spine-framework 0.3.124 → 0.3.126

package/.framework/functions/cil-validate.ts

@@ -0,0 +1,469 @@
+// CIL[BEGIN chunk_id="custom_apps_cortex_functions_custom_cil_validate_module_header_1784235266" type="module_header" identity="module_header" parent="none"]
+// CIL[DOC-MACRO purpose="Module header and top-level exports for cortex.functions.custom_cil-validate"]
+// CIL[DOC-RESPONSIBILITY responsibility="Own module-level imports, exports, and configuration for cortex.functions.custom_cil-validate"]
+// CIL[DOC-CONTEXT module="cortex.functions.custom_cil-validate" layer="function" related_files="[\".framework/migrations/015_simplify_apps_table.sql\",\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\"custom/apps/portal/pages/ContentPage.tsx\",\".framework/src/components/ui/table-primitives.tsx\",\".framework/src/pages/admin/TypeDetailPage.tsx\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="module exports and side effects" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Declares module scope, imports dependencies, and exports public surface of cortex.functions.custom_cil-validate" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-AUDIENCE audience="developer"]
+// CIL[DOC-VECTOR type="context" content="Layer: function. Direct callers: 0. Direct calls: 0. Related files: .framework/migrations/015_simplify_apps_table.sql, custom/apps/cortex/pages/operations/OperationsDashboard.tsx, custom/apps/portal/pages/ContentPage.tsx, .framework/src/components/ui/table-primitives.tsx, .framework/src/pages/admin/TypeDetailPage.tsx, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+
+
+import { createHandler } from './_shared/middleware'
+import { adminDb } from './_shared/db'
+import * as crypto from 'crypto'
+import * as fs from 'fs'
+import * as path from 'path'
+
+
+
+
+
+
+
+// CIL[END chunk_id="custom_apps_cortex_functions_custom_cil_validate_module_header_1784235266"]
+// CIL[BEGIN chunk_id="custom_apps_cortex_functions_custom_cil_validate_chunktovalidate_1784235266" type="interface" identity="chunktovalidate" parent="none"]
+// CIL[DOC-MACRO purpose="Defines the chunktovalidate type contract in cortex.functions.custom_cil-validate"]
+// CIL[DOC-RESPONSIBILITY responsibility="Describe the shape and allowed fields for chunktovalidate"]
+// CIL[DOC-CONTEXT module="cortex.functions.custom_cil-validate" layer="function" related_files="[\".framework/src/pages/admin/TypeDetailPage.tsx\",\".framework/functions/_shared/principal.ts\",\".framework/src/pages/admin/IntegrationsPage.tsx\",\".framework/migrations/015_simplify_apps_table.sql\",\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="type definition for chunktovalidate" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Declares TypeScript type/interface chunktovalidate with member definitions" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: function. Direct callers: 0. Direct calls: 0. Related files: .framework/src/pages/admin/TypeDetailPage.tsx, .framework/functions/_shared/principal.ts, .framework/src/pages/admin/IntegrationsPage.tsx, .framework/migrations/015_simplify_apps_table.sql, custom/apps/cortex/pages/operations/OperationsDashboard.tsx, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+interface ChunkToValidate {
+  chunk_id: string   
+  chunk_name: string
+  content: string    
+}
+
+
+
+
+
+// CIL[END chunk_id="custom_apps_cortex_functions_custom_cil_validate_chunktovalidate_1784235266"]
+// CIL[BEGIN chunk_id="custom_apps_cortex_functions_custom_cil_validate_validationresult_1784235266" type="interface" identity="validationresult" parent="none"]
+// CIL[DOC-MACRO purpose="Defines the validationresult type contract in cortex.functions.custom_cil-validate"]
+// CIL[DOC-RESPONSIBILITY responsibility="Describe the shape and allowed fields for validationresult"]
+// CIL[DOC-CONTEXT module="cortex.functions.custom_cil-validate" layer="function" related_files="[\".framework/src/pages/admin/TypeDetailPage.tsx\",\".framework/functions/_shared/principal.ts\",\".framework/src/pages/admin/IntegrationsPage.tsx\",\".framework/migrations/015_simplify_apps_table.sql\",\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="type definition for validationresult" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Declares TypeScript type/interface validationresult with member definitions" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: function. Direct callers: 0. Direct calls: 0. Related files: .framework/src/pages/admin/TypeDetailPage.tsx, .framework/functions/_shared/principal.ts, .framework/src/pages/admin/IntegrationsPage.tsx, .framework/migrations/015_simplify_apps_table.sql, custom/apps/cortex/pages/operations/OperationsDashboard.tsx, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+interface ValidationResult {
+  chunk_id: string
+  chunk_name: string
+  status: 'current' | 'drift_detected' | 'not_found'
+  stored_hash: string | null
+  validation_hash: string
+  message: string
+}
+
+
+
+
+
+// CIL[END chunk_id="custom_apps_cortex_functions_custom_cil_validate_validationresult_1784235266"]
+// CIL[BEGIN chunk_id="custom_apps_cortex_functions_custom_cil_validate_validaterequest_1784235266" type="interface" identity="validaterequest" parent="none"]
+// CIL[DOC-MACRO purpose="Defines the validaterequest type contract in cortex.functions.custom_cil-validate"]
+// CIL[DOC-RESPONSIBILITY responsibility="Describe the shape and allowed fields for validaterequest"]
+// CIL[DOC-CONTEXT module="cortex.functions.custom_cil-validate" layer="function" related_files="[\".framework/src/pages/admin/TypeDetailPage.tsx\",\".framework/functions/_shared/principal.ts\",\".framework/src/pages/admin/IntegrationsPage.tsx\",\".framework/migrations/015_simplify_apps_table.sql\",\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="type definition for validaterequest" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Declares TypeScript type/interface validaterequest with member definitions" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: function. Direct callers: 0. Direct calls: 0. Related files: .framework/src/pages/admin/TypeDetailPage.tsx, .framework/functions/_shared/principal.ts, .framework/src/pages/admin/IntegrationsPage.tsx, .framework/migrations/015_simplify_apps_table.sql, custom/apps/cortex/pages/operations/OperationsDashboard.tsx, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+interface ValidateRequest {
+  file_path?: string
+  chunks: ChunkToValidate[]
+}
+
+
+
+
+
+// CIL[END chunk_id="custom_apps_cortex_functions_custom_cil_validate_validaterequest_1784235266"]
+// CIL[BEGIN chunk_id="custom_apps_cortex_functions_custom_cil_validate_updatehashrequest_1784235266" type="interface" identity="updatehashrequest" parent="none"]
+// CIL[DOC-MACRO purpose="Defines the updatehashrequest type contract in cortex.functions.custom_cil-validate"]
+// CIL[DOC-RESPONSIBILITY responsibility="Describe the shape and allowed fields for updatehashrequest"]
+// CIL[DOC-CONTEXT module="cortex.functions.custom_cil-validate" layer="function" related_files="[\".framework/src/pages/admin/TypeDetailPage.tsx\",\".framework/functions/_shared/principal.ts\",\".framework/src/pages/admin/IntegrationsPage.tsx\",\".framework/migrations/015_simplify_apps_table.sql\",\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="type definition for updatehashrequest" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Declares TypeScript type/interface updatehashrequest with member definitions" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: function. Direct callers: 0. Direct calls: 0. Related files: .framework/src/pages/admin/TypeDetailPage.tsx, .framework/functions/_shared/principal.ts, .framework/src/pages/admin/IntegrationsPage.tsx, .framework/migrations/015_simplify_apps_table.sql, custom/apps/cortex/pages/operations/OperationsDashboard.tsx, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+interface UpdateHashRequest {
+  chunk_id: string
+  content: string
+}
+
+
+
+
+
+
+
+
+// CIL[END chunk_id="custom_apps_cortex_functions_custom_cil_validate_updatehashrequest_1784235266"]
+// CIL[BEGIN chunk_id="custom_apps_cortex_functions_custom_cil_validate_normalisecontent_1784235266" type="function" identity="normalisecontent" parent="none"]
+// CIL[DOC-MACRO purpose="Implements normalisecontent logic in cortex.functions.custom_cil-validate"]
+// CIL[DOC-RESPONSIBILITY responsibility="Execute normalisecontent and return its computed result"]
+// CIL[DOC-CONTEXT module="cortex.functions.custom_cil-validate" layer="function" related_files="[]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="return value from function execution" errors="throws on invalid input or runtime failure" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Provides normalisecontent with normaliseContent(raw: string inputs, handling internal flow and returning a result" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: function. Direct callers: 0. Direct calls: 0. Related files: none."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+function normaliseContent(raw: string): string {
+  const lines = raw.replace(/\r\n/g, '\n').split('\n')
+  const filtered = lines.filter(line => {
+    const trimmed = line.trim()
+    
+    return !trimmed.match(/^\/\/\s*[─\-]+\s*CHUNK_(START|END):/) &&
+           !trimmed.match(/^\/\*\*?\s*CHUNK_(START|END):.+\*\//)
+  })
+  
+  const collapsed: string[] = []
+  let lastBlank = false
+  for (const line of filtered) {
+    const isBlank = line.trim() === ''
+    if (isBlank && lastBlank) continue
+    collapsed.push(line)
+    lastBlank = isBlank
+  }
+  return collapsed.join('\n').trim()
+}
+
+
+
+
+
+// CIL[END chunk_id="custom_apps_cortex_functions_custom_cil_validate_normalisecontent_1784235266"]
+// CIL[BEGIN chunk_id="custom_apps_cortex_functions_custom_cil_validate_computehash_1784235266" type="function" identity="computehash" parent="none"]
+// CIL[DOC-MACRO purpose="Implements computehash logic in cortex.functions.custom_cil-validate"]
+// CIL[DOC-RESPONSIBILITY responsibility="Execute computehash and return its computed result"]
+// CIL[DOC-CONTEXT module="cortex.functions.custom_cil-validate" layer="function" related_files="[]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="return value from function execution" errors="throws on invalid input or runtime failure" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Provides computehash with computeHash(content: string inputs, handling internal flow and returning a result" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: function. Direct callers: 0. Direct calls: 0. Related files: none."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+function computeHash(content: string): string {
+  return crypto.createHash('sha256').update(normaliseContent(content)).digest('hex').slice(0, 16)
+}
+
+
+
+
+
+
+
+// CIL[END chunk_id="custom_apps_cortex_functions_custom_cil_validate_computehash_1784235266"]
+// CIL[BEGIN chunk_id="custom_apps_cortex_functions_custom_cil_validate_handler_1784235266" type="variable" identity="handler" parent="none"]
+// CIL[DOC-MACRO purpose="Defines handler configuration or state in cortex.functions.custom_cil-validate"]
+// CIL[DOC-RESPONSIBILITY responsibility="Hold the value and default configuration for handler"]
+// CIL[DOC-CONTEXT module="cortex.functions.custom_cil-validate" layer="function" related_files="[]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="value of handler" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Declares handler with initial value or constant binding used by cortex.functions.custom_cil-validate" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: function. Direct callers: 0. Direct calls: 0. Related files: none."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+export const handler = createHandler(async (ctx, body) => {
+  const action = ctx.query?.action
+
+  
+  if (action === 'validate' || !action) {
+    const req = body as ValidateRequest
+    if (!req?.chunks || !Array.isArray(req.chunks)) {
+      throw new Error('chunks array is required')
+    }
+
+    const results: ValidationResult[] = []
+
+    for (const chunk of req.chunks) {
+      const validationHash = computeHash(chunk.content)
+
+      
+      const { data: item, error } = await adminDb
+        .from('items')
+        .select('id, data')
+        .eq('id', chunk.chunk_id)
+        .maybeSingle()
+
+      if (error || !item) {
+        results.push({
+          chunk_id: chunk.chunk_id,
+          chunk_name: chunk.chunk_name,
+          status: 'not_found',
+          stored_hash: null,
+          validation_hash: validationHash,
+          message: 'Chunk not found in graph — needs ingestion',
+        })
+        continue
+      }
+
+      const storedHash: string | null = item.data?.stored_hash || null
+
+      if (!storedHash) {
+        results.push({
+          chunk_id: chunk.chunk_id,
+          chunk_name: chunk.chunk_name,
+          status: 'drift_detected',
+          stored_hash: null,
+          validation_hash: validationHash,
+          message: 'No stored hash — chunk has never been hash-verified',
+        })
+        continue
+      }
+
+      const status: 'current' | 'drift_detected' =
+        storedHash === validationHash ? 'current' : 'drift_detected'
+
+      results.push({
+        chunk_id: chunk.chunk_id,
+        chunk_name: chunk.chunk_name,
+        status,
+        stored_hash: storedHash,
+        validation_hash: validationHash,
+        message: status === 'current'
+          ? 'Embedding is current — content matches stored hash'
+          : 'Content has drifted since last ingestion — re-ingest required before trusting contract',
+      })
+    }
+
+    const driftCount = results.filter(r => r.status === 'drift_detected').length
+    const currentCount = results.filter(r => r.status === 'current').length
+
+    return {
+      file_path: req.file_path || null,
+      results,
+      summary: {
+        total: results.length,
+        current: currentCount,
+        drift_detected: driftCount,
+        not_found: results.filter(r => r.status === 'not_found').length,
+        trust_rating: results.length > 0 ? Math.round((currentCount / results.length) * 100) : 0,
+      }
+    }
+  }
+
+  
+  if (action === 'update_hash') {
+    const req = body as UpdateHashRequest
+    if (!req?.chunk_id) throw new Error('chunk_id is required')
+    if (!req?.content) throw new Error('content is required')
+
+    const newHash = computeHash(req.content)
+
+    const { data: item } = await adminDb
+      .from('items')
+      .select('id, data')
+      .eq('id', req.chunk_id)
+      .maybeSingle()
+
+    if (!item) throw new Error(`Chunk not found: ${req.chunk_id}`)
+
+    const { error } = await adminDb
+      .from('items')
+      .update({
+        data: { ...item.data, stored_hash: newHash, hash_updated_at: new Date().toISOString() },
+        updated_at: new Date().toISOString(),
+      })
+      .eq('id', req.chunk_id)
+
+    if (error) throw new Error(`Failed to update hash: ${error.message}`)
+
+    return {
+      chunk_id: req.chunk_id,
+      new_hash: newHash,
+      updated_at: new Date().toISOString(),
+    }
+  }
+
+  
+  if (action === 'compute_hash') {
+    const content = body?.content
+    if (!content) throw new Error('content is required')
+    return { hash: computeHash(content) }
+  }
+
+  
+  
+  
+  
+  
+  
+  
+  if (action === 'validate_file') {
+    const fileId = ctx.query?.file_id || body?.file_id
+    const repoPathOverride: string | null = ctx.query?.repo_path || body?.repo_path || null
+
+    if (!fileId) throw new Error('file_id is required')
+
+    
+    const { data: fileItem } = await adminDb
+      .from('items')
+      .select('id, title, data')
+      .eq('id', fileId)
+      .maybeSingle()
+
+    if (!fileItem) throw new Error(`File not found: ${fileId}`)
+
+    const filePath: string = fileItem.data?.file_path || fileItem.title
+    const projectId: string = fileItem.data?.project_id
+
+    
+    let repoPath = repoPathOverride
+    if (!repoPath && projectId) {
+      const { data: project } = await adminDb
+        .from('items')
+        .select('data')
+        .eq('id', projectId)
+        .maybeSingle()
+      repoPath = project?.data?.repo_path || null
+    }
+
+    if (!repoPath) throw new Error('Could not determine repo_path. Pass repo_path in request body or ensure project has repo_path set.')
+
+    const absPath = path.join(repoPath, filePath)
+    if (!fs.existsSync(absPath)) {
+      throw new Error(`Source file not found on disk: ${absPath}`)
+    }
+
+    const content = fs.readFileSync(absPath, 'utf-8')
+    const lines = content.split('\n')
+
+    
+    const { data: chunks } = await adminDb
+      .from('items')
+      .select('id, data')
+      .filter('data->>file_id', 'eq', fileId)
+      .filter('data->>kb_type', 'eq', 'cil_chunk')
+      .eq('is_active', true)
+
+    if (!chunks?.length) {
+      return {
+        file_id: fileId,
+        file_path: filePath,
+        results: [],
+        summary: { total: 0, current: 0, drift_detected: 0, not_found: 0, trust_rating: 100 },
+      }
+    }
+
+    const results: ValidationResult[] = []
+
+    for (const chunk of chunks) {
+      const d = chunk.data || {}
+      const lineStart: number = d.line_start || 0
+      const lineEnd: number = d.line_end || 0
+      const chunkName: string = d.chunk_name || ''
+      const storedHash: string | null = d.stored_hash || null
+
+      if (!lineStart || !lineEnd) {
+        results.push({
+          chunk_id: chunk.id,
+          chunk_name: chunkName,
+          status: 'not_found',
+          stored_hash: storedHash,
+          validation_hash: '',
+          message: 'Chunk has no line_start / line_end — cannot extract from file',
+        })
+        continue
+      }
+
+      
+      const chunkLines = lines.slice(lineStart - 1, lineEnd)
+      const liveContent = chunkLines.join('\n')
+      const validationHash = computeHash(liveContent)
+
+      if (!storedHash) {
+        results.push({
+          chunk_id: chunk.id,
+          chunk_name: chunkName,
+          status: 'drift_detected',
+          stored_hash: null,
+          validation_hash: validationHash,
+          message: 'No stored hash — chunk has never been hash-verified',
+        })
+        continue
+      }
+
+      const status: 'current' | 'drift_detected' = storedHash === validationHash ? 'current' : 'drift_detected'
+      results.push({
+        chunk_id: chunk.id,
+        chunk_name: chunkName,
+        status,
+        stored_hash: storedHash,
+        validation_hash: validationHash,
+        message: status === 'current'
+          ? 'Content matches stored hash'
+          : 'Content has drifted since last ingestion — re-ingest required',
+      })
+    }
+
+    const currentCount = results.filter(r => r.status === 'current').length
+    const driftCount = results.filter(r => r.status === 'drift_detected').length
+
+    return {
+      file_id: fileId,
+      file_path: filePath,
+      repo_path: repoPath,
+      results,
+      summary: {
+        total: results.length,
+        current: currentCount,
+        drift_detected: driftCount,
+        not_found: results.filter(r => r.status === 'not_found').length,
+        trust_rating: results.length > 0 ? Math.round((currentCount / results.length) * 100) : 0,
+      },
+    }
+  }
+
+  throw new Error(`Unknown action: ${action}. Valid: validate, validate_file, update_hash, compute_hash`)
+})
+
+
+
+// CIL[END chunk_id="custom_apps_cortex_functions_custom_cil_validate_handler_1784235266"]

package/.framework/functions/debug-auth.ts

@@ -1,41 +1,48 @@
-/**
- * @module debug-auth
- * @audience core-contributor
- * @layer api-handler
- * @stability internal
- *
- * Development/diagnostic endpoint for verifying that authentication
- * middleware is resolving principals correctly. **Never expose this in
- * production without access controls.**
- *
- * **Routed by:** `GET /.netlify/functions/debug-auth`
- *
- * **Actions (via ?method):**
- * | ?method  | handler  | description                         |
- * |----------|----------|-------------------------------------|
- * | debug    | debug    | env check + principal presence      |
- * | testJwt  | testJwt  | validates JWT, returns principal ID |
- *
- * **Authorization:** None — intentionally unauthenticated so broken JWT
- * flows can be diagnosed. Reveals only presence/absence of env vars and
- * principal shape, never secret values.
- *
- * @seeAlso auth.ts (production auth context endpoint)
- * @seeAlso middleware.ts (createHandler — JWT resolution logic)
- */
 
-import { createHandler } from './_shared/middleware'
 
-// ─── HANDLERS ─────────────────────────────────────────────────────────────────
 
-/**
- * Diagnostic snapshot: confirms the middleware is running and reports
- * whether a principal was resolved plus env var presence/absence.
- *
- * @returns `{ data: { message, hasPrincipal, principalType, requestId, envVars } }`
- * @sideEffects none
- * @calledBy handler (?method=debug or default)
- */
+
+
+
+
+
+
+
+
+
+
+// CIL[BEGIN chunk_id="debug-auth_moduleheader_1783969696" type="module_header" identity="imports" parent="none"]
+// CIL[DOC-MACRO purpose="Import middleware for debug auth module"]
+// CIL[DOC-RESPONSIBILITY responsibility="Import request handler creation utility"]
+// CIL[DOC-CONTEXT module="debug-auth" layer="backend_functions" related_files="[\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\".framework/migrations/015_simplify_apps_table.sql\",\".framework/functions/_shared/principal.ts\",\".framework/src/pages/admin/TypeDetailPage.tsx\",\".framework/functions/_shared/schema-utils.ts\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="imported_modules" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Import createHandler for debug authentication functions" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-AUDIENCE audience="developer"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 0. Direct calls: 0. Related files: custom/apps/cortex/pages/operations/OperationsDashboard.tsx, .framework/migrations/015_simplify_apps_table.sql, .framework/functions/_shared/principal.ts, .framework/src/pages/admin/TypeDetailPage.tsx, .framework/functions/_shared/schema-utils.ts, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+
+import { createHandler } from './_shared/middleware'
+// CIL[END chunk_id="debug-auth_moduleheader_1783969696"]
+// CIL[BEGIN chunk_id="debug-auth_debug_1783969696" type="function" identity="debug" parent="none"]
+// CIL[DOC-MACRO purpose="Debug authentication endpoint"]
+// CIL[DOC-RESPONSIBILITY responsibility="Return auth context and environment info"]
+// CIL[DOC-CONTEXT module="debug-auth" layer="backend_functions" related_files="[\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="debug_info" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Return principal info, request ID, and environment variables status" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 1. Direct calls: 0. Related files: \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 1. Total affected: 1."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 const debug = createHandler(async (ctx, _body) => {
   const envObj = (globalThis as any).process?.env || {}
   return {
@@ -51,15 +58,21 @@ const debug = createHandler(async (ctx, _body) => {
     }
   }
 })
-
-/**
- * Validates that the provided JWT was successfully decoded by middleware.
- * Returns principal type, id, and accountId on success.
- *
- * @returns `{ data: { tokenValid, principal } }` or `{ data: null, error: string }`
- * @sideEffects none
- * @calledBy handler (?method=testJwt)
- */
+// CIL[END chunk_id="debug-auth_debug_1783969696"]
+// CIL[BEGIN chunk_id="debug-auth_testjwt_1783969696" type="function" identity="testJwt" parent="none"]
+// CIL[DOC-MACRO purpose="Test JWT token validation"]
+// CIL[DOC-RESPONSIBILITY responsibility="Validate and return JWT principal information"]
+// CIL[DOC-CONTEXT module="debug-auth" layer="backend_functions" related_files="[\".framework/functions/_shared/schema-utils.ts\",\".framework/src/pages/admin/TypeDetailPage.tsx\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="principal_info" errors="auth_errors" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Extract and return principal details from validated JWT token" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 1. Direct calls: 0. Related files: .framework/functions/_shared/schema-utils.ts, .framework/src/pages/admin/TypeDetailPage.tsx, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 1. Total affected: 1."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 const testJwt = createHandler(async (ctx, _body) => {
   const envObj = (globalThis as any).process?.env || {}
   if (!ctx.principal) {
@@ -80,15 +93,21 @@ const testJwt = createHandler(async (ctx, _body) => {
     }
   }
 })
-
-// ─── MAIN HANDLER ────────────────────────────────────────────────────────────
-
-/**
- * Netlify function entry point. Routes by ?method (debug | testJwt),
- * defaulting to debug. Note: uses raw Netlify event/context signature
- * rather than `createHandler` wrapper to allow unauthenticated access.
- * @calledBy Netlify function routing (GET)
- */
+// CIL[END chunk_id="debug-auth_testjwt_1783969696"]
+// CIL[BEGIN chunk_id="debug-auth_handler_1783969696" type="function" identity="handler" parent="none"]
+// CIL[DOC-MACRO purpose="Route debug auth HTTP methods"]
+// CIL[DOC-RESPONSIBILITY responsibility="Dispatch requests to debug authentication operations"]
+// CIL[DOC-CONTEXT module="debug-auth" layer="backend_functions" related_files="[\".framework/functions/_shared/principal.ts\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="function_responses" errors="method_errors" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Route method parameter to debug or testJwt functions" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 0. Direct calls: 0. Related files: .framework/functions/_shared/principal.ts, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export async function handler(event: any, context: any) {
   const method = event.queryStringParameters?.method || 'debug'
   
@@ -105,3 +124,4 @@ export async function handler(event: any, context: any) {
   
   return ctx
 }
+// CIL[END chunk_id="debug-auth_handler_1783969696"]