whale-code 6.4.0

package/dist/server/handlers/enrichment.js

@@ -0,0 +1,768 @@
+// server/handlers/enrichment.ts — Customer enrichment, breach checking, and data protection CRUD
+// Integrates with PDL (Person Enrichment), Bright Data (LinkedIn), HIBP (Breach Check),
+// DeHashed, and xonPlus (real-time breach monitoring).
+// All external API keys are fetched via decrypt_secret RPC from encrypted store secrets.
+// ---- Helpers ----
+async function getSecret(sb, name, storeId) {
+    const { data, error } = await sb.rpc("decrypt_secret", { p_name: name, p_store_id: storeId });
+    if (error || !data)
+        return null;
+    return data;
+}
+function nowISO() {
+    return new Date().toISOString();
+}
+// ---- Main Handler ----
+export async function handleEnrichment(sb, args, storeId) {
+    const sid = storeId;
+    const action = args.action;
+    if (!action) {
+        return { success: false, error: "action is required" };
+    }
+    switch (action) {
+        // ---- ENRICH_PERSON: PDL Person Enrichment API ----
+        case "enrich_person": {
+            const customerId = args.customer_id;
+            if (!customerId)
+                return { success: false, error: "customer_id is required" };
+            const apiKey = await getSecret(sb, "pdl_api_key", sid);
+            if (!apiKey)
+                return { success: false, error: "PDL API key not configured. Add 'pdl_api_key' to store secrets." };
+            // Build PDL query params from available identifiers
+            const params = {};
+            if (args.email)
+                params.email = args.email;
+            if (args.phone)
+                params.phone = args.phone;
+            if (args.first_name)
+                params.first_name = args.first_name;
+            if (args.last_name)
+                params.last_name = args.last_name;
+            if (args.linkedin_url)
+                params.profile = args.linkedin_url;
+            if (args.location)
+                params.location = args.location;
+            if (Object.keys(params).length === 0) {
+                return { success: false, error: "At least one identifier required: email, phone, first_name+last_name, or linkedin_url" };
+            }
+            try {
+                const queryString = new URLSearchParams(params).toString();
+                const resp = await fetch(`https://api.peopledatalabs.com/v5/person/enrich?${queryString}`, {
+                    method: "GET",
+                    headers: {
+                        "X-Api-Key": apiKey,
+                        "Accept": "application/json",
+                    },
+                });
+                if (!resp.ok) {
+                    const text = await resp.text().catch(() => "");
+                    if (resp.status === 404) {
+                        return { success: true, data: null, error: "No enrichment data found for this person" };
+                    }
+                    return { success: false, error: `PDL API error ${resp.status}: ${text.substring(0, 500)}` };
+                }
+                const pdlData = await resp.json();
+                // Store enrichment profile
+                const profile = {
+                    customer_id: customerId,
+                    store_id: sid,
+                    source: "pdl",
+                    enrichment_data: pdlData,
+                    enriched_at: nowISO(),
+                    updated_at: nowISO(),
+                };
+                // Extract common fields if present
+                if (pdlData.full_name)
+                    profile.full_name = pdlData.full_name;
+                if (pdlData.job_title)
+                    profile.job_title = pdlData.job_title;
+                if (pdlData.job_company_name)
+                    profile.company = pdlData.job_company_name;
+                if (pdlData.linkedin_url)
+                    profile.linkedin_url = pdlData.linkedin_url;
+                if (pdlData.location_name)
+                    profile.location = pdlData.location_name;
+                if (pdlData.gender)
+                    profile.gender = pdlData.gender;
+                if (pdlData.birth_year)
+                    profile.birth_year = pdlData.birth_year;
+                // Upsert — update if already exists for this customer+store
+                const { data: existing } = await sb.from("customer_enrichment_profiles")
+                    .select("id")
+                    .eq("customer_id", customerId)
+                    .eq("store_id", sid)
+                    .maybeSingle();
+                let result;
+                if (existing) {
+                    const { data, error } = await sb.from("customer_enrichment_profiles")
+                        .update(profile)
+                        .eq("id", existing.id)
+                        .select()
+                        .single();
+                    result = { data, error };
+                }
+                else {
+                    profile.created_at = nowISO();
+                    const { data, error } = await sb.from("customer_enrichment_profiles")
+                        .insert(profile)
+                        .select()
+                        .single();
+                    result = { data, error };
+                }
+                if (result.error)
+                    return { success: false, error: `Failed to store enrichment: ${result.error.message}` };
+                return { success: true, data: result.data };
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                return { success: false, error: `PDL enrichment failed: ${msg}` };
+            }
+        }
+        // ---- ENRICH_LINKEDIN: Bright Data LinkedIn scraper ----
+        case "enrich_linkedin": {
+            const customerId = args.customer_id;
+            const linkedinUrl = args.linkedin_url;
+            if (!customerId)
+                return { success: false, error: "customer_id is required" };
+            if (!linkedinUrl)
+                return { success: false, error: "linkedin_url is required" };
+            const apiKey = await getSecret(sb, "brightdata_api_key", sid);
+            if (!apiKey)
+                return { success: false, error: "Bright Data API key not configured. Add 'brightdata_api_key' to store secrets." };
+            const datasetId = await getSecret(sb, "brightdata_dataset_id", sid) || "gd_l1viktl72bvl7bjuj0";
+            try {
+                // Bright Data Scraper API — synchronous LinkedIn profile collection
+                const resp = await fetch(`https://api.brightdata.com/datasets/v3/scrape?dataset_id=${datasetId}&notify=false&include_errors=true`, {
+                    method: "POST",
+                    headers: {
+                        Authorization: `Bearer ${apiKey}`,
+                        "Content-Type": "application/json",
+                    },
+                    body: JSON.stringify({ input: [{ url: linkedinUrl }] }),
+                });
+                if (!resp.ok) {
+                    const text = await resp.text().catch(() => "");
+                    if (resp.status === 404) {
+                        return { success: true, data: null, error: "No LinkedIn profile found at this URL" };
+                    }
+                    return { success: false, error: `Bright Data API error ${resp.status}: ${text.substring(0, 500)}` };
+                }
+                const bdResult = await resp.json();
+                // Bright Data returns an array of results
+                const profileData = Array.isArray(bdResult) ? bdResult[0] : bdResult;
+                if (!profileData || profileData.error) {
+                    return { success: true, data: null, error: profileData?.error || "No data returned for this profile" };
+                }
+                // Store as enrichment profile with source=brightdata
+                const profile = {
+                    customer_id: customerId,
+                    store_id: sid,
+                    source: "brightdata",
+                    enrichment_data: profileData,
+                    enriched_at: nowISO(),
+                    updated_at: nowISO(),
+                };
+                // Extract common fields from Bright Data response
+                if (profileData.name || profileData.full_name)
+                    profile.full_name = profileData.name || profileData.full_name;
+                if (profileData.position || profileData.job_title)
+                    profile.job_title = profileData.position || profileData.job_title;
+                if (profileData.current_company || profileData.company)
+                    profile.company = profileData.current_company || profileData.company;
+                if (profileData.headline)
+                    profile.headline = profileData.headline;
+                if (profileData.location)
+                    profile.location = profileData.location;
+                profile.linkedin_url = linkedinUrl;
+                // Upsert — update if already exists for this customer+store+source
+                const { data: existing } = await sb.from("customer_enrichment_profiles")
+                    .select("id")
+                    .eq("customer_id", customerId)
+                    .eq("store_id", sid)
+                    .eq("source", "brightdata")
+                    .maybeSingle();
+                let result;
+                if (existing) {
+                    const { data, error } = await sb.from("customer_enrichment_profiles")
+                        .update(profile)
+                        .eq("id", existing.id)
+                        .select()
+                        .single();
+                    result = { data, error };
+                }
+                else {
+                    profile.created_at = nowISO();
+                    const { data, error } = await sb.from("customer_enrichment_profiles")
+                        .insert(profile)
+                        .select()
+                        .single();
+                    result = { data, error };
+                }
+                if (result.error)
+                    return { success: false, error: `Failed to store enrichment: ${result.error.message}` };
+                return { success: true, data: result.data };
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                return { success: false, error: `Bright Data enrichment failed: ${msg}` };
+            }
+        }
+        // ---- CHECK_XONPLUS: xonPlus real-time breach monitoring ----
+        case "check_xonplus": {
+            const customerId = args.customer_id;
+            const email = args.email;
+            if (!customerId)
+                return { success: false, error: "customer_id is required" };
+            if (!email)
+                return { success: false, error: "email is required" };
+            const apiKey = await getSecret(sb, "xonplus_api_key", sid);
+            if (!apiKey)
+                return { success: false, error: "xonPlus API key not configured. Add 'xonplus_api_key' to store secrets." };
+            try {
+                const resp = await fetch(`https://api.xposedornot.com/v1/check-email/${encodeURIComponent(email)}`, {
+                    method: "GET",
+                    headers: {
+                        "x-api-key": apiKey,
+                        Accept: "application/json",
+                    },
+                });
+                if (!resp.ok) {
+                    const text = await resp.text().catch(() => "");
+                    if (resp.status === 404) {
+                        return { success: true, data: { email, total_breaches: 0, breaches: [] } };
+                    }
+                    return { success: false, error: `xonPlus API error ${resp.status}: ${text.substring(0, 500)}` };
+                }
+                const xonData = await resp.json();
+                const breaches = (xonData.breaches || xonData.ExposedBreaches?.breaches_details || []);
+                // Store each breach record
+                const inserted = [];
+                for (const breach of breaches) {
+                    const record = {
+                        customer_id: customerId,
+                        store_id: sid,
+                        breach_name: breach.breach || breach.name || "unknown",
+                        breach_domain: breach.domain || null,
+                        breach_date: breach.xposed_date || breach.date || null,
+                        data_classes: breach.xposed_data ? breach.xposed_data.split(",").map((s) => s.trim()) : null,
+                        source: "xonplus",
+                        raw_data: breach,
+                        discovered_at: nowISO(),
+                        created_at: nowISO(),
+                    };
+                    // Deduplicate by customer_id + breach_name + source
+                    const { data: existing } = await sb.from("customer_breach_records")
+                        .select("id")
+                        .eq("customer_id", customerId)
+                        .eq("breach_name", record.breach_name)
+                        .eq("source", "xonplus")
+                        .maybeSingle();
+                    if (!existing) {
+                        const { data, error } = await sb.from("customer_breach_records")
+                            .insert(record)
+                            .select()
+                            .single();
+                        if (!error && data)
+                            inserted.push(data);
+                    }
+                }
+                return {
+                    success: true,
+                    data: {
+                        email,
+                        total_breaches: breaches.length,
+                        new_breaches: inserted.length,
+                        risk_metrics: xonData.BreachMetrics || null,
+                        breaches: inserted.length > 0 ? inserted : breaches,
+                    },
+                };
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                return { success: false, error: `xonPlus breach check failed: ${msg}` };
+            }
+        }
+        // ---- CHECK_BREACHES: HIBP Breach Check ----
+        case "check_breaches": {
+            const customerId = args.customer_id;
+            const email = args.email;
+            if (!customerId)
+                return { success: false, error: "customer_id is required" };
+            if (!email)
+                return { success: false, error: "email is required" };
+            const apiKey = await getSecret(sb, "hibp_api_key", sid);
+            if (!apiKey)
+                return { success: false, error: "HIBP API key not configured. Add 'hibp_api_key' to store secrets." };
+            try {
+                const resp = await fetch(`https://haveibeenpwned.com/api/v3/breachedaccount/${encodeURIComponent(email)}?truncateResponse=false`, {
+                    method: "GET",
+                    headers: {
+                        "hibp-api-key": apiKey,
+                        "User-Agent": "SwagManager-DataProtection",
+                        Accept: "application/json",
+                    },
+                });
+                let breaches = [];
+                if (resp.status === 404) {
+                    // No breaches found — that's good
+                    breaches = [];
+                }
+                else if (!resp.ok) {
+                    const text = await resp.text().catch(() => "");
+                    return { success: false, error: `HIBP API error ${resp.status}: ${text.substring(0, 500)}` };
+                }
+                else {
+                    breaches = await resp.json();
+                }
+                // Store each breach record
+                const inserted = [];
+                for (const breach of breaches) {
+                    const record = {
+                        customer_id: customerId,
+                        store_id: sid,
+                        breach_name: breach.Name,
+                        breach_domain: breach.Domain,
+                        breach_date: breach.BreachDate,
+                        data_classes: breach.DataClasses,
+                        description: breach.Description,
+                        is_verified: breach.IsVerified,
+                        is_sensitive: breach.IsSensitive,
+                        source: "hibp",
+                        discovered_at: nowISO(),
+                        created_at: nowISO(),
+                    };
+                    // Upsert by customer_id + breach_name to avoid duplicates
+                    const { data: existing } = await sb.from("customer_breach_records")
+                        .select("id")
+                        .eq("customer_id", customerId)
+                        .eq("breach_name", breach.Name)
+                        .maybeSingle();
+                    if (!existing) {
+                        const { data, error } = await sb.from("customer_breach_records")
+                            .insert(record)
+                            .select()
+                            .single();
+                        if (!error && data)
+                            inserted.push(data);
+                    }
+                }
+                return {
+                    success: true,
+                    data: {
+                        email,
+                        total_breaches: breaches.length,
+                        new_breaches: inserted.length,
+                        breaches: inserted.length > 0 ? inserted : breaches,
+                    },
+                };
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                return { success: false, error: `HIBP breach check failed: ${msg}` };
+            }
+        }
+        // ---- CHECK_DEHASHED: DeHashed credential exposure search ----
+        case "check_dehashed": {
+            const customerId = args.customer_id;
+            const email = args.email;
+            if (!customerId)
+                return { success: false, error: "customer_id is required" };
+            if (!email)
+                return { success: false, error: "email is required" };
+            const apiKey = await getSecret(sb, "dehashed_api_key", sid);
+            if (!apiKey)
+                return { success: false, error: "DeHashed API key not configured. Add 'dehashed_api_key' to store secrets." };
+            try {
+                const resp = await fetch("https://api.dehashed.com/v2/search", {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/json",
+                        "DeHashed-Api-Key": apiKey,
+                    },
+                    body: JSON.stringify({
+                        query: `email:"${email}"`,
+                        page: 1,
+                        size: 100,
+                        wildcard: false,
+                        regex: false,
+                        de_dupe: true,
+                    }),
+                });
+                if (!resp.ok) {
+                    const text = await resp.text().catch(() => "");
+                    return { success: false, error: `DeHashed API error ${resp.status}: ${text.substring(0, 500)}` };
+                }
+                const result = await resp.json();
+                const entries = (result.entries || []);
+                // Store each as a breach record with source=dehashed
+                const inserted = [];
+                for (const entry of entries) {
+                    const record = {
+                        customer_id: customerId,
+                        store_id: sid,
+                        breach_name: entry.database_name || "unknown",
+                        breach_domain: entry.domain || null,
+                        breach_date: entry.obtained_date || null,
+                        data_classes: entry.type ? [entry.type] : null,
+                        source: "dehashed",
+                        raw_data: entry,
+                        discovered_at: nowISO(),
+                        created_at: nowISO(),
+                    };
+                    const { data, error } = await sb.from("customer_breach_records")
+                        .insert(record)
+                        .select()
+                        .single();
+                    if (!error && data)
+                        inserted.push(data);
+                }
+                return {
+                    success: true,
+                    data: {
+                        email,
+                        total_results: entries.length,
+                        stored: inserted.length,
+                        entries: inserted,
+                    },
+                };
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                return { success: false, error: `DeHashed check failed: ${msg}` };
+            }
+        }
+        // ---- GET_ENRICHMENT: Read enrichment profiles ----
+        case "get_enrichment": {
+            const customerId = args.customer_id;
+            if (!customerId)
+                return { success: false, error: "customer_id is required" };
+            let q = sb.from("customer_enrichment_profiles")
+                .select("*")
+                .eq("customer_id", customerId)
+                .eq("store_id", sid)
+                .order("enriched_at", { ascending: false });
+            if (args.source)
+                q = q.eq("source", args.source);
+            const limit = args.limit || 10;
+            q = q.limit(limit);
+            const { data, error } = await q;
+            return error
+                ? { success: false, error: error.message }
+                : { success: true, data: { count: data?.length, records: data } };
+        }
+        // ---- GET_BREACHES: Read breach records ----
+        case "get_breaches": {
+            const customerId = args.customer_id;
+            if (!customerId)
+                return { success: false, error: "customer_id is required" };
+            let q = sb.from("customer_breach_records")
+                .select("*")
+                .eq("customer_id", customerId)
+                .eq("store_id", sid)
+                .order("discovered_at", { ascending: false });
+            if (args.source)
+                q = q.eq("source", args.source);
+            const limit = args.limit || 50;
+            q = q.limit(limit);
+            const { data, error } = await q;
+            return error
+                ? { success: false, error: error.message }
+                : { success: true, data: { count: data?.length, records: data } };
+        }
+        // ---- GET_EXPOSURES: Read broker exposures ----
+        case "get_exposures": {
+            const customerId = args.customer_id;
+            if (!customerId)
+                return { success: false, error: "customer_id is required" };
+            let q = sb.from("customer_exposures")
+                .select("*")
+                .eq("customer_id", customerId)
+                .eq("store_id", sid)
+                .order("discovered_at", { ascending: false });
+            if (args.status)
+                q = q.eq("status", args.status);
+            if (args.broker)
+                q = q.eq("broker", args.broker);
+            const limit = args.limit || 50;
+            q = q.limit(limit);
+            const { data, error } = await q;
+            return error
+                ? { success: false, error: error.message }
+                : { success: true, data: { count: data?.length, records: data } };
+        }
+        // ---- GET_REMOVAL_STATUS: Read removal requests ----
+        case "get_removal_status": {
+            const customerId = args.customer_id;
+            if (!customerId)
+                return { success: false, error: "customer_id is required" };
+            let q = sb.from("customer_removal_requests")
+                .select("*")
+                .eq("customer_id", customerId)
+                .eq("store_id", sid)
+                .order("created_at", { ascending: false });
+            if (args.status)
+                q = q.eq("status", args.status);
+            const limit = args.limit || 50;
+            q = q.limit(limit);
+            const { data, error } = await q;
+            return error
+                ? { success: false, error: error.message }
+                : { success: true, data: { count: data?.length, records: data } };
+        }
+        // ---- GET_RISK_SCORE: Read latest risk score ----
+        case "get_risk_score": {
+            const customerId = args.customer_id;
+            if (!customerId)
+                return { success: false, error: "customer_id is required" };
+            const { data, error } = await sb.from("customer_risk_scores")
+                .select("*")
+                .eq("customer_id", customerId)
+                .eq("store_id", sid)
+                .order("calculated_at", { ascending: false })
+                .limit(1)
+                .maybeSingle();
+            return error
+                ? { success: false, error: error.message }
+                : { success: true, data };
+        }
+        // ---- STORE_SCAN_RESULTS: Insert scan results ----
+        case "store_scan_results": {
+            const customerId = args.customer_id;
+            if (!customerId)
+                return { success: false, error: "customer_id is required" };
+            const record = {
+                customer_id: customerId,
+                store_id: sid,
+                scan_type: args.scan_type || "discovery",
+                scan_data: args.scan_data || {},
+                broker_count: args.broker_count ?? 0,
+                exposure_count: args.exposure_count ?? 0,
+                status: args.status || "completed",
+                created_at: nowISO(),
+            };
+            if (args.scan_id)
+                record.scan_id = args.scan_id;
+            if (args.file_path)
+                record.file_path = args.file_path;
+            const { data, error } = await sb.from("customer_scan_results")
+                .insert(record)
+                .select()
+                .single();
+            return error
+                ? { success: false, error: `Failed to store scan results: ${error.message}` }
+                : { success: true, data };
+        }
+        // ---- STORE_EXPOSURE: Insert a broker exposure ----
+        case "store_exposure": {
+            const customerId = args.customer_id;
+            const broker = args.broker;
+            if (!customerId)
+                return { success: false, error: "customer_id is required" };
+            if (!broker)
+                return { success: false, error: "broker is required" };
+            // Check for existing exposure to avoid duplicates
+            const { data: existing } = await sb.from("customer_exposures")
+                .select("id")
+                .eq("customer_id", customerId)
+                .eq("store_id", sid)
+                .eq("broker", broker)
+                .maybeSingle();
+            if (existing) {
+                // Update existing record
+                const updates = { updated_at: nowISO() };
+                if (args.profile_url)
+                    updates.profile_url = args.profile_url;
+                if (args.data_found)
+                    updates.data_found = args.data_found;
+                if (args.status)
+                    updates.status = args.status;
+                if (args.exposure_data)
+                    updates.exposure_data = args.exposure_data;
+                const { data, error } = await sb.from("customer_exposures")
+                    .update(updates)
+                    .eq("id", existing.id)
+                    .select()
+                    .single();
+                return error
+                    ? { success: false, error: `Failed to update exposure: ${error.message}` }
+                    : { success: true, data: { ...data, _note: "Updated existing exposure record" } };
+            }
+            const record = {
+                customer_id: customerId,
+                store_id: sid,
+                broker,
+                status: args.status || "found",
+                discovered_at: nowISO(),
+                created_at: nowISO(),
+            };
+            if (args.profile_url)
+                record.profile_url = args.profile_url;
+            if (args.data_found)
+                record.data_found = args.data_found;
+            if (args.exposure_data)
+                record.exposure_data = args.exposure_data;
+            if (args.scan_id)
+                record.scan_id = args.scan_id;
+            const { data, error } = await sb.from("customer_exposures")
+                .insert(record)
+                .select()
+                .single();
+            return error
+                ? { success: false, error: `Failed to store exposure: ${error.message}` }
+                : { success: true, data };
+        }
+        // ---- UPDATE_EXPOSURE_STATUS: Update exposure status ----
+        case "update_exposure_status": {
+            const exposureId = args.exposure_id;
+            if (!exposureId)
+                return { success: false, error: "exposure_id is required" };
+            const updates = { updated_at: nowISO() };
+            if (args.status)
+                updates.status = args.status;
+            if (args.removal_method)
+                updates.removal_method = args.removal_method;
+            if (args.removal_confirmed_at)
+                updates.removal_confirmed_at = args.removal_confirmed_at;
+            if (args.notes)
+                updates.notes = args.notes;
+            if (args.status === "removed") {
+                updates.removed_at = nowISO();
+            }
+            const { data, error } = await sb.from("customer_exposures")
+                .update(updates)
+                .eq("id", exposureId)
+                .eq("store_id", sid)
+                .select()
+                .single();
+            return error
+                ? { success: false, error: `Failed to update exposure: ${error.message}` }
+                : { success: true, data };
+        }
+        // ---- STORE_REMOVAL_REQUEST: Insert a removal request ----
+        case "store_removal_request": {
+            const customerId = args.customer_id;
+            const broker = args.broker;
+            if (!customerId)
+                return { success: false, error: "customer_id is required" };
+            if (!broker)
+                return { success: false, error: "broker is required" };
+            const record = {
+                customer_id: customerId,
+                store_id: sid,
+                broker,
+                method: args.method || "manual",
+                status: args.status || "pending",
+                created_at: nowISO(),
+                updated_at: nowISO(),
+            };
+            if (args.exposure_id)
+                record.exposure_id = args.exposure_id;
+            if (args.request_data)
+                record.request_data = args.request_data;
+            if (args.submitted_at)
+                record.submitted_at = args.submitted_at;
+            if (args.confirmation_id)
+                record.confirmation_id = args.confirmation_id;
+            const { data, error } = await sb.from("customer_removal_requests")
+                .insert(record)
+                .select()
+                .single();
+            return error
+                ? { success: false, error: `Failed to store removal request: ${error.message}` }
+                : { success: true, data };
+        }
+        // ---- CALCULATE_RISK_SCORE: Compute and store a risk score ----
+        case "calculate_risk_score": {
+            const customerId = args.customer_id;
+            if (!customerId)
+                return { success: false, error: "customer_id is required" };
+            // Gather data for risk calculation
+            const [exposuresResult, breachesResult, removalsResult] = await Promise.all([
+                sb.from("customer_exposures")
+                    .select("id, broker, status, data_found")
+                    .eq("customer_id", customerId)
+                    .eq("store_id", sid),
+                sb.from("customer_breach_records")
+                    .select("id, breach_name, data_classes, is_sensitive, is_verified")
+                    .eq("customer_id", customerId)
+                    .eq("store_id", sid),
+                sb.from("customer_removal_requests")
+                    .select("id, status, broker")
+                    .eq("customer_id", customerId)
+                    .eq("store_id", sid),
+            ]);
+            const exposures = exposuresResult.data || [];
+            const breaches = breachesResult.data || [];
+            const removals = removalsResult.data || [];
+            // Score calculation:
+            // - Each active exposure: +10 points
+            // - Each removed exposure: -5 points (still contributes slightly)
+            // - Each breach: +15 points
+            // - Each sensitive breach: +25 points (instead of 15)
+            // - Each verified breach: +5 bonus
+            // - Each completed removal: -8 points
+            // - Base floor: 0, cap: 100
+            let score = 0;
+            // Exposure scoring
+            const activeExposures = exposures.filter((e) => e.status !== "removed");
+            const removedExposures = exposures.filter((e) => e.status === "removed");
+            score += activeExposures.length * 10;
+            score += removedExposures.length * 2;
+            // Breach scoring
+            for (const breach of breaches) {
+                if (breach.is_sensitive) {
+                    score += 25;
+                }
+                else {
+                    score += 15;
+                }
+                if (breach.is_verified) {
+                    score += 5;
+                }
+            }
+            // Removal credit
+            const completedRemovals = removals.filter((r) => r.status === "completed" || r.status === "confirmed");
+            score -= completedRemovals.length * 8;
+            // Clamp to 0-100
+            score = Math.max(0, Math.min(100, score));
+            // Determine risk level
+            let riskLevel;
+            if (score >= 75)
+                riskLevel = "critical";
+            else if (score >= 50)
+                riskLevel = "high";
+            else if (score >= 25)
+                riskLevel = "medium";
+            else
+                riskLevel = "low";
+            const riskRecord = {
+                customer_id: customerId,
+                store_id: sid,
+                overall_score: score,
+                risk_level: riskLevel,
+                factors: {
+                    active_exposures: activeExposures.length,
+                    removed_exposures: removedExposures.length,
+                    total_breaches: breaches.length,
+                    sensitive_breaches: breaches.filter((b) => b.is_sensitive).length,
+                    completed_removals: completedRemovals.length,
+                    pending_removals: removals.filter((r) => r.status === "pending").length,
+                },
+                calculated_at: nowISO(),
+                created_at: nowISO(),
+            };
+            const { data, error } = await sb.from("customer_risk_scores")
+                .insert(riskRecord)
+                .select()
+                .single();
+            return error
+                ? { success: false, error: `Failed to store risk score: ${error.message}` }
+                : { success: true, data };
+        }
+        default:
+            return {
+                success: false,
+                error: `Unknown enrichment action: ${action}. Valid: enrich_person, enrich_linkedin, check_breaches, check_dehashed, check_xonplus, get_enrichment, get_breaches, get_exposures, get_removal_status, get_risk_score, store_scan_results, store_exposure, update_exposure_status, store_removal_request, calculate_risk_score`,
+            };
+    }
+}