whale-code 6.5.4 → 6.5.6

package/dist/server/handlers/comms.js

@@ -1,1021 +1,1494 @@
 import { sanitizeFilterValue, escapeCSV, fillTemplate, groupBy } from "../lib/utils.js";
 import { validateUrl } from "../lib/ssrf-guard.js";
-import { applyGenerationRules, generateCannabinoidData, applyCalculations, runValidation, generateFullPanelData, } from "../lib/pdf-renderer.js";
+import { applyGenerationRules, generateCannabinoidData, applyCalculations, runValidation, generateFullPanelData } from "../lib/pdf-renderer.js";
 import { renderLayoutToPdf, renderHtmlToPdf, renderLabelToPdf } from "../lib/react-pdf-layout.js";
 import { renderCOAToPdf } from "../lib/coa-renderer.js";
 import QRCode from "qrcode";
+import { handleBrowser } from "./browser.js";
 const MAX_ATTACHMENT_BYTES = 10 * 1024 * 1024; // 10MB per attachment
 const MAX_TOTAL_ATTACHMENT_BYTES = 25 * 1024 * 1024; // 25MB total
 const MAX_ATTACHMENT_COUNT = 10;
+
+/** Generate a PNG thumbnail for a PDF document via Playwright screenshot and store it in Supabase. */
+async function generateThumbnail(sb, docId, pdfUrl) {
+  // Wrap in Google Docs viewer — headless Chromium downloads raw PDFs instead of rendering them
+  const viewerUrl = `https://docs.google.com/gview?url=${encodeURIComponent(pdfUrl)}&embedded=true`;
+  const result = await handleBrowser(sb, {
+    action: "screenshot",
+    url: viewerUrl
+  });
+  const b64 = result.data?.screenshot_base64;
+  if (!b64) return;
+  const thumbBuffer = Buffer.from(b64, 'base64');
+  const thumbPath = `thumbs/${docId}.png`;
+  await sb.storage.from('screenshots').upload(thumbPath, thumbBuffer, {
+    contentType: 'image/png',
+    upsert: true
+  });
+  const {
+    data: thumbUrlData
+  } = sb.storage.from('screenshots').getPublicUrl(thumbPath);
+  await sb.from('store_documents').update({
+    thumbnail_url: thumbUrlData.publicUrl
+  }).eq('id', docId);
+}
 export async function handleEmail(sb, args, storeId) {
-    if (!storeId)
-        return { success: false, error: "store_id required" };
-    const sid = storeId;
-    switch (args.action) {
-        case "inbox": {
-            let q = sb.from("email_threads").select("*, latest_message:email_inbox(subject, from_email, created_at)")
-                .eq("store_id", sid).order("updated_at", { ascending: false }).limit(args.limit || 25);
-            if (args.status)
-                q = q.eq("status", args.status);
-            if (args.mailbox)
-                q = q.eq("mailbox", args.mailbox);
-            if (args.priority)
-                q = q.eq("priority", args.priority);
-            const { data, error } = await q;
-            if (error)
-                return { success: false, error: error.message };
-            // Flatten latest_message join so subject/from appear as table columns
-            const flattened = (data || []).map((row) => {
-                const { latest_message, ...rest } = row;
-                return { ...rest, subject: latest_message?.subject || null, from_email: latest_message?.from_email || null };
-            });
-            return { success: true, data: flattened };
+  if (!storeId) return {
+    success: false,
+    error: "store_id required"
+  };
+  const sid = storeId;
+  switch (args.action) {
+    case "inbox":
+      {
+        let q = sb.from("email_threads").select("*, latest_message:email_inbox(subject, from_email, created_at)").eq("store_id", sid).order("updated_at", {
+          ascending: false
+        }).limit(args.limit || 25);
+        if (args.status) q = q.eq("status", args.status);
+        if (args.mailbox) q = q.eq("mailbox", args.mailbox);
+        if (args.priority) q = q.eq("priority", args.priority);
+        const {
+          data,
+          error
+        } = await q;
+        if (error) return {
+          success: false,
+          error: error.message
+        };
+        // Flatten latest_message join so subject/from appear as table columns
+        const flattened = (data || []).map(row => {
+          const {
+            latest_message,
+            ...rest
+          } = row;
+          return {
+            ...rest,
+            subject: latest_message?.subject || null,
+            from_email: latest_message?.from_email || null
+          };
+        });
+        return {
+          success: true,
+          data: flattened
+        };
+      }
+    case "inbox_get":
+      {
+        const {
+          data,
+          error
+        } = await sb.from("email_threads").select("*, messages:email_inbox(id, subject, from_email, to_email, body_text, created_at)").eq("id", args.thread_id).eq("store_id", sid).single();
+        if (error) return {
+          success: false,
+          error: error.message
+        };
+        // Pre-format so messages are visible (formatter handles sub-tables but body gets truncated)
+        const {
+          messages,
+          ...thread
+        } = data;
+        const lines = [`## Email Thread`, `**Status**: ${thread.status || "—"} | **Mailbox**: ${thread.mailbox || "—"} | **Priority**: ${thread.priority || "—"}`, ""];
+        for (const msg of (messages || []).sort((a, b) => new Date(a.created_at).getTime() - new Date(b.created_at).getTime())) {
+          lines.push(`### ${msg.from_email} → ${msg.to_email || "—"} (${msg.created_at?.slice(0, 16) || "—"})`);
+          lines.push(`**Subject**: ${msg.subject || "(no subject)"}`);
+          const body = (msg.body_text || "").slice(0, 500);
+          lines.push(body + (msg.body_text?.length > 500 ? "..." : ""));
+          lines.push("");
         }
-        case "inbox_get": {
-            const { data, error } = await sb.from("email_threads")
-                .select("*, messages:email_inbox(id, subject, from_email, to_email, body_text, created_at)").eq("id", args.thread_id).eq("store_id", sid).single();
-            if (error)
-                return { success: false, error: error.message };
-            // Pre-format so messages are visible (formatter handles sub-tables but body gets truncated)
-            const { messages, ...thread } = data;
-            const lines = [
-                `## Email Thread`,
-                `**Status**: ${thread.status || "—"} | **Mailbox**: ${thread.mailbox || "—"} | **Priority**: ${thread.priority || "—"}`,
-                "",
-            ];
-            for (const msg of (messages || []).sort((a, b) => new Date(a.created_at).getTime() - new Date(b.created_at).getTime())) {
-                lines.push(`### ${msg.from_email} → ${msg.to_email || "—"} (${msg.created_at?.slice(0, 16) || "—"})`);
-                lines.push(`**Subject**: ${msg.subject || "(no subject)"}`);
-                const body = (msg.body_text || "").slice(0, 500);
-                lines.push(body + (msg.body_text?.length > 500 ? "..." : ""));
-                lines.push("");
-            }
-            return { success: true, data: lines.join("\n") };
+        return {
+          success: true,
+          data: lines.join("\n")
+        };
+      }
+    case "send":
+      {
+        // P0 FIX: Per-store email rate limit (100 emails/hour)
+        const oneHourAgo = new Date(Date.now() - 3600_000).toISOString();
+        const {
+          count: recentSends
+        } = await sb.from("email_sends").select("id", {
+          count: "exact",
+          head: true
+        }).eq("store_id", sid).gte("created_at", oneHourAgo);
+        if ((recentSends || 0) >= 100) {
+          return {
+            success: false,
+            error: "Email rate limit exceeded (100/hour). Try again later."
+          };
         }
-        case "send": {
-            // P0 FIX: Per-store email rate limit (100 emails/hour)
-            const oneHourAgo = new Date(Date.now() - 3600_000).toISOString();
-            const { count: recentSends } = await sb.from("email_sends")
-                .select("id", { count: "exact", head: true })
-                .eq("store_id", sid)
-                .gte("created_at", oneHourAgo);
-            if ((recentSends || 0) >= 100) {
-                return { success: false, error: "Email rate limit exceeded (100/hour). Try again later." };
+
+        // Invoke send-email edge function
+        const sbUrl = process.env["SUPABASE_URL"];
+        const sbKey = process.env["SUPABASE_SERVICE_ROLE_KEY"];
+        try {
+          // Resolve URL-based attachments to base64 for Resend API
+          let attachments;
+          const rawAttachments = args.attachments;
+          if (rawAttachments && rawAttachments.length > 0) {
+            // P0 FIX: Enforce attachment count limit
+            if (rawAttachments.length > MAX_ATTACHMENT_COUNT) {
+              throw new Error(`Too many attachments: ${rawAttachments.length} (max ${MAX_ATTACHMENT_COUNT})`);
             }
-            // Invoke send-email edge function
-            const sbUrl = process.env["SUPABASE_URL"];
-            const sbKey = process.env["SUPABASE_SERVICE_ROLE_KEY"];
-            try {
-                // Resolve URL-based attachments to base64 for Resend API
-                let attachments;
-                const rawAttachments = args.attachments;
-                if (rawAttachments && rawAttachments.length > 0) {
-                    // P0 FIX: Enforce attachment count limit
-                    if (rawAttachments.length > MAX_ATTACHMENT_COUNT) {
-                        throw new Error(`Too many attachments: ${rawAttachments.length} (max ${MAX_ATTACHMENT_COUNT})`);
-                    }
-                    attachments = [];
-                    let totalBytes = 0;
-                    for (const att of rawAttachments) {
-                        if (att.url) {
-                            // P0 FIX: Validate URL to prevent SSRF via attachment URLs
-                            const ssrfErr = await validateUrl(att.url);
-                            if (ssrfErr)
-                                throw new Error(`Attachment URL blocked: ${ssrfErr}`);
-                            // Fetch the file and convert to base64
-                            const fileResp = await fetch(att.url);
-                            if (!fileResp.ok)
-                                throw new Error(`Failed to fetch attachment: ${att.url} (${fileResp.status})`);
-                            const buffer = await fileResp.arrayBuffer();
-                            // P0 FIX: Enforce 10MB per-attachment size limit
-                            if (buffer.byteLength > MAX_ATTACHMENT_BYTES) {
-                                throw new Error(`Attachment too large: ${(buffer.byteLength / 1024 / 1024).toFixed(1)}MB (max 10MB)`);
-                            }
-                            // P0 FIX: Enforce 25MB total attachment size limit
-                            totalBytes += buffer.byteLength;
-                            if (totalBytes > MAX_TOTAL_ATTACHMENT_BYTES) {
-                                throw new Error(`Total attachment size exceeds limit: ${(totalBytes / 1024 / 1024).toFixed(1)}MB (max 25MB)`);
-                            }
-                            const base64 = Buffer.from(buffer).toString("base64");
-                            const filename = att.filename || att.url.split("/").pop() || "attachment";
-                            attachments.push({ filename, content: base64 });
-                        }
-                        else if (att.content && att.filename) {
-                            // Already base64 — decode length to check size
-                            const contentBytes = Math.ceil((att.content.length * 3) / 4);
-                            if (contentBytes > MAX_ATTACHMENT_BYTES) {
-                                throw new Error(`Attachment too large: ${(contentBytes / 1024 / 1024).toFixed(1)}MB (max 10MB)`);
-                            }
-                            totalBytes += contentBytes;
-                            if (totalBytes > MAX_TOTAL_ATTACHMENT_BYTES) {
-                                throw new Error(`Total attachment size exceeds limit: ${(totalBytes / 1024 / 1024).toFixed(1)}MB (max 25MB)`);
-                            }
-                            attachments.push({ filename: att.filename, content: att.content });
-                        }
-                    }
+            attachments = [];
+            let totalBytes = 0;
+            for (const att of rawAttachments) {
+              if (att.url) {
+                // P0 FIX: Validate URL to prevent SSRF via attachment URLs
+                const ssrfErr = await validateUrl(att.url);
+                if (ssrfErr) throw new Error(`Attachment URL blocked: ${ssrfErr}`);
+                // Fetch the file and convert to base64
+                const fileResp = await fetch(att.url);
+                if (!fileResp.ok) throw new Error(`Failed to fetch attachment: ${att.url} (${fileResp.status})`);
+                const buffer = await fileResp.arrayBuffer();
+                // P0 FIX: Enforce 10MB per-attachment size limit
+                if (buffer.byteLength > MAX_ATTACHMENT_BYTES) {
+                  throw new Error(`Attachment too large: ${(buffer.byteLength / 1024 / 1024).toFixed(1)}MB (max 10MB)`);
                 }
-                // Resolve {{variable}} placeholders in email fields against template_data
-                let emailHtml = args.html;
-                let emailSubject = args.subject;
-                let emailText = args.text;
-                if (args.template_data && typeof args.template_data === "object") {
-                    const tplData = args.template_data;
-                    if (emailHtml)
-                        emailHtml = fillTemplate(emailHtml, tplData);
-                    if (emailSubject)
-                        emailSubject = fillTemplate(emailSubject, tplData);
-                    if (emailText)
-                        emailText = fillTemplate(emailText, tplData);
+                // P0 FIX: Enforce 25MB total attachment size limit
+                totalBytes += buffer.byteLength;
+                if (totalBytes > MAX_TOTAL_ATTACHMENT_BYTES) {
+                  throw new Error(`Total attachment size exceeds limit: ${(totalBytes / 1024 / 1024).toFixed(1)}MB (max 25MB)`);
                 }
-                const payload = { to: args.to, subject: emailSubject, html: emailHtml, text: emailText, storeId: sid };
-                if (attachments && attachments.length > 0)
-                    payload.attachments = attachments;
-                const resp = await fetch(`${sbUrl}/functions/v1/send-email`, {
-                    method: "POST",
-                    headers: { "Content-Type": "application/json", "Authorization": `Bearer ${sbKey}` },
-                    body: JSON.stringify(payload)
+                const base64 = Buffer.from(buffer).toString("base64");
+                const filename = att.filename || att.url.split("/").pop() || "attachment";
+                attachments.push({
+                  filename,
+                  content: base64
                 });
-                const result = await resp.json();
-                return resp.ok ? { success: true, data: result } : { success: false, error: result.error || "Send failed" };
-            }
-            catch (err) {
-                return { success: false, error: `Email send failed: ${err}` };
-            }
-        }
-        case "send_template": {
-            const sbUrl = process.env["SUPABASE_URL"];
-            const sbKey = process.env["SUPABASE_SERVICE_ROLE_KEY"];
-            try {
-                const resp = await fetch(`${sbUrl}/functions/v1/send-email`, {
-                    method: "POST",
-                    headers: { "Content-Type": "application/json", "Authorization": `Bearer ${sbKey}` },
-                    body: JSON.stringify({ to: args.to, template: args.template, template_data: args.template_data, storeId: sid })
-                });
-                const result = await resp.json();
-                return resp.ok ? { success: true, data: result } : { success: false, error: result.error || "Send failed" };
-            }
-            catch (err) {
-                return { success: false, error: `Template send failed: ${err}` };
-            }
-        }
-        case "list": {
-            const { data, error } = await sb.from("email_sends").select("*")
-                .eq("store_id", sid).order("created_at", { ascending: false }).limit(args.limit || 50);
-            return error ? { success: false, error: error.message } : { success: true, data };
-        }
-        case "get": {
-            const { data, error } = await sb.from("email_sends")
-                .select("*").eq("id", args.email_id).eq("store_id", sid).single();
-            return error ? { success: false, error: error.message } : { success: true, data };
-        }
-        case "templates": {
-            const { data, error } = await sb.from("email_templates").select("*")
-                .eq("store_id", sid).eq("is_active", true).limit(100);
-            return error ? { success: false, error: error.message } : { success: true, data };
-        }
-        case "inbox_reply": {
-            const sbUrl = process.env["SUPABASE_URL"];
-            const sbKey = process.env["SUPABASE_SERVICE_ROLE_KEY"];
-            try {
-                const resp = await fetch(`${sbUrl}/functions/v1/send-email`, {
-                    method: "POST",
-                    headers: { "Content-Type": "application/json", "Authorization": `Bearer ${sbKey}` },
-                    body: JSON.stringify({ to: args.to, subject: args.subject, html: args.html, text: args.text, thread_id: args.thread_id, storeId: sid })
+              } else if (att.content && att.filename) {
+                // Already base64 — decode length to check size
+                const contentBytes = Math.ceil(att.content.length * 3 / 4);
+                if (contentBytes > MAX_ATTACHMENT_BYTES) {
+                  throw new Error(`Attachment too large: ${(contentBytes / 1024 / 1024).toFixed(1)}MB (max 10MB)`);
+                }
+                totalBytes += contentBytes;
+                if (totalBytes > MAX_TOTAL_ATTACHMENT_BYTES) {
+                  throw new Error(`Total attachment size exceeds limit: ${(totalBytes / 1024 / 1024).toFixed(1)}MB (max 25MB)`);
+                }
+                attachments.push({
+                  filename: att.filename,
+                  content: att.content
                 });
-                const result = await resp.json();
-                return resp.ok ? { success: true, data: result } : { success: false, error: result.error || "Reply failed" };
-            }
-            catch (err) {
-                return { success: false, error: `Reply failed: ${err}` };
+              }
             }
+          }
+
+          // Resolve {{variable}} placeholders in email fields against template_data
+          let emailHtml = args.html;
+          let emailSubject = args.subject;
+          let emailText = args.text;
+          if (args.template_data && typeof args.template_data === "object") {
+            const tplData = args.template_data;
+            if (emailHtml) emailHtml = fillTemplate(emailHtml, tplData);
+            if (emailSubject) emailSubject = fillTemplate(emailSubject, tplData);
+            if (emailText) emailText = fillTemplate(emailText, tplData);
+          }
+          const payload = {
+            to: args.to,
+            subject: emailSubject,
+            html: emailHtml,
+            text: emailText,
+            storeId: sid
+          };
+          if (attachments && attachments.length > 0) payload.attachments = attachments;
+          const resp = await fetch(`${sbUrl}/functions/v1/send-email`, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              "Authorization": `Bearer ${sbKey}`
+            },
+            body: JSON.stringify(payload)
+          });
+          const result = await resp.json();
+          return resp.ok ? {
+            success: true,
+            data: result
+          } : {
+            success: false,
+            error: result.error || "Send failed"
+          };
+        } catch (err) {
+          return {
+            success: false,
+            error: `Email send failed: ${err}`
+          };
         }
-        case "inbox_update": {
-            const updates = {};
-            if (args.status)
-                updates.status = args.status;
-            if (args.priority)
-                updates.priority = args.priority;
-            if (args.intent)
-                updates.ai_intent = args.intent;
-            if (args.ai_summary)
-                updates.ai_summary = args.ai_summary;
-            const { data, error } = await sb.from("email_threads")
-                .update(updates).eq("id", args.thread_id).eq("store_id", sid).select().single();
-            return error ? { success: false, error: error.message } : { success: true, data };
+      }
+    case "send_template":
+      {
+        const sbUrl = process.env["SUPABASE_URL"];
+        const sbKey = process.env["SUPABASE_SERVICE_ROLE_KEY"];
+        try {
+          const resp = await fetch(`${sbUrl}/functions/v1/send-email`, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              "Authorization": `Bearer ${sbKey}`
+            },
+            body: JSON.stringify({
+              to: args.to,
+              template: args.template,
+              template_data: args.template_data,
+              storeId: sid
+            })
+          });
+          const result = await resp.json();
+          return resp.ok ? {
+            success: true,
+            data: result
+          } : {
+            success: false,
+            error: result.error || "Send failed"
+          };
+        } catch (err) {
+          return {
+            success: false,
+            error: `Template send failed: ${err}`
+          };
         }
-        case "inbox_stats": {
-            const { data, error } = await sb.from("email_threads")
-                .select("status, mailbox, priority").eq("store_id", sid).limit(1000);
-            if (error)
-                return { success: false, error: error.message };
-            const stats = {
-                total: data.length,
-                by_status: groupBy(data, "status"),
-                by_mailbox: groupBy(data, "mailbox"),
-                by_priority: groupBy(data, "priority")
-            };
-            return { success: true, data: stats };
+      }
+    case "list":
+      {
+        const {
+          data,
+          error
+        } = await sb.from("email_sends").select("*").eq("store_id", sid).order("created_at", {
+          ascending: false
+        }).limit(args.limit || 50);
+        return error ? {
+          success: false,
+          error: error.message
+        } : {
+          success: true,
+          data
+        };
+      }
+    case "get":
+      {
+        const {
+          data,
+          error
+        } = await sb.from("email_sends").select("*").eq("id", args.email_id).eq("store_id", sid).single();
+        return error ? {
+          success: false,
+          error: error.message
+        } : {
+          success: true,
+          data
+        };
+      }
+    case "templates":
+      {
+        const {
+          data,
+          error
+        } = await sb.from("email_templates").select("*").eq("store_id", sid).eq("is_active", true).limit(100);
+        return error ? {
+          success: false,
+          error: error.message
+        } : {
+          success: true,
+          data
+        };
+      }
+    case "inbox_reply":
+      {
+        const sbUrl = process.env["SUPABASE_URL"];
+        const sbKey = process.env["SUPABASE_SERVICE_ROLE_KEY"];
+        try {
+          const resp = await fetch(`${sbUrl}/functions/v1/send-email`, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              "Authorization": `Bearer ${sbKey}`
+            },
+            body: JSON.stringify({
+              to: args.to,
+              subject: args.subject,
+              html: args.html,
+              text: args.text,
+              thread_id: args.thread_id,
+              storeId: sid
+            })
+          });
+          const result = await resp.json();
+          return resp.ok ? {
+            success: true,
+            data: result
+          } : {
+            success: false,
+            error: result.error || "Reply failed"
+          };
+        } catch (err) {
+          return {
+            success: false,
+            error: `Reply failed: ${err}`
+          };
         }
-        case "create_template": {
-            if (!args.name)
-                return { success: false, error: "name is required" };
-            if (!args.subject)
-                return { success: false, error: "subject is required" };
-            const slug = args.slug || args.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-            const { data, error } = await sb.from("email_templates").insert({
-                store_id: sid,
-                name: args.name,
-                slug,
-                subject: args.subject,
-                category: args.category || "general",
-                description: args.description || null,
-                html_content: args.html_content || null,
-                preview_text: args.preview_text || null,
-                text_content: args.text_content || null,
-                is_active: true,
-            }).select("id, name, slug, subject, category, created_at").single();
-            if (error)
-                return { success: false, error: error.message };
-            return { success: true, data };
-        }
-        case "update_template": {
-            if (!args.template_id)
-                return { success: false, error: "template_id is required" };
-            const updates = {};
-            if (args.name !== undefined)
-                updates.name = args.name;
-            if (args.slug !== undefined)
-                updates.slug = args.slug;
-            if (args.subject !== undefined)
-                updates.subject = args.subject;
-            if (args.category !== undefined)
-                updates.category = args.category;
-            if (args.description !== undefined)
-                updates.description = args.description;
-            if (args.html_content !== undefined)
-                updates.html_content = args.html_content;
-            if (args.preview_text !== undefined)
-                updates.preview_text = args.preview_text;
-            if (args.text_content !== undefined)
-                updates.text_content = args.text_content;
-            if (Object.keys(updates).length === 0)
-                return { success: false, error: "No fields to update" };
-            const { data, error } = await sb.from("email_templates")
-                .update(updates).eq("id", args.template_id).eq("store_id", sid)
-                .select("id, name, slug, subject, category, updated_at").single();
-            if (error)
-                return { success: false, error: error.message };
-            return { success: true, data };
-        }
-        case "delete_template": {
-            if (!args.template_id)
-                return { success: false, error: "template_id is required" };
-            const { data, error } = await sb.from("email_templates")
-                .update({ is_active: false }).eq("id", args.template_id).eq("store_id", sid)
-                .select("id, name").single();
-            if (error)
-                return { success: false, error: error.message };
-            return { success: true, data: { ...data, deleted: true } };
-        }
-        default:
-            return { success: false, error: `Unknown email action: ${args.action}. Valid: send, send_template, list, get, templates, inbox, inbox_get, inbox_reply, inbox_update, inbox_stats, create_template, update_template, delete_template` };
-    }
+      }
+    case "inbox_update":
+      {
+        const updates = {};
+        if (args.status) updates.status = args.status;
+        if (args.priority) updates.priority = args.priority;
+        if (args.intent) updates.ai_intent = args.intent;
+        if (args.ai_summary) updates.ai_summary = args.ai_summary;
+        const {
+          data,
+          error
+        } = await sb.from("email_threads").update(updates).eq("id", args.thread_id).eq("store_id", sid).select().single();
+        return error ? {
+          success: false,
+          error: error.message
+        } : {
+          success: true,
+          data
+        };
+      }
+    case "inbox_stats":
+      {
+        const {
+          data,
+          error
+        } = await sb.from("email_threads").select("status, mailbox, priority").eq("store_id", sid).limit(1000);
+        if (error) return {
+          success: false,
+          error: error.message
+        };
+        const stats = {
+          total: data.length,
+          by_status: groupBy(data, "status"),
+          by_mailbox: groupBy(data, "mailbox"),
+          by_priority: groupBy(data, "priority")
+        };
+        return {
+          success: true,
+          data: stats
+        };
+      }
+    case "create_template":
+      {
+        if (!args.name) return {
+          success: false,
+          error: "name is required"
+        };
+        if (!args.subject) return {
+          success: false,
+          error: "subject is required"
+        };
+        const slug = args.slug || args.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+        const {
+          data,
+          error
+        } = await sb.from("email_templates").insert({
+          store_id: sid,
+          name: args.name,
+          slug,
+          subject: args.subject,
+          category: args.category || "general",
+          description: args.description || null,
+          html_content: args.html_content || null,
+          preview_text: args.preview_text || null,
+          text_content: args.text_content || null,
+          is_active: true
+        }).select("id, name, slug, subject, category, created_at").single();
+        if (error) return {
+          success: false,
+          error: error.message
+        };
+        return {
+          success: true,
+          data
+        };
+      }
+    case "update_template":
+      {
+        if (!args.template_id) return {
+          success: false,
+          error: "template_id is required"
+        };
+        const updates = {};
+        if (args.name !== undefined) updates.name = args.name;
+        if (args.slug !== undefined) updates.slug = args.slug;
+        if (args.subject !== undefined) updates.subject = args.subject;
+        if (args.category !== undefined) updates.category = args.category;
+        if (args.description !== undefined) updates.description = args.description;
+        if (args.html_content !== undefined) updates.html_content = args.html_content;
+        if (args.preview_text !== undefined) updates.preview_text = args.preview_text;
+        if (args.text_content !== undefined) updates.text_content = args.text_content;
+        if (Object.keys(updates).length === 0) return {
+          success: false,
+          error: "No fields to update"
+        };
+        const {
+          data,
+          error
+        } = await sb.from("email_templates").update(updates).eq("id", args.template_id).eq("store_id", sid).select("id, name, slug, subject, category, updated_at").single();
+        if (error) return {
+          success: false,
+          error: error.message
+        };
+        return {
+          success: true,
+          data
+        };
+      }
+    case "delete_template":
+      {
+        if (!args.template_id) return {
+          success: false,
+          error: "template_id is required"
+        };
+        const {
+          data,
+          error
+        } = await sb.from("email_templates").update({
+          is_active: false
+        }).eq("id", args.template_id).eq("store_id", sid).select("id, name").single();
+        if (error) return {
+          success: false,
+          error: error.message
+        };
+        return {
+          success: true,
+          data: {
+            ...data,
+            deleted: true
+          }
+        };
+      }
+    default:
+      return {
+        success: false,
+        error: `Unknown email action: ${args.action}. Valid: send, send_template, list, get, templates, inbox, inbox_get, inbox_reply, inbox_update, inbox_stats, create_template, update_template, delete_template`
+      };
+  }
 }
 export async function handleDocuments(sb, args, storeId) {
-    if (!storeId)
-        return { success: false, error: "store_id required" };
-    const sid = storeId;
-    const action = args.action;
-    switch (action) {
-        case "create": {
-            const docType = args.document_type || "text";
-            const name = args.name;
-            if (!name)
-                return { success: false, error: "name is required" };
-            const extMap = { csv: "csv", json: "json", text: "txt", markdown: "md", html: "html", pdf: "pdf" };
-            const mimeMap = {
-                csv: "text/csv", json: "application/json", text: "text/plain",
-                markdown: "text/markdown", html: "text/html", pdf: "application/pdf",
+  if (!storeId) return {
+    success: false,
+    error: "store_id required"
+  };
+  const sid = storeId;
+  const action = args.action;
+  switch (action) {
+    case "create":
+      {
+        const docType = args.document_type || "text";
+        const name = args.name;
+        if (!name) return {
+          success: false,
+          error: "name is required"
+        };
+        const extMap = {
+          csv: "csv",
+          json: "json",
+          text: "txt",
+          markdown: "md",
+          html: "html",
+          pdf: "pdf"
+        };
+        const mimeMap = {
+          csv: "text/csv",
+          json: "application/json",
+          text: "text/plain",
+          markdown: "text/markdown",
+          html: "text/html",
+          pdf: "application/pdf"
+        };
+        const ext = extMap[docType] || "txt";
+        const mime = mimeMap[docType] || "text/plain";
+        const safeName = name.replace(/[^a-zA-Z0-9_\-]/g, "_");
+        const fileName = `${safeName}_${Date.now()}.${ext}`;
+        const storagePath = `${sid}/${fileName}`;
+        let uploadBuffer;
+        if (docType === "pdf") {
+          // PDF generation from HTML content via React-PDF
+          const htmlContent = args.html || args.content;
+          if (!htmlContent) return {
+            success: false,
+            error: "html or content (HTML string) is required for PDF documents"
+          };
+          try {
+            const pdfBuffer = await renderHtmlToPdf(htmlContent, {
+              format: args.format || "A4",
+              landscape: args.landscape || false
+            });
+            uploadBuffer = new Uint8Array(pdfBuffer);
+          } catch (err) {
+            return {
+              success: false,
+              error: `PDF generation failed: ${err instanceof Error ? err.message : String(err)}`
             };
-            const ext = extMap[docType] || "txt";
-            const mime = mimeMap[docType] || "text/plain";
-            const safeName = name.replace(/[^a-zA-Z0-9_\-]/g, "_");
-            const fileName = `${safeName}_${Date.now()}.${ext}`;
-            const storagePath = `${sid}/${fileName}`;
-            let uploadBuffer;
-            if (docType === "pdf") {
-                // PDF generation from HTML content via React-PDF
-                const htmlContent = args.html || args.content;
-                if (!htmlContent)
-                    return { success: false, error: "html or content (HTML string) is required for PDF documents" };
-                try {
-                    const pdfBuffer = await renderHtmlToPdf(htmlContent, {
-                        format: args.format || "A4",
-                        landscape: args.landscape || false,
-                    });
-                    uploadBuffer = new Uint8Array(pdfBuffer);
-                }
-                catch (err) {
-                    return { success: false, error: `PDF generation failed: ${err instanceof Error ? err.message : String(err)}` };
-                }
-            }
-            else {
-                let content;
-                if (docType === "csv") {
-                    const headers = args.headers;
-                    const rows = args.rows;
-                    if (!headers || !rows)
-                        return { success: false, error: "headers and rows required for CSV" };
-                    const lines = [headers.map(escapeCSV).join(",")];
-                    for (const row of rows) {
-                        if (Array.isArray(row)) {
-                            lines.push(row.map(escapeCSV).join(","));
-                        }
-                        else {
-                            lines.push(headers.map(h => escapeCSV(row[h])).join(","));
-                        }
-                    }
-                    content = lines.join("\n");
-                }
-                else if (docType === "json") {
-                    const jsonData = args.data || args.content;
-                    content = typeof jsonData === "string" ? jsonData : JSON.stringify(jsonData, null, 2);
-                }
-                else {
-                    content = args.content || "";
-                }
-                uploadBuffer = new TextEncoder().encode(content);
+          }
+        } else {
+          let content;
+          if (docType === "csv") {
+            const headers = args.headers;
+            const rows = args.rows;
+            if (!headers || !rows) return {
+              success: false,
+              error: "headers and rows required for CSV"
+            };
+            const lines = [headers.map(escapeCSV).join(",")];
+            for (const row of rows) {
+              if (Array.isArray(row)) {
+                lines.push(row.map(escapeCSV).join(","));
+              } else {
+                lines.push(headers.map(h => escapeCSV(row[h])).join(","));
+              }
             }
-            const { error: uploadErr } = await sb.storage
-                .from("documents")
-                .upload(storagePath, uploadBuffer, { contentType: mime, upsert: true });
-            if (uploadErr)
-                return { success: false, error: `Upload failed: ${uploadErr.message}` };
-            const { data: urlData } = sb.storage.from("documents").getPublicUrl(storagePath);
-            const fileUrl = urlData.publicUrl;
-            const sizeBytes = uploadBuffer.length;
-            const { data: record, error: insertErr } = await sb.from("store_documents").insert({
-                store_id: sid,
-                document_type: docType,
-                file_name: fileName,
-                file_url: fileUrl,
-                file_size: sizeBytes,
-                file_type: mime,
-                document_name: name,
-                source_name: "Documents Edge Function",
-                document_date: new Date().toISOString().split("T")[0],
-                data: { document_type: docType },
-                metadata: { size_bytes: sizeBytes },
-            }).select("id, document_name, file_url, created_at").single();
-            if (insertErr)
-                return { success: false, error: insertErr.message };
-            return { success: true, data: { id: record.id, name: record.document_name, type: docType, url: record.file_url, file_name: fileName, size: sizeBytes } };
+            content = lines.join("\n");
+          } else if (docType === "json") {
+            const jsonData = args.data || args.content;
+            content = typeof jsonData === "string" ? jsonData : JSON.stringify(jsonData, null, 2);
+          } else {
+            content = args.content || "";
+          }
+          uploadBuffer = new TextEncoder().encode(content);
         }
-        case "find": {
-            let query = sb.from("store_documents")
-                .select("id, document_type, document_name, reference_number, file_url, file_type, file_size, created_at, metadata");
-            query = query.eq("store_id", sid);
-            if (args.document_type)
-                query = query.eq("document_type", args.document_type);
-            if (args.name) {
-                const sn = sanitizeFilterValue(args.name);
-                query = query.ilike("document_name", `%${sn}%`);
-            }
-            query = query.order("created_at", { ascending: false }).limit(args.limit || 50);
-            const { data, error } = await query;
-            if (error)
-                return { success: false, error: error.message };
-            return {
-                success: true,
-                data: {
-                    count: data?.length || 0,
-                    documents: (data || []).map(d => ({
-                        id: d.id, type: d.document_type, name: d.document_name,
-                        reference: d.reference_number, url: d.file_url,
-                        size: d.file_size, created: d.created_at,
-                    })),
-                },
-            };
+        const {
+          error: uploadErr
+        } = await sb.storage.from("documents").upload(storagePath, uploadBuffer, {
+          contentType: mime,
+          upsert: true
+        });
+        if (uploadErr) return {
+          success: false,
+          error: `Upload failed: ${uploadErr.message}`
+        };
+        const {
+          data: urlData
+        } = sb.storage.from("documents").getPublicUrl(storagePath);
+        const fileUrl = urlData.publicUrl;
+        const sizeBytes = uploadBuffer.length;
+        const {
+          data: record,
+          error: insertErr
+        } = await sb.from("store_documents").insert({
+          store_id: sid,
+          document_type: docType,
+          file_name: fileName,
+          file_url: fileUrl,
+          file_size: sizeBytes,
+          file_type: mime,
+          document_name: name,
+          source_name: "Documents Edge Function",
+          document_date: new Date().toISOString().split("T")[0],
+          data: {
+            document_type: docType
+          },
+          metadata: {
+            size_bytes: sizeBytes
+          }
+        }).select("id, document_name, file_url, created_at").single();
+        if (insertErr) return {
+          success: false,
+          error: insertErr.message
+        };
+        if (fileUrl.endsWith('.pdf')) await generateThumbnail(sb, record.id, fileUrl).catch(() => {});
+        return {
+          success: true,
+          data: {
+            id: record.id,
+            name: record.document_name,
+            type: docType,
+            url: record.file_url,
+            file_name: fileName,
+            size: sizeBytes
+          }
+        };
+      }
+    case "find":
+      {
+        let query = sb.from("store_documents").select("id, document_type, document_name, reference_number, file_url, file_type, file_size, created_at, metadata");
+        query = query.eq("store_id", sid);
+        if (args.document_type) query = query.eq("document_type", args.document_type);
+        if (args.name) {
+          const sn = sanitizeFilterValue(args.name);
+          query = query.ilike("document_name", `%${sn}%`);
         }
-        case "delete": {
-            if (!args.confirm)
-                return { success: false, error: "Set confirm: true to delete" };
-            let query = sb.from("store_documents").delete().eq("store_id", sid);
-            if (args.document_type)
-                query = query.eq("document_type", args.document_type);
-            if (args.name) {
-                const sn = sanitizeFilterValue(args.name);
-                query = query.ilike("document_name", `%${sn}%`);
-            }
-            const { data, error } = await query.select("id");
-            if (error)
-                return { success: false, error: error.message };
-            return { success: true, data: { deleted: data?.length || 0 } };
+        query = query.order("created_at", {
+          ascending: false
+        }).limit(args.limit || 50);
+        const {
+          data,
+          error
+        } = await query;
+        if (error) return {
+          success: false,
+          error: error.message
+        };
+        return {
+          success: true,
+          data: {
+            count: data?.length || 0,
+            documents: (data || []).map(d => ({
+              id: d.id,
+              type: d.document_type,
+              name: d.document_name,
+              reference: d.reference_number,
+              url: d.file_url,
+              size: d.file_size,
+              created: d.created_at
+            }))
+          }
+        };
+      }
+    case "delete":
+      {
+        if (!args.confirm) return {
+          success: false,
+          error: "Set confirm: true to delete"
+        };
+        let query = sb.from("store_documents").delete().eq("store_id", sid);
+        if (args.document_type) query = query.eq("document_type", args.document_type);
+        if (args.name) {
+          const sn = sanitizeFilterValue(args.name);
+          query = query.ilike("document_name", `%${sn}%`);
         }
-        case "create_template": {
-            if (!args.name)
-                return { success: false, error: "name is required" };
-            if (!args.document_type)
-                return { success: false, error: "document_type is required" };
-            const { data, error } = await sb.from("document_templates").insert({
-                store_id: sid || null,
-                name: args.name,
-                description: args.description || null,
-                document_type: args.document_type,
-                content: args.content || null,
-                headers: args.headers || null,
-                schema: args.schema || [],
-                metadata: args.data || {},
-            }).select("id, name, document_type, created_at").single();
-            if (error)
-                return { success: false, error: error.message };
-            return { success: true, data: { template_id: data.id, name: data.name, type: data.document_type } };
+        const {
+          data,
+          error
+        } = await query.select("id");
+        if (error) return {
+          success: false,
+          error: error.message
+        };
+        return {
+          success: true,
+          data: {
+            deleted: data?.length || 0
+          }
+        };
+      }
+    case "create_template":
+      {
+        if (!args.name) return {
+          success: false,
+          error: "name is required"
+        };
+        if (!args.document_type) return {
+          success: false,
+          error: "document_type is required"
+        };
+        const {
+          data,
+          error
+        } = await sb.from("document_templates").insert({
+          store_id: sid || null,
+          name: args.name,
+          description: args.description || null,
+          document_type: args.document_type,
+          content: args.content || null,
+          headers: args.headers || null,
+          schema: args.schema || [],
+          metadata: args.data || {}
+        }).select("id, name, document_type, created_at").single();
+        if (error) return {
+          success: false,
+          error: error.message
+        };
+        return {
+          success: true,
+          data: {
+            template_id: data.id,
+            name: data.name,
+            type: data.document_type
+          }
+        };
+      }
+    case "list_templates":
+      {
+        let query = sb.from("document_templates").select("id, name, description, document_type, headers, schema, created_at").eq("is_active", true);
+        if (sid) query = query.or(`store_id.eq.${sid},store_id.is.null`);
+        if (args.document_type) query = query.eq("document_type", args.document_type);
+        if (args.limit) query = query.limit(args.limit);
+        query = query.order("created_at", {
+          ascending: false
+        });
+        const {
+          data,
+          error
+        } = await query;
+        if (error) return {
+          success: false,
+          error: error.message
+        };
+        return {
+          success: true,
+          data: {
+            count: data?.length || 0,
+            templates: (data || []).map(t => ({
+              id: t.id,
+              name: t.name,
+              description: t.description,
+              type: t.document_type,
+              headers: t.headers,
+              fields: t.schema?.length || 0
+            }))
+          }
+        };
+      }
+    case "from_template":
+      {
+        const templateId = args.template_id;
+        if (!templateId) return {
+          success: false,
+          error: "template_id is required"
+        };
+        const {
+          data: template,
+          error: tErr
+        } = await sb.from("document_templates").select("*").eq("id", templateId).or(`store_id.eq.${sid},store_id.is.null`).single();
+        if (tErr || !template) return {
+          success: false,
+          error: "Template not found"
+        };
+        const tData = {
+          ...template.metadata,
+          ...(args.data || {}),
+          date: new Date().toISOString().split("T")[0]
+        };
+        const docType = template.document_type;
+        const docName = args.name || fillTemplate(template.name, tData);
+        let content;
+        if (docType === "csv") {
+          const headers = template.headers || [];
+          const rows = args.rows;
+          if (!rows) return {
+            success: false,
+            error: "rows required for CSV template"
+          };
+          const lines = [headers.map(escapeCSV).join(",")];
+          for (const row of rows) {
+            if (Array.isArray(row)) lines.push(row.map(escapeCSV).join(","));else lines.push(headers.map(h => escapeCSV(row[h])).join(","));
+          }
+          content = lines.join("\n");
+        } else if (docType === "json") {
+          content = template.content ? fillTemplate(template.content, tData) : JSON.stringify(tData, null, 2);
+        } else {
+          content = template.content ? fillTemplate(template.content, tData) : "";
         }
-        case "list_templates": {
-            let query = sb.from("document_templates")
-                .select("id, name, description, document_type, headers, schema, created_at")
-                .eq("is_active", true);
-            if (sid)
-                query = query.or(`store_id.eq.${sid},store_id.is.null`);
-            if (args.document_type)
-                query = query.eq("document_type", args.document_type);
-            if (args.limit)
-                query = query.limit(args.limit);
-            query = query.order("created_at", { ascending: false });
-            const { data, error } = await query;
-            if (error)
-                return { success: false, error: error.message };
-            return {
-                success: true,
-                data: {
-                    count: data?.length || 0,
-                    templates: (data || []).map(t => ({
-                        id: t.id, name: t.name, description: t.description,
-                        type: t.document_type, headers: t.headers,
-                        fields: t.schema?.length || 0,
-                    })),
-                },
-            };
+        const extMap = {
+          csv: "csv",
+          json: "json",
+          text: "txt",
+          markdown: "md",
+          html: "html"
+        };
+        const mimeMap = {
+          csv: "text/csv",
+          json: "application/json",
+          text: "text/plain",
+          markdown: "text/markdown",
+          html: "text/html"
+        };
+        const ext = extMap[docType] || "txt";
+        const mime = mimeMap[docType] || "text/plain";
+        const safeName = docName.replace(/[^a-zA-Z0-9_\-]/g, "_");
+        const fileName = `${safeName}_${Date.now()}.${ext}`;
+        const storagePath = `${sid}/${fileName}`;
+        const {
+          error: uploadErr
+        } = await sb.storage.from("documents").upload(storagePath, new TextEncoder().encode(content), {
+          contentType: mime,
+          upsert: true
+        });
+        if (uploadErr) return {
+          success: false,
+          error: `Upload failed: ${uploadErr.message}`
+        };
+        const {
+          data: urlData
+        } = sb.storage.from("documents").getPublicUrl(storagePath);
+        const sizeBytes = new TextEncoder().encode(content).length;
+        const {
+          data: record,
+          error: insertErr
+        } = await sb.from("store_documents").insert({
+          store_id: sid,
+          document_type: docType,
+          file_name: fileName,
+          file_url: urlData.publicUrl,
+          file_size: sizeBytes,
+          file_type: mime,
+          document_name: docName,
+          source_name: "Documents Edge Function",
+          document_date: new Date().toISOString().split("T")[0],
+          data: {
+            template_id: template.id,
+            template_name: template.name
+          },
+          metadata: {
+            size_bytes: sizeBytes,
+            from_template: true
+          }
+        }).select("id, document_name, file_url, created_at").single();
+        if (insertErr) return {
+          success: false,
+          error: insertErr.message
+        };
+        if (urlData.publicUrl.endsWith('.pdf')) await generateThumbnail(sb, record.id, urlData.publicUrl).catch(() => {});
+        return {
+          success: true,
+          data: {
+            id: record.id,
+            name: record.document_name,
+            type: docType,
+            template: template.name,
+            url: record.file_url,
+            size: sizeBytes
+          }
+        };
+      }
+    case "list_stores":
+      {
+        const {
+          data,
+          error
+        } = await sb.from("stores").select("id, store_name, slug, status, created_at").eq("id", sid).order("store_name");
+        if (error) return {
+          success: false,
+          error: error.message
+        };
+        return {
+          success: true,
+          data: {
+            count: data?.length || 0,
+            stores: data
+          }
+        };
+      }
+    case "list_profiles":
+      {
+        const {
+          data,
+          error
+        } = await sb.from("document_profiles").select("id, name, category, sample_type, config, template_id, is_active, created_at").eq("is_active", true).eq("owner_store_id", sid).order("name");
+        if (error) return {
+          success: false,
+          error: error.message
+        };
+        return {
+          success: true,
+          data: {
+            count: data?.length || 0,
+            profiles: (data || []).map(p => ({
+              id: p.id,
+              name: p.name,
+              category: p.category,
+              sample_type: p.sample_type,
+              template_id: p.template_id,
+              has_config: Object.keys(p.config || {}).length > 0
+            }))
+          }
+        };
+      }
+    case "generate":
+      {
+        // Generate a document from a template profile with store data
+        const templateId = args.template_id;
+        if (!templateId) return {
+          success: false,
+          error: "template_id is required. Use list_profiles to find available templates."
+        };
+        // Route to from_template with the same args
+        return handleDocuments(sb, {
+          ...args,
+          action: "from_template"
+        }, storeId);
+      }
+    case "bulk_generate":
+      {
+        const templateId = args.template_id;
+        if (!templateId) return {
+          success: false,
+          error: "template_id required"
+        };
+        const items = args.items;
+        if (!items || !Array.isArray(items) || items.length === 0) {
+          return {
+            success: false,
+            error: "items required: array of variable sets for each document"
+          };
         }
-        case "from_template": {
-            const templateId = args.template_id;
-            if (!templateId)
-                return { success: false, error: "template_id is required" };
-            const { data: template, error: tErr } = await sb.from("document_templates")
-                .select("*").eq("id", templateId).or(`store_id.eq.${sid},store_id.is.null`).single();
-            if (tErr || !template)
-                return { success: false, error: "Template not found" };
-            const tData = { ...template.metadata, ...(args.data || {}), date: new Date().toISOString().split("T")[0] };
-            const docType = template.document_type;
-            const docName = args.name || fillTemplate(template.name, tData);
-            let content;
-            if (docType === "csv") {
-                const headers = template.headers || [];
-                const rows = args.rows;
-                if (!rows)
-                    return { success: false, error: "rows required for CSV template" };
-                const lines = [headers.map(escapeCSV).join(",")];
-                for (const row of rows) {
-                    if (Array.isArray(row))
-                        lines.push(row.map(escapeCSV).join(","));
-                    else
-                        lines.push(headers.map(h => escapeCSV(row[h])).join(","));
-                }
-                content = lines.join("\n");
+        if (items.length > 50) {
+          return {
+            success: false,
+            error: "Maximum 50 documents per bulk_generate call"
+          };
+        }
+        const results = [];
+        for (const item of items) {
+          const itemArgs = {
+            ...args,
+            action: "from_template",
+            data: item,
+            name: item.name || undefined
+          };
+          const result = await handleDocuments(sb, itemArgs, storeId);
+          if (result.success && result.data) {
+            results.push({
+              name: result.data.name || "",
+              url: result.data.url || ""
+            });
+          } else {
+            results.push({
+              name: String(item.name || ""),
+              url: "",
+              error: result.error || "Generation failed"
+            });
+          }
+        }
+        const succeeded = results.filter(r => !r.error).length;
+        return {
+          success: true,
+          data: {
+            total: items.length,
+            succeeded,
+            failed: items.length - succeeded,
+            results
+          }
+        };
+      }
+
+    // ================================================================
+    // PDF TEMPLATE SYSTEM — full layout rendering, calculations, profiles
+    // ================================================================
+
+    case "generate_pdf":
+      {
+        const templateId = args.template_id;
+        const templateSlug = args.template_slug;
+        if (!templateId && !templateSlug) return {
+          success: false,
+          error: "template_id or template_slug required"
+        };
+
+        // 1. Load pdf_template
+        let tplQuery = sb.from("pdf_templates").select("*").eq("is_active", true);
+        if (templateId) tplQuery = tplQuery.eq("id", templateId);else tplQuery = tplQuery.eq("slug", templateSlug);
+        tplQuery = tplQuery.or(`store_id.eq.${sid},store_id.is.null`);
+        const {
+          data: tpl,
+          error: tplErr
+        } = await tplQuery.limit(1).single();
+        if (tplErr || !tpl) return {
+          success: false,
+          error: `Template not found: ${templateId || templateSlug}`
+        };
+
+        // 2. Optionally load document_profile + its client store
+        let profileConfig = {};
+        let profileConstants = {};
+        let profileClientData = {};
+        let resolvedClientStoreId = null;
+        if (args.profile_id) {
+          const {
+            data: profile
+          } = await sb.from("document_profiles").select("*").eq("id", args.profile_id).eq("is_active", true).single();
+          if (profile) {
+            const cfg = profile.config || {};
+            profileConfig = cfg;
+            profileConstants = cfg.constants || {};
+            resolvedClientStoreId = profile.client_store_id || null;
+            // Load client info from the profile's linked store
+            if (profile.client_store_id) {
+              const {
+                data: clientStore
+              } = await sb.from("stores").select("store_name, legal_name, address, city, state, zip, distributor_license_number, phone, email").eq("id", profile.client_store_id).single();
+              if (clientStore) {
+                profileClientData = {
+                  clientName: clientStore.legal_name || clientStore.store_name,
+                  clientAddress: [clientStore.address, clientStore.city, clientStore.state, clientStore.zip].filter(Boolean).join(", ") || null,
+                  licenseNumber: clientStore.distributor_license_number || null,
+                  clientPhone: clientStore.phone || null,
+                  clientEmail: clientStore.email || null
+                };
+              }
             }
-            else if (docType === "json") {
-                content = template.content ? fillTemplate(template.content, tData) : JSON.stringify(tData, null, 2);
+            // Use profile name as sampleName if not already set
+            if (profile.name && !profileConstants.sampleName) {
+              profileClientData.sampleName = profile.name;
             }
-            else {
-                content = template.content ? fillTemplate(template.content, tData) : "";
+            if (profile.sample_type) {
+              profileClientData.sampleType = profile.sample_type;
             }
-            const extMap = { csv: "csv", json: "json", text: "txt", markdown: "md", html: "html" };
-            const mimeMap = {
-                csv: "text/csv", json: "application/json", text: "text/plain",
-                markdown: "text/markdown", html: "text/html",
-            };
-            const ext = extMap[docType] || "txt";
-            const mime = mimeMap[docType] || "text/plain";
-            const safeName = docName.replace(/[^a-zA-Z0-9_\-]/g, "_");
-            const fileName = `${safeName}_${Date.now()}.${ext}`;
-            const storagePath = `${sid}/${fileName}`;
-            const { error: uploadErr } = await sb.storage
-                .from("documents")
-                .upload(storagePath, new TextEncoder().encode(content), { contentType: mime, upsert: true });
-            if (uploadErr)
-                return { success: false, error: `Upload failed: ${uploadErr.message}` };
-            const { data: urlData } = sb.storage.from("documents").getPublicUrl(storagePath);
-            const sizeBytes = new TextEncoder().encode(content).length;
-            const { data: record, error: insertErr } = await sb.from("store_documents").insert({
-                store_id: sid,
-                document_type: docType,
-                file_name: fileName,
-                file_url: urlData.publicUrl,
-                file_size: sizeBytes,
-                file_type: mime,
-                document_name: docName,
-                source_name: "Documents Edge Function",
-                document_date: new Date().toISOString().split("T")[0],
-                data: { template_id: template.id, template_name: template.name },
-                metadata: { size_bytes: sizeBytes, from_template: true },
-            }).select("id, document_name, file_url, created_at").single();
-            if (insertErr)
-                return { success: false, error: insertErr.message };
-            return { success: true, data: { id: record.id, name: record.document_name, type: docType, template: template.name, url: record.file_url, size: sizeBytes } };
-        }
-        case "list_stores": {
-            const { data, error } = await sb.from("stores")
-                .select("id, store_name, slug, status, created_at")
-                .eq("id", sid)
-                .order("store_name");
-            if (error)
-                return { success: false, error: error.message };
-            return { success: true, data: { count: data?.length || 0, stores: data } };
+            if (profile.default_size) {
+              profileClientData.sampleSize = profile.default_size;
+            }
+          }
         }
-        case "list_profiles": {
-            const { data, error } = await sb.from("document_profiles")
-                .select("id, name, category, sample_type, config, template_id, is_active, created_at")
-                .eq("is_active", true)
-                .eq("owner_store_id", sid)
-                .order("name");
-            if (error)
-                return { success: false, error: error.message };
-            return {
-                success: true,
-                data: {
-                    count: data?.length || 0,
-                    profiles: (data || []).map(p => ({
-                        id: p.id, name: p.name, category: p.category,
-                        sample_type: p.sample_type, template_id: p.template_id,
-                        has_config: Object.keys(p.config || {}).length > 0,
-                    })),
-                },
+
+        // 3. Optionally load customer (via store_customer_profiles + platform_users) — overrides profile client
+        let clientData = {};
+        if (args.customer_id) {
+          const {
+            data: rel
+          } = await sb.from("user_creation_relationships").select("id, store_id, platform_users!inner(first_name, last_name, email, phone)").eq("id", args.customer_id).single();
+          if (rel) {
+            const pu = rel.platform_users;
+            const {
+              data: prof
+            } = await sb.from("store_customer_profiles").select("street_address, city, state, postal_code, drivers_license_number, medical_card_number").eq("relationship_id", rel.id).maybeSingle();
+            clientData = {
+              clientName: [pu.first_name, pu.last_name].filter(Boolean).join(" "),
+              clientEmail: pu.email,
+              clientPhone: pu.phone,
+              clientAddress: prof ? [prof.street_address, prof.city, prof.state, prof.postal_code].filter(Boolean).join(", ") : null,
+              clientLicense: prof?.drivers_license_number || null,
+              clientMedicalCard: prof?.medical_card_number || null
             };
+          }
         }
-        case "generate": {
-            // Generate a document from a template profile with store data
-            const templateId = args.template_id;
-            if (!templateId)
-                return { success: false, error: "template_id is required. Use list_profiles to find available templates." };
-            // Route to from_template with the same args
-            return handleDocuments(sb, { ...args, action: "from_template" }, storeId);
+
+        // 4. Merge data: constants ← profile config ← profile client ← explicit client ← user data
+        const tplConstants = tpl.constants || {};
+        const mergedConstants = {
+          ...tplConstants,
+          ...profileConstants
+        };
+        const cannabinoidCfg = profileConfig.cannabinoids ?? undefined;
+        const {
+          cannabinoids: _cfgRanges,
+          ...profileDataOnly
+        } = profileConfig;
+        let mergedData = {
+          ...mergedConstants,
+          ...profileDataOnly,
+          ...profileClientData,
+          ...clientData,
+          ...(args.data || {}),
+          date: new Date().toISOString().slice(0, 10),
+          approvalDate: new Date().toISOString().slice(0, 10)
+        };
+
+        // 5. Apply generation rules — auto-fill sampleId, dates, etc.
+        mergedData = applyGenerationRules(tpl.generation_rules, mergedData);
+
+        // 6. Generate cannabinoid data if profile has cannabinoid config
+        if (cannabinoidCfg && !mergedData.cannabinoids) {
+          mergedData.cannabinoids = generateCannabinoidData(cannabinoidCfg, mergedConstants);
         }
-        case "bulk_generate": {
-            const templateId = args.template_id;
-            if (!templateId)
-                return { success: false, error: "template_id required" };
-            const items = args.items;
-            if (!items || !Array.isArray(items) || items.length === 0) {
-                return { success: false, error: "items required: array of variable sets for each document" };
-            }
-            if (items.length > 50) {
-                return { success: false, error: "Maximum 50 documents per bulk_generate call" };
-            }
-            const results = [];
-            for (const item of items) {
-                const itemArgs = { ...args, action: "from_template", data: item, name: item.name || undefined };
-                const result = await handleDocuments(sb, itemArgs, storeId);
-                if (result.success && result.data) {
-                    results.push({ name: result.data.name || "", url: result.data.url || "" });
-                }
-                else {
-                    results.push({ name: String(item.name || ""), url: "", error: result.error || "Generation failed" });
-                }
+
+        // 6b. Flatten cannabinoid rows into top-level keys for calculation formulas
+        // e.g. { name: "D9-THC", percentWeight: 0.22 } → D9_THC: 0.22
+        if (Array.isArray(mergedData.cannabinoids)) {
+          for (const row of mergedData.cannabinoids) {
+            const key = row.name.replace(/-/g, "_").replace(/[^a-zA-Z0-9_]/g, "");
+            if (key && row.percentWeight !== undefined) {
+              mergedData[key] = row.percentWeight;
             }
-            const succeeded = results.filter(r => !r.error).length;
-            return { success: true, data: { total: items.length, succeeded, failed: items.length - succeeded, results } };
+          }
         }
-        // ================================================================
-        // PDF TEMPLATE SYSTEM — full layout rendering, calculations, profiles
-        // ================================================================
-        case "generate_pdf": {
-            const templateId = args.template_id;
-            const templateSlug = args.template_slug;
-            if (!templateId && !templateSlug)
-                return { success: false, error: "template_id or template_slug required" };
-            // 1. Load pdf_template
-            let tplQuery = sb.from("pdf_templates").select("*").eq("is_active", true);
-            if (templateId)
-                tplQuery = tplQuery.eq("id", templateId);
-            else
-                tplQuery = tplQuery.eq("slug", templateSlug);
-            tplQuery = tplQuery.or(`store_id.eq.${sid},store_id.is.null`);
-            const { data: tpl, error: tplErr } = await tplQuery.limit(1).single();
-            if (tplErr || !tpl)
-                return { success: false, error: `Template not found: ${templateId || templateSlug}` };
-            // 2. Optionally load document_profile + its client store
-            let profileConfig = {};
-            let profileConstants = {};
-            let profileClientData = {};
-            let resolvedClientStoreId = null;
-            if (args.profile_id) {
-                const { data: profile } = await sb.from("document_profiles")
-                    .select("*").eq("id", args.profile_id).eq("is_active", true).single();
-                if (profile) {
-                    const cfg = (profile.config || {});
-                    profileConfig = cfg;
-                    profileConstants = (cfg.constants || {});
-                    resolvedClientStoreId = profile.client_store_id || null;
-                    // Load client info from the profile's linked store
-                    if (profile.client_store_id) {
-                        const { data: clientStore } = await sb.from("stores")
-                            .select("store_name, legal_name, address, city, state, zip, distributor_license_number, phone, email")
-                            .eq("id", profile.client_store_id).single();
-                        if (clientStore) {
-                            profileClientData = {
-                                clientName: clientStore.legal_name || clientStore.store_name,
-                                clientAddress: [clientStore.address, clientStore.city, clientStore.state, clientStore.zip].filter(Boolean).join(", ") || null,
-                                licenseNumber: clientStore.distributor_license_number || null,
-                                clientPhone: clientStore.phone || null,
-                                clientEmail: clientStore.email || null,
-                            };
-                        }
-                    }
-                    // Use profile name as sampleName if not already set
-                    if (profile.name && !profileConstants.sampleName) {
-                        profileClientData.sampleName = profile.name;
-                    }
-                    if (profile.sample_type) {
-                        profileClientData.sampleType = profile.sample_type;
-                    }
-                    if (profile.default_size) {
-                        profileClientData.sampleSize = profile.default_size;
-                    }
-                }
-            }
-            // 3. Optionally load customer (via store_customer_profiles + platform_users) — overrides profile client
-            let clientData = {};
-            if (args.customer_id) {
-                const { data: rel } = await sb.from("user_creation_relationships")
-                    .select("id, store_id, platform_users!inner(first_name, last_name, email, phone)")
-                    .eq("id", args.customer_id).single();
-                if (rel) {
-                    const pu = rel.platform_users;
-                    const { data: prof } = await sb.from("store_customer_profiles")
-                        .select("street_address, city, state, postal_code, drivers_license_number, medical_card_number")
-                        .eq("relationship_id", rel.id).maybeSingle();
-                    clientData = {
-                        clientName: [pu.first_name, pu.last_name].filter(Boolean).join(" "),
-                        clientEmail: pu.email,
-                        clientPhone: pu.phone,
-                        clientAddress: prof ? [prof.street_address, prof.city, prof.state, prof.postal_code].filter(Boolean).join(", ") : null,
-                        clientLicense: prof?.drivers_license_number || null,
-                        clientMedicalCard: prof?.medical_card_number || null,
-                    };
-                }
-            }
-            // 4. Merge data: constants ← profile config ← profile client ← explicit client ← user data
-            const tplConstants = (tpl.constants || {});
-            const mergedConstants = { ...tplConstants, ...profileConstants };
-            const cannabinoidCfg = (profileConfig.cannabinoids ?? undefined);
-            const { cannabinoids: _cfgRanges, ...profileDataOnly } = profileConfig;
-            let mergedData = {
-                ...mergedConstants,
-                ...profileDataOnly,
-                ...profileClientData,
-                ...clientData,
-                ...(args.data || {}),
-                date: new Date().toISOString().slice(0, 10),
-                approvalDate: new Date().toISOString().slice(0, 10),
+
+        // 7. Apply calculations
+        mergedData = applyCalculations(tpl.calculations, mergedConstants, mergedData);
+
+        // Also run per-row calculations if cannabinoids exist
+        if (Array.isArray(mergedData.cannabinoids)) {
+          const rows = mergedData.cannabinoids;
+          for (const row of rows) {
+            const rowCtx = {
+              ...mergedConstants,
+              ...row
             };
-            // 5. Apply generation rules — auto-fill sampleId, dates, etc.
-            mergedData = applyGenerationRules(tpl.generation_rules, mergedData);
-            // 6. Generate cannabinoid data if profile has cannabinoid config
-            if (cannabinoidCfg && !mergedData.cannabinoids) {
-                mergedData.cannabinoids = generateCannabinoidData(cannabinoidCfg, mergedConstants);
-            }
-            // 7. Apply calculations
-            mergedData = applyCalculations(tpl.calculations, mergedConstants, mergedData);
-            // Also run per-row calculations if cannabinoids exist
-            if (Array.isArray(mergedData.cannabinoids)) {
-                const rows = mergedData.cannabinoids;
-                for (const row of rows) {
-                    const rowCtx = { ...mergedConstants, ...row };
-                    const rowCalcs = (tpl.row_calculations || tpl.calculations);
-                    if (rowCalcs) {
-                        const computed = applyCalculations(rowCalcs, mergedConstants, rowCtx);
-                        Object.assign(row, computed);
-                    }
-                }
-            }
-            // 7b. Generate full panel data if requested (safety tests, pesticides, solvents)
-            if (mergedData.fullPanel && !mergedData.microbialResults) {
-                const tplConstants = (tpl.constants || {});
-                const fullPanel = generateFullPanelData(tplConstants);
-                mergedData.microbialResults = fullPanel.microbialResults;
-                mergedData.heavyMetalsResults = fullPanel.heavyMetalsResults;
-                mergedData.mycotoxinResults = fullPanel.mycotoxinResults;
-                mergedData.pesticidesCat1 = fullPanel.pesticidesCat1;
-                mergedData.pesticidesCat2 = fullPanel.pesticidesCat2;
-                mergedData.testsResidualSolvents = fullPanel.residualSolventsResults;
-                mergedData.totalPages = 5;
-                mergedData.complianceResults = mergedData.complianceResults || {
-                    heavyMetals: { status: "PASS" }, microbial: { status: "PASS" },
-                    pesticides: { status: "PASS" }, mycotoxins: { status: "PASS" },
-                    residualSolvents: { status: "PASS" },
-                };
-            }
-            // 7c. Generate QR code for COA templates — links to Quantix COA landing page
-            if (tpl.slug?.startsWith("cannabis-coa") && !mergedData.qrCodeDataUrl) {
-                const productSlug = (mergedData.sampleName || "certificate")
-                    .toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "");
-                const coaUrl = `https://quantixanalytics.com/coa/${sid}/${productSlug}`;
-                try {
-                    mergedData.qrCodeDataUrl = await QRCode.toDataURL(coaUrl, { width: 120, margin: 1 });
-                }
-                catch { /* skip QR if generation fails */ }
-            }
-            // 8. Validate
-            const validationResults = runValidation(tpl.validation_rules, mergedData);
-            const errors = validationResults.filter(v => v.severity === "error" && !v.passed);
-            const warnings = validationResults.filter(v => v.severity === "warning" && !v.passed);
-            if (errors.length > 0 && !args.force) {
-                return {
-                    success: false,
-                    error: `Validation failed: ${errors.map(e => e.message).join("; ")}`,
-                    data: { errors, warnings },
-                };
-            }
-            // 9-10. Render PDF — all templates use React-PDF
-            let pdfBuffer;
-            try {
-                if (tpl.slug?.startsWith("cannabis-coa")) {
-                    // COA templates use dedicated renderer
-                    pdfBuffer = await renderCOAToPdf(mergedData);
-                }
-                else {
-                    // Detect label layout vs generic layout
-                    const layout = tpl.layout;
-                    const isLabel = layout?.version === 1 && Array.isArray(layout?.elements) && layout.elements[0]?.field;
-                    if (isLabel) {
-                        const items = Array.isArray(mergedData.items)
-                            ? mergedData.items
-                            : [mergedData];
-                        pdfBuffer = await renderLabelToPdf(layout, tpl.page_config, items);
-                    }
-                    else {
-                        pdfBuffer = await renderLayoutToPdf(tpl.layout, tpl.page_config, tpl.styles, mergedData);
-                    }
-                }
-            }
-            catch (err) {
-                return { success: false, error: `PDF generation failed: ${err instanceof Error ? err.message : String(err)}` };
+            const rowCalcs = tpl.row_calculations || tpl.calculations;
+            if (rowCalcs) {
+              const computed = applyCalculations(rowCalcs, mergedConstants, rowCtx);
+              Object.assign(row, computed);
             }
-            // 11. Upload to Supabase storage
-            const sampleName = mergedData.sampleName || mergedData.productName || "";
-            const docName = args.name || (sampleName ? `${sampleName} COA` : fillTemplate(tpl.name || "Document", mergedData));
-            const safeName = docName.replace(/[^a-zA-Z0-9_\-]/g, "_");
-            const fileName = `${safeName}_${Date.now()}.pdf`;
-            const storagePath = `${sid}/${fileName}`;
-            const bucketName = "store-documents";
-            const { error: uploadErr } = await sb.storage
-                .from(bucketName)
-                .upload(storagePath, new Uint8Array(pdfBuffer), { contentType: "application/pdf", upsert: true });
-            if (uploadErr)
-                return { success: false, error: `Upload failed: ${uploadErr.message}` };
-            const { data: urlData } = sb.storage.from(bucketName).getPublicUrl(storagePath);
-            // 12. Build COA metadata for the Quantix landing page
-            const coaMetadata = {
-                size_bytes: pdfBuffer.length,
-                from_pdf_template: true,
-                template_version: tpl.version,
-            };
-            if (tpl.slug?.startsWith("cannabis-coa")) {
-                coaMetadata.sample_name = sampleName;
-                coaMetadata.sample_id = mergedData.sampleId || null;
-                coaMetadata.sample_type = mergedData.sampleType || mergedData.strain || null;
-                coaMetadata.sample_size = mergedData.sampleSize || null;
-                coaMetadata.batch_number = mergedData.batchId || null;
-                coaMetadata.lab_name = mergedData.labName || null;
-                coaMetadata.lab_contact = mergedData.labContact || null;
-                coaMetadata.lab_website = mergedData.labWebsite || null;
-                coaMetadata.lab_director = mergedData.labDirector || null;
-                coaMetadata.director_title = mergedData.directorTitle || null;
-                coaMetadata.logo_url = mergedData.logoUrl || null;
-                coaMetadata.signature_url = mergedData.signatureUrl || null;
-                coaMetadata.client_name = mergedData.clientName || null;
-                coaMetadata.client_address = mergedData.clientAddress || null;
-                coaMetadata.date_collected = mergedData.dateCollected || null;
-                coaMetadata.date_received = mergedData.dateReceived || null;
-                coaMetadata.date_tested = mergedData.dateTested || null;
-                coaMetadata.date_reported = mergedData.dateReported || null;
-                coaMetadata.status = "Pass";
-                coaMetadata.thc_total = mergedData.totalTHC || null;
-                coaMetadata.cbd_total = mergedData.totalCBD || null;
-                coaMetadata.cannabinoids_total = mergedData.totalCannabinoids || null;
-                coaMetadata.moisture = mergedData.moisture || null;
-                // Detailed cannabinoid data for the interactive landing page
-                const cannabinoids = mergedData.cannabinoids;
-                if (Array.isArray(cannabinoids)) {
-                    coaMetadata.cannabinoids = Object.fromEntries(cannabinoids.filter((c) => typeof c.percentWeight === "number" && c.percentWeight > 0)
-                        .map((c) => [c.name, c.percentWeight]));
-                    coaMetadata.cannabinoids_detailed = cannabinoids.map((c) => ({
-                        name: c.name, percent: c.percentWeight, mg_per_g: c.mgPerG, lod: c.lod, loq: c.loq, result: String(c.result ?? c.percentWeight),
-                    }));
-                }
-                // Safety test panels
-                if (mergedData.fullPanel) {
-                    coaMetadata.test_panels = {
-                        cannabinoids: true, microbial: true, heavy_metals: true,
-                        mycotoxins: true, pesticides: true, residual_solvents: true,
-                    };
-                    coaMetadata.safety_tests = {
-                        microbial: "Pass", heavy_metals: "Pass", mycotoxins: "Pass",
-                        pesticides: "Pass", residual_solvents: "Pass",
-                    };
-                }
+          }
+        }
+
+        // 7b. Generate full panel data if requested (safety tests, pesticides, solvents)
+        if (mergedData.fullPanel && !mergedData.microbialResults) {
+          const tplConstants = tpl.constants || {};
+          const fullPanel = generateFullPanelData(tplConstants);
+          mergedData.microbialResults = fullPanel.microbialResults;
+          mergedData.heavyMetalsResults = fullPanel.heavyMetalsResults;
+          mergedData.mycotoxinResults = fullPanel.mycotoxinResults;
+          mergedData.pesticidesCat1 = fullPanel.pesticidesCat1;
+          mergedData.pesticidesCat2 = fullPanel.pesticidesCat2;
+          mergedData.testsResidualSolvents = fullPanel.residualSolventsResults;
+          mergedData.totalPages = 5;
+          mergedData.complianceResults = mergedData.complianceResults || {
+            heavyMetals: {
+              status: "PASS"
+            },
+            microbial: {
+              status: "PASS"
+            },
+            pesticides: {
+              status: "PASS"
+            },
+            mycotoxins: {
+              status: "PASS"
+            },
+            residualSolvents: {
+              status: "PASS"
             }
-            // 13. Insert store_documents record
-            const { data: record, error: insertErr } = await sb.from("store_documents").insert({
-                store_id: sid,
-                document_type: tpl.document_type || "pdf",
-                file_name: fileName,
-                file_url: urlData.publicUrl,
-                file_size: pdfBuffer.length,
-                file_type: "application/pdf",
-                document_name: docName,
-                source_name: "PDF Template Engine",
-                document_date: new Date().toISOString().split("T")[0],
-                customer_id: args.customer_id || null,
-                client_store_id: resolvedClientStoreId,
-                data: { template_id: tpl.id, template_slug: tpl.slug, profile_id: args.profile_id || null },
-                metadata: coaMetadata,
-            }).select("id, document_name, file_url, created_at").single();
-            if (insertErr)
-                return { success: false, error: insertErr.message };
-            return {
-                success: true,
-                data: {
-                    id: record.id,
-                    name: record.document_name,
-                    url: record.file_url,
-                    template: tpl.name,
-                    size: pdfBuffer.length,
-                    warnings: warnings.map(w => w.message),
-                },
-            };
+          };
         }
-        case "list_pdf_templates": {
-            let query = sb.from("pdf_templates")
-                .select("id, slug, name, description, document_type, version, created_at")
-                .eq("is_active", true)
-                .or(`store_id.eq.${sid},store_id.is.null`)
-                .order("name");
-            if (args.document_type)
-                query = query.eq("document_type", args.document_type);
-            if (args.limit)
-                query = query.limit(args.limit);
-            const { data, error } = await query;
-            if (error)
-                return { success: false, error: error.message };
-            return {
-                success: true,
-                data: {
-                    count: data?.length || 0,
-                    templates: (data || []).map(t => ({
-                        id: t.id, slug: t.slug, name: t.name,
-                        description: t.description, type: t.document_type, version: t.version,
-                    })),
-                },
-            };
+
+        // 7b2. Auto-set test status flags for summary section
+        if (mergedData.cannabinoids && mergedData.cannabinoids.length > 0) {
+          mergedData.testsCannabinoids = true;
         }
-        case "list_document_profiles": {
-            let query = sb.from("document_profiles")
-                .select("id, name, category, sample_type, default_size, client_store_id, template_id, created_at")
-                .eq("is_active", true)
-                .eq("owner_store_id", sid)
-                .order("name");
-            if (args.template_id)
-                query = query.eq("template_id", args.template_id);
-            if (args.category)
-                query = query.eq("category", args.category);
-            if (args.limit)
-                query = query.limit(args.limit);
-            const { data, error } = await query;
-            if (error)
-                return { success: false, error: error.message };
-            return {
-                success: true,
-                data: {
-                    count: data?.length || 0,
-                    profiles: (data || []).map(p => ({
-                        id: p.id, name: p.name, category: p.category,
-                        sample_type: p.sample_type, default_size: p.default_size,
-                        client_store_id: p.client_store_id,
-                    })),
-                },
-            };
+        if (mergedData.moisture !== undefined && mergedData.moisture !== null) {
+          mergedData.testsMoisture = true;
+        }
+        if (mergedData.dateTested) {
+          mergedData.testsBatch = true;
         }
-        case "list_clients":
-        case "list_customers": {
-            let query = sb.from("v_store_customers")
-                .select("id, first_name, last_name, email, phone, loyalty_tier, total_orders, is_active, created_at")
-                .eq("store_id", sid)
-                .order("created_at", { ascending: false });
-            if (args.query) {
-                const term = `%${sanitizeFilterValue(String(args.query).trim())}%`;
-                query = query.or(`first_name.ilike.${term},last_name.ilike.${term},email.ilike.${term}`);
+
+        // 7c. Generate QR code for COA templates — links to Quantix COA landing page
+        if (tpl.slug?.startsWith("cannabis-coa") && !mergedData.qrCodeDataUrl) {
+          const productSlug = (mergedData.sampleName || "certificate").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "");
+          const coaUrl = `https://quantixanalytics.com/coa/${sid}/${productSlug}`;
+          try {
+            mergedData.qrCodeDataUrl = await QRCode.toDataURL(coaUrl, {
+              width: 120,
+              margin: 1
+            });
+          } catch {/* skip QR if generation fails */}
+        }
+
+        // 8. Validate
+        const validationResults = runValidation(tpl.validation_rules, mergedData);
+        const errors = validationResults.filter(v => v.severity === "error" && !v.passed);
+        const warnings = validationResults.filter(v => v.severity === "warning" && !v.passed);
+        if (errors.length > 0 && !args.force) {
+          return {
+            success: false,
+            error: `Validation failed: ${errors.map(e => e.message).join("; ")}`,
+            data: {
+              errors,
+              warnings
             }
-            if (args.limit)
-                query = query.limit(args.limit);
-            const { data, error } = await query;
-            if (error)
-                return { success: false, error: error.message };
-            return {
-                success: true,
-                data: {
-                    count: data?.length || 0,
-                    customers: (data || []).map(c => ({
-                        id: c.id, name: [c.first_name, c.last_name].filter(Boolean).join(" "),
-                        email: c.email, phone: c.phone, loyalty_tier: c.loyalty_tier,
-                        total_orders: c.total_orders, is_active: c.is_active,
-                    })),
-                },
-            };
+          };
         }
-        case "deliver_documents": {
-            // Batch-assign documents to a customer and optionally send notification email
-            const docIds = args.document_ids || (args.document_id ? [args.document_id] : []);
-            const customerId = args.customer_id;
-            if (!docIds.length)
-                return { success: false, error: "document_ids (array) or document_id (string) is required" };
-            if (!customerId)
-                return { success: false, error: "customer_id is required" };
-            // Verify customer belongs to this store
-            const { data: rel, error: relErr } = await sb.from("user_creation_relationships")
-                .select("id, store_id, platform_users!inner(first_name, last_name, email)")
-                .eq("id", customerId).eq("store_id", sid).single();
-            if (relErr || !rel)
-                return { success: false, error: "Customer not found for this store" };
-            const pu = rel.platform_users;
-            const customerEmail = pu.email;
-            const customerName = [pu.first_name, pu.last_name].filter(Boolean).join(" ");
-            // Assign all documents to the customer
-            const { error: updateErr } = await sb.from("store_documents")
-                .update({ customer_id: customerId })
-                .in("id", docIds)
-                .eq("store_id", sid);
-            if (updateErr)
-                return { success: false, error: `Failed to assign documents: ${updateErr.message}` };
-            // Get document names for the email
-            const { data: docs } = await sb.from("store_documents")
-                .select("id, document_name, file_url")
-                .in("id", docIds);
-            let emailSent = false;
-            if (!args.skip_email && customerEmail) {
-                const portalUrl = args.portal_url || null;
-                const docList = (docs || []).map(d => `<li><a href="${d.file_url}">${d.document_name || "Document"}</a></li>`).join("");
-                // Get store name for template
-                const { data: store } = await sb.from("stores").select("store_name").eq("id", sid).single();
-                const emailResult = await handleEmail(sb, {
-                    action: "send_template",
-                    to: customerEmail,
-                    template: "documents-delivered",
-                    template_data: {
-                        customer_name: customerName || "there",
-                        store_name: store?.store_name || "",
-                        document_count: String(docIds.length),
-                        document_list: docList,
-                        portal_url: portalUrl || "",
-                    },
-                }, storeId);
-                emailSent = emailResult.success;
+
+        // 9-10. Render PDF — all templates use React-PDF
+        let pdfBuffer;
+        try {
+          if (tpl.slug?.startsWith("cannabis-coa")) {
+            // COA templates use dedicated renderer
+            pdfBuffer = await renderCOAToPdf(mergedData);
+          } else {
+            // Detect label layout vs generic layout
+            const layout = tpl.layout;
+            const isLabel = layout?.version === 1 && Array.isArray(layout?.elements) && layout.elements[0]?.field;
+            if (isLabel) {
+              const items = Array.isArray(mergedData.items) ? mergedData.items : [mergedData];
+              pdfBuffer = await renderLabelToPdf(layout, tpl.page_config, items);
+            } else {
+              pdfBuffer = await renderLayoutToPdf(tpl.layout, tpl.page_config, tpl.styles, mergedData);
             }
-            return {
-                success: true,
-                data: {
-                    document_ids: docIds,
-                    customer_id: customerId,
-                    customer_email: customerEmail,
-                    email_sent: emailSent,
-                    count: docIds.length,
-                },
-            };
+          }
+        } catch (err) {
+          return {
+            success: false,
+            error: `PDF generation failed: ${err instanceof Error ? err.message : String(err)}`
+          };
         }
-        case "list_customer_documents": {
-            const customerId = args.customer_id;
-            if (!customerId)
-                return { success: false, error: "customer_id is required" };
-            let query = sb.from("store_documents")
-                .select("id, document_name, file_url, file_type, created_at, thumbnail_url, metadata, document_type")
-                .eq("store_id", sid)
-                .eq("customer_id", customerId)
-                .eq("is_active", true)
-                .order("created_at", { ascending: false });
-            if (args.limit)
-                query = query.limit(args.limit);
-            const { data, error } = await query;
-            if (error)
-                return { success: false, error: error.message };
-            return {
-                success: true,
-                data: {
-                    count: data?.length || 0,
-                    documents: data || [],
-                },
+
+        // 11. Upload to Supabase storage
+        const sampleName = mergedData.sampleName || mergedData.productName || "";
+        const docName = args.name || (sampleName ? `${sampleName} COA` : fillTemplate(tpl.name || "Document", mergedData));
+        const safeName = docName.replace(/[^a-zA-Z0-9_\-]/g, "_");
+        const fileName = `${safeName}_${Date.now()}.pdf`;
+        const storagePath = `${sid}/${fileName}`;
+        const bucketName = "store-documents";
+        const {
+          error: uploadErr
+        } = await sb.storage.from(bucketName).upload(storagePath, new Uint8Array(pdfBuffer), {
+          contentType: "application/pdf",
+          upsert: true
+        });
+        if (uploadErr) return {
+          success: false,
+          error: `Upload failed: ${uploadErr.message}`
+        };
+        const {
+          data: urlData
+        } = sb.storage.from(bucketName).getPublicUrl(storagePath);
+
+        // 12. Build COA metadata for the Quantix landing page
+        const coaMetadata = {
+          size_bytes: pdfBuffer.length,
+          from_pdf_template: true,
+          template_version: tpl.version
+        };
+        if (tpl.slug?.startsWith("cannabis-coa")) {
+          coaMetadata.sample_name = sampleName;
+          coaMetadata.sample_id = mergedData.sampleId || null;
+          coaMetadata.sample_type = mergedData.sampleType || mergedData.strain || null;
+          coaMetadata.sample_size = mergedData.sampleSize || null;
+          coaMetadata.batch_number = mergedData.batchId || null;
+          coaMetadata.lab_name = mergedData.labName || null;
+          coaMetadata.lab_contact = mergedData.labContact || null;
+          coaMetadata.lab_website = mergedData.labWebsite || null;
+          coaMetadata.lab_director = mergedData.labDirector || null;
+          coaMetadata.director_title = mergedData.directorTitle || null;
+          coaMetadata.logo_url = mergedData.logoUrl || null;
+          coaMetadata.signature_url = mergedData.signatureUrl || null;
+          coaMetadata.client_name = mergedData.clientName || null;
+          coaMetadata.client_address = mergedData.clientAddress || null;
+          coaMetadata.date_collected = mergedData.dateCollected || null;
+          coaMetadata.date_received = mergedData.dateReceived || null;
+          coaMetadata.date_tested = mergedData.dateTested || null;
+          coaMetadata.date_reported = mergedData.dateReported || null;
+          coaMetadata.status = "Pass";
+          coaMetadata.thc_total = mergedData.totalTHC || null;
+          coaMetadata.cbd_total = mergedData.totalCBD || null;
+          coaMetadata.cannabinoids_total = mergedData.totalCannabinoids || null;
+          coaMetadata.moisture = mergedData.moisture || null;
+          // Detailed cannabinoid data for the interactive landing page
+          const cannabinoids = mergedData.cannabinoids;
+          if (Array.isArray(cannabinoids)) {
+            coaMetadata.cannabinoids = Object.fromEntries(cannabinoids.filter(c => typeof c.percentWeight === "number" && c.percentWeight > 0).map(c => [c.name, c.percentWeight]));
+            coaMetadata.cannabinoids_detailed = cannabinoids.map(c => ({
+              name: c.name,
+              percent: c.percentWeight,
+              mg_per_g: c.mgPerG,
+              lod: c.lod,
+              loq: c.loq,
+              result: String(c.result ?? c.percentWeight)
+            }));
+          }
+          // Safety test panels
+          if (mergedData.fullPanel) {
+            coaMetadata.test_panels = {
+              cannabinoids: true,
+              microbial: true,
+              heavy_metals: true,
+              mycotoxins: true,
+              pesticides: true,
+              residual_solvents: true
+            };
+            coaMetadata.safety_tests = {
+              microbial: "Pass",
+              heavy_metals: "Pass",
+              mycotoxins: "Pass",
+              pesticides: "Pass",
+              residual_solvents: "Pass"
             };
+          }
+        }
+
+        // 13. Insert store_documents record
+        const {
+          data: record,
+          error: insertErr
+        } = await sb.from("store_documents").insert({
+          store_id: sid,
+          document_type: tpl.document_type || "pdf",
+          file_name: fileName,
+          file_url: urlData.publicUrl,
+          file_size: pdfBuffer.length,
+          file_type: "application/pdf",
+          document_name: docName,
+          source_name: "PDF Template Engine",
+          document_date: new Date().toISOString().split("T")[0],
+          customer_id: args.customer_id || null,
+          client_store_id: resolvedClientStoreId,
+          data: {
+            template_id: tpl.id,
+            template_slug: tpl.slug,
+            profile_id: args.profile_id || null
+          },
+          metadata: coaMetadata
+        }).select("id, document_name, file_url, created_at").single();
+        if (insertErr) return {
+          success: false,
+          error: insertErr.message
+        };
+        await generateThumbnail(sb, record.id, urlData.publicUrl).catch(() => {});
+        return {
+          success: true,
+          data: {
+            id: record.id,
+            name: record.document_name,
+            url: record.file_url,
+            template: tpl.name,
+            size: pdfBuffer.length,
+            warnings: warnings.map(w => w.message)
+          }
+        };
+      }
+    case "list_pdf_templates":
+      {
+        let query = sb.from("pdf_templates").select("id, slug, name, description, document_type, version, created_at").eq("is_active", true).or(`store_id.eq.${sid},store_id.is.null`).order("name");
+        if (args.document_type) query = query.eq("document_type", args.document_type);
+        if (args.limit) query = query.limit(args.limit);
+        const {
+          data,
+          error
+        } = await query;
+        if (error) return {
+          success: false,
+          error: error.message
+        };
+        return {
+          success: true,
+          data: {
+            count: data?.length || 0,
+            templates: (data || []).map(t => ({
+              id: t.id,
+              slug: t.slug,
+              name: t.name,
+              description: t.description,
+              type: t.document_type,
+              version: t.version
+            }))
+          }
+        };
+      }
+    case "list_document_profiles":
+      {
+        let query = sb.from("document_profiles").select("id, name, category, sample_type, default_size, client_store_id, template_id, created_at").eq("is_active", true).eq("owner_store_id", sid).order("name");
+        if (args.template_id) query = query.eq("template_id", args.template_id);
+        if (args.category) query = query.eq("category", args.category);
+        if (args.limit) query = query.limit(args.limit);
+        const {
+          data,
+          error
+        } = await query;
+        if (error) return {
+          success: false,
+          error: error.message
+        };
+        return {
+          success: true,
+          data: {
+            count: data?.length || 0,
+            profiles: (data || []).map(p => ({
+              id: p.id,
+              name: p.name,
+              category: p.category,
+              sample_type: p.sample_type,
+              default_size: p.default_size,
+              client_store_id: p.client_store_id
+            }))
+          }
+        };
+      }
+    case "list_clients":
+    case "list_customers":
+      return {
+        success: false,
+        error: "Use the 'customers' tool instead. Clients are customers."
+      };
+    case "deliver_documents":
+      {
+        // Batch-assign documents to a customer and optionally send notification email
+        const docIds = args.document_ids || (args.document_id ? [args.document_id] : []);
+        const customerId = args.customer_id;
+        if (!docIds.length) return {
+          success: false,
+          error: "document_ids (array) or document_id (string) is required"
+        };
+        if (!customerId) return {
+          success: false,
+          error: "customer_id is required"
+        };
+
+        // Verify customer belongs to this store
+        const {
+          data: rel,
+          error: relErr
+        } = await sb.from("user_creation_relationships").select("id, store_id, platform_users!inner(first_name, last_name, email)").eq("id", customerId).eq("store_id", sid).single();
+        if (relErr || !rel) return {
+          success: false,
+          error: "Customer not found for this store"
+        };
+        const pu = rel.platform_users;
+        const customerEmail = pu.email;
+        const customerName = [pu.first_name, pu.last_name].filter(Boolean).join(" ");
+
+        // Assign all documents to the customer
+        const {
+          error: updateErr
+        } = await sb.from("store_documents").update({
+          customer_id: customerId
+        }).in("id", docIds).eq("store_id", sid);
+        if (updateErr) return {
+          success: false,
+          error: `Failed to assign documents: ${updateErr.message}`
+        };
+
+        // Get document names for the email
+        const {
+          data: docs
+        } = await sb.from("store_documents").select("id, document_name, file_url").in("id", docIds);
+        let emailSent = false;
+        if (!args.skip_email && customerEmail) {
+          const portalUrl = args.portal_url || null;
+          const docList = (docs || []).map(d => `<li><a href="${d.file_url}">${d.document_name || "Document"}</a></li>`).join("");
+
+          // Get store name for template
+          const {
+            data: store
+          } = await sb.from("stores").select("store_name").eq("id", sid).single();
+          const emailResult = await handleEmail(sb, {
+            action: "send_template",
+            to: customerEmail,
+            template: "documents-delivered",
+            template_data: {
+              customer_name: customerName || "there",
+              store_name: store?.store_name || "",
+              document_count: String(docIds.length),
+              document_list: docList,
+              portal_url: portalUrl || ""
+            }
+          }, storeId);
+          emailSent = emailResult.success;
         }
-        default:
-            return { success: false, error: `Unknown documents action: ${action}. Valid: create, find, delete, create_template, list_templates, from_template, list_stores, list_profiles, generate, bulk_generate, generate_pdf, list_pdf_templates, list_document_profiles, list_customers, deliver_documents, list_customer_documents` };
-    }
+        return {
+          success: true,
+          data: {
+            document_ids: docIds,
+            customer_id: customerId,
+            customer_email: customerEmail,
+            email_sent: emailSent,
+            count: docIds.length
+          }
+        };
+      }
+    case "list_customer_documents":
+      {
+        const customerId = args.customer_id;
+        if (!customerId) return {
+          success: false,
+          error: "customer_id is required"
+        };
+        let query = sb.from("store_documents").select("id, document_name, file_url, file_type, created_at, thumbnail_url, metadata, document_type").eq("store_id", sid).eq("customer_id", customerId).eq("is_active", true).order("created_at", {
+          ascending: false
+        });
+        if (args.limit) query = query.limit(args.limit);
+        const {
+          data,
+          error
+        } = await query;
+        if (error) return {
+          success: false,
+          error: error.message
+        };
+        return {
+          success: true,
+          data: {
+            count: data?.length || 0,
+            documents: data || []
+          }
+        };
+      }
+    default:
+      return {
+        success: false,
+        error: `Unknown documents action: ${action}. Valid: create, find, delete, create_template, list_templates, from_template, list_stores, list_profiles, generate, bulk_generate, generate_pdf, list_pdf_templates, list_document_profiles, deliver_documents, list_customer_documents`
+      };
+  }
 }
+//# sourceMappingURL=comms.js.map