whale-code 6.4.0

package/dist/server/handlers/comms.js

@@ -0,0 +1,588 @@
+import { sanitizeFilterValue, escapeCSV, fillTemplate, groupBy } from "../lib/utils.js";
+import { generatePdfFromHtml } from "./browser.js";
+import { validateUrl } from "../lib/ssrf-guard.js";
+const MAX_ATTACHMENT_BYTES = 10 * 1024 * 1024; // 10MB per attachment
+const MAX_TOTAL_ATTACHMENT_BYTES = 25 * 1024 * 1024; // 25MB total
+const MAX_ATTACHMENT_COUNT = 10;
+export async function handleEmail(sb, args, storeId) {
+    if (!storeId)
+        return { success: false, error: "store_id required" };
+    const sid = storeId;
+    switch (args.action) {
+        case "inbox": {
+            let q = sb.from("email_threads").select("*, latest_message:email_inbox(subject, from_email, created_at)")
+                .eq("store_id", sid).order("updated_at", { ascending: false }).limit(args.limit || 25);
+            if (args.status)
+                q = q.eq("status", args.status);
+            if (args.mailbox)
+                q = q.eq("mailbox", args.mailbox);
+            if (args.priority)
+                q = q.eq("priority", args.priority);
+            const { data, error } = await q;
+            if (error)
+                return { success: false, error: error.message };
+            // Flatten latest_message join so subject/from appear as table columns
+            const flattened = (data || []).map((row) => {
+                const { latest_message, ...rest } = row;
+                return { ...rest, subject: latest_message?.subject || null, from_email: latest_message?.from_email || null };
+            });
+            return { success: true, data: flattened };
+        }
+        case "inbox_get": {
+            const { data, error } = await sb.from("email_threads")
+                .select("*, messages:email_inbox(id, subject, from_email, to_email, body_text, created_at)").eq("id", args.thread_id).eq("store_id", sid).single();
+            if (error)
+                return { success: false, error: error.message };
+            // Pre-format so messages are visible (formatter handles sub-tables but body gets truncated)
+            const { messages, ...thread } = data;
+            const lines = [
+                `## Email Thread`,
+                `**Status**: ${thread.status || "—"} | **Mailbox**: ${thread.mailbox || "—"} | **Priority**: ${thread.priority || "—"}`,
+                "",
+            ];
+            for (const msg of (messages || []).sort((a, b) => new Date(a.created_at).getTime() - new Date(b.created_at).getTime())) {
+                lines.push(`### ${msg.from_email} → ${msg.to_email || "—"} (${msg.created_at?.slice(0, 16) || "—"})`);
+                lines.push(`**Subject**: ${msg.subject || "(no subject)"}`);
+                const body = (msg.body_text || "").slice(0, 500);
+                lines.push(body + (msg.body_text?.length > 500 ? "..." : ""));
+                lines.push("");
+            }
+            return { success: true, data: lines.join("\n") };
+        }
+        case "send": {
+            // P0 FIX: Per-store email rate limit (100 emails/hour)
+            const oneHourAgo = new Date(Date.now() - 3600_000).toISOString();
+            const { count: recentSends } = await sb.from("email_sends")
+                .select("id", { count: "exact", head: true })
+                .eq("store_id", sid)
+                .gte("created_at", oneHourAgo);
+            if ((recentSends || 0) >= 100) {
+                return { success: false, error: "Email rate limit exceeded (100/hour). Try again later." };
+            }
+            // Invoke send-email edge function
+            const sbUrl = process.env["SUPABASE_URL"];
+            const sbKey = process.env["SUPABASE_SERVICE_ROLE_KEY"];
+            try {
+                // Resolve URL-based attachments to base64 for Resend API
+                let attachments;
+                const rawAttachments = args.attachments;
+                if (rawAttachments && rawAttachments.length > 0) {
+                    // P0 FIX: Enforce attachment count limit
+                    if (rawAttachments.length > MAX_ATTACHMENT_COUNT) {
+                        throw new Error(`Too many attachments: ${rawAttachments.length} (max ${MAX_ATTACHMENT_COUNT})`);
+                    }
+                    attachments = [];
+                    let totalBytes = 0;
+                    for (const att of rawAttachments) {
+                        if (att.url) {
+                            // P0 FIX: Validate URL to prevent SSRF via attachment URLs
+                            const ssrfErr = await validateUrl(att.url);
+                            if (ssrfErr)
+                                throw new Error(`Attachment URL blocked: ${ssrfErr}`);
+                            // Fetch the file and convert to base64
+                            const fileResp = await fetch(att.url);
+                            if (!fileResp.ok)
+                                throw new Error(`Failed to fetch attachment: ${att.url} (${fileResp.status})`);
+                            const buffer = await fileResp.arrayBuffer();
+                            // P0 FIX: Enforce 10MB per-attachment size limit
+                            if (buffer.byteLength > MAX_ATTACHMENT_BYTES) {
+                                throw new Error(`Attachment too large: ${(buffer.byteLength / 1024 / 1024).toFixed(1)}MB (max 10MB)`);
+                            }
+                            // P0 FIX: Enforce 25MB total attachment size limit
+                            totalBytes += buffer.byteLength;
+                            if (totalBytes > MAX_TOTAL_ATTACHMENT_BYTES) {
+                                throw new Error(`Total attachment size exceeds limit: ${(totalBytes / 1024 / 1024).toFixed(1)}MB (max 25MB)`);
+                            }
+                            const base64 = Buffer.from(buffer).toString("base64");
+                            const filename = att.filename || att.url.split("/").pop() || "attachment";
+                            attachments.push({ filename, content: base64 });
+                        }
+                        else if (att.content && att.filename) {
+                            // Already base64 — decode length to check size
+                            const contentBytes = Math.ceil((att.content.length * 3) / 4);
+                            if (contentBytes > MAX_ATTACHMENT_BYTES) {
+                                throw new Error(`Attachment too large: ${(contentBytes / 1024 / 1024).toFixed(1)}MB (max 10MB)`);
+                            }
+                            totalBytes += contentBytes;
+                            if (totalBytes > MAX_TOTAL_ATTACHMENT_BYTES) {
+                                throw new Error(`Total attachment size exceeds limit: ${(totalBytes / 1024 / 1024).toFixed(1)}MB (max 25MB)`);
+                            }
+                            attachments.push({ filename: att.filename, content: att.content });
+                        }
+                    }
+                }
+                // Resolve {{variable}} placeholders in email fields against template_data
+                let emailHtml = args.html;
+                let emailSubject = args.subject;
+                let emailText = args.text;
+                if (args.template_data && typeof args.template_data === "object") {
+                    const tplData = args.template_data;
+                    if (emailHtml)
+                        emailHtml = fillTemplate(emailHtml, tplData);
+                    if (emailSubject)
+                        emailSubject = fillTemplate(emailSubject, tplData);
+                    if (emailText)
+                        emailText = fillTemplate(emailText, tplData);
+                }
+                const payload = { to: args.to, subject: emailSubject, html: emailHtml, text: emailText, storeId: sid };
+                if (attachments && attachments.length > 0)
+                    payload.attachments = attachments;
+                const resp = await fetch(`${sbUrl}/functions/v1/send-email`, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json", "Authorization": `Bearer ${sbKey}` },
+                    body: JSON.stringify(payload)
+                });
+                const result = await resp.json();
+                return resp.ok ? { success: true, data: result } : { success: false, error: result.error || "Send failed" };
+            }
+            catch (err) {
+                return { success: false, error: `Email send failed: ${err}` };
+            }
+        }
+        case "send_template": {
+            const sbUrl = process.env["SUPABASE_URL"];
+            const sbKey = process.env["SUPABASE_SERVICE_ROLE_KEY"];
+            try {
+                const resp = await fetch(`${sbUrl}/functions/v1/send-email`, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json", "Authorization": `Bearer ${sbKey}` },
+                    body: JSON.stringify({ to: args.to, template: args.template, template_data: args.template_data, storeId: sid })
+                });
+                const result = await resp.json();
+                return resp.ok ? { success: true, data: result } : { success: false, error: result.error || "Send failed" };
+            }
+            catch (err) {
+                return { success: false, error: `Template send failed: ${err}` };
+            }
+        }
+        case "list": {
+            const { data, error } = await sb.from("email_sends").select("*")
+                .eq("store_id", sid).order("created_at", { ascending: false }).limit(args.limit || 50);
+            return error ? { success: false, error: error.message } : { success: true, data };
+        }
+        case "get": {
+            const { data, error } = await sb.from("email_sends")
+                .select("*").eq("id", args.email_id).eq("store_id", sid).single();
+            return error ? { success: false, error: error.message } : { success: true, data };
+        }
+        case "templates": {
+            const { data, error } = await sb.from("email_templates").select("*")
+                .eq("store_id", sid).eq("is_active", true).limit(100);
+            return error ? { success: false, error: error.message } : { success: true, data };
+        }
+        case "inbox_reply": {
+            const sbUrl = process.env["SUPABASE_URL"];
+            const sbKey = process.env["SUPABASE_SERVICE_ROLE_KEY"];
+            try {
+                const resp = await fetch(`${sbUrl}/functions/v1/send-email`, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json", "Authorization": `Bearer ${sbKey}` },
+                    body: JSON.stringify({ to: args.to, subject: args.subject, html: args.html, text: args.text, thread_id: args.thread_id, storeId: sid })
+                });
+                const result = await resp.json();
+                return resp.ok ? { success: true, data: result } : { success: false, error: result.error || "Reply failed" };
+            }
+            catch (err) {
+                return { success: false, error: `Reply failed: ${err}` };
+            }
+        }
+        case "inbox_update": {
+            const updates = {};
+            if (args.status)
+                updates.status = args.status;
+            if (args.priority)
+                updates.priority = args.priority;
+            if (args.intent)
+                updates.ai_intent = args.intent;
+            if (args.ai_summary)
+                updates.ai_summary = args.ai_summary;
+            const { data, error } = await sb.from("email_threads")
+                .update(updates).eq("id", args.thread_id).eq("store_id", sid).select().single();
+            return error ? { success: false, error: error.message } : { success: true, data };
+        }
+        case "inbox_stats": {
+            const { data, error } = await sb.from("email_threads")
+                .select("status, mailbox, priority").eq("store_id", sid).limit(1000);
+            if (error)
+                return { success: false, error: error.message };
+            const stats = {
+                total: data.length,
+                by_status: groupBy(data, "status"),
+                by_mailbox: groupBy(data, "mailbox"),
+                by_priority: groupBy(data, "priority")
+            };
+            return { success: true, data: stats };
+        }
+        case "create_template": {
+            if (!args.name)
+                return { success: false, error: "name is required" };
+            if (!args.subject)
+                return { success: false, error: "subject is required" };
+            const slug = args.slug || args.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+            const { data, error } = await sb.from("email_templates").insert({
+                store_id: sid,
+                name: args.name,
+                slug,
+                subject: args.subject,
+                category: args.category || "general",
+                description: args.description || null,
+                html_content: args.html_content || null,
+                preview_text: args.preview_text || null,
+                text_content: args.text_content || null,
+                is_active: true,
+            }).select("id, name, slug, subject, category, created_at").single();
+            if (error)
+                return { success: false, error: error.message };
+            return { success: true, data };
+        }
+        case "update_template": {
+            if (!args.template_id)
+                return { success: false, error: "template_id is required" };
+            const updates = {};
+            if (args.name !== undefined)
+                updates.name = args.name;
+            if (args.slug !== undefined)
+                updates.slug = args.slug;
+            if (args.subject !== undefined)
+                updates.subject = args.subject;
+            if (args.category !== undefined)
+                updates.category = args.category;
+            if (args.description !== undefined)
+                updates.description = args.description;
+            if (args.html_content !== undefined)
+                updates.html_content = args.html_content;
+            if (args.preview_text !== undefined)
+                updates.preview_text = args.preview_text;
+            if (args.text_content !== undefined)
+                updates.text_content = args.text_content;
+            if (Object.keys(updates).length === 0)
+                return { success: false, error: "No fields to update" };
+            const { data, error } = await sb.from("email_templates")
+                .update(updates).eq("id", args.template_id).eq("store_id", sid)
+                .select("id, name, slug, subject, category, updated_at").single();
+            if (error)
+                return { success: false, error: error.message };
+            return { success: true, data };
+        }
+        case "delete_template": {
+            if (!args.template_id)
+                return { success: false, error: "template_id is required" };
+            const { data, error } = await sb.from("email_templates")
+                .update({ is_active: false }).eq("id", args.template_id).eq("store_id", sid)
+                .select("id, name").single();
+            if (error)
+                return { success: false, error: error.message };
+            return { success: true, data: { ...data, deleted: true } };
+        }
+        default:
+            return { success: false, error: `Unknown email action: ${args.action}. Valid: send, send_template, list, get, templates, inbox, inbox_get, inbox_reply, inbox_update, inbox_stats, create_template, update_template, delete_template` };
+    }
+}
+export async function handleDocuments(sb, args, storeId) {
+    if (!storeId)
+        return { success: false, error: "store_id required" };
+    const sid = storeId;
+    const action = args.action;
+    switch (action) {
+        case "create": {
+            const docType = args.document_type || "text";
+            const name = args.name;
+            if (!name)
+                return { success: false, error: "name is required" };
+            const extMap = { csv: "csv", json: "json", text: "txt", markdown: "md", html: "html", pdf: "pdf" };
+            const mimeMap = {
+                csv: "text/csv", json: "application/json", text: "text/plain",
+                markdown: "text/markdown", html: "text/html", pdf: "application/pdf",
+            };
+            const ext = extMap[docType] || "txt";
+            const mime = mimeMap[docType] || "text/plain";
+            const safeName = name.replace(/[^a-zA-Z0-9_\-]/g, "_");
+            const fileName = `${safeName}_${Date.now()}.${ext}`;
+            const storagePath = `${sid}/${fileName}`;
+            let uploadBuffer;
+            if (docType === "pdf") {
+                // PDF generation from HTML content via Playwright
+                const htmlContent = args.html || args.content;
+                if (!htmlContent)
+                    return { success: false, error: "html or content (HTML string) is required for PDF documents" };
+                try {
+                    const pdfBuffer = await generatePdfFromHtml(htmlContent, {
+                        format: args.format || "A4",
+                        landscape: args.landscape || false,
+                    });
+                    uploadBuffer = new Uint8Array(pdfBuffer);
+                }
+                catch (err) {
+                    return { success: false, error: `PDF generation failed: ${err instanceof Error ? err.message : String(err)}` };
+                }
+            }
+            else {
+                let content;
+                if (docType === "csv") {
+                    const headers = args.headers;
+                    const rows = args.rows;
+                    if (!headers || !rows)
+                        return { success: false, error: "headers and rows required for CSV" };
+                    const lines = [headers.map(escapeCSV).join(",")];
+                    for (const row of rows) {
+                        if (Array.isArray(row)) {
+                            lines.push(row.map(escapeCSV).join(","));
+                        }
+                        else {
+                            lines.push(headers.map(h => escapeCSV(row[h])).join(","));
+                        }
+                    }
+                    content = lines.join("\n");
+                }
+                else if (docType === "json") {
+                    const jsonData = args.data || args.content;
+                    content = typeof jsonData === "string" ? jsonData : JSON.stringify(jsonData, null, 2);
+                }
+                else {
+                    content = args.content || "";
+                }
+                uploadBuffer = new TextEncoder().encode(content);
+            }
+            const { error: uploadErr } = await sb.storage
+                .from("documents")
+                .upload(storagePath, uploadBuffer, { contentType: mime, upsert: true });
+            if (uploadErr)
+                return { success: false, error: `Upload failed: ${uploadErr.message}` };
+            const { data: urlData } = sb.storage.from("documents").getPublicUrl(storagePath);
+            const fileUrl = urlData.publicUrl;
+            const sizeBytes = uploadBuffer.length;
+            const { data: record, error: insertErr } = await sb.from("store_documents").insert({
+                store_id: sid,
+                document_type: docType,
+                file_name: fileName,
+                file_url: fileUrl,
+                file_size: sizeBytes,
+                file_type: mime,
+                document_name: name,
+                source_name: "Documents Edge Function",
+                document_date: new Date().toISOString().split("T")[0],
+                data: { document_type: docType },
+                metadata: { size_bytes: sizeBytes },
+            }).select("id, document_name, file_url, created_at").single();
+            if (insertErr)
+                return { success: false, error: insertErr.message };
+            return { success: true, data: { id: record.id, name: record.document_name, type: docType, url: record.file_url, file_name: fileName, size: sizeBytes } };
+        }
+        case "find": {
+            let query = sb.from("store_documents")
+                .select("id, document_type, document_name, reference_number, file_url, file_type, file_size, created_at, metadata");
+            query = query.eq("store_id", sid);
+            if (args.document_type)
+                query = query.eq("document_type", args.document_type);
+            if (args.name) {
+                const sn = sanitizeFilterValue(args.name);
+                query = query.ilike("document_name", `%${sn}%`);
+            }
+            query = query.order("created_at", { ascending: false }).limit(args.limit || 50);
+            const { data, error } = await query;
+            if (error)
+                return { success: false, error: error.message };
+            return {
+                success: true,
+                data: {
+                    count: data?.length || 0,
+                    documents: (data || []).map(d => ({
+                        id: d.id, type: d.document_type, name: d.document_name,
+                        reference: d.reference_number, url: d.file_url,
+                        size: d.file_size, created: d.created_at,
+                    })),
+                },
+            };
+        }
+        case "delete": {
+            if (!args.confirm)
+                return { success: false, error: "Set confirm: true to delete" };
+            let query = sb.from("store_documents").delete().eq("store_id", sid);
+            if (args.document_type)
+                query = query.eq("document_type", args.document_type);
+            if (args.name) {
+                const sn = sanitizeFilterValue(args.name);
+                query = query.ilike("document_name", `%${sn}%`);
+            }
+            const { data, error } = await query.select("id");
+            if (error)
+                return { success: false, error: error.message };
+            return { success: true, data: { deleted: data?.length || 0 } };
+        }
+        case "create_template": {
+            if (!args.name)
+                return { success: false, error: "name is required" };
+            if (!args.document_type)
+                return { success: false, error: "document_type is required" };
+            const { data, error } = await sb.from("document_templates").insert({
+                store_id: sid || null,
+                name: args.name,
+                description: args.description || null,
+                document_type: args.document_type,
+                content: args.content || null,
+                headers: args.headers || null,
+                schema: args.schema || [],
+                metadata: args.data || {},
+            }).select("id, name, document_type, created_at").single();
+            if (error)
+                return { success: false, error: error.message };
+            return { success: true, data: { template_id: data.id, name: data.name, type: data.document_type } };
+        }
+        case "list_templates": {
+            let query = sb.from("document_templates")
+                .select("id, name, description, document_type, headers, schema, created_at")
+                .eq("is_active", true);
+            if (sid)
+                query = query.or(`store_id.eq.${sid},store_id.is.null`);
+            if (args.document_type)
+                query = query.eq("document_type", args.document_type);
+            if (args.limit)
+                query = query.limit(args.limit);
+            query = query.order("created_at", { ascending: false });
+            const { data, error } = await query;
+            if (error)
+                return { success: false, error: error.message };
+            return {
+                success: true,
+                data: {
+                    count: data?.length || 0,
+                    templates: (data || []).map(t => ({
+                        id: t.id, name: t.name, description: t.description,
+                        type: t.document_type, headers: t.headers,
+                        fields: t.schema?.length || 0,
+                    })),
+                },
+            };
+        }
+        case "from_template": {
+            const templateId = args.template_id;
+            if (!templateId)
+                return { success: false, error: "template_id is required" };
+            const { data: template, error: tErr } = await sb.from("document_templates")
+                .select("*").eq("id", templateId).or(`store_id.eq.${sid},store_id.is.null`).single();
+            if (tErr || !template)
+                return { success: false, error: "Template not found" };
+            const tData = { ...template.metadata, ...(args.data || {}), date: new Date().toISOString().split("T")[0] };
+            const docType = template.document_type;
+            const docName = args.name || fillTemplate(template.name, tData);
+            let content;
+            if (docType === "csv") {
+                const headers = template.headers || [];
+                const rows = args.rows;
+                if (!rows)
+                    return { success: false, error: "rows required for CSV template" };
+                const lines = [headers.map(escapeCSV).join(",")];
+                for (const row of rows) {
+                    if (Array.isArray(row))
+                        lines.push(row.map(escapeCSV).join(","));
+                    else
+                        lines.push(headers.map(h => escapeCSV(row[h])).join(","));
+                }
+                content = lines.join("\n");
+            }
+            else if (docType === "json") {
+                content = template.content ? fillTemplate(template.content, tData) : JSON.stringify(tData, null, 2);
+            }
+            else {
+                content = template.content ? fillTemplate(template.content, tData) : "";
+            }
+            const extMap = { csv: "csv", json: "json", text: "txt", markdown: "md", html: "html" };
+            const mimeMap = {
+                csv: "text/csv", json: "application/json", text: "text/plain",
+                markdown: "text/markdown", html: "text/html",
+            };
+            const ext = extMap[docType] || "txt";
+            const mime = mimeMap[docType] || "text/plain";
+            const safeName = docName.replace(/[^a-zA-Z0-9_\-]/g, "_");
+            const fileName = `${safeName}_${Date.now()}.${ext}`;
+            const storagePath = `${sid}/${fileName}`;
+            const { error: uploadErr } = await sb.storage
+                .from("documents")
+                .upload(storagePath, new TextEncoder().encode(content), { contentType: mime, upsert: true });
+            if (uploadErr)
+                return { success: false, error: `Upload failed: ${uploadErr.message}` };
+            const { data: urlData } = sb.storage.from("documents").getPublicUrl(storagePath);
+            const sizeBytes = new TextEncoder().encode(content).length;
+            const { data: record, error: insertErr } = await sb.from("store_documents").insert({
+                store_id: sid,
+                document_type: docType,
+                file_name: fileName,
+                file_url: urlData.publicUrl,
+                file_size: sizeBytes,
+                file_type: mime,
+                document_name: docName,
+                source_name: "Documents Edge Function",
+                document_date: new Date().toISOString().split("T")[0],
+                data: { template_id: template.id, template_name: template.name },
+                metadata: { size_bytes: sizeBytes, from_template: true },
+            }).select("id, document_name, file_url, created_at").single();
+            if (insertErr)
+                return { success: false, error: insertErr.message };
+            return { success: true, data: { id: record.id, name: record.document_name, type: docType, template: template.name, url: record.file_url, size: sizeBytes } };
+        }
+        case "list_stores": {
+            const { data, error } = await sb.from("stores")
+                .select("id, store_name, slug, status, created_at")
+                .eq("id", sid)
+                .order("store_name");
+            if (error)
+                return { success: false, error: error.message };
+            return { success: true, data: { count: data?.length || 0, stores: data } };
+        }
+        case "list_profiles": {
+            const { data, error } = await sb.from("document_templates")
+                .select("id, name, description, document_type, headers, schema, created_at")
+                .eq("is_active", true)
+                .or(`store_id.eq.${sid},store_id.is.null`)
+                .order("name");
+            if (error)
+                return { success: false, error: error.message };
+            return {
+                success: true,
+                data: {
+                    count: data?.length || 0,
+                    profiles: (data || []).map(t => ({
+                        id: t.id, name: t.name, description: t.description,
+                        type: t.document_type, headers: t.headers,
+                        fields: t.schema?.length || 0,
+                    })),
+                },
+            };
+        }
+        case "generate": {
+            // Generate a document from a template profile with store data
+            const templateId = args.template_id;
+            if (!templateId)
+                return { success: false, error: "template_id is required. Use list_profiles to find available templates." };
+            // Route to from_template with the same args
+            return handleDocuments(sb, { ...args, action: "from_template" }, storeId);
+        }
+        case "bulk_generate": {
+            const templateId = args.template_id;
+            if (!templateId)
+                return { success: false, error: "template_id required" };
+            const items = args.items;
+            if (!items || !Array.isArray(items) || items.length === 0) {
+                return { success: false, error: "items required: array of variable sets for each document" };
+            }
+            if (items.length > 50) {
+                return { success: false, error: "Maximum 50 documents per bulk_generate call" };
+            }
+            const results = [];
+            for (const item of items) {
+                const itemArgs = { ...args, action: "from_template", data: item, name: item.name || undefined };
+                const result = await handleDocuments(sb, itemArgs, storeId);
+                if (result.success && result.data) {
+                    results.push({ name: result.data.name || "", url: result.data.url || "" });
+                }
+                else {
+                    results.push({ name: String(item.name || ""), url: "", error: result.error || "Generation failed" });
+                }
+            }
+            const succeeded = results.filter(r => !r.error).length;
+            return { success: true, data: { total: items.length, succeeded, failed: items.length - succeeded, results } };
+        }
+        default:
+            return { success: false, error: `Unknown documents action: ${action}. Valid: create, find, delete, create_template, list_templates, from_template, list_stores, list_profiles, generate` };
+    }
+}

package/dist/server/handlers/creations.d.ts

@@ -0,0 +1,6 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+export declare function handleCreations(sb: SupabaseClient, args: Record<string, unknown>, storeId?: string): Promise<{
+    success: boolean;
+    data?: unknown;
+    error?: string;
+}>;