whale-code 6.4.0 → 6.5.0

package/dist/node/runtime.d.ts

@@ -1,5 +1,5 @@
 import type { NodeConfig } from "./config.js";
-import type { MessagePayload } from "./adapters/base.js";
+import type { BaseAdapter, MessagePayload } from "./adapters/base.js";
 export type NodeStatus = "starting" | "connected" | "degraded" | "disconnected";
 export interface NodeRuntimeStats {
     status: NodeStatus;
@@ -32,10 +32,17 @@ export declare class NodeRuntime {
     private heartbeatsFailed;
     private messagesRelayed;
     private messagesFailed;
+    private gatewayClient;
+    private screenCapture;
+    private portalManager;
     constructor(config: NodeConfig);
     getStats(): NodeRuntimeStats;
     start(): Promise<void>;
     stop(): Promise<void>;
+    /**
+     * Get a channel adapter by ID.
+     */
+    getAdapter(channelId: string): BaseAdapter | undefined;
     private startAdapter;
     /** Fetch with retry and exponential backoff */
     private fetchWithRetry;

package/dist/node/runtime.js

@@ -8,6 +8,9 @@ import { WhatsAppAdapter } from "./adapters/whatsapp.js";
 import { SmsAdapter } from "./adapters/sms.js";
 import { EmailAdapter } from "./adapters/email.js";
 import { captureError, addBreadcrumb } from "../cli/services/error-logger.js";
+import { GatewayClient } from "./gateway-client.js";
+import { ScreenCaptureService } from "./remote-desktop/index.js";
+import { PortalManager } from "./portal/index.js";
 const HEARTBEAT_INTERVAL_MS = 60_000;
 const POLL_INTERVAL_MS = 2_000;
 const VERSION = "1.1.0";
@@ -30,6 +33,12 @@ export class NodeRuntime {
     heartbeatsFailed = 0;
     messagesRelayed = 0;
     messagesFailed = 0;
+    // Server gateway connection
+    gatewayClient = null;
+    // Screen capture service (macOS only)
+    screenCapture = null;
+    // Portal manager (node-to-node connectivity)
+    portalManager = null;
     constructor(config) {
         this.config = config;
     }
@@ -71,10 +80,79 @@ export class NodeRuntime {
         for (const ch of this.config.channels) {
             await this.startAdapter(ch);
         }
+        // Connect to server gateway for receiving commands
+        this.gatewayClient = new GatewayClient({
+            serverUrl: this.config.server_url,
+            apiKey: this.config.api_key,
+            version: VERSION,
+        });
+        // Register exec command handler
+        this.gatewayClient.onCommand("exec", async (msg) => {
+            const { execSync } = await import("node:child_process");
+            try {
+                const stdout = execSync(msg.command, {
+                    timeout: msg.timeout || 30_000,
+                    cwd: process.env.HOME,
+                    encoding: "utf-8",
+                    maxBuffer: 512 * 1024,
+                });
+                return { stdout, exit_code: 0 };
+            }
+            catch (err) {
+                return {
+                    stdout: err.stdout || "",
+                    stderr: err.stderr || err.message,
+                    exit_code: err.status || 1,
+                };
+            }
+        });
+        // Register remote desktop command handler on gateway — forward input events
+        this.gatewayClient.onCommand("remote_desktop", async (msg) => {
+            if (!this.screenCapture) {
+                return { error: "Screen capture not enabled" };
+            }
+            if (msg.type === "input") {
+                this.screenCapture.injectInput(msg);
+                return null;
+            }
+            // Return capture status for session requests
+            return {
+                type: "remote_desktop_response",
+                success: true,
+                ...this.screenCapture.getStatus(),
+            };
+        });
+        this.gatewayClient.start();
+        // Start screen capture service (macOS only)
+        if (process.platform === "darwin" && this.config.remote_desktop?.enabled !== false) {
+            try {
+                this.screenCapture = new ScreenCaptureService(this.config.remote_desktop || {});
+                await this.screenCapture.start();
+            }
+            catch (err) {
+                console.warn("[node] Screen capture failed to start:", err.message);
+            }
+        }
+        // Initialize portal manager
+        try {
+            const portalConfig = this.config.portal || {};
+            this.portalManager = new PortalManager({
+                nodeConfig: this.config,
+                gateway: this.gatewayClient,
+                screenCapture: this.screenCapture,
+                receiveDir: portalConfig.receive_dir,
+                autoAcceptAdmins: portalConfig.auto_accept_admins !== false,
+                maxSessions: portalConfig.max_sessions || 5,
+            });
+            console.log("[node] Portal handler registered");
+        }
+        catch (err) {
+            console.warn("[node] Portal handler failed to initialize:", err.message);
+        }
         // Handle graceful shutdown
         process.on("SIGTERM", () => this.stop());
         process.on("SIGINT", () => this.stop());
-        console.log(`[node] Running with ${this.adapters.size} channel adapter(s). Status: ${this.status}. Press Ctrl+C to stop.`);
+        console.log(`[node] Running with ${this.adapters.size} channel adapter(s). Gateway: connecting. Press Ctrl+C to stop.`);
     }
     async stop() {
         console.log(`[node] Shutting down...`);
@@ -84,6 +162,19 @@ export class NodeRuntime {
             clearInterval(this.heartbeatTimer);
         for (const [, timer] of this.pollTimers)
             clearInterval(timer);
+        // Stop portal sessions
+        if (this.portalManager) {
+            this.portalManager.closeAll();
+            this.portalManager = null;
+        }
+        // Stop screen capture
+        if (this.screenCapture) {
+            await this.screenCapture.stop();
+            this.screenCapture = null;
+        }
+        // Disconnect from server gateway
+        if (this.gatewayClient)
+            this.gatewayClient.stop();
         for (const [name, adapter] of this.adapters) {
             console.log(`[node] Stopping adapter: ${name}`);
             await adapter.stop();
@@ -91,6 +182,12 @@ export class NodeRuntime {
         console.log(`[node] Stopped.`);
         process.exit(0);
     }
+    /**
+     * Get a channel adapter by ID.
+     */
+    getAdapter(channelId) {
+        return this.adapters.get(channelId);
+    }
     async startAdapter(ch) {
         let adapter;
         switch (ch.type) {
@@ -282,12 +379,21 @@ export class NodeRuntime {
     }
     async sendHeartbeat() {
         try {
-            const channelStatuses = Array.from(this.adapters.entries()).map(([, adapter]) => ({
-                type: adapter.type,
-                name: adapter.name,
-                status: adapter.isRunning() ? "active" : "error",
-                stats: adapter.getStats(),
-            }));
+            const channelStatuses = Array.from(this.adapters.entries()).map(([, adapter]) => {
+                const base = {
+                    type: adapter.type,
+                    name: adapter.name,
+                    status: adapter.isRunning() ? "active" : "error",
+                    stats: adapter.getStats(),
+                };
+                // Include diagnostics for iMessage adapters
+                if (adapter.type === "imessage" && "getLastError" in adapter) {
+                    const imsg = adapter;
+                    base.last_error = imsg.getLastError();
+                    base.restart_attempts = imsg.getRestartAttempts();
+                }
+                return base;
+            });
             const res = await this.fetchWithRetry(`${this.config.server_url}/nodes/heartbeat`, {
                 method: "POST",
                 headers: {
@@ -344,8 +450,10 @@ function getHardwareInfo() {
     };
 }
 function getCapabilities() {
-    const caps = ["messaging", "discord", "slack", "telegram", "webchat", "whatsapp", "sms", "email"];
-    if (process.platform === "darwin")
+    const caps = ["messaging", "discord", "slack", "telegram", "webchat", "whatsapp", "sms", "email", "portal"];
+    if (process.platform === "darwin") {
         caps.push("imessage");
+        caps.push("remote_desktop");
+    }
     return caps;
 }

package/dist/server/handlers/__test-utils__/test-db.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Real Supabase test helper for handler tests.
+ * Replaces mock-supabase.ts — all operations hit the real database.
+ *
+ * When SUPABASE_URL / SUPABASE_SERVICE_ROLE_KEY / TEST_STORE_ID are missing,
+ * exports are stubbed so test files can skip gracefully via:
+ *   describe.skipIf(!HAS_TEST_DB)("...", () => { ... })
+ */
+import { SupabaseClient } from "@supabase/supabase-js";
+/** true when all required env vars are present — use with describe.skipIf(!HAS_TEST_DB) */
+export declare const HAS_TEST_DB: boolean;
+export declare const TEST_STORE: string;
+/** Unique prefix per test run */
+export declare const RUN_PREFIX: string;
+/** Get the real Supabase client (pass to handlers as `sb`) */
+export declare function getTestClient(): SupabaseClient;
+/** Insert rows and return them with DB-generated fields */
+export declare function seed(table: string, rows: Record<string, unknown>[]): Promise<any[]>;
+/** Delete rows by IDs */
+export declare function deleteByIds(table: string, ids: string[]): Promise<void>;
+/** Delete rows matching column=value */
+export declare function deleteWhere(table: string, column: string, value: unknown): Promise<void>;
+export declare function seedTracked(table: string, rows: Record<string, unknown>[]): Promise<any[]>;
+/** Delete all tracked rows in FK-safe order */
+export declare function cleanup(): Promise<void>;

package/dist/server/handlers/__test-utils__/test-db.js

@@ -0,0 +1,128 @@
+/**
+ * Real Supabase test helper for handler tests.
+ * Replaces mock-supabase.ts — all operations hit the real database.
+ *
+ * When SUPABASE_URL / SUPABASE_SERVICE_ROLE_KEY / TEST_STORE_ID are missing,
+ * exports are stubbed so test files can skip gracefully via:
+ *   describe.skipIf(!HAS_TEST_DB)("...", () => { ... })
+ */
+import { createClient } from "@supabase/supabase-js";
+import { randomUUID } from "node:crypto";
+const url = process.env.SUPABASE_URL;
+const key = process.env.SUPABASE_SERVICE_ROLE_KEY;
+const storeId = process.env.TEST_STORE_ID;
+/** true when all required env vars are present — use with describe.skipIf(!HAS_TEST_DB) */
+export const HAS_TEST_DB = !!(url && key && storeId);
+const sb = HAS_TEST_DB ? createClient(url, key) : null;
+export const TEST_STORE = storeId ?? "missing-test-store";
+/** Unique prefix per test run */
+export const RUN_PREFIX = `T${randomUUID().slice(0, 6)}`;
+/** Get the real Supabase client (pass to handlers as `sb`) */
+export function getTestClient() {
+    return sb;
+}
+/** Insert rows and return them with DB-generated fields */
+export async function seed(table, rows) {
+    if (!rows.length)
+        return [];
+    const { data, error } = await sb.from(table).insert(rows).select();
+    if (error)
+        throw new Error(`seed(${table}): ${error.message}`);
+    return data;
+}
+/** Delete rows by IDs */
+export async function deleteByIds(table, ids) {
+    if (!ids.length)
+        return;
+    const { error } = await sb.from(table).delete().in("id", ids);
+    if (error)
+        throw new Error(`deleteByIds(${table}): ${error.message}`);
+}
+/** Delete rows matching column=value */
+export async function deleteWhere(table, column, value) {
+    const { error } = await sb.from(table).delete().eq(column, value);
+    if (error)
+        throw new Error(`deleteWhere(${table}): ${error.message}`);
+}
+/** Track seeded data for automatic cleanup */
+const tracked = new Map();
+export async function seedTracked(table, rows) {
+    const data = await seed(table, rows);
+    const ids = data.map((r) => r.id);
+    tracked.set(table, [...(tracked.get(table) || []), ...ids]);
+    return data;
+}
+/** Delete all tracked rows in FK-safe order */
+export async function cleanup() {
+    const fkOrder = [
+        "ai_messages",
+        "ai_conversation_checkpoints",
+        "ai_conversations",
+        "ai_agent_config",
+        "platform_secrets",
+        "business_audit",
+        "workflow_step_runs",
+        "workflow_dlq",
+        "workflow_runs",
+        "workflow_versions",
+        "workflow_steps",
+        "workflows",
+        "error_events",
+        "payment_intents",
+        "order_items",
+        "cart_items",
+        "webhook_events",
+        "inventory_levels",
+        "inventory",
+        "email_sends",
+        "orders",
+        "carts",
+        "products",
+        "categories",
+        "catalogs",
+        "creation_collections",
+        "customers",
+        "store_customer_profiles",
+        "user_creation_relationships",
+        "creations",
+        "locations",
+        "webhook_configs",
+        "webhook_endpoints",
+        "api_keys",
+        "platform_users",
+        "store_media",
+        "purchase_orders",
+        "suppliers",
+        "stock_transfers",
+        "v_daily_sales",
+        "meta_ads",
+        "meta_ad_sets",
+        "meta_campaigns",
+        "meta_integrations",
+        "channel_messages",
+        "channels",
+        "node_events",
+        "nodes",
+        "store_members",
+        "store_plans",
+        "store_usage",
+        "email_templates",
+        "email_threads",
+        "customer_risk_scores",
+        "customer_exposures",
+        "customer_breach_records",
+        "customer_enrichment_profiles",
+        "stores",
+    ];
+    const orderedTables = [
+        ...fkOrder.filter((t) => tracked.has(t)),
+        ...[...tracked.keys()].filter((t) => !fkOrder.includes(t)),
+    ];
+    for (const table of orderedTables) {
+        const ids = tracked.get(table);
+        if (ids?.length) {
+            await deleteByIds(table, ids).catch(() => { });
+        }
+    }
+    tracked.clear();
+}

package/dist/server/handlers/api-keys.js

@@ -1,7 +1,7 @@
 // server/handlers/api-keys.ts — API Key management: create, list, get, revoke, update
 // Supports linking keys to creations (TV menus, displays, landing pages)
 import { createHash, randomUUID } from "node:crypto";
-const KEY_COLS = "id, name, key_prefix, key_type, scope, is_active, rate_limit_per_minute, rate_limit_per_day, last_used_at, request_count, expires_at, revoked_at, revoked_reason, creation_id, created_at, updated_at";
+const KEY_COLS = "id, name, key_prefix, key_type, scope, is_active, rate_limit_per_minute, rate_limit_per_day, last_used_at, request_count, expires_at, revoked_at, revoked_reason, creation_id, client_store_id, created_at, updated_at";
 export async function handleAPIKeys(sb, args, storeId) {
     const sid = storeId;
     const action = args.action;
@@ -20,6 +20,7 @@ export async function handleAPIKeys(sb, args, storeId) {
             const rateLimitPerDay = args.rate_limit_per_day || 10000;
             const expiresAt = args.expires_at;
             const creationId = args.creation_id;
+            const clientStoreId = args.client_store_id;
             // Resolve owner — use provided owner_user_id or find store owner
             let ownerUserId = args.owner_user_id;
             if (!ownerUserId) {
@@ -65,6 +66,7 @@ export async function handleAPIKeys(sb, args, storeId) {
                 rate_limit_per_day: rateLimitPerDay,
                 expires_at: expiresAt || null,
                 creation_id: creationId || null,
+                client_store_id: clientStoreId || null,
             }).select(KEY_COLS).single();
             if (error)
                 return { success: false, error: error.message };
@@ -74,6 +76,17 @@ export async function handleAPIKeys(sb, args, storeId) {
                     ...data,
                     key_value: keyValue,
                     warning: "Copy this key now. The full key value will NOT be returned again — only the hash is stored.",
+                    api_gateway: {
+                        base_url: "https://whale-gateway.fly.dev",
+                        docs_url: "https://whale-gateway.fly.dev/docs",
+                        openapi_spec: "https://whale-gateway.fly.dev/openapi.json",
+                        usage: `curl -H "x-api-key: ${keyValue}" https://whale-gateway.fly.dev/v1/stores/${sid}/products`,
+                        scopes: scopes,
+                        rate_limits: {
+                            per_minute: rateLimitPerMinute,
+                            per_day: rateLimitPerDay,
+                        },
+                    },
                 },
             };
         }
@@ -95,7 +108,18 @@ export async function handleAPIKeys(sb, args, storeId) {
             const { data, error } = await q;
             if (error)
                 return { success: false, error: error.message };
-            return { success: true, data: { count: data?.length || 0, keys: data } };
+            return {
+                success: true,
+                data: {
+                    count: data?.length || 0,
+                    keys: data,
+                    api_gateway: {
+                        base_url: "https://whale-gateway.fly.dev",
+                        docs_url: "https://whale-gateway.fly.dev/docs",
+                        openapi_spec: "https://whale-gateway.fly.dev/openapi.json",
+                    },
+                },
+            };
         }
         // ---- get: Get a single API key by ID ----
         case "get": {

package/dist/server/handlers/browser.d.ts

@@ -1,8 +1,4 @@
 import type { SupabaseClient } from "@supabase/supabase-js";
-export declare function generatePdfFromHtml(html: string, options?: {
-    format?: string;
-    landscape?: boolean;
-}): Promise<Buffer>;
 export declare function handleBrowser(_sb: SupabaseClient, args: Record<string, unknown>, _storeId?: string): Promise<{
     success: boolean;
     data?: unknown;

package/dist/server/handlers/browser.js

@@ -274,52 +274,6 @@ async function actionPdf(url, waitFor) {
         };
     });
 }
-// ============================================================================
-// PDF FROM HTML (reusable by documents handler)
-// ============================================================================
-export async function generatePdfFromHtml(html, options) {
-    // P0 FIX: Strip dangerous tags from user HTML before rendering to prevent
-    // script execution, SSRF via iframes, and local file reads
-    const sanitizedHtml = html
-        .replace(/<script[\s\S]*?<\/script>/gi, "")
-        .replace(/<script[^>]*\/?>/gi, "")
-        .replace(/<iframe[\s\S]*?<\/iframe>/gi, "")
-        .replace(/<iframe[^>]*\/?>/gi, "")
-        .replace(/<object[\s\S]*?<\/object>/gi, "")
-        .replace(/<object[^>]*\/?>/gi, "")
-        .replace(/<embed[^>]*\/?>/gi, "")
-        .replace(/<link[^>]*\/?>/gi, "");
-    const browser = await getBrowser();
-    const context = await browser.newContext({ viewport: { width: 1280, height: 720 } });
-    const page = await context.newPage();
-    try {
-        // P0 FIX: Block all network requests to prevent SSRF from headless Chromium.
-        // Only allow data: URIs (inline images/fonts) and about:blank.
-        await page.route('**/*', (route) => {
-            const url = route.request().url();
-            if (url.startsWith('data:') || url === 'about:blank') {
-                route.continue();
-            }
-            else {
-                route.abort();
-            }
-        });
-        // P0 FIX: Use domcontentloaded instead of networkidle to avoid waiting for
-        // (now-blocked) network requests and reduce attack surface
-        await page.setContent(sanitizedHtml, { waitUntil: "domcontentloaded", timeout: PAGE_TIMEOUT_MS });
-        const buffer = await page.pdf({
-            format: options?.format || "A4",
-            printBackground: true,
-            landscape: options?.landscape || false,
-            margin: { top: "1cm", bottom: "1cm", left: "1cm", right: "1cm" },
-        });
-        return Buffer.from(buffer);
-    }
-    finally {
-        await page.close().catch(() => { });
-        await context.close().catch(() => { });
-    }
-}
 async function callCapMonster(taskType, params) {
     const apiKey = process.env.CAPMONSTER_API_KEY;
     if (!apiKey)

package/dist/server/handlers/catalog.js

@@ -150,7 +150,11 @@ export async function handleProducts(sb, args, storeId) {
             if (args.pricing_data)
                 insert.pricing_data = args.pricing_data;
             // custom_fields NOT inserted directly — schema is the source of truth
-            // Agent-provided field_values are filtered against schema keys post-insert
+            // Agent-provided custom_fields are filtered against schema keys post-insert
+            if (args.featured_image !== undefined)
+                insert.featured_image = args.featured_image;
+            if (args.image_gallery !== undefined)
+                insert.image_gallery = args.image_gallery;
             if (args.is_wholesale !== undefined)
                 insert.is_wholesale = args.is_wholesale;
             if (args.wholesale_only !== undefined)
@@ -203,7 +207,7 @@ export async function handleProducts(sb, args, storeId) {
                             }
                         }
                         // Only accept agent values for keys that exist in the schema
-                        const agentValues = args.field_values || {};
+                        const agentValues = args.custom_fields || {};
                         for (const [k, v] of Object.entries(agentValues)) {
                             if (schemaKeys.has(k))
                                 fieldValues[k] = v;
@@ -279,8 +283,8 @@ export async function handleProducts(sb, args, storeId) {
             if (args.pricing_data !== undefined)
                 updates.pricing_data = args.pricing_data;
             // custom_fields filtered to schema keys only (schema = source of truth)
-            if (args.field_values !== undefined) {
-                const agentFV = args.field_values;
+            if (args.custom_fields !== undefined) {
+                const agentFV = args.custom_fields;
                 // Look up product's linked field schema to get allowed keys
                 const { data: pfs } = await sb.from("product_field_schemas").select("field_schema_id").eq("product_id", pid).limit(1);
                 if (pfs?.length) {
@@ -312,6 +316,8 @@ export async function handleProducts(sb, args, storeId) {
                 updates.minimum_wholesale_quantity = args.minimum_wholesale_quantity;
             if (args.featured_image !== undefined)
                 updates.featured_image = args.featured_image;
+            if (args.image_gallery !== undefined)
+                updates.image_gallery = args.image_gallery;
             const updateCatArg = (args.category ?? args.primary_category_id ?? args.category_id);
             if (updateCatArg !== undefined) {
                 if (!updateCatArg) {
@@ -494,6 +500,14 @@ export async function handleProducts(sb, args, storeId) {
                 return { success: false, error: "name is required" };
             if (!args.fields || !Array.isArray(args.fields))
                 return { success: false, error: "fields array is required" };
+            // Auto-resolve catalog_id: use provided value, or fall back to store's default catalog
+            let catalogId = args.catalog_id;
+            if (!catalogId) {
+                const { data: defaultCatalog } = await sb.from("catalogs")
+                    .select("id").eq("store_id", sid).eq("is_default", true).single();
+                if (defaultCatalog)
+                    catalogId = defaultCatalog.id;
+            }
             const insert = {
                 store_id: sid,
                 name,
@@ -504,12 +518,12 @@ export async function handleProducts(sb, args, storeId) {
                 insert.description = args.description;
             if (args.icon)
                 insert.icon = args.icon;
-            if (args.catalog_id)
-                insert.catalog_id = args.catalog_id;
+            if (catalogId)
+                insert.catalog_id = catalogId;
             if (args.is_public !== undefined)
                 insert.is_public = args.is_public;
             const { data, error } = await sb.from("field_schemas").insert(insert)
-                .select("id, name, slug, fields, icon, is_active, created_at").single();
+                .select("id, name, slug, fields, icon, is_active, catalog_id, created_at").single();
             return error ? { success: false, error: error.message } : { success: true, data };
         }
         case "update_field_schema": {
@@ -534,7 +548,7 @@ export async function handleProducts(sb, args, storeId) {
             // Only allow modification of own schemas (prevent IDOR)
             const { data, error } = await sb.from("field_schemas")
                 .update(updates).eq("id", fsId).eq("store_id", sid)
-                .select("id, name, slug, fields, icon, is_active, updated_at").single();
+                .select("id, name, slug, fields, icon, is_active, catalog_id, updated_at").single();
             return error ? { success: false, error: error.message } : { success: true, data };
         }
         case "delete_field_schema": {
@@ -585,6 +599,14 @@ export async function handleProducts(sb, args, storeId) {
                 return { success: false, error: "name is required" };
             if (!args.tiers || !Array.isArray(args.tiers))
                 return { success: false, error: "tiers array is required" };
+            // Auto-resolve catalog_id: use provided value, or fall back to store's default catalog
+            let catalogId = args.catalog_id;
+            if (!catalogId) {
+                const { data: defaultCatalog } = await sb.from("catalogs")
+                    .select("id").eq("store_id", sid).eq("is_default", true).single();
+                if (defaultCatalog)
+                    catalogId = defaultCatalog.id;
+            }
             const insert = {
                 store_id: sid,
                 name,
@@ -595,12 +617,12 @@ export async function handleProducts(sb, args, storeId) {
                 insert.description = args.description;
             if (args.quality_tier)
                 insert.quality_tier = args.quality_tier;
-            if (args.catalog_id)
-                insert.catalog_id = args.catalog_id;
+            if (catalogId)
+                insert.catalog_id = catalogId;
             if (args.is_public !== undefined)
                 insert.is_public = args.is_public;
             const { data, error } = await sb.from("pricing_schemas").insert(insert)
-                .select("id, name, slug, tiers, quality_tier, is_active, created_at").single();
+                .select("id, name, slug, tiers, quality_tier, is_active, catalog_id, created_at").single();
             return error ? { success: false, error: error.message } : { success: true, data };
         }
         case "update_pricing_schema": {
@@ -625,7 +647,7 @@ export async function handleProducts(sb, args, storeId) {
             // Only allow modification of own schemas (prevent IDOR)
             const { data, error } = await sb.from("pricing_schemas")
                 .update(updates).eq("id", psId).eq("store_id", sid)
-                .select("id, name, slug, tiers, quality_tier, is_active, updated_at").single();
+                .select("id, name, slug, tiers, quality_tier, is_active, catalog_id, updated_at").single();
             return error ? { success: false, error: error.message } : { success: true, data };
         }
         case "delete_pricing_schema": {
@@ -916,7 +938,7 @@ export async function handleProducts(sb, args, storeId) {
                 .update({ product_id: primaryId }).eq("product_id", secondaryId);
             reassignResults.product_reviews = prErr ? `error: ${prErr.message}` : `moved ${prCount ?? 0} rows`;
             // 6. Fill in missing fields on primary from secondary
-            const fillFields = ["description", "short_description", "cost_price", "wholesale_price", "weight", "featured_image"];
+            const fillFields = ["description", "short_description", "cost_price", "wholesale_price", "weight", "featured_image", "image_gallery"];
             const fills = {};
             for (const field of fillFields) {
                 if (!primary[field] && secondary[field])
@@ -966,8 +988,9 @@ export async function handleCollections(sb, args, storeId) {
             return error ? { success: false, error: error.message } : { success: true, data };
         }
         case "create": {
+            const slug = args.slug || (args.name || "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
             const { data, error } = await sb.from("creation_collections")
-                .insert({ store_id: sid, name: args.name }).select().single();
+                .insert({ store_id: sid, name: args.name, slug }).select().single();
             return error ? { success: false, error: error.message } : { success: true, data };
         }
         default:

package/dist/server/handlers/clickhouse.d.ts

@@ -0,0 +1,10 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+/**
+ * ClickHouse observability handler — platform-level metrics via direct HTTP queries.
+ * Replaces FDW RPCs with direct ClickHouse queries for lower latency.
+ */
+export declare function handleClickHouse(sb: SupabaseClient, args: Record<string, unknown>, storeId?: string): Promise<{
+    success: boolean;
+    data?: unknown;
+    error?: string;
+}>;