spine-framework 0.3.124 → 0.3.126

package/.framework/functions/apps.ts

@@ -1,55 +1,77 @@
-/**
- * @module apps
- * @audience core-contributor
- * @layer api-handler
- * @stability stable
- *
- * CRUD API for the `apps` table. Apps are the installable units of functionality
- * in Spine v2. They group types, roles, integrations, and nav configuration.
- *
- * **Routed by:** `GET/POST/PATCH/DELETE /.netlify/functions/apps`
- *
- * **Authorization model:**
- * - `list` / `get` / `getSchema` / `checkAvailability`: any authenticated principal
- *   (RLS-scoped via `ctx.db`). Returns sanitized records.
- * - `create`: requires `isSystemAdmin` or first-surface `canCreate` permission.
- * - `update` / `remove`: requires authenticated principal + field-level permission
- *   check via `validateUpdatePermissions`.
- * - `updateVersion`: authenticated principal via RPC.
- *
- * INVARIANT: app slugs are globally unique across the `apps` table.
- * INVARIANT: `is_system` apps can only be manipulated by system admins.
- *
- * @seeAlso middleware.ts (createHandler)
- * @seeAlso permissions.ts (PermissionEngine, sanitizeRecordData)
- * @seeAlso audit.ts (emitLog for app.created / app.updated / app.deleted)
- * @seeAlso types.ts (types reference apps via app_id)
- */
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+// CIL[BEGIN chunk_id="apps_moduleheader_1783969696" type="module_header" identity="imports" parent="none"]
+// CIL[DOC-MACRO purpose="Import dependencies for apps module"]
+// CIL[DOC-RESPONSIBILITY responsibility="Import middleware, database, permissions, and logging utilities"]
+// CIL[DOC-CONTEXT module="apps" layer="backend_functions" related_files="[\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\".framework/migrations/015_simplify_apps_table.sql\",\"custom/apps/portal/pages/ContentPage.tsx\",\".framework/src/pages/admin/TypeDetailPage.tsx\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="imported_modules" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Imports required dependencies for app management functions" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.96" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-AUDIENCE audience="developer"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 0. Direct calls: 0. Related files: custom/apps/cortex/pages/operations/OperationsDashboard.tsx, .framework/migrations/015_simplify_apps_table.sql, custom/apps/portal/pages/ContentPage.tsx, .framework/src/pages/admin/TypeDetailPage.tsx, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 
 import { createHandler } from './_shared/middleware'
-import { joins } from './_shared/db'
+import { adminDb } from './_shared/db'
 import { emitLog } from './_shared/audit'
+import { isSystemAdmin } from './_shared/principal'
 import { PermissionEngine, sanitizeRecordData } from './_shared/permissions'
 
 const permissions = PermissionEngine as any
-
-// ─── HANDLERS ─────────────────────────────────────────────────────────────────
-
-// ─── CHUNK_START: APPS_LIST ──────────────────────────────────────────────
-/**
- * @chunk-id    APPS_LIST_1_0_0
- * @version     1.0.0
- * @hash        8eaac3c01786fadeb3c4acb34c9725378f2055766213493859835cadf2bb3963
- * @macro       Apps List Handler
- * @micro       Lists accessible apps via RPC with filtering and sanitization
- * @inputs      ctx: CoreContext — Request context with principal and database
- * @inputs      body: any — Request body (unused for GET)
- * @outputs     Array of sanitized app records
- * @depends-on  [createHandler, sanitizeRecordData]
- * @depended-by [Netlify function routing]
- * @side-effects [RPC call, permission sanitization]
- * @tags        apps, list, crud, rpc
- */
+// CIL[END chunk_id="apps_moduleheader_1783969696"]
+// CIL[BEGIN chunk_id="apps_list_1783969696" type="function" identity="list" parent="none"]
+// CIL[DOC-LEARNING topic="apps_list:get_account_apps_filter" content="/api/apps?action=list calls get_account_apps, which filters by account ownership, is_active, and the requesting user's roles. An app missing from this list will never be rendered by AuthenticatedRouter."]
+// CIL[DOC-MACRO purpose="List apps with filtering and permissions"]
+// CIL[DOC-RESPONSIBILITY responsibility="Retrieve and filter apps by account and user roles"]
+// CIL[DOC-CONTEXT module="apps" layer="backend_functions" related_files="[\"custom/apps/portal/pages/ContentPage.tsx\",\".framework/migrations/015_simplify_apps_table.sql\",\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\"custom/apps/cortex/functions/custom_cil-embeddings.ts\",\".framework/src/pages/admin/RolesPage.tsx\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="sanitized_app_list" errors="auth_errors,db_errors" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Query apps by account with role-based filtering and data sanitization" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 0. Direct calls: 0. Related files: custom/apps/portal/pages/ContentPage.tsx, .framework/migrations/015_simplify_apps_table.sql, custom/apps/cortex/pages/operations/OperationsDashboard.tsx, custom/apps/cortex/functions/custom_cil-embeddings.ts, .framework/src/pages/admin/RolesPage.tsx, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const list = createHandler(async (ctx, body) => {
   const { include_system, include_inactive, account_id } = ctx.query || {}
 
@@ -59,12 +81,12 @@ export const list = createHandler(async (ctx, body) => {
     throw new Error('Account context required')
   }
 
-  // Pass user roles to the RPC so filtering happens server-side.
-  // system_admin bypasses all role checks in the RPC.
+  const db = isSystemAdmin(ctx.principal) ? adminDb : ctx.db
+
   const userRoles = ctx.principal?.roles || []
   const isSysAdmin = userRoles.includes('system_admin')
 
-  const { data, error: err } = await ctx.db
+  const { data, error: err } = await db
     .rpc('get_account_apps', {
       account_id: targetAccountId,
       include_system: include_system !== 'false',
@@ -75,7 +97,7 @@ export const list = createHandler(async (ctx, body) => {
 
   if (err) throw err
 
-  // Sanitize each record based on role permissions
+  
   const sanitized = []
   for (const app of data || []) {
     sanitized.push(await sanitizeRecordData(ctx, app, 'app'))
@@ -83,23 +105,21 @@ export const list = createHandler(async (ctx, body) => {
 
   return sanitized
 })
-// ─── CHUNK_END: APPS_LIST ────────────────────────────────────────────────
-
-// ─── CHUNK_START: APPS_GET ──────────────────────────────────────────────
-/**
- * @chunk-id    APPS_GET_1_0_0
- * @version     1.0.0
- * @hash        5449bb3ac8726775412df541e1f2abf2400fb18751e3c9aad5f0aafb09cc7f60
- * @macro       App Get Handler
- * @micro       Returns single app by ID or slug with owner account join
- * @inputs      ctx: CoreContext — Request context with principal and database
- * @inputs      body: any — Request body (unused for GET)
- * @outputs     Sanitized app record with ownerAccount join
- * @depends-on  [createHandler, joins, sanitizeRecordData]
- * @depended-by [Netlify function routing]
- * @side-effects [DB single row query, permission sanitization]
- * @tags        apps, get, crud, single-record
- */
+// CIL[END chunk_id="apps_list_1783969696"]
+// CIL[BEGIN chunk_id="apps_get_1783969696" type="function" identity="get" parent="none"]
+// CIL[DOC-MACRO purpose="Get single app by ID or slug"]
+// CIL[DOC-RESPONSIBILITY responsibility="Retrieve individual app record with owner details"]
+// CIL[DOC-CONTEXT module="apps" layer="backend_functions" related_files="[\".framework/functions/_shared/schema-utils.ts\",\".framework/migrations/015_simplify_apps_table.sql\",\"custom/apps/portal/pages/ContentPage.tsx\",\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\".framework/src/pages/admin/TypeDetailPage.tsx\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="sanitized_app" errors="not_found,db_errors" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Query app by ID or slug and sanitize data for response" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.96" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 0. Direct calls: 0. Related files: .framework/functions/_shared/schema-utils.ts, .framework/migrations/015_simplify_apps_table.sql, custom/apps/portal/pages/ContentPage.tsx, custom/apps/cortex/pages/operations/OperationsDashboard.tsx, .framework/src/pages/admin/TypeDetailPage.tsx, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const get = createHandler(async (ctx, body) => {
   const { id, slug } = ctx.query || {}
   
@@ -107,9 +127,11 @@ export const get = createHandler(async (ctx, body) => {
     throw new Error('App ID or slug is required')
   }
 
-  let query = ctx.db
+  const db = isSystemAdmin(ctx.principal) ? adminDb : ctx.db
+
+  let query = db
     .from('apps')
-    .select(`*, ${joins.ownerAccount}`)
+    .select('*')
     .eq('is_active', true)
 
   if (id) {
@@ -122,26 +144,24 @@ export const get = createHandler(async (ctx, body) => {
 
   if (err) throw err
 
-  // Sanitize based on role permissions
+  
   return await sanitizeRecordData(ctx, data, 'app')
 })
-// ─── CHUNK_END: APPS_GET ────────────────────────────────────────────────
-
-// ─── CHUNK_START: APPS_GET_SCHEMA ──────────────────────────────────────────────
-/**
- * @chunk-id    APPS_GET_SCHEMA_1_0_0
- * @version     1.0.0
- * @hash        8b6b7bb419114cbb699ad841dc4ba760ff36a626e8a9513de24715229e5a064b
- * @macro       App Schema Handler
- * @micro       Returns full app schema via RPC with types, roles, views, integrations
- * @inputs      ctx: CoreContext — Request context with principal and database
- * @inputs      body: any — Request body (unused for GET)
- * @outputs     App schema object with complete configuration
- * @depends-on  [createHandler]
- * @depended-by [Netlify function routing]
- * @side-effects [RPC call for schema retrieval]
- * @tags        apps, schema, rpc, configuration
- */
+// CIL[END chunk_id="apps_get_1783969696"]
+// CIL[BEGIN chunk_id="apps_getschema_1783969696" type="function" identity="getSchema" parent="none"]
+// CIL[DOC-MACRO purpose="Get app schema configuration"]
+// CIL[DOC-RESPONSIBILITY responsibility="Retrieve schema definition for specific app"]
+// CIL[DOC-CONTEXT module="apps" layer="backend_functions" related_files="[\".framework/migrations/015_simplify_apps_table.sql\",\".framework/functions/_shared/schema-utils.ts\",\".framework/src/pages/admin/RolesPage.tsx\",\"custom/apps/portal/pages/ContentPage.tsx\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="app_schema" errors="not_found,db_errors" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Call stored procedure to get app schema by slug" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="rpc_behavior_not_mapped"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 1. Direct calls: 0. Related files: .framework/migrations/015_simplify_apps_table.sql, .framework/functions/_shared/schema-utils.ts, .framework/src/pages/admin/RolesPage.tsx, custom/apps/portal/pages/ContentPage.tsx, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 1. Total affected: 1."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const getSchema = createHandler(async (ctx, body) => {
   const { slug } = ctx.query || {}
 
@@ -156,23 +176,21 @@ export const getSchema = createHandler(async (ctx, body) => {
 
   return data
 })
-// ─── CHUNK_END: APPS_GET_SCHEMA ────────────────────────────────────────────────
-
-// ─── CHUNK_START: APPS_CREATE ──────────────────────────────────────────────
-/**
- * @chunk-id    APPS_CREATE_1_0_0
- * @version     1.0.0
- * @hash        f440efbf4a020b2d0d21ed7d90c5995538dd76d631f1b16fc53c1f2e9a1e4f91
- * @macro       App Create Handler
- * @micro       Creates new app with permission validation and audit logging
- * @inputs      ctx: CoreContext — Request context with principal and database
- * @inputs      body: object — App configuration data including slug and name
- * @outputs     Inserted app record
- * @depends-on  [createHandler, permissions, emitLog]
- * @depended-by [Netlify function routing]
- * @side-effects [DB insert, permission checks, audit logging]
- * @tags        apps, create, crud, permissions, audit
- */
+// CIL[END chunk_id="apps_getschema_1783969696"]
+// CIL[BEGIN chunk_id="apps_create_1783969696" type="function" identity="create" parent="none"]
+// CIL[DOC-MACRO purpose="Create new app with validation"]
+// CIL[DOC-RESPONSIBILITY responsibility="Create app record with permissions and audit logging"]
+// CIL[DOC-CONTEXT module="apps" layer="backend_functions" related_files="[]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="created_app" errors="validation_errors,permission_errors" side_effects="db_write,audit_log"]
+// CIL[DOC-MICRO logic_summary="Validate permissions, check slug uniqueness, create app, log event" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 0. Direct calls: 0. Related files: none."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const create = createHandler(async (ctx, body) => {
   const { slug, name, description, icon, color, version, app_type, source, owner_account_id, config, nav_items, min_role, integration_deps, metadata, route_prefix, renderer } = body
 
@@ -184,7 +202,7 @@ export const create = createHandler(async (ctx, body) => {
     throw new Error('User context (person and account) required')
   }
 
-  // Check create permissions
+  
   if (!permissions.isSystemAdmin(ctx)) {
     const perms = await permissions.resolveFirstSurfacePermissions(
       ctx.principal.id,
@@ -198,7 +216,7 @@ export const create = createHandler(async (ctx, body) => {
     }
   }
 
-  // Check if slug is unique
+  
   const { data: existing } = await ctx.db
     .from('apps')
     .select('id')
@@ -240,23 +258,21 @@ export const create = createHandler(async (ctx, body) => {
 
   return data
 })
-// ─── CHUNK_END: APPS_CREATE ────────────────────────────────────────────────
-
-// ─── CHUNK_START: APPS_UPDATE ──────────────────────────────────────────────
-/**
- * @chunk-id    APPS_UPDATE_1_0_0
- * @version     1.0.0
- * @hash        77029f18737fee801ff5ebdde199d6b52454fd9fe3842694b072181fc713b937
- * @macro       App Update Handler
- * @micro       Updates app with field-level permission validation and audit logging
- * @inputs      ctx: CoreContext — Request context with principal and database
- * @inputs      body: object — App updates including id
- * @outputs     Updated app record
- * @depends-on  [createHandler, permissions, emitLog]
- * @depended-by [Netlify function routing]
- * @side-effects [DB update, permission validation, audit logging]
- * @tags        apps, update, crud, permissions, audit
- */
+// CIL[END chunk_id="apps_create_1783969696"]
+// CIL[BEGIN chunk_id="apps_update_1783969696" type="function" identity="update" parent="none"]
+// CIL[DOC-MACRO purpose="Update existing app with permissions"]
+// CIL[DOC-RESPONSIBILITY responsibility="Update app record with field-level permission validation"]
+// CIL[DOC-CONTEXT module="apps" layer="backend_functions" related_files="[]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="updated_app" errors="not_found,permission_errors" side_effects="db_write,audit_log"]
+// CIL[DOC-MICRO logic_summary="Validate update permissions, apply changes, log modification" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 0. Direct calls: 0. Related files: none."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const update = createHandler(async (ctx, body) => {
   const id = body?.id || ctx.query?.id
   const { id: _bodyId, ...updates } = body || {}
@@ -269,7 +285,7 @@ export const update = createHandler(async (ctx, body) => {
     throw new Error('User context (person and account) required')
   }
 
-  // Get current state for audit - RLS will filter to accessible apps
+  
   const { data: current } = await ctx.db
     .from('apps')
     .select('*')
@@ -280,7 +296,7 @@ export const update = createHandler(async (ctx, body) => {
     throw new Error('App not found')
   }
 
-  // Validate field-level permissions
+  
   const fieldValidation = await permissions.validateUpdatePermissions(
     ctx,
     updates,
@@ -308,23 +324,21 @@ export const update = createHandler(async (ctx, body) => {
 
   return data
 })
-// ─── CHUNK_END: APPS_UPDATE ────────────────────────────────────────────────
-
-// ─── CHUNK_START: APPS_REMOVE ──────────────────────────────────────────────
-/**
- * @chunk-id    APPS_REMOVE_1_0_0
- * @version     1.0.0
- * @hash        b2c79779820861406f1adabc2279e332727b936abab4c6f5e5762a62d1373169
- * @macro       App Remove Handler
- * @micro       Soft-deletes app with validation and audit logging
- * @inputs      ctx: CoreContext — Request context with principal and database
- * @inputs      body: any — Request body with app ID
- * @outputs     Updated app record with is_active: false
- * @depends-on  [createHandler, emitLog]
- * @depended-by [Netlify function routing]
- * @side-effects [DB soft delete, audit logging]
- * @tags        apps, remove, crud, audit
- */
+// CIL[END chunk_id="apps_update_1783969696"]
+// CIL[BEGIN chunk_id="apps_remove_1783969696" type="function" identity="remove" parent="none"]
+// CIL[DOC-MACRO purpose="Soft delete app by deactivating"]
+// CIL[DOC-RESPONSIBILITY responsibility="Deactivate app record with audit logging"]
+// CIL[DOC-CONTEXT module="apps" layer="backend_functions" related_files="[]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="deactivated_app" errors="not_found,auth_errors" side_effects="db_write,audit_log"]
+// CIL[DOC-MICRO logic_summary="Set is_active=false instead of hard delete, log removal" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.96" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 0. Direct calls: 0. Related files: none."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const remove = createHandler(async (ctx, body) => {
   const id = body?.id || ctx.query?.id
 
@@ -336,7 +350,7 @@ export const remove = createHandler(async (ctx, body) => {
     throw new Error('User context (person and account) required')
   }
 
-  // Get current state for audit - RLS will filter to accessible apps
+  
   const { data: current } = await ctx.db
     .from('apps')
     .select('*')
@@ -363,23 +377,21 @@ export const remove = createHandler(async (ctx, body) => {
 
   return data
 })
-// ─── CHUNK_END: APPS_REMOVE ────────────────────────────────────────────────
-
-// ─── CHUNK_START: APPS_CHECK_AVAILABILITY ──────────────────────────────────────────────
-/**
- * @chunk-id    APPS_CHECK_AVAILABILITY_1_0_0
- * @version     1.0.0
- * @hash        db7d52bcb1002d923dac039a99e6f6fb0eb9889e9b4a44994bf7bb75477ac9a4
- * @macro       App Availability Checker
- * @micro       Checks if app is available for account via RPC
- * @inputs      ctx: CoreContext — Request context with principal and database
- * @inputs      body: any — Request body (unused for GET)
- * @outputs     {available: boolean} — Availability status
- * @depends-on  [createHandler]
- * @depended-by [Netlify function routing]
- * @side-effects [RPC call for availability check]
- * @tags        apps, availability, rpc, check
- */
+// CIL[END chunk_id="apps_remove_1783969696"]
+// CIL[BEGIN chunk_id="apps_checkavailability_1783969696" type="function" identity="checkAvailability" parent="none"]
+// CIL[DOC-MACRO purpose="Check if app slug is available"]
+// CIL[DOC-RESPONSIBILITY responsibility="Validate app slug uniqueness for account"]
+// CIL[DOC-CONTEXT module="apps" layer="backend_functions" related_files="[]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="availability_boolean" errors="validation_errors,db_errors" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Call stored procedure to check slug availability in account" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="rpc_behavior_not_mapped"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 0. Direct calls: 0. Related files: none."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const checkAvailability = createHandler(async (ctx, body) => {
   const { slug } = ctx.query || {}
 
@@ -401,23 +413,21 @@ export const checkAvailability = createHandler(async (ctx, body) => {
 
   return { available: data }
 })
-// ─── CHUNK_END: APPS_CHECK_AVAILABILITY ────────────────────────────────────────────────
-
-// ─── CHUNK_START: APPS_UPDATE_VERSION ──────────────────────────────────────────────
-/**
- * @chunk-id    APPS_UPDATE_VERSION_1_0_0
- * @version     1.0.0
- * @hash        04a1a3367e4b8ca0f58e0719e73b0ccda378e84b4b874f3f7e07ee0faa423bfd
- * @macro       App Version Update Handler
- * @micro       Updates app version string via RPC with audit logging
- * @inputs      ctx: CoreContext — Request context with principal and database
- * @inputs      body: object — App ID and new version string
- * @outputs     {success: true} — Success confirmation
- * @depends-on  [createHandler, emitLog]
- * @depended-by [Netlify function routing]
- * @side-effects [RPC call, audit logging]
- * @tags        apps, version, update, rpc, audit
- */
+// CIL[END chunk_id="apps_checkavailability_1783969696"]
+// CIL[BEGIN chunk_id="apps_updateversion_1783969696" type="function" identity="updateVersion" parent="none"]
+// CIL[DOC-MACRO purpose="Update app version number"]
+// CIL[DOC-RESPONSIBILITY responsibility="Change app version with audit logging"]
+// CIL[DOC-CONTEXT module="apps" layer="backend_functions" related_files="[]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="success_status" errors="validation_errors,db_errors" side_effects="db_write,audit_log"]
+// CIL[DOC-MICRO logic_summary="Call stored procedure to update version, log change" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="rpc_behavior_not_mapped"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 0. Direct calls: 0. Related files: none."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const updateVersion = createHandler(async (ctx, body) => {
   const { id, version } = body
 
@@ -437,25 +447,21 @@ export const updateVersion = createHandler(async (ctx, body) => {
 
   return { success: true }
 })
-// ─── CHUNK_END: APPS_UPDATE_VERSION ────────────────────────────────────────────────
-
-// ─── MAIN HANDLER ────────────────────────────────────────────────────────────
-
-// ─── CHUNK_START: APPS_HANDLER ──────────────────────────────────────────────
-/**
- * @chunk-id    APPS_HANDLER_1_0_0
- * @version     1.0.0
- * @hash        361e1ba86b38a4611f3170526e4ff7f456d58b929c1d39bf847135afdebf3867
- * @macro       Apps Router
- * @micro       Routes HTTP methods and actions to appropriate handlers
- * @inputs      ctx: CoreContext — Request context with principal and database
- * @inputs      body: any — Request body for POST/PATCH operations
- * @outputs     Varies — Depends on routed handler (list/get/create/update/remove/schema/available/version)
- * @depends-on  [createHandler, list, get, getSchema, checkAvailability, create, update, remove, updateVersion]
- * @depended-by [Netlify function routing]
- * @side-effects [Delegates to appropriate handler]
- * @tags        apps, router, crud, netlify-function
- */
+// CIL[END chunk_id="apps_updateversion_1783969696"]
+// CIL[BEGIN chunk_id="apps_handler_1783969696" type="function" identity="handler" parent="none"]
+// CIL[DOC-MACRO purpose="Route HTTP methods to app functions"]
+// CIL[DOC-RESPONSIBILITY responsibility="Dispatch requests to appropriate app operations"]
+// CIL[DOC-CONTEXT module="apps" layer="backend_functions" related_files="[]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="function_responses" errors="method_errors" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Route based on HTTP method and query parameters to specific functions" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.97" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 0. Direct calls: 0. Related files: none."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const handler = createHandler(async (ctx, body) => {
   const method = ctx.query?.method || 'GET'
 
@@ -486,4 +492,4 @@ export const handler = createHandler(async (ctx, body) => {
       throw new Error(`Unsupported method: ${method}`)
   }
 })
-// ─── CHUNK_END: APPS_HANDLER ────────────────────────────────────────────────
+// CIL[END chunk_id="apps_handler_1783969696"]