spine-framework 0.3.144 → 0.4.0

package/.framework/src/lib/registration.ts

@@ -0,0 +1,181 @@
+// CIL[BEGIN stable_id="~/.framework/src/lib/registration.ts:module_header:module_header" type="module_header" identity="module_header" parent="~/.framework/src/lib/registration.ts"]
+// CIL[DOC-MACRO purpose="Client helpers for resumable registration completion"]
+// CIL[DOC-RESPONSIBILITY responsibility="Persist non-secret pending registration intent in sessionStorage and finalize registration through the authenticated invites API"]
+// CIL[DOC-CONTEXT module="framework-api" layer="lib" related_files=".framework/src/lib/api.ts,.framework/src/pages/auth/RegisterPage.tsx,.framework/src/pages/auth/AuthConfirmPage.tsx"]
+// CIL[DOC-CONTRACT inputs="module imports" outputs="pending-intent storage helpers, RegistrationError, finalizeRegistration" errors="none" side_effects="reads/writes sessionStorage"]
+// CIL[DOC-MICRO logic_summary="Exports spine.pending_registration sessionStorage helpers plus finalizeRegistration, which POSTs {app, path, account_name} to invites?action=complete-registration via apiFetch (Bearer session) and returns the server-truth {status, account_slug, role_slug}" notable_decisions="Never stores password or invite token; invite claim happens in the auth.users trigger at signUp, so invite intent only needs {invite:true}"]
+// CIL[DOC-CONFIDENCE pass="first" score="0.85" flags="none"]
+// CIL[DOC-STABILITY stability="experimental"]
+// CIL[DOC-AUDIENCE audience="framework developers"]
+// CIL[DOC-NOTE type="contract" content="complete-registration is authenticated server-side (createHandler rejects anonymous). Email/role/account target are resolved from ctx.principal + installed app config — the client sends only app, path, account_name."]
+
+import { apiFetch } from './api'
+// CIL[END stable_id="~/.framework/src/lib/registration.ts:module_header:module_header"]
+
+// CIL[BEGIN stable_id="~/.framework/src/lib/registration.ts:pendingregistrationintent:interface" type="interface" identity="PendingRegistrationIntent" parent="~/.framework/src/lib/registration.ts"]
+// CIL[DOC-MACRO purpose="Describe the resumable registration intent persisted across email confirmation"]
+// CIL[DOC-RESPONSIBILITY responsibility="Type for the non-secret pending registration payload stored in sessionStorage"]
+// CIL[DOC-CONTEXT module="framework-api" layer="lib" related_files=".framework/src/lib/registration.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="PendingRegistrationIntent object" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="{app, path, account_name, invite} — no password, email, or invite token" notable_decisions="path is optional because invite intents ({invite:true}) need no server call"]
+// CIL[DOC-CONFIDENCE pass="first" score="0.85" flags="none"]
+// CIL[DOC-STABILITY stability="experimental"]
+export interface PendingRegistrationIntent {
+  app?: string
+  path?: 'new_account' | 'existing_account' | 'join_request'
+  account_name?: string
+  invite?: boolean
+}
+// CIL[END stable_id="~/.framework/src/lib/registration.ts:pendingregistrationintent:interface"]
+
+// CIL[BEGIN stable_id="~/.framework/src/lib/registration.ts:pending_registration_key:constant" type="constant" identity="PENDING_REGISTRATION_KEY" parent="~/.framework/src/lib/registration.ts"]
+// CIL[DOC-MACRO purpose="sessionStorage key for the pending registration intent"]
+// CIL[DOC-RESPONSIBILITY responsibility="Single source for the 'spine.pending_registration' storage key"]
+// CIL[DOC-CONTEXT module="framework-api" layer="lib" related_files=".framework/src/lib/registration.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="string constant" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Constant string 'spine.pending_registration'" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="first" score="0.85" flags="none"]
+// CIL[DOC-STABILITY stability="experimental"]
+export const PENDING_REGISTRATION_KEY = 'spine.pending_registration'
+// CIL[END stable_id="~/.framework/src/lib/registration.ts:pending_registration_key:constant"]
+
+// CIL[BEGIN stable_id="~/.framework/src/lib/registration.ts:registrationerror:class" type="class" identity="RegistrationError" parent="~/.framework/src/lib/registration.ts"]
+// CIL[DOC-MACRO purpose="Error type distinguishing definitive server rejections from transient network failures"]
+// CIL[DOC-RESPONSIBILITY responsibility="Carry a serverResponded flag so callers know whether a stored intent should be cleared (definitive) or kept for retry (transient)"]
+// CIL[DOC-CONTEXT module="framework-api" layer="lib" related_files=".framework/src/lib/registration.ts"]
+// CIL[DOC-CONTRACT inputs="message, serverResponded" outputs="Error subclass" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Extends Error with a serverResponded boolean" notable_decisions="serverResponded=true whenever the invites API returned a response (error body or non-OK status); false only for fetch-level/network failures"]
+// CIL[DOC-CONFIDENCE pass="first" score="0.85" flags="none"]
+// CIL[DOC-STABILITY stability="experimental"]
+export class RegistrationError extends Error {
+  serverResponded: boolean
+  constructor(message: string, serverResponded: boolean) {
+    super(message)
+    this.name = 'RegistrationError'
+    this.serverResponded = serverResponded
+  }
+}
+// CIL[END stable_id="~/.framework/src/lib/registration.ts:registrationerror:class"]
+
+// CIL[BEGIN stable_id="~/.framework/src/lib/registration.ts:savependingregistration:function" type="function" identity="savePendingRegistration" parent="~/.framework/src/lib/registration.ts"]
+// CIL[DOC-MACRO purpose="Persist the pending registration intent so a confirmation round-trip can resume it"]
+// CIL[DOC-RESPONSIBILITY responsibility="Write the intent JSON to sessionStorage under spine.pending_registration"]
+// CIL[DOC-CONTEXT module="framework-api" layer="lib" related_files=".framework/src/lib/registration.ts"]
+// CIL[DOC-CONTRACT inputs="intent: PendingRegistrationIntent" outputs="void" errors="storage exceptions swallowed" side_effects="sessionStorage write"]
+// CIL[DOC-MICRO logic_summary="JSON.stringify intent into sessionStorage, swallowing storage errors" notable_decisions="Must be called BEFORE complete-registration so a lost response can still resume"]
+// CIL[DOC-CONFIDENCE pass="first" score="0.85" flags="none"]
+// CIL[DOC-STABILITY stability="experimental"]
+export function savePendingRegistration(intent: PendingRegistrationIntent): void {
+  try {
+    sessionStorage.setItem(PENDING_REGISTRATION_KEY, JSON.stringify(intent))
+  } catch {
+    // sessionStorage may be unavailable (private mode, SSR); resume simply won't fire
+  }
+}
+// CIL[END stable_id="~/.framework/src/lib/registration.ts:savependingregistration:function"]
+
+// CIL[BEGIN stable_id="~/.framework/src/lib/registration.ts:readpendingregistration:function" type="function" identity="readPendingRegistration" parent="~/.framework/src/lib/registration.ts"]
+// CIL[DOC-MACRO purpose="Read the persisted pending registration intent"]
+// CIL[DOC-RESPONSIBILITY responsibility="Parse and return the sessionStorage intent, or null when absent/corrupt"]
+// CIL[DOC-CONTEXT module="framework-api" layer="lib" related_files=".framework/src/lib/registration.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="PendingRegistrationIntent | null" errors="parse/storage errors return null" side_effects="sessionStorage read"]
+// CIL[DOC-MICRO logic_summary="JSON.parse the stored value; validates it is a plain object" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="first" score="0.85" flags="none"]
+// CIL[DOC-STABILITY stability="experimental"]
+export function readPendingRegistration(): PendingRegistrationIntent | null {
+  try {
+    const raw = sessionStorage.getItem(PENDING_REGISTRATION_KEY)
+    if (!raw) return null
+    const parsed = JSON.parse(raw)
+    if (!parsed || typeof parsed !== 'object') return null
+    return parsed as PendingRegistrationIntent
+  } catch {
+    return null
+  }
+}
+// CIL[END stable_id="~/.framework/src/lib/registration.ts:readpendingregistration:function"]
+
+// CIL[BEGIN stable_id="~/.framework/src/lib/registration.ts:clearpendingregistration:function" type="function" identity="clearPendingRegistration" parent="~/.framework/src/lib/registration.ts"]
+// CIL[DOC-MACRO purpose="Remove the persisted pending registration intent"]
+// CIL[DOC-RESPONSIBILITY responsibility="Delete spine.pending_registration from sessionStorage on success or definitive failure"]
+// CIL[DOC-CONTEXT module="framework-api" layer="lib" related_files=".framework/src/lib/registration.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="void" errors="storage exceptions swallowed" side_effects="sessionStorage removeItem"]
+// CIL[DOC-MICRO logic_summary="removeItem wrapped in try/catch" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="first" score="0.85" flags="none"]
+// CIL[DOC-STABILITY stability="experimental"]
+export function clearPendingRegistration(): void {
+  try {
+    sessionStorage.removeItem(PENDING_REGISTRATION_KEY)
+  } catch {
+    // ignore
+  }
+}
+// CIL[END stable_id="~/.framework/src/lib/registration.ts:clearpendingregistration:function"]
+
+// CIL[BEGIN stable_id="~/.framework/src/lib/registration.ts:completeregistrationresult:interface" type="interface" identity="CompleteRegistrationResult" parent="~/.framework/src/lib/registration.ts"]
+// CIL[DOC-MACRO purpose="Normalized result returned by the authenticated complete-registration endpoint"]
+// CIL[DOC-RESPONSIBILITY responsibility="Type for {status, account_slug, role_slug} — server-truth placement and role"]
+// CIL[DOC-CONTEXT module="framework-api" layer="lib" related_files=".framework/src/lib/registration.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="CompleteRegistrationResult object" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="status 'active'|'pending'; role_slug is the server-assigned role (never trust the client guess)" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="first" score="0.85" flags="none"]
+// CIL[DOC-STABILITY stability="experimental"]
+export interface CompleteRegistrationResult {
+  status: 'active' | 'pending'
+  account_slug?: string
+  role_slug?: string
+}
+// CIL[END stable_id="~/.framework/src/lib/registration.ts:completeregistrationresult:interface"]
+
+// CIL[BEGIN stable_id="~/.framework/src/lib/registration.ts:finalizeregistration:function" type="function" identity="finalizeRegistration" parent="~/.framework/src/lib/registration.ts"]
+// CIL[DOC-MACRO purpose="Complete registration through the authenticated invites endpoint"]
+// CIL[DOC-RESPONSIBILITY responsibility="POST {app, path, account_name} to invites?action=complete-registration via apiFetch and normalize the response"]
+// CIL[DOC-CONTEXT module="framework-api" layer="lib" related_files=".framework/src/lib/api.ts,.framework/src/lib/registration.ts"]
+// CIL[DOC-CONTRACT inputs="intent: PendingRegistrationIntent (path required; invite intents rejected)" outputs="Promise<CompleteRegistrationResult>" errors="RegistrationError — serverResponded=true for {error} bodies and non-OK responses, false for network failures" side_effects="authenticated HTTP POST to /.netlify/functions/invites"]
+// CIL[DOC-MICRO logic_summary="Sends only {app, path, account_name}; the server binds email/role/account from ctx.principal and installed app config" notable_decisions="Never forwards role_slug, email, target_account, or target_account_id — placement is server-resolved"]
+// CIL[DOC-CONFIDENCE pass="first" score="0.85" flags="none"]
+// CIL[DOC-STABILITY stability="experimental"]
+export async function finalizeRegistration(
+  intent: PendingRegistrationIntent
+): Promise<CompleteRegistrationResult> {
+  if (intent.invite || !intent.path) {
+    // Invite claims happen in the auth.users trigger at signUp time — there is
+    // nothing for complete-registration to do.
+    throw new RegistrationError('No registration action to complete for this intent', true)
+  }
+
+  let res: Response
+  try {
+    res = await apiFetch('/.netlify/functions/invites?action=complete-registration', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        app: intent.app,
+        path: intent.path,
+        account_name: intent.account_name,
+      }),
+    })
+  } catch (err: any) {
+    throw new RegistrationError(err?.message || 'Network error completing registration', false)
+  }
+
+  const json = await res.json().catch(() => null)
+
+  if (json?.error) {
+    throw new RegistrationError(String(json.error), true)
+  }
+  if (!res.ok) {
+    throw new RegistrationError(
+      json?.message || `Registration failed (HTTP ${res.status})`,
+      true
+    )
+  }
+
+  const data = json?.data ?? json ?? {}
+  return {
+    status: data.status === 'pending' ? 'pending' : 'active',
+    account_slug: data.account_slug,
+    role_slug: data.role_slug,
+  }
+}
+// CIL[END stable_id="~/.framework/src/lib/registration.ts:finalizeregistration:function"]

package/.framework/src/lib/supabase.ts

@@ -1,62 +1,88 @@
+// CIL[BEGIN stable_id="~/.framework/src/lib/supabase.ts:module_header:module_header" type="module_header" identity="module_header" parent="~/.framework/src/lib/supabase.ts"]
+// CIL[DOC-MACRO purpose="Module setup and imports for supabase.ts"]
+// CIL[DOC-RESPONSIBILITY responsibility="Establish the public surface and dependencies of supabase.ts"]
+// CIL[DOC-CONTEXT module=".framework/src/lib/supabase.ts" layer="lib" related_files=".framework/src/lib/supabase.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Imports required modules for supabase.ts" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-AUDIENCE audience="framework"]
+// CIL[DOC-STABILITY stability="stable"]
 
 
 
 
 
 
-// CIL[BEGIN chunk_id="supabase_module_header_1783672456" type="module_header" identity="imports" parent="none"]
-// CIL[DOC-MACRO purpose="Import Supabase client"]
-// CIL[DOC-RESPONSIBILITY responsibility="Import Supabase client factory"]
-// CIL[DOC-CONTEXT module="supabase" layer="frontend-hook" related_files="[\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="createClient function" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Imports Supabase client creation function" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-AUDIENCE audience="developer"]
-// CIL[DOC-VECTOR type="context" content="Layer: frontend-hook. Direct callers: 0. Direct calls: 0. Related files: custom/apps/cortex/pages/operations/OperationsDashboard.tsx, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+
+import { createClient } from '@supabase/supabase-js'
+// CIL[DOC-VECTOR type="context" content="purpose='Module setup and imports for supabase.ts'; No verified external callers; imports: none"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-import { createClient } from '@supabase/supabase-js'
-// CIL[END chunk_id="supabase_module_header_1783672456"]
-// CIL[BEGIN chunk_id="supabase_envvars_1783672456" type="variable" identity="environmentVariables" parent="none"]
-// CIL[DOC-MACRO purpose="Load Supabase environment variables"]
-// CIL[DOC-RESPONSIBILITY responsibility="Validate and store Supabase config"]
-// CIL[DOC-CONTEXT module="supabase" layer="frontend-hook" related_files="[\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="Environment variables" errors="Error on missing vars" side_effects="May throw error"]
-// CIL[DOC-MICRO logic_summary="Loads and validates required Supabase env vars" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[END stable_id="~/.framework/src/lib/supabase.ts:module_header:module_header"]
+// CIL[BEGIN stable_id="~/.framework/src/lib/supabase.ts:supabaseUrl:constant" type="constant" identity="supabaseUrl" parent="~/.framework/src/lib/supabase.ts"]
+// CIL[DOC-MACRO purpose="Define the supabaseUrl constant"]
+// CIL[DOC-RESPONSIBILITY responsibility="Expose the supabaseUrl value to consumers"]
+// CIL[DOC-CONTEXT module=".framework/src/lib/supabase.ts" layer="lib" related_files=".framework/src/lib/supabase.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="string value from import.meta.env" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Binds the expression to the supabaseUrl identifier" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: frontend-hook. Direct callers: 0. Direct calls: 0. Related files: \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+const supabaseUrl = import.meta.env.VITE_SUPABASE_URL
+// CIL[DOC-VECTOR type="context" content="purpose='Define the supabaseUrl constant'; No verified external callers; imports: none"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-const supabaseUrl = import.meta.env.VITE_SUPABASE_URL
+// CIL[END stable_id="~/.framework/src/lib/supabase.ts:supabaseUrl:constant"]
+// CIL[BEGIN stable_id="~/.framework/src/lib/supabase.ts:supabaseAnonKey:constant" type="constant" identity="supabaseAnonKey" parent="~/.framework/src/lib/supabase.ts"]
+// CIL[DOC-MACRO purpose="Define the supabaseAnonKey constant"]
+// CIL[DOC-RESPONSIBILITY responsibility="Expose the supabaseAnonKey value to consumers"]
+// CIL[DOC-CONTEXT module=".framework/src/lib/supabase.ts" layer="lib" related_files=".framework/src/lib/supabase.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="string value from import.meta.env" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Binds the expression to the supabaseAnonKey identifier" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 const supabaseAnonKey = import.meta.env.VITE_SUPABASE_ANON_KEY
+// CIL[DOC-VECTOR type="context" content="purpose='Define the supabaseAnonKey constant'; No verified external callers; imports: none"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/src/lib/supabase.ts:supabaseAnonKey:constant"]
 
+// CIL[BEGIN stable_id="~/.framework/src/lib/supabase.ts:supabase_env_check:variable" type="variable" identity="supabase_env_check" parent="~/.framework/src/lib/supabase.ts"]
+// CIL[DOC-MACRO purpose="Runtime guard for supabase_env_check"]
+// CIL[DOC-RESPONSIBILITY responsibility="Ensure required conditions are met before execution"]
+// CIL[DOC-CONTEXT module=".framework/src/lib/supabase.ts" layer="lib" related_files=".framework/src/lib/supabase.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="throws Error if validation fails" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Validates environment and throws if the guard fails" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 if (!supabaseUrl || !supabaseAnonKey) {
   throw new Error('Missing Supabase environment variables')
 }
-// CIL[END chunk_id="supabase_envvars_1783672456"]
-// CIL[BEGIN chunk_id="supabase_client_1783672456" type="variable" identity="supabase" parent="none"]
-// CIL[DOC-MACRO purpose="Create Supabase client singleton"]
-// CIL[DOC-RESPONSIBILITY responsibility="Initialize Supabase client with auth config"]
-// CIL[DOC-CONTEXT module="supabase" layer="frontend-hook" related_files="[\".framework/src/pages/admin/TypeDetailPage.tsx\",\".framework/src/components/ui/dialog.tsx\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="Supabase client instance" errors="none" side_effects="Reads localStorage"]
-// CIL[DOC-MICRO logic_summary="Configures session persistence, auto-refresh, and a no-op auth lock to bypass navigator.locks" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-NOTE type="caution" content="No-op lock bypasses navigator.locks to avoid NavigatorLockAcquireTimeoutError during login"]
-// CIL[DOC-VECTOR type="context" content="Layer: frontend-hook. Direct callers: 0. Direct calls: 0. Related files: .framework/src/pages/admin/TypeDetailPage.tsx, .framework/src/components/ui/dialog.tsx, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Runtime guard for supabase_env_check'; No verified external callers; imports: none"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/src/lib/supabase.ts:supabase_env_check:variable"]
+
+
+// CIL[BEGIN stable_id="~/.framework/src/lib/supabase.ts:supabase:constant" type="constant" identity="supabase" parent="~/.framework/src/lib/supabase.ts"]
+// CIL[DOC-MACRO purpose="Define the supabase constant"]
+// CIL[DOC-RESPONSIBILITY responsibility="Expose the supabase value to consumers"]
+// CIL[DOC-CONTEXT module=".framework/src/lib/supabase.ts" layer="lib" related_files=".framework/src/lib/supabase.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="SupabaseClient instance" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Binds the expression to the supabase identifier" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 export const supabase = createClient(supabaseUrl, supabaseAnonKey, {
   auth: {
     persistSession: true,
@@ -65,64 +91,75 @@ export const supabase = createClient(supabaseUrl, supabaseAnonKey, {
     lock: async <T>(_name: string, _acquireTimeout: number, fn: () => Promise<T>): Promise<T> => await fn(),
   },
 })
-// CIL[END chunk_id="supabase_client_1783672456"]
-// CIL[BEGIN chunk_id="supabase_getcurrentsession_1783672456" type="function" identity="getCurrentSession" parent="none"]
-// CIL[DOC-MACRO purpose="Get current Supabase session"]
-// CIL[DOC-RESPONSIBILITY responsibility="Retrieve active auth session"]
-// CIL[DOC-CONTEXT module="supabase" layer="frontend-hook" related_files="[\".framework/src/pages/admin/RolesPage.tsx\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="Session object or null" errors="Supabase AuthError" side_effects="Reads localStorage"]
-// CIL[DOC-MICRO logic_summary="Calls Supabase getSession and handles errors" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: frontend-hook. Direct callers: 0. Direct calls: 0. Related files: .framework/src/pages/admin/RolesPage.tsx, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Define the supabase constant'; No verified external callers; imports: none"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/src/lib/supabase.ts:supabase:constant"]
+
+
+// CIL[BEGIN stable_id="~/.framework/src/lib/supabase.ts:getCurrentSession:function" type="function" identity="getCurrentSession" parent="~/.framework/src/lib/supabase.ts"]
+// CIL[DOC-MACRO purpose="Implement getCurrentSession"]
+// CIL[DOC-RESPONSIBILITY responsibility="Execute the core logic for getCurrentSession"]
+// CIL[DOC-CONTEXT module=".framework/src/lib/supabase.ts" layer="lib" related_files=".framework/src/lib/supabase.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="result of the operation" errors="propagates dependency errors" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Processes inputs, performs work, and returns output for getCurrentSession" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 export const getCurrentSession = async () => {
   const { data: { session }, error } = await supabase.auth.getSession()
   if (error) throw error
   return session
 }
-// CIL[END chunk_id="supabase_getcurrentsession_1783672456"]
-// CIL[BEGIN chunk_id="supabase_getcurrentuser_1783672456" type="function" identity="getCurrentUser" parent="none"]
-// CIL[DOC-MACRO purpose="Get current Supabase user"]
-// CIL[DOC-RESPONSIBILITY responsibility="Retrieve authenticated user data"]
-// CIL[DOC-CONTEXT module="supabase" layer="frontend-hook" related_files="[\".framework/src/pages/admin/RolesPage.tsx\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="User object or null" errors="Supabase AuthError" side_effects="Reads localStorage"]
-// CIL[DOC-MICRO logic_summary="Calls Supabase getUser and handles errors" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: frontend-hook. Direct callers: 0. Direct calls: 0. Related files: .framework/src/pages/admin/RolesPage.tsx, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Implement getCurrentSession'; No verified external callers; imports: none"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/src/lib/supabase.ts:getCurrentSession:function"]
+
+
+// CIL[BEGIN stable_id="~/.framework/src/lib/supabase.ts:getCurrentUser:function" type="function" identity="getCurrentUser" parent="~/.framework/src/lib/supabase.ts"]
+// CIL[DOC-MACRO purpose="Implement getCurrentUser"]
+// CIL[DOC-RESPONSIBILITY responsibility="Execute the core logic for getCurrentUser"]
+// CIL[DOC-CONTEXT module=".framework/src/lib/supabase.ts" layer="lib" related_files=".framework/src/lib/supabase.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="result of the operation" errors="propagates dependency errors" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Processes inputs, performs work, and returns output for getCurrentUser" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 export const getCurrentUser = async () => {
   const { data: { user }, error } = await supabase.auth.getUser()
   if (error) throw error
   return user
 }
-// CIL[END chunk_id="supabase_getcurrentuser_1783672456"]
-// CIL[BEGIN chunk_id="supabase_refreshsession_1783672456" type="function" identity="refreshSession" parent="none"]
-// CIL[DOC-MACRO purpose="Refresh Supabase session"]
-// CIL[DOC-RESPONSIBILITY responsibility="Force session token refresh"]
-// CIL[DOC-CONTEXT module="supabase" layer="frontend-hook" related_files="[]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="Session data" errors="Supabase AuthError" side_effects="Updates localStorage"]
-// CIL[DOC-MICRO logic_summary="Calls Supabase refreshSession and handles errors" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: frontend-hook. Direct callers: 0. Direct calls: 0. Related files: none."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Implement getCurrentUser'; No verified external callers; imports: none"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/src/lib/supabase.ts:getCurrentUser:function"]
+
+// CIL[BEGIN stable_id="~/.framework/src/lib/supabase.ts:refreshSession:function" type="function" identity="refreshSession" parent="~/.framework/src/lib/supabase.ts"]
+// CIL[DOC-MACRO purpose="Implement refreshSession"]
+// CIL[DOC-RESPONSIBILITY responsibility="Execute the core logic for refreshSession"]
+// CIL[DOC-CONTEXT module=".framework/src/lib/supabase.ts" layer="lib" related_files=".framework/src/lib/supabase.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="result of the operation" errors="propagates dependency errors" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Processes inputs, performs work, and returns output for refreshSession" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 export const refreshSession = async () => {
   const { data, error } = await supabase.auth.refreshSession()
   if (error) throw error
   return data
 }
-// CIL[END chunk_id="supabase_refreshsession_1783672456"]
+// CIL[DOC-VECTOR type="context" content="purpose='Implement refreshSession'; No verified external callers; imports: none"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/src/lib/supabase.ts:refreshSession:function"]