.execTimeout(
-        "firebase",
-        ["firestore:databases:create", "(default)", "--location", location, "--json"],
-        6e4
-      );
-      return { success: true, message: `Firestore database created (location: ${location}).` };
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : "Unknown error";
-      if (msg.includes("ALREADY_EXISTS") || msg.includes("already exists")) {
-        return { success: true, message: "Firestore database already exists." };
-      }
-      if (msg.includes("403") || msg.includes("has not been used") || msg.includes("is disabled")) {
-        const enableResult = await this.enableFirestoreApi();
-        if (!enableResult.success) {
-          return enableResult;
+    const dbArgs = ["firestore:databases:create", "(default)", "--location", location, "--json"];
+    const tryCreate = async () => {
+      try {
+        await this.execTimeout("firebase", dbArgs, 6e4);
+        return { ok: true, alreadyExists: false, needsApi: false, msg: "" };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : "Unknown error";
+        if (msg.includes("ALREADY_EXISTS") || msg.includes("already exists")) {
+          return { ok: true, alreadyExists: true, needsApi: false, msg };
         }
-        await new Promise((r) => setTimeout(r, 5e3));
-        try {
-          await this.execTimeout(
-            "firebase",
-            ["firestore:databases:create", "(default)", "--location", location, "--json"],
-            6e4
-          );
-          return { success: true, message: `Firestore API enabled and database created (location: ${location}).` };
-        } catch (retryErr) {
-          const retryMsg = retryErr instanceof Error ? retryErr.message : "Unknown error";
-          if (retryMsg.includes("ALREADY_EXISTS") || retryMsg.includes("already exists")) {
-            return { success: true, message: "Firestore database already exists." };
-          }
-          return { success: false, message: `Failed to create Firestore database after enabling API: ${retryMsg}` };
+        if (msg.includes("403") || msg.includes("has not been used") || msg.includes("is disabled")) {
+          return { ok: false, alreadyExists: false, needsApi: true, msg };
         }
+        return { ok: false, alreadyExists: false, needsApi: false, msg };
+      }
+    };
+    const first = await tryCreate();
+    if (first.ok) {
+      return { success: true, message: first.alreadyExists ? "Firestore database already exists." : `Firestore database created (location: ${location}).` };
+    }
+    if (!first.needsApi) {
+      return { success: false, message: `Failed to create Firestore database: ${first.msg}` };
+    }
+    const enableResult = await this.enableFirestoreApi();
+    if (!enableResult.success) {
+      return enableResult;
+    }
+    const waits = [5e3, 5e3, 1e4, 1e4, 15e3];
+    for (let i = 0; i < waits.length; i++) {
+      await new Promise((r) => setTimeout(r, waits[i]));
+      const retry = await tryCreate();
+      if (retry.ok) {
+        return { success: true, message: `Firestore API enabled and database created (location: ${location}).` };
+      }
+      if (!retry.needsApi) {
+        return { success: false, message: `Failed to create Firestore database: ${retry.msg}` };
       }
-      return { success: false, message: `Failed to create Firestore database: ${msg}` };
     }
+    return {
+      success: false,
+      message: "Firestore API was enabled but database creation timed out waiting for propagation. Please wait a minute and try again."
+    };
   }
   /**
    * Deploy open Firestore security rules for dev testing.
@@ -4102,10 +4184,57 @@ ${liveReloadScript}
             sendJson({ success: false, message: "projectId is required" }, 400);
             return;
           }
-          this.firebaseSetup.selectProject(data.projectId).then((result) => {
+          (async () => {
+            const selectResult = await this.firebaseSetup.selectProject(data.projectId);
+            if (!selectResult.success) {
+              sendJson(selectResult);
+              return;
+            }
+            const steps = [selectResult.message];
+            try {
+              const { apps } = await this.firebaseSetup.listWebApps();
+              let webAppId = "";
+              if (apps.length > 0) {
+                webAppId = apps[0].appId;
+                this.firebaseSetup.selectWebApp(apps[0].appId, apps[0].displayName);
+                steps.push(`Web app "${apps[0].displayName}" selected.`);
+              } else {
+                const createResult = await this.firebaseSetup.createWebApp(data.projectId);
+                if (createResult.success && createResult.appId) {
+                  webAppId = createResult.appId;
+                  steps.push(`Web app "${data.projectId}" created.`);
+                } else {
+                  steps.push(`Web app creation skipped: ${createResult.message}`);
+                }
+              }
+              if (webAppId) {
+                try {
+                  const sdkConfig = await fetchFirebaseSdkConfig(this.options.projectDir, webAppId);
+                  const fields = {};
+                  for (const [key, value] of Object.entries(sdkConfig)) {
+                    if (value && typeof value === "string") {
+                      fields[key] = value;
+                    }
+                  }
+                  if (Object.keys(fields).length > 0) {
+                    for (const [key, value] of Object.entries(fields)) {
+                      try {
+                        this.updateProjectConfig(key, value);
+                      } catch {
+                      }
+                    }
+                    steps.push("Config auto-filled in clawfire.config.ts.");
+                  }
+                } catch (configErr) {
+                  steps.push(`Config auto-fill skipped: ${configErr instanceof Error ? configErr.message : "unknown error"}`);
+                }
+              }
+            } catch (autoFillErr) {
+              steps.push(`Auto-setup partial: ${autoFillErr instanceof Error ? autoFillErr.message : "unknown error"}`);
+            }
             clearFirebaseStatusCache();
-            sendJson(result);
-          }).catch((err) => sendJson({ success: false, message: err instanceof Error ? err.message : "Failed" }, 500));
+            sendJson({ success: true, message: steps.join(" "), steps });
+          })().catch((err) => sendJson({ success: false, message: err instanceof Error ? err.message : "Failed" }, 500));
         } catch {
           sendJson({ success: false, message: "Invalid JSON body" }, 400);
         }

package/dist/dev.cjs

@@ -2268,8 +2268,9 @@ function generateDashboardHtml(options) {
     }
 
     btn.disabled = true;
-    btn.textContent = 'Setting...';
-    status.style.display = 'none';
+    btn.textContent = 'Setting up...';
+    status.textContent = 'Selecting project, detecting web app, auto-filling config...';
+    status.style.cssText = 'display:block;margin-top:8px;font-size:13px;padding:8px 12px;border-radius:6px;background:#0a0a1c;border:1px solid #3b82f6;color:#93c5fd;';
 
     fetch(API + '/__dev/setup/select-project', {
       method: 'POST',
@@ -2279,8 +2280,11 @@ function generateDashboardHtml(options) {
     .then(function(r) { return r.json(); })
     .then(function(data) {
       if (data.success) {
-        status.textContent = data.message;
-        status.style.cssText = 'display:block;margin-top:8px;font-size:13px;padding:8px 12px;border-radius:6px;background:#0a1a0a;border:1px solid #22c55e;color:#22c55e;';
+        var msg = data.steps ? data.steps.join('\\n') : data.message;
+        status.textContent = msg;
+        status.style.whiteSpace = 'pre-line';
+        status.style.cssText = 'display:block;margin-top:8px;font-size:13px;padding:8px 12px;border-radius:6px;background:#0a1a0a;border:1px solid #22c55e;color:#22c55e;white-space:pre-line;';
+        btn.textContent = 'Done';
         setTimeout(refreshSetupStatus, 1000);
       } else {
         status.textContent = data.message;
@@ -3416,8 +3420,57 @@ var FirebaseSetup = class {
   }
   // ─── Firestore Database Automation ──────────────────────────────────
   /**
-   * Enable Firestore API via gcloud CLI.
-   * Required before creating a database for the first time.
+   * Read Firebase CLI's stored OAuth token and exchange for access token.
+   * No gcloud CLI needed — uses the token from `firebase login`.
+   */
+  async getFirebaseAccessToken() {
+    const home = (0, import_node_os.homedir)();
+    const configPath = (0, import_node_path4.join)(home, ".config", "configstore", "firebase-tools.json");
+    if (!(0, import_node_fs4.existsSync)(configPath)) return null;
+    try {
+      const config = JSON.parse((0, import_node_fs4.readFileSync)(configPath, "utf-8"));
+      let refreshToken = null;
+      if (config?.activeAccounts) {
+        const activeEmail = config?.user?.email;
+        if (activeEmail && config.activeAccounts[activeEmail]?.tokens?.refresh_token) {
+          refreshToken = config.activeAccounts[activeEmail].tokens.refresh_token;
+        }
+        if (!refreshToken) {
+          for (const account of Object.values(config.activeAccounts)) {
+            if (account?.tokens?.refresh_token) {
+              refreshToken = account.tokens.refresh_token;
+              break;
+            }
+          }
+        }
+      }
+      if (!refreshToken && config?.tokens?.refresh_token) {
+        refreshToken = config.tokens.refresh_token;
+      }
+      if (!refreshToken) return null;
+      const body = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refreshToken,
+        client_id: "563584335869-fgrhgmd47bqnekij5i8b5pr03ho849e6.apps.googleusercontent.com",
+        client_secret: "j9iVZfS8kkCEFUPaAeJV0sAi"
+      });
+      const res = await fetch("https://oauth2.googleapis.com/token", {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString()
+      });
+      if (res.ok) {
+        const data = await res.json();
+        return data.access_token || null;
+      }
+    } catch {
+    }
+    return null;
+  }
+  /**
+   * Enable Firestore API using Google Service Usage REST API.
+   * Uses Firebase CLI's stored auth token — no gcloud CLI needed.
+   * Falls back to gcloud CLI, then manual URL.
    */
   async enableFirestoreApi() {
     const state = this.loadState();
@@ -3435,24 +3488,46 @@ var FirebaseSetup = class {
     if (!projectId) {
       return { success: false, message: "No project ID found. Select a project first." };
     }
+    try {
+      const accessToken = await this.getFirebaseAccessToken();
+      if (accessToken) {
+        const res = await fetch(
+          `https://serviceusage.googleapis.com/v1/projects/${projectId}/services/firestore.googleapis.com:enable`,
+          {
+            method: "POST",
+            headers: {
+              Authorization: `Bearer ${accessToken}`,
+              "Content-Type": "application/json"
+            }
+          }
+        );
+        if (res.ok) {
+          return { success: true, message: "Firestore API enabled via REST API." };
+        }
+        if (res.status === 409) {
+          return { success: true, message: "Firestore API already enabled." };
+        }
+      }
+    } catch {
+    }
     try {
       await this.execTimeout(
         "gcloud",
         ["services", "enable", "firestore.googleapis.com", "--project", projectId],
         6e4
       );
-      return { success: true, message: "Firestore API enabled." };
+      return { success: true, message: "Firestore API enabled via gcloud." };
     } catch (err) {
       const msg = err instanceof Error ? err.message : "Unknown error";
-      if (msg.includes("ENOENT") || msg.includes("not found") || msg.includes("command not found")) {
-        return {
-          success: false,
-          message: `gcloud CLI not found. Please enable the Firestore API manually:
-https://console.developers.google.com/apis/api/firestore.googleapis.com/overview?project=${projectId}`
-        };
+      if (!(msg.includes("ENOENT") || msg.includes("not found") || msg.includes("command not found"))) {
+        return { success: false, message: `Failed to enable Firestore API: ${msg}` };
       }
-      return { success: false, message: `Failed to enable Firestore API: ${msg}` };
     }
+    return {
+      success: false,
+      message: `Failed to enable Firestore API automatically. Please enable it manually:
+https://console.developers.google.com/apis/api/firestore.googleapis.com/overview?project=${projectId}`
+    };
   }
   /**
    * Create Firestore database via CLI.
@@ -3460,41 +3535,48 @@ https://console.developers.google.com/apis/api/firestore.googleapis.com/overview
    * Handles "ALREADY_EXISTS" gracefully — returns success.
    */
   async createFirestoreDatabase(location = "nam5") {
-    try {
-      await this.execTimeout(
-        "firebase",
-        ["firestore:databases:create", "(default)", "--location", location, "--json"],
-        6e4
-      );
-      return { success: true, message: `Firestore database created (location: ${location}).` };
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : "Unknown error";
-      if (msg.includes("ALREADY_EXISTS") || msg.includes("already exists")) {
-        return { success: true, message: "Firestore database already exists." };
-      }
-      if (msg.includes("403") || msg.includes("has not been used") || msg.includes("is disabled")) {
-        const enableResult = await this.enableFirestoreApi();
-        if (!enableResult.success) {
-          return enableResult;
+    const dbArgs = ["firestore:databases:create", "(default)", "--location", location, "--json"];
+    const tryCreate = async () => {
+      try {
+        await this.execTimeout("firebase", dbArgs, 6e4);
+        return { ok: true, alreadyExists: false, needsApi: false, msg: "" };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : "Unknown error";
+        if (msg.includes("ALREADY_EXISTS") || msg.includes("already exists")) {
+          return { ok: true, alreadyExists: true, needsApi: false, msg };
         }
-        await new Promise((r) => setTimeout(r, 5e3));
-        try {
-          await this.execTimeout(
-            "firebase",
-            ["firestore:databases:create", "(default)", "--location", location, "--json"],
-            6e4
-          );
-          return { success: true, message: `Firestore API enabled and database created (location: ${location}).` };
-        } catch (retryErr) {
-          const retryMsg = retryErr instanceof Error ? retryErr.message : "Unknown error";
-          if (retryMsg.includes("ALREADY_EXISTS") || retryMsg.includes("already exists")) {
-            return { success: true, message: "Firestore database already exists." };
-          }
-          return { success: false, message: `Failed to create Firestore database after enabling API: ${retryMsg}` };
+        if (msg.includes("403") || msg.includes("has not been used") || msg.includes("is disabled")) {
+          return { ok: false, alreadyExists: false, needsApi: true, msg };
         }
+        return { ok: false, alreadyExists: false, needsApi: false, msg };
+      }
+    };
+    const first = await tryCreate();
+    if (first.ok) {
+      return { success: true, message: first.alreadyExists ? "Firestore database already exists." : `Firestore database created (location: ${location}).` };
+    }
+    if (!first.needsApi) {
+      return { success: false, message: `Failed to create Firestore database: ${first.msg}` };
+    }
+    const enableResult = await this.enableFirestoreApi();
+    if (!enableResult.success) {
+      return enableResult;
+    }
+    const waits = [5e3, 5e3, 1e4, 1e4, 15e3];
+    for (let i = 0; i < waits.length; i++) {
+      await new Promise((r) => setTimeout(r, waits[i]));
+      const retry = await tryCreate();
+      if (retry.ok) {
+        return { success: true, message: `Firestore API enabled and database created (location: ${location}).` };
+      }
+      if (!retry.needsApi) {
+        return { success: false, message: `Failed to create Firestore database: ${retry.msg}` };
       }
-      return { success: false, message: `Failed to create Firestore database: ${msg}` };
     }
+    return {
+      success: false,
+      message: "Firestore API was enabled but database creation timed out waiting for propagation. Please wait a minute and try again."
+    };
   }
   /**
    * Deploy open Firestore security rules for dev testing.
@@ -4514,10 +4596,57 @@ ${liveReloadScript}
             sendJson({ success: false, message: "projectId is required" }, 400);
             return;
           }
-          this.firebaseSetup.selectProject(data.projectId).then((result) => {
+          (async () => {
+            const selectResult = await this.firebaseSetup.selectProject(data.projectId);
+            if (!selectResult.success) {
+              sendJson(selectResult);
+              return;
+            }
+            const steps = [selectResult.message];
+            try {
+              const { apps } = await this.firebaseSetup.listWebApps();
+              let webAppId = "";
+              if (apps.length > 0) {
+                webAppId = apps[0].appId;
+                this.firebaseSetup.selectWebApp(apps[0].appId, apps[0].displayName);
+                steps.push(`Web app "${apps[0].displayName}" selected.`);
+              } else {
+                const createResult = await this.firebaseSetup.createWebApp(data.projectId);
+                if (createResult.success && createResult.appId) {
+                  webAppId = createResult.appId;
+                  steps.push(`Web app "${data.projectId}" created.`);
+                } else {
+                  steps.push(`Web app creation skipped: ${createResult.message}`);
+                }
+              }
+              if (webAppId) {
+                try {
+                  const sdkConfig = await fetchFirebaseSdkConfig(this.options.projectDir, webAppId);
+                  const fields = {};
+                  for (const [key, value] of Object.entries(sdkConfig)) {
+                    if (value && typeof value === "string") {
+                      fields[key] = value;
+                    }
+                  }
+                  if (Object.keys(fields).length > 0) {
+                    for (const [key, value] of Object.entries(fields)) {
+                      try {
+                        this.updateProjectConfig(key, value);
+                      } catch {
+                      }
+                    }
+                    steps.push("Config auto-filled in clawfire.config.ts.");
+                  }
+                } catch (configErr) {
+                  steps.push(`Config auto-fill skipped: ${configErr instanceof Error ? configErr.message : "unknown error"}`);
+                }
+              }
+            } catch (autoFillErr) {
+              steps.push(`Auto-setup partial: ${autoFillErr instanceof Error ? autoFillErr.message : "unknown error"}`);
+            }
             clearFirebaseStatusCache();
-            sendJson(result);
-          }).catch((err) => sendJson({ success: false, message: err instanceof Error ? err.message : "Failed" }, 500));
+            sendJson({ success: true, message: steps.join(" "), steps });
+          })().catch((err) => sendJson({ success: false, message: err instanceof Error ? err.message : "Failed" }, 500));
         } catch {
           sendJson({ success: false, message: "Invalid JSON body" }, 400);
         }