whale-code 6.5.4 → 6.5.6

package/dist/server/handlers/enrichment.js

@@ -2,751 +2,920 @@
 // Integrates with PDL (Person Enrichment), Bright Data (LinkedIn), HIBP (Breach Check),
 // DeHashed, and xonPlus (real-time breach monitoring).
 // All external API keys are fetched via decrypt_secret RPC from encrypted store secrets.
+
 // ---- Helpers ----
+
 async function getSecret(sb, name, storeId) {
-    const { data, error } = await sb.rpc("decrypt_secret", { p_name: name, p_store_id: storeId });
-    if (error || !data)
-        return null;
-    return data;
+  const {
+    data,
+    error
+  } = await sb.rpc("decrypt_secret", {
+    p_name: name,
+    p_store_id: storeId
+  });
+  if (error || !data) return null;
+  return data;
 }
 function nowISO() {
-    return new Date().toISOString();
+  return new Date().toISOString();
 }
+
 // ---- Main Handler ----
+
 export async function handleEnrichment(sb, args, storeId) {
-    const sid = storeId;
-    const action = args.action;
-    if (!action) {
-        return { success: false, error: "action is required" };
-    }
-    switch (action) {
-        // ---- ENRICH_PERSON: PDL Person Enrichment API ----
-        case "enrich_person": {
-            const customerId = args.customer_id;
-            if (!customerId)
-                return { success: false, error: "customer_id is required" };
-            const apiKey = await getSecret(sb, "pdl_api_key", sid);
-            if (!apiKey)
-                return { success: false, error: "PDL API key not configured. Add 'pdl_api_key' to store secrets." };
-            // Build PDL query params from available identifiers
-            const params = {};
-            if (args.email)
-                params.email = args.email;
-            if (args.phone)
-                params.phone = args.phone;
-            if (args.first_name)
-                params.first_name = args.first_name;
-            if (args.last_name)
-                params.last_name = args.last_name;
-            if (args.linkedin_url)
-                params.profile = args.linkedin_url;
-            if (args.location)
-                params.location = args.location;
-            if (Object.keys(params).length === 0) {
-                return { success: false, error: "At least one identifier required: email, phone, first_name+last_name, or linkedin_url" };
-            }
-            try {
-                const queryString = new URLSearchParams(params).toString();
-                const resp = await fetch(`https://api.peopledatalabs.com/v5/person/enrich?${queryString}`, {
-                    method: "GET",
-                    headers: {
-                        "X-Api-Key": apiKey,
-                        "Accept": "application/json",
-                    },
-                });
-                if (!resp.ok) {
-                    const text = await resp.text().catch(() => "");
-                    if (resp.status === 404) {
-                        return { success: true, data: null, error: "No enrichment data found for this person" };
-                    }
-                    return { success: false, error: `PDL API error ${resp.status}: ${text.substring(0, 500)}` };
-                }
-                const pdlData = await resp.json();
-                // Store enrichment profile
-                const profile = {
-                    customer_id: customerId,
-                    store_id: sid,
-                    enrichment_source: "pdl",
-                    enrichment_data: pdlData,
-                    enriched_at: nowISO(),
-                    updated_at: nowISO(),
-                };
-                // Extract common fields if present
-                if (pdlData.full_name)
-                    profile.full_name = pdlData.full_name;
-                if (pdlData.job_title)
-                    profile.job_title = pdlData.job_title;
-                if (pdlData.job_company_name)
-                    profile.company = pdlData.job_company_name;
-                if (pdlData.linkedin_url)
-                    profile.linkedin_url = pdlData.linkedin_url;
-                if (pdlData.location_name)
-                    profile.location = pdlData.location_name;
-                if (pdlData.gender)
-                    profile.gender = pdlData.gender;
-                if (pdlData.birth_year)
-                    profile.birth_year = pdlData.birth_year;
-                // Upsert — update if already exists for this customer+store
-                const { data: existing } = await sb.from("customer_enrichment_profiles")
-                    .select("id")
-                    .eq("customer_id", customerId)
-                    .eq("store_id", sid)
-                    .maybeSingle();
-                let result;
-                if (existing) {
-                    const { data, error } = await sb.from("customer_enrichment_profiles")
-                        .update(profile)
-                        .eq("id", existing.id)
-                        .select()
-                        .single();
-                    result = { data, error };
-                }
-                else {
-                    profile.created_at = nowISO();
-                    const { data, error } = await sb.from("customer_enrichment_profiles")
-                        .insert(profile)
-                        .select()
-                        .single();
-                    result = { data, error };
-                }
-                if (result.error)
-                    return { success: false, error: `Failed to store enrichment: ${result.error.message}` };
-                return { success: true, data: result.data };
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                return { success: false, error: `PDL enrichment failed: ${msg}` };
-            }
+  const sid = storeId;
+  const action = args.action;
+  if (!action) {
+    return {
+      success: false,
+      error: "action is required"
+    };
+  }
+  switch (action) {
+    // ---- ENRICH_PERSON: PDL Person Enrichment API ----
+    case "enrich_person":
+      {
+        const customerId = args.customer_id;
+        if (!customerId) return {
+          success: false,
+          error: "customer_id is required"
+        };
+        const apiKey = await getSecret(sb, "pdl_api_key", sid);
+        if (!apiKey) return {
+          success: false,
+          error: "PDL API key not configured. Add 'pdl_api_key' to store secrets."
+        };
+
+        // Build PDL query params from available identifiers
+        const params = {};
+        if (args.email) params.email = args.email;
+        if (args.phone) params.phone = args.phone;
+        if (args.first_name) params.first_name = args.first_name;
+        if (args.last_name) params.last_name = args.last_name;
+        if (args.linkedin_url) params.profile = args.linkedin_url;
+        if (args.location) params.location = args.location;
+        if (Object.keys(params).length === 0) {
+          return {
+            success: false,
+            error: "At least one identifier required: email, phone, first_name+last_name, or linkedin_url"
+          };
         }
-        // ---- ENRICH_LINKEDIN: Bright Data LinkedIn scraper ----
-        case "enrich_linkedin": {
-            const customerId = args.customer_id;
-            const linkedinUrl = args.linkedin_url;
-            if (!customerId)
-                return { success: false, error: "customer_id is required" };
-            if (!linkedinUrl)
-                return { success: false, error: "linkedin_url is required" };
-            const apiKey = await getSecret(sb, "brightdata_api_key", sid);
-            if (!apiKey)
-                return { success: false, error: "Bright Data API key not configured. Add 'brightdata_api_key' to store secrets." };
-            const datasetId = await getSecret(sb, "brightdata_dataset_id", sid) || "gd_l1viktl72bvl7bjuj0";
-            try {
-                // Bright Data Scraper API — synchronous LinkedIn profile collection
-                const resp = await fetch(`https://api.brightdata.com/datasets/v3/scrape?dataset_id=${datasetId}&notify=false&include_errors=true`, {
-                    method: "POST",
-                    headers: {
-                        Authorization: `Bearer ${apiKey}`,
-                        "Content-Type": "application/json",
-                    },
-                    body: JSON.stringify({ input: [{ url: linkedinUrl }] }),
-                });
-                if (!resp.ok) {
-                    const text = await resp.text().catch(() => "");
-                    if (resp.status === 404) {
-                        return { success: true, data: null, error: "No LinkedIn profile found at this URL" };
-                    }
-                    return { success: false, error: `Bright Data API error ${resp.status}: ${text.substring(0, 500)}` };
-                }
-                const bdResult = await resp.json();
-                // Bright Data returns an array of results
-                const profileData = Array.isArray(bdResult) ? bdResult[0] : bdResult;
-                if (!profileData || profileData.error) {
-                    return { success: true, data: null, error: profileData?.error || "No data returned for this profile" };
-                }
-                // Store as enrichment profile with source=brightdata
-                const profile = {
-                    customer_id: customerId,
-                    store_id: sid,
-                    enrichment_source: "brightdata",
-                    enrichment_data: profileData,
-                    enriched_at: nowISO(),
-                    updated_at: nowISO(),
-                };
-                // Extract common fields from Bright Data response
-                if (profileData.name || profileData.full_name)
-                    profile.full_name = profileData.name || profileData.full_name;
-                if (profileData.position || profileData.job_title)
-                    profile.job_title = profileData.position || profileData.job_title;
-                if (profileData.current_company || profileData.company)
-                    profile.company = profileData.current_company || profileData.company;
-                if (profileData.headline)
-                    profile.headline = profileData.headline;
-                if (profileData.location)
-                    profile.location = profileData.location;
-                profile.linkedin_url = linkedinUrl;
-                // Upsert — update if already exists for this customer+store+source
-                const { data: existing } = await sb.from("customer_enrichment_profiles")
-                    .select("id")
-                    .eq("customer_id", customerId)
-                    .eq("store_id", sid)
-                    .eq("enrichment_source", "brightdata")
-                    .maybeSingle();
-                let result;
-                if (existing) {
-                    const { data, error } = await sb.from("customer_enrichment_profiles")
-                        .update(profile)
-                        .eq("id", existing.id)
-                        .select()
-                        .single();
-                    result = { data, error };
-                }
-                else {
-                    profile.created_at = nowISO();
-                    const { data, error } = await sb.from("customer_enrichment_profiles")
-                        .insert(profile)
-                        .select()
-                        .single();
-                    result = { data, error };
-                }
-                if (result.error)
-                    return { success: false, error: `Failed to store enrichment: ${result.error.message}` };
-                return { success: true, data: result.data };
+        try {
+          const queryString = new URLSearchParams(params).toString();
+          const resp = await fetch(`https://api.peopledatalabs.com/v5/person/enrich?${queryString}`, {
+            method: "GET",
+            headers: {
+              "X-Api-Key": apiKey,
+              "Accept": "application/json"
             }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                return { success: false, error: `Bright Data enrichment failed: ${msg}` };
+          });
+          if (!resp.ok) {
+            const text = await resp.text().catch(() => "");
+            if (resp.status === 404) {
+              return {
+                success: true,
+                data: null,
+                error: "No enrichment data found for this person"
+              };
             }
+            return {
+              success: false,
+              error: `PDL API error ${resp.status}: ${text.substring(0, 500)}`
+            };
+          }
+          const pdlData = await resp.json();
+
+          // Store enrichment profile
+          const profile = {
+            customer_id: customerId,
+            store_id: sid,
+            enrichment_source: "pdl",
+            enrichment_data: pdlData,
+            enriched_at: nowISO(),
+            updated_at: nowISO()
+          };
+
+          // Extract common fields if present
+          if (pdlData.full_name) profile.full_name = pdlData.full_name;
+          if (pdlData.job_title) profile.job_title = pdlData.job_title;
+          if (pdlData.job_company_name) profile.company = pdlData.job_company_name;
+          if (pdlData.linkedin_url) profile.linkedin_url = pdlData.linkedin_url;
+          if (pdlData.location_name) profile.location = pdlData.location_name;
+          if (pdlData.gender) profile.gender = pdlData.gender;
+          if (pdlData.birth_year) profile.birth_year = pdlData.birth_year;
+
+          // Upsert — update if already exists for this customer+store
+          const {
+            data: existing
+          } = await sb.from("customer_enrichment_profiles").select("id").eq("customer_id", customerId).eq("store_id", sid).maybeSingle();
+          let result;
+          if (existing) {
+            const {
+              data,
+              error
+            } = await sb.from("customer_enrichment_profiles").update(profile).eq("id", existing.id).select().single();
+            result = {
+              data,
+              error
+            };
+          } else {
+            profile.created_at = nowISO();
+            const {
+              data,
+              error
+            } = await sb.from("customer_enrichment_profiles").insert(profile).select().single();
+            result = {
+              data,
+              error
+            };
+          }
+          if (result.error) return {
+            success: false,
+            error: `Failed to store enrichment: ${result.error.message}`
+          };
+          return {
+            success: true,
+            data: result.data
+          };
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          return {
+            success: false,
+            error: `PDL enrichment failed: ${msg}`
+          };
         }
-        // ---- CHECK_XONPLUS: xonPlus real-time breach monitoring ----
-        case "check_xonplus": {
-            const customerId = args.customer_id;
-            const email = args.email;
-            if (!customerId)
-                return { success: false, error: "customer_id is required" };
-            if (!email)
-                return { success: false, error: "email is required" };
-            const apiKey = await getSecret(sb, "xonplus_api_key", sid);
-            if (!apiKey)
-                return { success: false, error: "xonPlus API key not configured. Add 'xonplus_api_key' to store secrets." };
-            try {
-                const resp = await fetch(`https://api.xposedornot.com/v1/check-email/${encodeURIComponent(email)}`, {
-                    method: "GET",
-                    headers: {
-                        "x-api-key": apiKey,
-                        Accept: "application/json",
-                    },
-                });
-                if (!resp.ok) {
-                    const text = await resp.text().catch(() => "");
-                    if (resp.status === 404) {
-                        return { success: true, data: { email, total_breaches: 0, breaches: [] } };
-                    }
-                    return { success: false, error: `xonPlus API error ${resp.status}: ${text.substring(0, 500)}` };
-                }
-                const xonData = await resp.json();
-                const breaches = (xonData.breaches || xonData.ExposedBreaches?.breaches_details || []);
-                // Store each breach record
-                const inserted = [];
-                for (const breach of breaches) {
-                    const record = {
-                        customer_id: customerId,
-                        store_id: sid,
-                        breach_name: breach.breach || breach.name || "unknown",
-                        breach_domain: breach.domain || null,
-                        breach_date: breach.xposed_date || breach.date || null,
-                        data_classes: breach.xposed_data ? breach.xposed_data.split(",").map((s) => s.trim()) : null,
-                        breach_source: "xonplus",
-                        raw_data: breach,
-                        discovered_at: nowISO(),
-                        created_at: nowISO(),
-                    };
-                    // Deduplicate by customer_id + breach_name + breach_source
-                    const { data: existing } = await sb.from("customer_breach_records")
-                        .select("id")
-                        .eq("customer_id", customerId)
-                        .eq("breach_name", record.breach_name)
-                        .eq("breach_source", "xonplus")
-                        .maybeSingle();
-                    if (!existing) {
-                        const { data, error } = await sb.from("customer_breach_records")
-                            .insert(record)
-                            .select()
-                            .single();
-                        if (!error && data)
-                            inserted.push(data);
-                    }
-                }
-                return {
-                    success: true,
-                    data: {
-                        email,
-                        total_breaches: breaches.length,
-                        new_breaches: inserted.length,
-                        risk_metrics: xonData.BreachMetrics || null,
-                        breaches: inserted.length > 0 ? inserted : breaches,
-                    },
-                };
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                return { success: false, error: `xonPlus breach check failed: ${msg}` };
+      }
+
+    // ---- ENRICH_LINKEDIN: Bright Data LinkedIn scraper ----
+    case "enrich_linkedin":
+      {
+        const customerId = args.customer_id;
+        const linkedinUrl = args.linkedin_url;
+        if (!customerId) return {
+          success: false,
+          error: "customer_id is required"
+        };
+        if (!linkedinUrl) return {
+          success: false,
+          error: "linkedin_url is required"
+        };
+        const apiKey = await getSecret(sb, "brightdata_api_key", sid);
+        if (!apiKey) return {
+          success: false,
+          error: "Bright Data API key not configured. Add 'brightdata_api_key' to store secrets."
+        };
+        const datasetId = (await getSecret(sb, "brightdata_dataset_id", sid)) || "gd_l1viktl72bvl7bjuj0";
+        try {
+          // Bright Data Scraper API — synchronous LinkedIn profile collection
+          const resp = await fetch(`https://api.brightdata.com/datasets/v3/scrape?dataset_id=${datasetId}&notify=false&include_errors=true`, {
+            method: "POST",
+            headers: {
+              Authorization: `Bearer ${apiKey}`,
+              "Content-Type": "application/json"
+            },
+            body: JSON.stringify({
+              input: [{
+                url: linkedinUrl
+              }]
+            })
+          });
+          if (!resp.ok) {
+            const text = await resp.text().catch(() => "");
+            if (resp.status === 404) {
+              return {
+                success: true,
+                data: null,
+                error: "No LinkedIn profile found at this URL"
+              };
             }
+            return {
+              success: false,
+              error: `Bright Data API error ${resp.status}: ${text.substring(0, 500)}`
+            };
+          }
+          const bdResult = await resp.json();
+          // Bright Data returns an array of results
+          const profileData = Array.isArray(bdResult) ? bdResult[0] : bdResult;
+          if (!profileData || profileData.error) {
+            return {
+              success: true,
+              data: null,
+              error: profileData?.error || "No data returned for this profile"
+            };
+          }
+
+          // Store as enrichment profile with source=brightdata
+          const profile = {
+            customer_id: customerId,
+            store_id: sid,
+            enrichment_source: "brightdata",
+            enrichment_data: profileData,
+            enriched_at: nowISO(),
+            updated_at: nowISO()
+          };
+
+          // Extract common fields from Bright Data response
+          if (profileData.name || profileData.full_name) profile.full_name = profileData.name || profileData.full_name;
+          if (profileData.position || profileData.job_title) profile.job_title = profileData.position || profileData.job_title;
+          if (profileData.current_company || profileData.company) profile.company = profileData.current_company || profileData.company;
+          if (profileData.headline) profile.headline = profileData.headline;
+          if (profileData.location) profile.location = profileData.location;
+          profile.linkedin_url = linkedinUrl;
+
+          // Upsert — update if already exists for this customer+store+source
+          const {
+            data: existing
+          } = await sb.from("customer_enrichment_profiles").select("id").eq("customer_id", customerId).eq("store_id", sid).eq("enrichment_source", "brightdata").maybeSingle();
+          let result;
+          if (existing) {
+            const {
+              data,
+              error
+            } = await sb.from("customer_enrichment_profiles").update(profile).eq("id", existing.id).select().single();
+            result = {
+              data,
+              error
+            };
+          } else {
+            profile.created_at = nowISO();
+            const {
+              data,
+              error
+            } = await sb.from("customer_enrichment_profiles").insert(profile).select().single();
+            result = {
+              data,
+              error
+            };
+          }
+          if (result.error) return {
+            success: false,
+            error: `Failed to store enrichment: ${result.error.message}`
+          };
+          return {
+            success: true,
+            data: result.data
+          };
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          return {
+            success: false,
+            error: `Bright Data enrichment failed: ${msg}`
+          };
         }
-        // ---- CHECK_BREACHES: HIBP Breach Check ----
-        case "check_breaches": {
-            const customerId = args.customer_id;
-            const email = args.email;
-            if (!customerId)
-                return { success: false, error: "customer_id is required" };
-            if (!email)
-                return { success: false, error: "email is required" };
-            const apiKey = await getSecret(sb, "hibp_api_key", sid);
-            if (!apiKey)
-                return { success: false, error: "HIBP API key not configured. Add 'hibp_api_key' to store secrets." };
-            try {
-                const resp = await fetch(`https://haveibeenpwned.com/api/v3/breachedaccount/${encodeURIComponent(email)}?truncateResponse=false`, {
-                    method: "GET",
-                    headers: {
-                        "hibp-api-key": apiKey,
-                        "User-Agent": "SwagManager-DataProtection",
-                        Accept: "application/json",
-                    },
-                });
-                let breaches = [];
-                if (resp.status === 404) {
-                    // No breaches found — that's good
-                    breaches = [];
-                }
-                else if (!resp.ok) {
-                    const text = await resp.text().catch(() => "");
-                    return { success: false, error: `HIBP API error ${resp.status}: ${text.substring(0, 500)}` };
-                }
-                else {
-                    breaches = await resp.json();
-                }
-                // Store each breach record
-                const inserted = [];
-                for (const breach of breaches) {
-                    const record = {
-                        customer_id: customerId,
-                        store_id: sid,
-                        breach_name: breach.Name,
-                        breach_domain: breach.Domain,
-                        breach_date: breach.BreachDate,
-                        data_classes: breach.DataClasses,
-                        description: breach.Description,
-                        is_verified: breach.IsVerified,
-                        breach_source: "hibp",
-                        discovered_at: nowISO(),
-                        created_at: nowISO(),
-                    };
-                    // Upsert by customer_id + breach_name to avoid duplicates
-                    const { data: existing } = await sb.from("customer_breach_records")
-                        .select("id")
-                        .eq("customer_id", customerId)
-                        .eq("breach_name", breach.Name)
-                        .maybeSingle();
-                    if (!existing) {
-                        const { data, error } = await sb.from("customer_breach_records")
-                            .insert(record)
-                            .select()
-                            .single();
-                        if (!error && data)
-                            inserted.push(data);
-                    }
-                }
-                return {
-                    success: true,
-                    data: {
-                        email,
-                        total_breaches: breaches.length,
-                        new_breaches: inserted.length,
-                        breaches: inserted.length > 0 ? inserted : breaches,
-                    },
-                };
+      }
+
+    // ---- CHECK_XONPLUS: xonPlus real-time breach monitoring ----
+    case "check_xonplus":
+      {
+        const customerId = args.customer_id;
+        const email = args.email;
+        if (!customerId) return {
+          success: false,
+          error: "customer_id is required"
+        };
+        if (!email) return {
+          success: false,
+          error: "email is required"
+        };
+        const apiKey = await getSecret(sb, "xonplus_api_key", sid);
+        if (!apiKey) return {
+          success: false,
+          error: "xonPlus API key not configured. Add 'xonplus_api_key' to store secrets."
+        };
+        try {
+          const resp = await fetch(`https://api.xposedornot.com/v1/check-email/${encodeURIComponent(email)}`, {
+            method: "GET",
+            headers: {
+              "x-api-key": apiKey,
+              Accept: "application/json"
             }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                return { success: false, error: `HIBP breach check failed: ${msg}` };
-            }
-        }
-        // ---- CHECK_DEHASHED: DeHashed credential exposure search ----
-        case "check_dehashed": {
-            const customerId = args.customer_id;
-            const email = args.email;
-            if (!customerId)
-                return { success: false, error: "customer_id is required" };
-            if (!email)
-                return { success: false, error: "email is required" };
-            const apiKey = await getSecret(sb, "dehashed_api_key", sid);
-            if (!apiKey)
-                return { success: false, error: "DeHashed API key not configured. Add 'dehashed_api_key' to store secrets." };
-            try {
-                const resp = await fetch("https://api.dehashed.com/v2/search", {
-                    method: "POST",
-                    headers: {
-                        "Content-Type": "application/json",
-                        "DeHashed-Api-Key": apiKey,
-                    },
-                    body: JSON.stringify({
-                        query: `email:"${email}"`,
-                        page: 1,
-                        size: 100,
-                        wildcard: false,
-                        regex: false,
-                        de_dupe: true,
-                    }),
-                });
-                if (!resp.ok) {
-                    const text = await resp.text().catch(() => "");
-                    return { success: false, error: `DeHashed API error ${resp.status}: ${text.substring(0, 500)}` };
+          });
+          if (!resp.ok) {
+            const text = await resp.text().catch(() => "");
+            if (resp.status === 404) {
+              return {
+                success: true,
+                data: {
+                  email,
+                  total_breaches: 0,
+                  breaches: []
                 }
-                const result = await resp.json();
-                const entries = (result.entries || []);
-                // Store each as a breach record with source=dehashed
-                const inserted = [];
-                for (const entry of entries) {
-                    const record = {
-                        customer_id: customerId,
-                        store_id: sid,
-                        breach_name: entry.database_name || "unknown",
-                        breach_domain: entry.domain || null,
-                        breach_date: entry.obtained_date || null,
-                        data_classes: entry.type ? [entry.type] : null,
-                        breach_source: "dehashed",
-                        raw_data: entry,
-                        discovered_at: nowISO(),
-                        created_at: nowISO(),
-                    };
-                    const { data, error } = await sb.from("customer_breach_records")
-                        .insert(record)
-                        .select()
-                        .single();
-                    if (!error && data)
-                        inserted.push(data);
-                }
-                return {
-                    success: true,
-                    data: {
-                        email,
-                        total_results: entries.length,
-                        stored: inserted.length,
-                        entries: inserted,
-                    },
-                };
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                return { success: false, error: `DeHashed check failed: ${msg}` };
+              };
             }
-        }
-        // ---- GET_ENRICHMENT: Read enrichment profiles ----
-        case "get_enrichment": {
-            const customerId = args.customer_id;
-            if (!customerId)
-                return { success: false, error: "customer_id is required" };
-            let q = sb.from("customer_enrichment_profiles")
-                .select("*")
-                .eq("customer_id", customerId)
-                .eq("store_id", sid)
-                .order("enriched_at", { ascending: false });
-            if (args.source)
-                q = q.eq("enrichment_source", args.source);
-            const limit = args.limit || 10;
-            q = q.limit(limit);
-            const { data, error } = await q;
-            return error
-                ? { success: false, error: error.message }
-                : { success: true, data: { count: data?.length, records: data } };
-        }
-        // ---- GET_BREACHES: Read breach records ----
-        case "get_breaches": {
-            const customerId = args.customer_id;
-            if (!customerId)
-                return { success: false, error: "customer_id is required" };
-            let q = sb.from("customer_breach_records")
-                .select("*")
-                .eq("customer_id", customerId)
-                .eq("store_id", sid)
-                .order("discovered_at", { ascending: false });
-            if (args.source)
-                q = q.eq("breach_source", args.source);
-            const limit = args.limit || 50;
-            q = q.limit(limit);
-            const { data, error } = await q;
-            return error
-                ? { success: false, error: error.message }
-                : { success: true, data: { count: data?.length, records: data } };
-        }
-        // ---- GET_EXPOSURES: Read broker exposures ----
-        case "get_exposures": {
-            const customerId = args.customer_id;
-            if (!customerId)
-                return { success: false, error: "customer_id is required" };
-            let q = sb.from("customer_exposures")
-                .select("*")
-                .eq("customer_id", customerId)
-                .eq("store_id", sid)
-                .order("first_seen_at", { ascending: false });
-            if (args.status)
-                q = q.eq("status", args.status);
-            if (args.source_name || args.broker)
-                q = q.eq("source_name", (args.source_name || args.broker));
-            const limit = args.limit || 50;
-            q = q.limit(limit);
-            const { data, error } = await q;
-            return error
-                ? { success: false, error: error.message }
-                : { success: true, data: { count: data?.length, records: data } };
-        }
-        // ---- GET_REMOVAL_STATUS: Read removal requests ----
-        case "get_removal_status": {
-            const customerId = args.customer_id;
-            if (!customerId)
-                return { success: false, error: "customer_id is required" };
-            let q = sb.from("customer_removal_requests")
-                .select("*")
-                .eq("customer_id", customerId)
-                .eq("store_id", sid)
-                .order("created_at", { ascending: false });
-            if (args.status)
-                q = q.eq("status", args.status);
-            const limit = args.limit || 50;
-            q = q.limit(limit);
-            const { data, error } = await q;
-            return error
-                ? { success: false, error: error.message }
-                : { success: true, data: { count: data?.length, records: data } };
-        }
-        // ---- GET_RISK_SCORE: Read latest risk score ----
-        case "get_risk_score": {
-            const customerId = args.customer_id;
-            if (!customerId)
-                return { success: false, error: "customer_id is required" };
-            const { data, error } = await sb.from("customer_risk_scores")
-                .select("*")
-                .eq("customer_id", customerId)
-                .eq("store_id", sid)
-                .order("calculated_at", { ascending: false })
-                .limit(1)
-                .maybeSingle();
-            return error
-                ? { success: false, error: error.message }
-                : { success: true, data };
-        }
-        // ---- STORE_SCAN_RESULTS: Insert scan results ----
-        case "store_scan_results": {
-            const customerId = args.customer_id;
-            if (!customerId)
-                return { success: false, error: "customer_id is required" };
+            return {
+              success: false,
+              error: `xonPlus API error ${resp.status}: ${text.substring(0, 500)}`
+            };
+          }
+          const xonData = await resp.json();
+          const breaches = xonData.breaches || xonData.ExposedBreaches?.breaches_details || [];
+
+          // Store each breach record
+          const inserted = [];
+          for (const breach of breaches) {
             const record = {
-                customer_id: customerId,
-                store_id: sid,
-                scan_type: args.scan_type || "discovery",
-                scan_data: args.scan_data || {},
-                broker_count: args.broker_count ?? 0,
-                exposure_count: args.exposure_count ?? 0,
-                status: args.status || "completed",
-                created_at: nowISO(),
+              customer_id: customerId,
+              store_id: sid,
+              breach_name: breach.breach || breach.name || "unknown",
+              breach_domain: breach.domain || null,
+              breach_date: breach.xposed_date || breach.date || null,
+              data_classes: breach.xposed_data ? breach.xposed_data.split(",").map(s => s.trim()) : null,
+              breach_source: "xonplus",
+              raw_data: breach,
+              discovered_at: nowISO(),
+              created_at: nowISO()
             };
-            if (args.scan_id)
-                record.scan_id = args.scan_id;
-            if (args.file_path)
-                record.file_path = args.file_path;
-            const { data, error } = await sb.from("customer_scan_results")
-                .insert(record)
-                .select()
-                .single();
-            return error
-                ? { success: false, error: `Failed to store scan results: ${error.message}` }
-                : { success: true, data };
+
+            // Deduplicate by customer_id + breach_name + breach_source
+            const {
+              data: existing
+            } = await sb.from("customer_breach_records").select("id").eq("customer_id", customerId).eq("breach_name", record.breach_name).eq("breach_source", "xonplus").maybeSingle();
+            if (!existing) {
+              const {
+                data,
+                error
+              } = await sb.from("customer_breach_records").insert(record).select().single();
+              if (!error && data) inserted.push(data);
+            }
+          }
+          return {
+            success: true,
+            data: {
+              email,
+              total_breaches: breaches.length,
+              new_breaches: inserted.length,
+              risk_metrics: xonData.BreachMetrics || null,
+              breaches: inserted.length > 0 ? inserted : breaches
+            }
+          };
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          return {
+            success: false,
+            error: `xonPlus breach check failed: ${msg}`
+          };
         }
-        // ---- STORE_EXPOSURE: Insert a broker exposure ----
-        case "store_exposure": {
-            const customerId = args.customer_id;
-            const sourceName = (args.source_name || args.broker);
-            if (!customerId)
-                return { success: false, error: "customer_id is required" };
-            if (!sourceName)
-                return { success: false, error: "source_name is required" };
-            // Check for existing exposure to avoid duplicates
-            const { data: existing } = await sb.from("customer_exposures")
-                .select("id")
-                .eq("customer_id", customerId)
-                .eq("store_id", sid)
-                .eq("source_name", sourceName)
-                .maybeSingle();
-            if (existing) {
-                // Update existing record
-                const updates = {};
-                if (args.source_url)
-                    updates.source_url = args.source_url;
-                if (args.data_types_exposed)
-                    updates.data_types_exposed = args.data_types_exposed;
-                if (args.status)
-                    updates.status = args.status;
-                const { data, error } = await sb.from("customer_exposures")
-                    .update(updates)
-                    .eq("id", existing.id)
-                    .select()
-                    .single();
-                return error
-                    ? { success: false, error: `Failed to update exposure: ${error.message}` }
-                    : { success: true, data: { ...data, _note: "Updated existing exposure record" } };
+      }
+
+    // ---- CHECK_BREACHES: HIBP Breach Check ----
+    case "check_breaches":
+      {
+        const customerId = args.customer_id;
+        const email = args.email;
+        if (!customerId) return {
+          success: false,
+          error: "customer_id is required"
+        };
+        if (!email) return {
+          success: false,
+          error: "email is required"
+        };
+        const apiKey = await getSecret(sb, "hibp_api_key", sid);
+        if (!apiKey) return {
+          success: false,
+          error: "HIBP API key not configured. Add 'hibp_api_key' to store secrets."
+        };
+        try {
+          const resp = await fetch(`https://haveibeenpwned.com/api/v3/breachedaccount/${encodeURIComponent(email)}?truncateResponse=false`, {
+            method: "GET",
+            headers: {
+              "hibp-api-key": apiKey,
+              "User-Agent": "WhaleTools-DataProtection",
+              Accept: "application/json"
             }
+          });
+          let breaches = [];
+          if (resp.status === 404) {
+            // No breaches found — that's good
+            breaches = [];
+          } else if (!resp.ok) {
+            const text = await resp.text().catch(() => "");
+            return {
+              success: false,
+              error: `HIBP API error ${resp.status}: ${text.substring(0, 500)}`
+            };
+          } else {
+            breaches = await resp.json();
+          }
+
+          // Store each breach record
+          const inserted = [];
+          for (const breach of breaches) {
             const record = {
-                customer_id: customerId,
-                store_id: sid,
-                source_name: sourceName,
-                source_type: args.source_type || "data_broker",
-                status: args.status || "found",
-                first_seen_at: nowISO(),
-                created_at: nowISO(),
+              customer_id: customerId,
+              store_id: sid,
+              breach_name: breach.Name,
+              breach_domain: breach.Domain,
+              breach_date: breach.BreachDate,
+              data_classes: breach.DataClasses,
+              description: breach.Description,
+              is_verified: breach.IsVerified,
+              breach_source: "hibp",
+              discovered_at: nowISO(),
+              created_at: nowISO()
             };
-            if (args.source_url)
-                record.source_url = args.source_url;
-            if (args.data_types_exposed)
-                record.data_types_exposed = args.data_types_exposed;
-            if (args.scan_id)
-                record.scan_id = args.scan_id;
-            const { data, error } = await sb.from("customer_exposures")
-                .insert(record)
-                .select()
-                .single();
-            return error
-                ? { success: false, error: `Failed to store exposure: ${error.message}` }
-                : { success: true, data };
-        }
-        // ---- UPDATE_EXPOSURE_STATUS: Update exposure status ----
-        case "update_exposure_status": {
-            const exposureId = args.exposure_id;
-            if (!exposureId)
-                return { success: false, error: "exposure_id is required" };
-            const updates = {};
-            if (args.status)
-                updates.status = args.status;
-            if (args.status === "removed") {
-                updates.removed_at = nowISO();
+
+            // Upsert by customer_id + breach_name to avoid duplicates
+            const {
+              data: existing
+            } = await sb.from("customer_breach_records").select("id").eq("customer_id", customerId).eq("breach_name", breach.Name).maybeSingle();
+            if (!existing) {
+              const {
+                data,
+                error
+              } = await sb.from("customer_breach_records").insert(record).select().single();
+              if (!error && data) inserted.push(data);
+            }
+          }
+          return {
+            success: true,
+            data: {
+              email,
+              total_breaches: breaches.length,
+              new_breaches: inserted.length,
+              breaches: inserted.length > 0 ? inserted : breaches
             }
-            const { data, error } = await sb.from("customer_exposures")
-                .update(updates)
-                .eq("id", exposureId)
-                .eq("store_id", sid)
-                .select()
-                .single();
-            return error
-                ? { success: false, error: `Failed to update exposure: ${error.message}` }
-                : { success: true, data };
+          };
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          return {
+            success: false,
+            error: `HIBP breach check failed: ${msg}`
+          };
         }
-        // ---- STORE_REMOVAL_REQUEST: Insert a removal request ----
-        case "store_removal_request": {
-            const customerId = args.customer_id;
-            const brokerName = (args.broker_name || args.source_name || args.broker);
-            if (!customerId)
-                return { success: false, error: "customer_id is required" };
-            if (!brokerName)
-                return { success: false, error: "source_name is required" };
+      }
+
+    // ---- CHECK_DEHASHED: DeHashed credential exposure search ----
+    case "check_dehashed":
+      {
+        const customerId = args.customer_id;
+        const email = args.email;
+        if (!customerId) return {
+          success: false,
+          error: "customer_id is required"
+        };
+        if (!email) return {
+          success: false,
+          error: "email is required"
+        };
+        const apiKey = await getSecret(sb, "dehashed_api_key", sid);
+        if (!apiKey) return {
+          success: false,
+          error: "DeHashed API key not configured. Add 'dehashed_api_key' to store secrets."
+        };
+        try {
+          const resp = await fetch("https://api.dehashed.com/v2/search", {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              "DeHashed-Api-Key": apiKey
+            },
+            body: JSON.stringify({
+              query: `email:"${email}"`,
+              page: 1,
+              size: 100,
+              wildcard: false,
+              regex: false,
+              de_dupe: true
+            })
+          });
+          if (!resp.ok) {
+            const text = await resp.text().catch(() => "");
+            return {
+              success: false,
+              error: `DeHashed API error ${resp.status}: ${text.substring(0, 500)}`
+            };
+          }
+          const result = await resp.json();
+          const entries = result.entries || [];
+
+          // Store each as a breach record with source=dehashed
+          const inserted = [];
+          for (const entry of entries) {
             const record = {
-                customer_id: customerId,
-                store_id: sid,
-                broker_name: brokerName,
-                removal_method: args.removal_method || args.method || "manual",
-                status: args.status || "pending",
-                created_at: nowISO(),
-                updated_at: nowISO(),
+              customer_id: customerId,
+              store_id: sid,
+              breach_name: entry.database_name || "unknown",
+              breach_domain: entry.domain || null,
+              breach_date: entry.obtained_date || null,
+              data_classes: entry.type ? [entry.type] : null,
+              breach_source: "dehashed",
+              raw_data: entry,
+              discovered_at: nowISO(),
+              created_at: nowISO()
             };
-            if (args.exposure_id)
-                record.exposure_id = args.exposure_id;
-            if (args.request_data)
-                record.request_data = args.request_data;
-            if (args.submitted_at)
-                record.submitted_at = args.submitted_at;
-            if (args.confirmation_id)
-                record.confirmation_id = args.confirmation_id;
-            const { data, error } = await sb.from("customer_removal_requests")
-                .insert(record)
-                .select()
-                .single();
-            return error
-                ? { success: false, error: `Failed to store removal request: ${error.message}` }
-                : { success: true, data };
+            const {
+              data,
+              error
+            } = await sb.from("customer_breach_records").insert(record).select().single();
+            if (!error && data) inserted.push(data);
+          }
+          return {
+            success: true,
+            data: {
+              email,
+              total_results: entries.length,
+              stored: inserted.length,
+              entries: inserted
+            }
+          };
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          return {
+            success: false,
+            error: `DeHashed check failed: ${msg}`
+          };
         }
-        // ---- CALCULATE_RISK_SCORE: Compute and store a risk score ----
-        case "calculate_risk_score": {
-            const customerId = args.customer_id;
-            if (!customerId)
-                return { success: false, error: "customer_id is required" };
-            // Gather data for risk calculation
-            const [exposuresResult, breachesResult, removalsResult] = await Promise.all([
-                sb.from("customer_exposures")
-                    .select("id, source_name, status")
-                    .eq("customer_id", customerId)
-                    .eq("store_id", sid),
-                sb.from("customer_breach_records")
-                    .select("id, breach_name, data_classes, is_verified")
-                    .eq("customer_id", customerId)
-                    .eq("store_id", sid),
-                sb.from("customer_removal_requests")
-                    .select("id, status, broker_name")
-                    .eq("customer_id", customerId)
-                    .eq("store_id", sid),
-            ]);
-            const exposures = exposuresResult.data || [];
-            const breaches = breachesResult.data || [];
-            const removals = removalsResult.data || [];
-            // Score calculation:
-            // - Each active exposure: +10 points
-            // - Each removed exposure: -5 points (still contributes slightly)
-            // - Each breach: +15 points
-            // - Each sensitive breach: +25 points (instead of 15)
-            // - Each verified breach: +5 bonus
-            // - Each completed removal: -8 points
-            // - Base floor: 0, cap: 100
-            let score = 0;
-            // Exposure scoring
-            const activeExposures = exposures.filter((e) => e.status !== "removed");
-            const removedExposures = exposures.filter((e) => e.status === "removed");
-            score += activeExposures.length * 10;
-            score += removedExposures.length * 2;
-            // Breach scoring
-            for (const breach of breaches) {
-                score += 15;
-                if (breach.is_verified) {
-                    score += 5;
-                }
+      }
+
+    // ---- GET_ENRICHMENT: Read enrichment profiles ----
+    case "get_enrichment":
+      {
+        const customerId = args.customer_id;
+        if (!customerId) return {
+          success: false,
+          error: "customer_id is required"
+        };
+        let q = sb.from("customer_enrichment_profiles").select("*").eq("customer_id", customerId).eq("store_id", sid).order("enriched_at", {
+          ascending: false
+        });
+        if (args.source) q = q.eq("enrichment_source", args.source);
+        const limit = args.limit || 10;
+        q = q.limit(limit);
+        const {
+          data,
+          error
+        } = await q;
+        return error ? {
+          success: false,
+          error: error.message
+        } : {
+          success: true,
+          data: {
+            count: data?.length,
+            records: data
+          }
+        };
+      }
+
+    // ---- GET_BREACHES: Read breach records ----
+    case "get_breaches":
+      {
+        const customerId = args.customer_id;
+        if (!customerId) return {
+          success: false,
+          error: "customer_id is required"
+        };
+        let q = sb.from("customer_breach_records").select("*").eq("customer_id", customerId).eq("store_id", sid).order("discovered_at", {
+          ascending: false
+        });
+        if (args.source) q = q.eq("breach_source", args.source);
+        const limit = args.limit || 50;
+        q = q.limit(limit);
+        const {
+          data,
+          error
+        } = await q;
+        return error ? {
+          success: false,
+          error: error.message
+        } : {
+          success: true,
+          data: {
+            count: data?.length,
+            records: data
+          }
+        };
+      }
+
+    // ---- GET_EXPOSURES: Read broker exposures ----
+    case "get_exposures":
+      {
+        const customerId = args.customer_id;
+        if (!customerId) return {
+          success: false,
+          error: "customer_id is required"
+        };
+        let q = sb.from("customer_exposures").select("*").eq("customer_id", customerId).eq("store_id", sid).order("first_seen_at", {
+          ascending: false
+        });
+        if (args.status) q = q.eq("status", args.status);
+        if (args.source_name || args.broker) q = q.eq("source_name", args.source_name || args.broker);
+        const limit = args.limit || 50;
+        q = q.limit(limit);
+        const {
+          data,
+          error
+        } = await q;
+        return error ? {
+          success: false,
+          error: error.message
+        } : {
+          success: true,
+          data: {
+            count: data?.length,
+            records: data
+          }
+        };
+      }
+
+    // ---- GET_REMOVAL_STATUS: Read removal requests ----
+    case "get_removal_status":
+      {
+        const customerId = args.customer_id;
+        if (!customerId) return {
+          success: false,
+          error: "customer_id is required"
+        };
+        let q = sb.from("customer_removal_requests").select("*").eq("customer_id", customerId).eq("store_id", sid).order("created_at", {
+          ascending: false
+        });
+        if (args.status) q = q.eq("status", args.status);
+        const limit = args.limit || 50;
+        q = q.limit(limit);
+        const {
+          data,
+          error
+        } = await q;
+        return error ? {
+          success: false,
+          error: error.message
+        } : {
+          success: true,
+          data: {
+            count: data?.length,
+            records: data
+          }
+        };
+      }
+
+    // ---- GET_RISK_SCORE: Read latest risk score ----
+    case "get_risk_score":
+      {
+        const customerId = args.customer_id;
+        if (!customerId) return {
+          success: false,
+          error: "customer_id is required"
+        };
+        const {
+          data,
+          error
+        } = await sb.from("customer_risk_scores").select("*").eq("customer_id", customerId).eq("store_id", sid).order("calculated_at", {
+          ascending: false
+        }).limit(1).maybeSingle();
+        return error ? {
+          success: false,
+          error: error.message
+        } : {
+          success: true,
+          data
+        };
+      }
+
+    // ---- STORE_SCAN_RESULTS: Insert scan results ----
+    case "store_scan_results":
+      {
+        const customerId = args.customer_id;
+        if (!customerId) return {
+          success: false,
+          error: "customer_id is required"
+        };
+        const record = {
+          customer_id: customerId,
+          store_id: sid,
+          scan_type: args.scan_type || "discovery",
+          scan_data: args.scan_data || {},
+          broker_count: args.broker_count ?? 0,
+          exposure_count: args.exposure_count ?? 0,
+          status: args.status || "completed",
+          created_at: nowISO()
+        };
+        if (args.scan_id) record.scan_id = args.scan_id;
+        if (args.file_path) record.file_path = args.file_path;
+        const {
+          data,
+          error
+        } = await sb.from("customer_scan_results").insert(record).select().single();
+        return error ? {
+          success: false,
+          error: `Failed to store scan results: ${error.message}`
+        } : {
+          success: true,
+          data
+        };
+      }
+
+    // ---- STORE_EXPOSURE: Insert a broker exposure ----
+    case "store_exposure":
+      {
+        const customerId = args.customer_id;
+        const sourceName = args.source_name || args.broker;
+        if (!customerId) return {
+          success: false,
+          error: "customer_id is required"
+        };
+        if (!sourceName) return {
+          success: false,
+          error: "source_name is required"
+        };
+
+        // Check for existing exposure to avoid duplicates
+        const {
+          data: existing
+        } = await sb.from("customer_exposures").select("id").eq("customer_id", customerId).eq("store_id", sid).eq("source_name", sourceName).maybeSingle();
+        if (existing) {
+          // Update existing record
+          const updates = {};
+          if (args.source_url) updates.source_url = args.source_url;
+          if (args.data_types_exposed) updates.data_types_exposed = args.data_types_exposed;
+          if (args.status) updates.status = args.status;
+          const {
+            data,
+            error
+          } = await sb.from("customer_exposures").update(updates).eq("id", existing.id).select().single();
+          return error ? {
+            success: false,
+            error: `Failed to update exposure: ${error.message}`
+          } : {
+            success: true,
+            data: {
+              ...data,
+              _note: "Updated existing exposure record"
             }
-            // Removal credit
-            const completedRemovals = removals.filter((r) => r.status === "completed" || r.status === "confirmed");
-            score -= completedRemovals.length * 8;
-            // Clamp to 0-100
-            score = Math.max(0, Math.min(100, score));
-            // Determine risk level
-            let riskLevel;
-            if (score >= 75)
-                riskLevel = "critical";
-            else if (score >= 50)
-                riskLevel = "high";
-            else if (score >= 25)
-                riskLevel = "medium";
-            else
-                riskLevel = "low";
-            const riskRecord = {
-                customer_id: customerId,
-                store_id: sid,
-                overall_score: score,
-                risk_level: riskLevel,
-                factors: {
-                    active_exposures: activeExposures.length,
-                    removed_exposures: removedExposures.length,
-                    total_breaches: breaches.length,
-                    completed_removals: completedRemovals.length,
-                    pending_removals: removals.filter((r) => r.status === "pending").length,
-                },
-                calculated_at: nowISO(),
-                created_at: nowISO(),
-            };
-            const { data, error } = await sb.from("customer_risk_scores")
-                .insert(riskRecord)
-                .select()
-                .single();
-            return error
-                ? { success: false, error: `Failed to store risk score: ${error.message}` }
-                : { success: true, data };
+          };
         }
-        default:
-            return {
-                success: false,
-                error: `Unknown enrichment action: ${action}. Valid: enrich_person, enrich_linkedin, check_breaches, check_dehashed, check_xonplus, get_enrichment, get_breaches, get_exposures, get_removal_status, get_risk_score, store_scan_results, store_exposure, update_exposure_status, store_removal_request, calculate_risk_score`,
-            };
-    }
+        const record = {
+          customer_id: customerId,
+          store_id: sid,
+          source_name: sourceName,
+          source_type: args.source_type || "data_broker",
+          status: args.status || "found",
+          first_seen_at: nowISO(),
+          created_at: nowISO()
+        };
+        if (args.source_url) record.source_url = args.source_url;
+        if (args.data_types_exposed) record.data_types_exposed = args.data_types_exposed;
+        if (args.scan_id) record.scan_id = args.scan_id;
+        const {
+          data,
+          error
+        } = await sb.from("customer_exposures").insert(record).select().single();
+        return error ? {
+          success: false,
+          error: `Failed to store exposure: ${error.message}`
+        } : {
+          success: true,
+          data
+        };
+      }
+
+    // ---- UPDATE_EXPOSURE_STATUS: Update exposure status ----
+    case "update_exposure_status":
+      {
+        const exposureId = args.exposure_id;
+        if (!exposureId) return {
+          success: false,
+          error: "exposure_id is required"
+        };
+        const updates = {};
+        if (args.status) updates.status = args.status;
+        if (args.status === "removed") {
+          updates.removed_at = nowISO();
+        }
+        const {
+          data,
+          error
+        } = await sb.from("customer_exposures").update(updates).eq("id", exposureId).eq("store_id", sid).select().single();
+        return error ? {
+          success: false,
+          error: `Failed to update exposure: ${error.message}`
+        } : {
+          success: true,
+          data
+        };
+      }
+
+    // ---- STORE_REMOVAL_REQUEST: Insert a removal request ----
+    case "store_removal_request":
+      {
+        const customerId = args.customer_id;
+        const brokerName = args.broker_name || args.source_name || args.broker;
+        if (!customerId) return {
+          success: false,
+          error: "customer_id is required"
+        };
+        if (!brokerName) return {
+          success: false,
+          error: "source_name is required"
+        };
+        const record = {
+          customer_id: customerId,
+          store_id: sid,
+          broker_name: brokerName,
+          removal_method: args.removal_method || args.method || "manual",
+          status: args.status || "pending",
+          created_at: nowISO(),
+          updated_at: nowISO()
+        };
+        if (args.exposure_id) record.exposure_id = args.exposure_id;
+        if (args.request_data) record.request_data = args.request_data;
+        if (args.submitted_at) record.submitted_at = args.submitted_at;
+        if (args.confirmation_id) record.confirmation_id = args.confirmation_id;
+        const {
+          data,
+          error
+        } = await sb.from("customer_removal_requests").insert(record).select().single();
+        return error ? {
+          success: false,
+          error: `Failed to store removal request: ${error.message}`
+        } : {
+          success: true,
+          data
+        };
+      }
+
+    // ---- CALCULATE_RISK_SCORE: Compute and store a risk score ----
+    case "calculate_risk_score":
+      {
+        const customerId = args.customer_id;
+        if (!customerId) return {
+          success: false,
+          error: "customer_id is required"
+        };
+
+        // Gather data for risk calculation
+        const [exposuresResult, breachesResult, removalsResult] = await Promise.all([sb.from("customer_exposures").select("id, source_name, status").eq("customer_id", customerId).eq("store_id", sid), sb.from("customer_breach_records").select("id, breach_name, data_classes, is_verified").eq("customer_id", customerId).eq("store_id", sid), sb.from("customer_removal_requests").select("id, status, broker_name").eq("customer_id", customerId).eq("store_id", sid)]);
+        const exposures = exposuresResult.data || [];
+        const breaches = breachesResult.data || [];
+        const removals = removalsResult.data || [];
+
+        // Score calculation:
+        // - Each active exposure: +10 points
+        // - Each removed exposure: -5 points (still contributes slightly)
+        // - Each breach: +15 points
+        // - Each sensitive breach: +25 points (instead of 15)
+        // - Each verified breach: +5 bonus
+        // - Each completed removal: -8 points
+        // - Base floor: 0, cap: 100
+
+        let score = 0;
+
+        // Exposure scoring
+        const activeExposures = exposures.filter(e => e.status !== "removed");
+        const removedExposures = exposures.filter(e => e.status === "removed");
+        score += activeExposures.length * 10;
+        score += removedExposures.length * 2;
+
+        // Breach scoring
+        for (const breach of breaches) {
+          score += 15;
+          if (breach.is_verified) {
+            score += 5;
+          }
+        }
+
+        // Removal credit
+        const completedRemovals = removals.filter(r => r.status === "completed" || r.status === "confirmed");
+        score -= completedRemovals.length * 8;
+
+        // Clamp to 0-100
+        score = Math.max(0, Math.min(100, score));
+
+        // Determine risk level
+        let riskLevel;
+        if (score >= 75) riskLevel = "critical";else if (score >= 50) riskLevel = "high";else if (score >= 25) riskLevel = "medium";else riskLevel = "low";
+        const riskRecord = {
+          customer_id: customerId,
+          store_id: sid,
+          overall_score: score,
+          risk_level: riskLevel,
+          factors: {
+            active_exposures: activeExposures.length,
+            removed_exposures: removedExposures.length,
+            total_breaches: breaches.length,
+            completed_removals: completedRemovals.length,
+            pending_removals: removals.filter(r => r.status === "pending").length
+          },
+          calculated_at: nowISO(),
+          created_at: nowISO()
+        };
+        const {
+          data,
+          error
+        } = await sb.from("customer_risk_scores").insert(riskRecord).select().single();
+        return error ? {
+          success: false,
+          error: `Failed to store risk score: ${error.message}`
+        } : {
+          success: true,
+          data
+        };
+      }
+    default:
+      return {
+        success: false,
+        error: `Unknown enrichment action: ${action}. Valid: enrich_person, enrich_linkedin, check_breaches, check_dehashed, check_xonplus, get_enrichment, get_breaches, get_exposures, get_removal_status, get_risk_score, store_scan_results, store_exposure, update_exposure_status, store_removal_request, calculate_risk_score`
+      };
+  }
 }
+//# sourceMappingURL=enrichment.js.map