spine-framework 0.3.145 → 0.4.1

package/.framework/functions/_shared/permissions.ts

@@ -1,38 +1,33 @@
-// CIL[BEGIN chunk_id="permissions_moduleheader_1784066609" type="module_header" identity="module_header" parent="none"]
-// CIL[DOC-MACRO purpose="Permission system for data access control"]
-// CIL[DOC-RESPONSIBILITY responsibility="Manage record and field-level permissions"]
-// CIL[DOC-CONTEXT module="_shared/permissions" layer="infrastructure" related_files="[\".framework/functions/_shared/principal.ts\",\".framework/functions/_shared/schema-utils.ts\",\".framework/src/pages/admin/TypeDetailPage.tsx\",\".framework/src/pages/admin/IntegrationsPage.tsx\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="permission utilities" errors="none" side_effects="access control"]
-// CIL[DOC-MICRO logic_summary="Defines PermissionEngine and permission resolution logic" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-AUDIENCE audience="developer"]
-// CIL[DOC-VECTOR type="context" content="Layer: infrastructure. Direct callers: 0. Direct calls: 0. Related files: .framework/functions/_shared/principal.ts, .framework/functions/_shared/schema-utils.ts, .framework/src/pages/admin/TypeDetailPage.tsx, .framework/src/pages/admin/IntegrationsPage.tsx, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
-// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
-// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-// CIL[END chunk_id="permissions_moduleheader_1784066609"]
-// CIL[BEGIN chunk_id="permissions_types_1784066609" type="module_header" identity="types" parent="none"]
-// CIL[DOC-MACRO purpose="Permission types and interfaces"]
-// CIL[DOC-RESPONSIBILITY responsibility="Define permission data structures"]
-// CIL[DOC-CONTEXT module="_shared/permissions" layer="infrastructure" related_files="[\"custom/apps/portal/pages/ContentPage.tsx\",\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\".framework/src/pages/admin/RolesPage.tsx\",\".framework/functions/_shared/principal.ts\",\".framework/src/components/ui/dialog.tsx\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="type definitions" errors="none" side_effects="type definitions"]
-// CIL[DOC-MICRO logic_summary="Defines PermissionResult interface and imports" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:module_header:module_header" type="module_header" identity="module_header" parent="~/.framework/functions/_shared/permissions.ts"]
+// CIL[DOC-MACRO purpose="Entry point for the permissions shared module"]
+// CIL[DOC-RESPONSIBILITY responsibility="Sets up imports and module context for permissions engine"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Imports dependencies and declares the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-AUDIENCE audience="developer"]
-// CIL[DOC-VECTOR type="context" content="Layer: infrastructure. Direct callers: 0. Direct calls: 0. Related files: custom/apps/portal/pages/ContentPage.tsx, custom/apps/cortex/pages/operations/OperationsDashboard.tsx, .framework/src/pages/admin/RolesPage.tsx, .framework/functions/_shared/principal.ts, .framework/src/components/ui/dialog.tsx, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
-// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
-// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[DOC-AUDIENCE audience="developers"]
+
 import { adminDb } from './db'
 import { Principal } from './principal'
 import { CoreContext } from './middleware'
+// CIL[DOC-VECTOR type="context" content="purpose='Entry point for the permissions shared module'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:module_header:module_header"]
+
 
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:PermissionResult:interface" type="interface" identity="PermissionResult" parent="~/.framework/functions/_shared/permissions.ts"]
+// CIL[DOC-MACRO purpose="Declares the PermissionResult permission-related type"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the PermissionResult behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the PermissionResult logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 export interface PermissionResult {
   canCreate: boolean
   canRead: boolean
@@ -40,41 +35,49 @@ export interface PermissionResult {
   canDelete: boolean
   fieldPermissions: Record<string, { read: boolean; write: boolean }>
 }
-
-type RequestContext = CoreContext
-// CIL[END chunk_id="permissions_types_1784066609"]
-// CIL[BEGIN chunk_id="permissions_engineclass_1784066609" type="class" identity="_PermissionEngineInternal" parent="none"]
-// CIL[DOC-MACRO purpose="Permission engine internal class placeholder"]
-// CIL[DOC-RESPONSIBILITY responsibility="Define permission engine structure"]
-// CIL[DOC-CONTEXT module="_shared/permissions" layer="infrastructure" related_files="[\".framework/functions/_shared/principal.ts\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="class definition" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Empty class definition for permission engine" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: infrastructure. Direct callers: 0. Direct calls: 0. Related files: .framework/functions/_shared/principal.ts, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Declares the PermissionResult permission-related type'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-// CIL[END chunk_id="permissions_engineclass_1784066609"]
-// CIL[BEGIN chunk_id="permissions_classification_1784066609" type="class" identity="_PermissionEngineInternal" parent="permissions_engineclass_1784066609"]
-// CIL[DOC-MACRO purpose="Permission engine implementation"]
-// CIL[DOC-RESPONSIBILITY responsibility="Implement permission resolution logic"]
-// CIL[DOC-CONTEXT module="_shared/permissions" layer="infrastructure" related_files="[\".framework/functions/_shared/principal.ts\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="permission methods" errors="none" side_effects="permission evaluation"]
-// CIL[DOC-MICRO logic_summary="Implements singleton permission engine with surface detection" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:PermissionResult:interface"]
+
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:RequestContext:type" type="type" identity="RequestContext" parent="~/.framework/functions/_shared/permissions.ts"]
+// CIL[DOC-MACRO purpose="Declares the RequestContext permission-related type"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the RequestContext behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the RequestContext logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: infrastructure. Direct callers: 0. Direct calls: 0. Related files: .framework/functions/_shared/principal.ts, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+type RequestContext = CoreContext
+// CIL[DOC-VECTOR type="context" content="purpose='Declares the RequestContext permission-related type'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:RequestContext:type"]
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class" type="class" identity="_PermissionEngineInternal" parent="~/.framework/functions/_shared/permissions.ts"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal class"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 class _PermissionEngineInternal {
   private static instance: _PermissionEngineInternal
 
+  // personId → role slug, short-TTL. resolveFirstSurfacePermissions runs once
+  // per record inside list-sanitize loops — without this cache a 20-message
+  // poll is 20 sequential people lookups.
+  private roleSlugCache = new Map<string, { slug: string | null; expiresAt: number }>()
+  private static readonly ROLE_CACHE_TTL_MS = 60_000
+
   private readonly SECOND_SURFACE_TABLES = new Set([
     'apps', 'app', 'pipelines', 'triggers', 'ai_agents', 'embeddings', 
     'timers', 'integrations', 'roles', 'types', 'prompt_configs'
@@ -86,7 +89,22 @@ class _PermissionEngineInternal {
   ])
 
   private constructor() {}
-
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal class'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.detectSurface:method" type="method" identity="_PermissionEngineInternal.detectSurface" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.detectSurface permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.detectSurface behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="tableName: string" outputs="'first' | 'second' | 'third'" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.detectSurface logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
   private detectSurface(tableName: string): 'first' | 'second' | 'third' {
     if (this.SECOND_SURFACE_TABLES.has(tableName)) {
       return 'second'
@@ -96,7 +114,22 @@ class _PermissionEngineInternal {
     }
     return 'first'
   }
-
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.detectSurface permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.detectSurface:method"]
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.extractTableName:method" type="method" identity="_PermissionEngineInternal.extractTableName" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.extractTableName permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.extractTableName behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="record: any, typeSlug?: string" outputs="string" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.extractTableName logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
   private extractTableName(record: any, typeSlug?: string): string {
     if (record?.table_name) {
       return record.table_name
@@ -116,28 +149,44 @@ class _PermissionEngineInternal {
     
     return 'unknown'
   }
-
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.extractTableName permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.extractTableName:method"]
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.getInstance:method" type="method" identity="_PermissionEngineInternal.getInstance" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.getInstance permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.getInstance behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="_PermissionEngineInternal" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.getInstance logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
   static getInstance(): _PermissionEngineInternal {
     if (!_PermissionEngineInternal.instance) {
       _PermissionEngineInternal.instance = new _PermissionEngineInternal()
     }
     return _PermissionEngineInternal.instance
   }
-// CIL[END chunk_id="permissions_classification_1784066609"]
-  // CIL[BEGIN chunk_id="permissions_resolvefirstsurface_1784066609" type="function" identity="resolveFirstSurfacePermissions" parent="permissions_classification_1784066609"]
-// CIL[DOC-MACRO purpose="Resolve first surface permissions"]
-// CIL[DOC-RESPONSIBILITY responsibility="Evaluate record and field permissions for runtime data"]
-// CIL[DOC-CONTEXT module="_shared/permissions" layer="infrastructure" related_files="[\".framework/migrations/025_retype_threads_messages.sql\",\".framework/functions/_shared/principal.ts\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="PermissionResult" errors="database errors" side_effects="database reads"]
-// CIL[DOC-MICRO logic_summary="Resolves permissions based on role and design schema" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="complex_dependencies"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: infrastructure. Direct callers: 0. Direct calls: 0. Related files: .framework/migrations/025_retype_threads_messages.sql, .framework/functions/_shared/principal.ts, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.getInstance permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.getInstance:method"]
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.resolveFirstSurfacePermissions:method" type="method" identity="_PermissionEngineInternal.resolveFirstSurfacePermissions" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.resolveFirstSurfacePermissions permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.resolveFirstSurfacePermissions behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="May return error results or throw on permission resolution failure" side_effects="May log debug information to console"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.resolveFirstSurfacePermissions logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-LEARNING topic="invariant" content="record_permissions keys are matched verbatim against the seeded roles.slug — nothing normalizes hyphens. 'system-admin' is a dead key that silently denies system_admin; only real slugs (system_admin, member, support, ...) or the 'all' wildcard are valid. Proven by a shipped downstream-app defect (403 on create for system_admin)."]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
   async resolveFirstSurfacePermissions(
     personId: string,
     accountId: string,
@@ -164,15 +213,22 @@ class _PermissionEngineInternal {
         return defaultResult
       }
 
-      // 2. Get user's role via people.role_id FK
-      const { data: person } = await adminDb
-        .from('people')
-        .select('role:role_id(slug)')
-        .eq('id', personId)
-        .eq('is_active', true)
-        .single()
-
-      const roleSlug = (person?.role as any)?.slug || Array.isArray(person?.role) && (person.role as any)[0]?.slug
+      // 2. Get user's role via people.role_id FK — cached by personId so
+      //    per-record sanitize calls don't each hit the database.
+      const cachedRole = this.roleSlugCache.get(personId)
+      let roleSlug: string | null | undefined
+      if (cachedRole && cachedRole.expiresAt > Date.now()) {
+        roleSlug = cachedRole.slug
+      } else {
+        const { data: person } = await adminDb
+          .from('people')
+          .select('role:role_id(slug)')
+          .eq('id', personId)
+          .eq('is_active', true)
+          .single()
+        roleSlug = (person?.role as any)?.slug || Array.isArray(person?.role) && (person.role as any)[0]?.slug || null
+        this.roleSlugCache.set(personId, { slug: roleSlug, expiresAt: Date.now() + _PermissionEngineInternal.ROLE_CACHE_TTL_MS })
+      }
       if (!roleSlug) {
         return defaultResult
       }
@@ -239,21 +295,21 @@ class _PermissionEngineInternal {
       return defaultResult
     }
   }
-// CIL[END chunk_id="permissions_resolvefirstsurface_1784066609"]
-  // CIL[BEGIN chunk_id="permissions_canaccessconfig_1784066609" type="function" identity="canAccessConfigObject" parent="permissions_classification_1784066609"]
-// CIL[DOC-MACRO purpose="Export permission engine instance and methods"]
-// CIL[DOC-RESPONSIBILITY responsibility="Provide public API for permission system"]
-// CIL[DOC-CONTEXT module="_shared/permissions" layer="infrastructure" related_files="[]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="exports" errors="none" side_effects="module exports"]
-// CIL[DOC-MICRO logic_summary="Exports PermissionEngine singleton and bound methods" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: infrastructure. Direct callers: 0. Direct calls: 0. Related files: none."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.resolveFirstSurfacePermissions permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.resolveFirstSurfacePermissions:method"]
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.canAccessConfigObject:method" type="method" identity="_PermissionEngineInternal.canAccessConfigObject" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.canAccessConfigObject permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.canAccessConfigObject behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="ctx: RequestContext, action: 'create' | 'read' | 'update' | 'delete'" outputs="boolean" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.canAccessConfigObject logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
   private canAccessConfigObject(ctx: RequestContext, action: 'create' | 'read' | 'update' | 'delete'): boolean {
     // System admin has full access
     if (this.isSystemAdmin(ctx)) {
@@ -268,22 +324,22 @@ class _PermissionEngineInternal {
     // All other access denied
     return false
   }
-
-// CIL[END chunk_id="permissions_canaccessconfig_1784066609"]
-  // CIL[BEGIN chunk_id="permissions_sanitizeconfig_1784066609" type="function" identity="sanitizeConfigObject" parent="permissions_classification_1784066609"]
-// CIL[DOC-MACRO purpose="sanitizeConfigObject"]
-// CIL[DOC-RESPONSIBILITY responsibility="Handle sanitizeConfigObject"]
-// CIL[DOC-CONTEXT module="sanitizeConfigObject" layer="unknown" related_files="[]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Implements sanitizeConfigObject" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: unknown. Direct callers: 0. Direct calls: 0. Related files: none."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.canAccessConfigObject permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.canAccessConfigObject:method"]
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.sanitizeConfigObject:method" type="method" identity="_PermissionEngineInternal.sanitizeConfigObject" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.sanitizeConfigObject permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.sanitizeConfigObject behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="ctx: RequestContext, record: any" outputs="any" errors="none" side_effects="May log debug information to console"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.sanitizeConfigObject logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
   private sanitizeConfigObject(ctx: RequestContext, record: any): any {
     // Debug logging
     console.log('sanitizeConfigObject called with record:', {
@@ -336,22 +392,22 @@ class _PermissionEngineInternal {
       updated_at: record.updated_at
     }
   }
-
-// CIL[END chunk_id="permissions_sanitizeconfig_1784066609"]
-  // CIL[BEGIN chunk_id="permissions_validateconfig_1784066609" type="function" identity="validateConfigObjectPermissions" parent="permissions_classification_1784066609"]
-// CIL[DOC-MACRO purpose="validateConfigObjectPermissions"]
-// CIL[DOC-RESPONSIBILITY responsibility="Handle validateConfigObjectPermissions"]
-// CIL[DOC-CONTEXT module="validateConfigObjectPermissions" layer="unknown" related_files="[]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Implements validateConfigObjectPermissions" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: unknown. Direct callers: 0. Direct calls: 0. Related files: none."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.sanitizeConfigObject permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.sanitizeConfigObject:method"]
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.validateConfigObjectPermissions:method" type="method" identity="_PermissionEngineInternal.validateConfigObjectPermissions" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.validateConfigObjectPermissions permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.validateConfigObjectPermissions behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="ctx: RequestContext, action: 'create' | 'read' | 'update' | 'delete'" outputs="string }" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.validateConfigObjectPermissions logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
   private validateConfigObjectPermissions(ctx: RequestContext, action: 'create' | 'read' | 'update' | 'delete'): { valid: boolean; error?: string } {
     if (this.canAccessConfigObject(ctx, action)) {
       return { valid: true }
@@ -359,22 +415,22 @@ class _PermissionEngineInternal {
     
     return { valid: false, error: 'Insufficient permissions for this operation' }
   }
-
-// CIL[END chunk_id="permissions_validateconfig_1784066609"]
-  // CIL[BEGIN chunk_id="permissions_canaccesssystem_1784066609" type="function" identity="canAccessSystemMetadata" parent="permissions_classification_1784066609"]
-// CIL[DOC-MACRO purpose="canAccessSystemMetadata"]
-// CIL[DOC-RESPONSIBILITY responsibility="Handle canAccessSystemMetadata"]
-// CIL[DOC-CONTEXT module="canAccessSystemMetadata" layer="unknown" related_files="[]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Implements canAccessSystemMetadata" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: unknown. Direct callers: 0. Direct calls: 0. Related files: none."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.validateConfigObjectPermissions permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.validateConfigObjectPermissions:method"]
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.canAccessSystemMetadata:method" type="method" identity="_PermissionEngineInternal.canAccessSystemMetadata" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.canAccessSystemMetadata permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.canAccessSystemMetadata behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="ctx: RequestContext, record: any, action: 'create' | 'read' | 'update' | 'delete'" outputs="boolean" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.canAccessSystemMetadata logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
   private canAccessSystemMetadata(ctx: RequestContext, record: any, action: 'create' | 'read' | 'update' | 'delete'): boolean {
     // System admin has full access
     if (this.isSystemAdmin(ctx)) {
@@ -407,22 +463,22 @@ class _PermissionEngineInternal {
     // Users cannot create/update/delete system metadata
     return false
   }
-
-// CIL[END chunk_id="permissions_canaccesssystem_1784066609"]
-  // CIL[BEGIN chunk_id="permissions_sanitizesystem_1784066609" type="function" identity="sanitizeSystemMetadata" parent="permissions_classification_1784066609"]
-// CIL[DOC-MACRO purpose="sanitizeSystemMetadata"]
-// CIL[DOC-RESPONSIBILITY responsibility="Handle sanitizeSystemMetadata"]
-// CIL[DOC-CONTEXT module="sanitizeSystemMetadata" layer="unknown" related_files="[]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Implements sanitizeSystemMetadata" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: unknown. Direct callers: 0. Direct calls: 0. Related files: none."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.canAccessSystemMetadata permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.canAccessSystemMetadata:method"]
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.sanitizeSystemMetadata:method" type="method" identity="_PermissionEngineInternal.sanitizeSystemMetadata" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.sanitizeSystemMetadata permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.sanitizeSystemMetadata behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="ctx: RequestContext, record: any" outputs="any" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.sanitizeSystemMetadata logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
   private sanitizeSystemMetadata(ctx: RequestContext, record: any): any {
     // System admin and system role see everything
     if (this.isSystemAdmin(ctx) || ctx.principal?.type === 'machine') {
@@ -441,22 +497,22 @@ class _PermissionEngineInternal {
       updated_at: record.updated_at
     }
   }
-
-// CIL[END chunk_id="permissions_sanitizesystem_1784066609"]
-  // CIL[BEGIN chunk_id="permissions_validatesystem_1784066609" type="function" identity="validateSystemMetadataPermissions" parent="permissions_classification_1784066609"]
-// CIL[DOC-MACRO purpose="validateSystemMetadataPermissions"]
-// CIL[DOC-RESPONSIBILITY responsibility="Handle validateSystemMetadataPermissions"]
-// CIL[DOC-CONTEXT module="validateSystemMetadataPermissions" layer="unknown" related_files="[]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Implements validateSystemMetadataPermissions" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: unknown. Direct callers: 0. Direct calls: 0. Related files: none."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.sanitizeSystemMetadata permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.sanitizeSystemMetadata:method"]
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.validateSystemMetadataPermissions:method" type="method" identity="_PermissionEngineInternal.validateSystemMetadataPermissions" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.validateSystemMetadataPermissions permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.validateSystemMetadataPermissions behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="ctx: RequestContext, record: any, action: 'create' | 'read' | 'update' | 'delete'" outputs="string }" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.validateSystemMetadataPermissions logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
   private validateSystemMetadataPermissions(ctx: RequestContext, record: any, action: 'create' | 'read' | 'update' | 'delete'): { valid: boolean; error?: string } {
     if (this.canAccessSystemMetadata(ctx, record, action)) {
       return { valid: true }
@@ -464,41 +520,41 @@ class _PermissionEngineInternal {
     
     return { valid: false, error: 'Insufficient permissions for this operation' }
   }
-
-// CIL[END chunk_id="permissions_validatesystem_1784066609"]
-  // CIL[BEGIN chunk_id="permissions_issystemadmin_1784066609" type="function" identity="isSystemAdmin" parent="permissions_classification_1784066609"]
-// CIL[DOC-MACRO purpose="isSystemAdmin"]
-// CIL[DOC-RESPONSIBILITY responsibility="Handle isSystemAdmin"]
-// CIL[DOC-CONTEXT module="isSystemAdmin" layer="unknown" related_files="[]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Implements isSystemAdmin" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: unknown. Direct callers: 0. Direct calls: 0. Related files: none."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.validateSystemMetadataPermissions permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.validateSystemMetadataPermissions:method"]
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.isSystemAdmin:method" type="method" identity="_PermissionEngineInternal.isSystemAdmin" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.isSystemAdmin permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.isSystemAdmin behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="ctx: RequestContext" outputs="boolean" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.isSystemAdmin logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
   isSystemAdmin(ctx: RequestContext): boolean {
     return ctx.principal?.roles?.some((r: any) => r?.slug === 'system_admin' || r === 'system_admin') || false
   }
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.isSystemAdmin permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.isSystemAdmin:method"]
 
-// CIL[END chunk_id="permissions_issystemadmin_1784066609"]
-  // CIL[BEGIN chunk_id="permissions_canaccessrecord_1784066609" type="function" identity="canAccessRecord" parent="permissions_classification_1784066609"]
-// CIL[DOC-MACRO purpose="canAccessRecord"]
-// CIL[DOC-RESPONSIBILITY responsibility="Handle canAccessRecord"]
-// CIL[DOC-CONTEXT module="canAccessRecord" layer="unknown" related_files="[]"]
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.canAccessRecord:method" type="method" identity="_PermissionEngineInternal.canAccessRecord" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.canAccessRecord permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.canAccessRecord behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
 // CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Implements canAccessRecord" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.canAccessRecord logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: unknown. Direct callers: 0. Direct calls: 0. Related files: none."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
-// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
-// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
   async canAccessRecord(
     ctx: RequestContext,
     record: any,
@@ -526,22 +582,22 @@ class _PermissionEngineInternal {
         return this.canAccessFirstSurfaceRecord(ctx, record, action)
     }
   }
-// CIL[END chunk_id="permissions_canaccessrecord_1784066609"]
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.canAccessRecord permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.canAccessRecord:method"]
 
-  // CIL[BEGIN chunk_id="permissions_canaccessfirst_1784066609" type="function" identity="canAccessFirstSurfaceRecord" parent="permissions_classification_1784066609"]
-// CIL[DOC-MACRO purpose="canAccessFirstSurfaceRecord"]
-// CIL[DOC-RESPONSIBILITY responsibility="Handle canAccessFirstSurfaceRecord"]
-// CIL[DOC-CONTEXT module="canAccessFirstSurfaceRecord" layer="unknown" related_files="[]"]
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.canAccessFirstSurfaceRecord:method" type="method" identity="_PermissionEngineInternal.canAccessFirstSurfaceRecord" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.canAccessFirstSurfaceRecord permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.canAccessFirstSurfaceRecord behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
 // CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Implements canAccessFirstSurfaceRecord" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.canAccessFirstSurfaceRecord logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: unknown. Direct callers: 0. Direct calls: 0. Related files: none."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
-// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
-// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
   private async canAccessFirstSurfaceRecord(
     ctx: RequestContext,
     record: any,
@@ -593,22 +649,22 @@ class _PermissionEngineInternal {
 
     return true
   }
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.canAccessFirstSurfaceRecord permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.canAccessFirstSurfaceRecord:method"]
 
-// CIL[END chunk_id="permissions_canaccessfirst_1784066609"]
-  // CIL[BEGIN chunk_id="permissions_saniterecorddata_1784066609" type="function" identity="sanitizeRecordData" parent="permissions_classification_1784066609"]
-// CIL[DOC-MACRO purpose="sanitizeRecordData"]
-// CIL[DOC-RESPONSIBILITY responsibility="Handle sanitizeRecordData"]
-// CIL[DOC-CONTEXT module="sanitizeRecordData" layer="unknown" related_files="[]"]
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.sanitizeRecordData:method" type="method" identity="_PermissionEngineInternal.sanitizeRecordData" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.sanitizeRecordData permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.sanitizeRecordData behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
 // CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Implements sanitizeRecordData" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.sanitizeRecordData logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: unknown. Direct callers: 0. Direct calls: 0. Related files: none."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
-// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
-// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
   async sanitizeRecordData(
     ctx: RequestContext,
     record: any,
@@ -636,24 +692,22 @@ class _PermissionEngineInternal {
         return this.sanitizeFirstSurfaceRecordData(ctx, record, typeSlug || '')
     }
   }
-// CIL[END chunk_id="permissions_saniterecorddata_1784066609"]
-
-  // CIL[BEGIN chunk_id="permissions_sanitizerecord_1784066609" type="function" identity="sanitizeFirstSurfaceRecordData" parent="permissions_classification_1784066609"]
-// CIL[DOC-LEARNING topic="runtime-type:generic/permissions" content="Record visibility is controlled by record.design_schema.record_permissions and each field's fields[name].permissions. The function checks the current principal role against allowed actions create/read/update/delete. If record_permissions is missing, the record is reduced to {id}."]
-// CIL[DOC-NOTE type="design_schema_caveat" content="Every stamped record must carry its type's record_permissions and per-field permissions or users will see empty records. Permissions are inherited from the type at creation time; updating the type does not retroactively update existing records unless migrations run."]
-// CIL[DOC-MACRO purpose="sanitizeFirstSurfaceRecordData"]
-// CIL[DOC-RESPONSIBILITY responsibility="Handle sanitizeFirstSurfaceRecordData"]
-// CIL[DOC-CONTEXT module="sanitizeFirstSurfaceRecordData" layer="unknown" related_files="[]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Implements sanitizeFirstSurfaceRecordData" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: unknown. Direct callers: 0. Direct calls: 0. Related files: none."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.sanitizeRecordData permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.sanitizeRecordData:method"]
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.sanitizeFirstSurfaceRecordData:method" type="method" identity="_PermissionEngineInternal.sanitizeFirstSurfaceRecordData" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.sanitizeFirstSurfaceRecordData permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.sanitizeFirstSurfaceRecordData behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="May log debug information to console"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.sanitizeFirstSurfaceRecordData logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
   private async sanitizeFirstSurfaceRecordData(
     ctx: RequestContext,
     record: any,
@@ -761,22 +815,22 @@ class _PermissionEngineInternal {
 
     return sanitized
   }
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.sanitizeFirstSurfaceRecordData permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.sanitizeFirstSurfaceRecordData:method"]
 
-// CIL[END chunk_id="permissions_sanitizerecord_1784066609"]
-  // CIL[BEGIN chunk_id="permissions_validateupdatepermissions_1784066609" type="function" identity="validateUpdatePermissions" parent="permissions_classification_1784066609"]
-// CIL[DOC-MACRO purpose="validateUpdatePermissions"]
-// CIL[DOC-RESPONSIBILITY responsibility="Handle validateUpdatePermissions"]
-// CIL[DOC-CONTEXT module="validateUpdatePermissions" layer="unknown" related_files="[]"]
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.validateUpdatePermissions:method" type="method" identity="_PermissionEngineInternal.validateUpdatePermissions" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.validateUpdatePermissions permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.validateUpdatePermissions behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
 // CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Implements validateUpdatePermissions" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.validateUpdatePermissions logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: unknown. Direct callers: 0. Direct calls: 0. Related files: none."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
-// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
-// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
   async validateUpdatePermissions(
     ctx: RequestContext,
     updateData: any,
@@ -805,22 +859,22 @@ class _PermissionEngineInternal {
         return this.validateFirstSurfaceUpdatePermissions(ctx, updateData, existingRecord, typeSlug || '')
     }
   }
-// CIL[END chunk_id="permissions_validateupdatepermissions_1784066609"]
-
-  // CIL[BEGIN chunk_id="permissions_validatefirstupdate_1784066609" type="function" identity="validateFirstSurfaceUpdatePermissions" parent="permissions_classification_1784066609"]
-// CIL[DOC-MACRO purpose="validateFirstSurfaceUpdatePermissions"]
-// CIL[DOC-RESPONSIBILITY responsibility="Handle validateFirstSurfaceUpdatePermissions"]
-// CIL[DOC-CONTEXT module="validateFirstSurfaceUpdatePermissions" layer="unknown" related_files="[]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Implements validateFirstSurfaceUpdatePermissions" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: unknown. Direct callers: 0. Direct calls: 0. Related files: none."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.validateUpdatePermissions permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.validateUpdatePermissions:method"]
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.validateFirstSurfaceUpdatePermissions:method" type="method" identity="_PermissionEngineInternal.validateFirstSurfaceUpdatePermissions" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.validateFirstSurfaceUpdatePermissions permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.validateFirstSurfaceUpdatePermissions behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="May return error results or throw on permission resolution failure" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.validateFirstSurfaceUpdatePermissions logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
   private async validateFirstSurfaceUpdatePermissions(
     ctx: RequestContext,
     updateData: any,
@@ -915,22 +969,22 @@ class _PermissionEngineInternal {
 
     return { valid: true, sanitizedData }
   }
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.validateFirstSurfaceUpdatePermissions permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.validateFirstSurfaceUpdatePermissions:method"]
 
-// CIL[END chunk_id="permissions_validatefirstupdate_1784066609"]
-  // CIL[BEGIN chunk_id="permissions_canprincipalaccessrecord_1784066609" type="function" identity="canPrincipalAccessRecord" parent="permissions_classification_1784066609"]
-// CIL[DOC-MACRO purpose="canPrincipalAccessRecord"]
-// CIL[DOC-RESPONSIBILITY responsibility="Handle canPrincipalAccessRecord"]
-// CIL[DOC-CONTEXT module="canPrincipalAccessRecord" layer="unknown" related_files="[]"]
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.canPrincipalAccessRecord:method" type="method" identity="_PermissionEngineInternal.canPrincipalAccessRecord" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.canPrincipalAccessRecord permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.canPrincipalAccessRecord behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
 // CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Implements canPrincipalAccessRecord" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.canPrincipalAccessRecord logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: unknown. Direct callers: 0. Direct calls: 0. Related files: none."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
-// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
-// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
   async canPrincipalAccessRecord(
     principal: Principal,
     record: { account_id: string; type?: string; [key: string]: any },
@@ -964,22 +1018,22 @@ class _PermissionEngineInternal {
     
     return false
   }
-// CIL[END chunk_id="permissions_canprincipalaccessrecord_1784066609"]
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.canPrincipalAccessRecord permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.canPrincipalAccessRecord:method"]
 
-  // CIL[BEGIN chunk_id="permissions_checkmachinescope_1784066609" type="function" identity="checkMachineScope" parent="permissions_classification_1784066609"]
-// CIL[DOC-MACRO purpose="checkMachineScope"]
-// CIL[DOC-RESPONSIBILITY responsibility="Handle checkMachineScope"]
-// CIL[DOC-CONTEXT module="checkMachineScope" layer="unknown" related_files="[]"]
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.checkMachineScope:method" type="method" identity="_PermissionEngineInternal.checkMachineScope" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.checkMachineScope permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.checkMachineScope behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
 // CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Implements checkMachineScope" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.checkMachineScope logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: unknown. Direct callers: 0. Direct calls: 0. Related files: none."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
-// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
-// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
   private checkMachineScope(
     principal: Principal,
     record: any,
@@ -1002,22 +1056,22 @@ class _PermissionEngineInternal {
     
     return false
   }
-
-// CIL[END chunk_id="permissions_checkmachinescope_1784066609"]
-  // CIL[BEGIN chunk_id="permissions_getprincipalsummary_1784066609" type="function" identity="getPrincipalPermissionSummary" parent="permissions_classification_1784066609"]
-// CIL[DOC-MACRO purpose="getPrincipalPermissionSummary"]
-// CIL[DOC-RESPONSIBILITY responsibility="Handle getPrincipalPermissionSummary"]
-// CIL[DOC-CONTEXT module="getPrincipalPermissionSummary" layer="unknown" related_files="[]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Implements getPrincipalPermissionSummary" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: unknown. Direct callers: 0. Direct calls: 0. Related files: none."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.checkMachineScope permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.checkMachineScope:method"]
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.getPrincipalPermissionSummary:method" type="method" identity="_PermissionEngineInternal.getPrincipalPermissionSummary" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal.getPrincipalPermissionSummary permission method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal.getPrincipalPermissionSummary behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="principal: Principal" outputs="object" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal.getPrincipalPermissionSummary logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
   getPrincipalPermissionSummary(principal: Principal): object {
     if (principal.type === 'human') {
       return {
@@ -1038,28 +1092,160 @@ class _PermissionEngineInternal {
     
     return { type: 'unknown' }
   }
-}
-
-// CIL[END chunk_id="permissions_getprincipalsummary_1784066609"]
-// CIL[BEGIN chunk_id="permissions_exports_1784066609" type="exports" identity="exports" parent="none"]
-// CIL[DOC-MACRO purpose="exports"]
-// CIL[DOC-RESPONSIBILITY responsibility="Handle exports"]
-// CIL[DOC-CONTEXT module="exports" layer="unknown" related_files="[]"]
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal.getPrincipalPermissionSummary permission method'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal.getPrincipalPermissionSummary:method"]
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal_close:class" type="class" identity="_PermissionEngineInternal_close" parent="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal:class"]
+// CIL[DOC-MACRO purpose="Implements the _PermissionEngineInternal_close class"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the _PermissionEngineInternal_close behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
 // CIL[DOC-CONTRACT inputs="none" outputs="none" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Implements exports" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-MICRO logic_summary="Implements the _PermissionEngineInternal_close logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: unknown. Direct callers: 0. Direct calls: 0. Related files: none."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+}
+// CIL[DOC-VECTOR type="context" content="purpose='Implements the _PermissionEngineInternal_close class'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:_PermissionEngineInternal_close:class"]
+
+
+
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:PermissionEngine:constant" type="constant" identity="PermissionEngine" parent="~/.framework/functions/_shared/permissions.ts"]
+// CIL[DOC-MACRO purpose="Exports the PermissionEngine convenience binding"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the PermissionEngine behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="none" outputs="_PermissionEngineInternal" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the PermissionEngine logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 export const PermissionEngine: _PermissionEngineInternal = _PermissionEngineInternal.getInstance()
+// CIL[DOC-VECTOR type="context" content="purpose='Exports the PermissionEngine convenience binding'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:PermissionEngine:constant"]
+
+
+
 
+
+
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:resolveFirstSurfacePermissions:constant" type="constant" identity="resolveFirstSurfacePermissions" parent="~/.framework/functions/_shared/permissions.ts"]
+// CIL[DOC-MACRO purpose="Exports the resolveFirstSurfacePermissions convenience binding"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the resolveFirstSurfacePermissions behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="PermissionEngine" outputs="none" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the resolveFirstSurfacePermissions logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 export const resolveFirstSurfacePermissions = PermissionEngine.resolveFirstSurfacePermissions.bind(PermissionEngine)
+// CIL[DOC-VECTOR type="context" content="purpose='Exports the resolveFirstSurfacePermissions convenience binding'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:resolveFirstSurfacePermissions:constant"]
+
+
+
+
+
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:isSystemAdmin:constant" type="constant" identity="isSystemAdmin" parent="~/.framework/functions/_shared/permissions.ts"]
+// CIL[DOC-MACRO purpose="Exports the isSystemAdmin convenience binding"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the isSystemAdmin behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="PermissionEngine" outputs="none" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the isSystemAdmin logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 export const isSystemAdmin = PermissionEngine.isSystemAdmin.bind(PermissionEngine)
+// CIL[DOC-VECTOR type="context" content="purpose='Exports the isSystemAdmin convenience binding'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:isSystemAdmin:constant"]
+
+
+
+
+
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:canAccessRecord:constant" type="constant" identity="canAccessRecord" parent="~/.framework/functions/_shared/permissions.ts"]
+// CIL[DOC-MACRO purpose="Exports the canAccessRecord convenience binding"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the canAccessRecord behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="PermissionEngine" outputs="none" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the canAccessRecord logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 export const canAccessRecord = PermissionEngine.canAccessRecord.bind(PermissionEngine)
+// CIL[DOC-VECTOR type="context" content="purpose='Exports the canAccessRecord convenience binding'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:canAccessRecord:constant"]
+
+
+
+
+
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:sanitizeRecordData:constant" type="constant" identity="sanitizeRecordData" parent="~/.framework/functions/_shared/permissions.ts"]
+// CIL[DOC-MACRO purpose="Exports the sanitizeRecordData convenience binding"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the sanitizeRecordData behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="PermissionEngine" outputs="none" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the sanitizeRecordData logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 export const sanitizeRecordData = PermissionEngine.sanitizeRecordData.bind(PermissionEngine)
+// CIL[DOC-VECTOR type="context" content="purpose='Exports the sanitizeRecordData convenience binding'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:sanitizeRecordData:constant"]
+
+
+
+
+
+
+// CIL[BEGIN stable_id="~/.framework/functions/_shared/permissions.ts:validateUpdatePermissions:constant" type="constant" identity="validateUpdatePermissions" parent="~/.framework/functions/_shared/permissions.ts"]
+// CIL[DOC-MACRO purpose="Exports the validateUpdatePermissions convenience binding"]
+// CIL[DOC-RESPONSIBILITY responsibility="Supplies the validateUpdatePermissions behavior for permission decisions"]
+// CIL[DOC-CONTEXT module="permissions" layer="functions" related_files=".framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts"]
+// CIL[DOC-CONTRACT inputs="PermissionEngine" outputs="none" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Implements the validateUpdatePermissions logic for the permissions module" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 export const validateUpdatePermissions = PermissionEngine.validateUpdatePermissions.bind(PermissionEngine)
-// CIL[END chunk_id="permissions_exports_1784066609"]
+// CIL[DOC-VECTOR type="context" content="purpose='Exports the validateUpdatePermissions convenience binding'; No verified external callers; imports: .framework/functions/_shared/db.ts,.framework/functions/_shared/principal.ts,.framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/_shared/permissions.ts:validateUpdatePermissions:constant"]
+
+
+