spine-framework 0.4.4 → 0.5.0-rc.5

package/.framework/functions/apps.ts

@@ -52,15 +52,14 @@ import { adminDb } from './_shared/db'
 import { emitLog } from './_shared/audit'
 import { isSystemAdmin } from './_shared/principal'
 import { PermissionEngine, sanitizeRecordData } from './_shared/permissions'
+// CIL[END stable_id="~/.framework/functions/apps.ts:module_header:module_header"]
 // CIL[DOC-VECTOR type="context" content="purpose='Application management handlers and CRUD operations for public.apps'; No verified external callers; imports: .framework/functions/_shared/middleware.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/audit.ts"]
 // CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
 // CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
 // CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-// CIL[END stable_id="~/.framework/functions/apps.ts:module_header:module_header"]
 
-// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:permissions:constant" type="constant" identity="permissions" parent="~/.framework/functions/apps.ts"]
 // CIL[DOC-MACRO purpose="Type alias shim for PermissionEngine"]
 // CIL[DOC-RESPONSIBILITY responsibility="Reference PermissionEngine with loose typing for app handlers"]
 // CIL[DOC-CONTEXT module="functions" layer="edge" related_files=".framework/functions/_shared/audit.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts,.framework/functions/apps.ts"]
@@ -68,15 +67,15 @@ import { PermissionEngine, sanitizeRecordData } from './_shared/permissions'
 // CIL[DOC-MICRO logic_summary="Casts PermissionEngine to any to avoid strict type errors in this module" notable_decisions="Should be replaced by a properly typed export from the permissions engine"]
 // CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
+// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:permissions:constant" type="constant" identity="permissions" parent="~/.framework/functions/apps.ts"]
 const permissions = PermissionEngine as any
+// CIL[END stable_id="~/.framework/functions/apps.ts:permissions:constant"]
 // CIL[DOC-VECTOR type="context" content="purpose='Type alias shim for PermissionEngine'; No verified external callers; imports: .framework/functions/_shared/middleware.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/audit.ts"]
 // CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
 // CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
 // CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-// CIL[END stable_id="~/.framework/functions/apps.ts:permissions:constant"]
-// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:list:constant" type="constant" identity="list" parent="~/.framework/functions/apps.ts"]
 // CIL[DOC-MACRO purpose="List apps for an account with optional filters"]
 // CIL[DOC-RESPONSIBILITY responsibility="Return a sanitized list of apps accessible to the caller's roles"]
 // CIL[DOC-CONTEXT module="functions" layer="edge" related_files=".framework/functions/_shared/audit.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts,.framework/functions/apps.ts"]
@@ -84,6 +83,7 @@ const permissions = PermissionEngine as any
 // CIL[DOC-MICRO logic_summary="Resolves target account, selects adminDb for system admins, calls get_account_apps RPC, and sanitizes each record" notable_decisions="Defaults include_system to true unless explicitly false; uses sanitizeRecordData per row"]
 // CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
+// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:list:constant" type="constant" identity="list" parent="~/.framework/functions/apps.ts"]
 export const list = createHandler(async (ctx, body) => {
   const { include_system, include_inactive, account_id } = ctx.query || {}
 
@@ -93,12 +93,25 @@ export const list = createHandler(async (ctx, body) => {
     throw new Error('Account context required')
   }
 
-  const db = isSystemAdmin(ctx.principal) ? adminDb : ctx.db
-
   const userRoles = ctx.principal?.roles || []
   const isSysAdmin = userRoles.includes('system_admin')
+  const isSystem = isSysAdmin || (ctx.principal?.isInternal === true && !ctx.accountId)
+
+  // get_account_apps is service-role-only — the account boundary is enforced
+  // here. A scoped caller may only resolve apps inside its access set
+  // (own account plus descendants); the query param alone never widened that.
+  if (!isSystem && targetAccountId !== ctx.accountId) {
+    const { data: accessible, error: accessErr } = await adminDb
+      .rpc('get_accessible_accounts', { actor_id: ctx.principal?.id })
+    const ids = (accessible || []).map((r: any) => r.account_id ?? r)
+    if (accessErr || !ids.includes(targetAccountId)) {
+      const e: any = new Error('Account not accessible')
+      e.statusCode = 403
+      throw e
+    }
+  }
 
-  const { data, error: err } = await db
+  const { data, error: err } = await adminDb
     .rpc('get_account_apps', {
       account_id: targetAccountId,
       include_system: include_system !== 'false',
@@ -117,14 +130,13 @@ export const list = createHandler(async (ctx, body) => {
 
   return sanitized
 })
+// CIL[END stable_id="~/.framework/functions/apps.ts:list:constant"]
 // CIL[DOC-VECTOR type="context" content="purpose='List apps for an account with optional filters'; No verified external callers; imports: .framework/functions/_shared/middleware.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/audit.ts"]
 // CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
 // CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
 // CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-// CIL[END stable_id="~/.framework/functions/apps.ts:list:constant"]
-// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:get:constant" type="constant" identity="get" parent="~/.framework/functions/apps.ts"]
 // CIL[DOC-MACRO purpose="Fetch a single active app by id or slug"]
 // CIL[DOC-RESPONSIBILITY responsibility="Return a sanitized app record matching the requested id or slug"]
 // CIL[DOC-CONTEXT module="functions" layer="edge" related_files=".framework/functions/_shared/audit.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts,.framework/functions/apps.ts"]
@@ -132,6 +144,7 @@ export const list = createHandler(async (ctx, body) => {
 // CIL[DOC-MICRO logic_summary="Queries the apps table by id or slug, limits to active records, and returns sanitized data" notable_decisions="Prefers id over slug; uses .single() to enforce a single result"]
 // CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
+// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:get:constant" type="constant" identity="get" parent="~/.framework/functions/apps.ts"]
 export const get = createHandler(async (ctx, body) => {
   const { id, slug } = ctx.query || {}
   
@@ -159,14 +172,13 @@ export const get = createHandler(async (ctx, body) => {
   
   return await sanitizeRecordData(ctx, data, 'app')
 })
+// CIL[END stable_id="~/.framework/functions/apps.ts:get:constant"]
 // CIL[DOC-VECTOR type="context" content="purpose='Fetch a single active app by id or slug'; No verified external callers; imports: .framework/functions/_shared/middleware.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/audit.ts"]
 // CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
 // CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
 // CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-// CIL[END stable_id="~/.framework/functions/apps.ts:get:constant"]
-// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:getSchema:constant" type="constant" identity="getSchema" parent="~/.framework/functions/apps.ts"]
 // CIL[DOC-MACRO purpose="Retrieve the design schema for an app by slug"]
 // CIL[DOC-RESPONSIBILITY responsibility="Return the schema payload from the get_app_schema RPC"]
 // CIL[DOC-CONTEXT module="functions" layer="edge" related_files=".framework/functions/_shared/audit.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts,.framework/functions/apps.ts"]
@@ -174,6 +186,7 @@ export const get = createHandler(async (ctx, body) => {
 // CIL[DOC-MICRO logic_summary="Validates the slug and invokes the get_app_schema RPC, returning the result" notable_decisions="Relies on a database stored procedure for schema generation"]
 // CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
+// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:getSchema:constant" type="constant" identity="getSchema" parent="~/.framework/functions/apps.ts"]
 export const getSchema = createHandler(async (ctx, body) => {
   const { slug } = ctx.query || {}
 
@@ -188,14 +201,13 @@ export const getSchema = createHandler(async (ctx, body) => {
 
   return data
 })
+// CIL[END stable_id="~/.framework/functions/apps.ts:getSchema:constant"]
 // CIL[DOC-VECTOR type="context" content="purpose='Retrieve the design schema for an app by slug'; No verified external callers; imports: .framework/functions/_shared/middleware.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/audit.ts"]
 // CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
 // CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
 // CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-// CIL[END stable_id="~/.framework/functions/apps.ts:getSchema:constant"]
-// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:create:constant" type="constant" identity="create" parent="~/.framework/functions/apps.ts"]
 // CIL[DOC-MACRO purpose="Create a new app record"]
 // CIL[DOC-RESPONSIBILITY responsibility="Validate input and permissions, insert a new app row, and emit an audit log"]
 // CIL[DOC-CONTEXT module="functions" layer="edge" related_files=".framework/functions/_shared/audit.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts,.framework/functions/apps.ts"]
@@ -203,8 +215,9 @@ export const getSchema = createHandler(async (ctx, body) => {
 // CIL[DOC-MICRO logic_summary="Enforces required fields and auth, checks create permission, ensures slug uniqueness, inserts with defaults, and emits an audit event" notable_decisions="Defaults version, app_type, source, route_prefix, and min_role; only system admins bypass permission checks"]
 // CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
+// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:create:constant" type="constant" identity="create" parent="~/.framework/functions/apps.ts"]
 export const create = createHandler(async (ctx, body) => {
-  const { slug, name, description, icon, color, version, app_type, source, owner_account_id, config, nav_items, min_role, integration_deps, metadata, route_prefix, renderer } = body
+  const { slug, name, description, icon, color, version, app_type, source, owner_account_id, config, nav_items, min_role, required_roles, integration_deps, metadata, route_prefix, renderer, preview_domain, prod_domain, preview_route_prefix, prod_route_prefix } = body
 
   if (!slug || !name) {
     throw new Error('slug and name are required')
@@ -239,7 +252,7 @@ export const create = createHandler(async (ctx, body) => {
     throw new Error('App slug already exists')
   }
 
-  const { data, error: err } = await ctx.db
+  const { data, error: err } = await adminDb
     .from('apps')
     .insert({
       slug,
@@ -254,10 +267,15 @@ export const create = createHandler(async (ctx, body) => {
       config: config || {},
       nav_items: nav_items || [],
       min_role: min_role || 'member',
+      required_roles: required_roles || [],
       integration_deps: integration_deps || [],
       metadata: metadata || {},
       route_prefix: route_prefix !== undefined ? route_prefix : ('/' + slug),
       renderer: renderer || 'generic',
+      preview_domain: preview_domain ?? null,
+      prod_domain: prod_domain ?? null,
+      preview_route_prefix: preview_route_prefix ?? null,
+      prod_route_prefix: prod_route_prefix ?? null,
       is_active: true,
       is_system: false
     })
@@ -270,14 +288,13 @@ export const create = createHandler(async (ctx, body) => {
 
   return data
 })
+// CIL[END stable_id="~/.framework/functions/apps.ts:create:constant"]
 // CIL[DOC-VECTOR type="context" content="purpose='Create a new app record'; No verified external callers; imports: .framework/functions/_shared/middleware.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/audit.ts"]
 // CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
 // CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
 // CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-// CIL[END stable_id="~/.framework/functions/apps.ts:create:constant"]
-// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:update:constant" type="constant" identity="update" parent="~/.framework/functions/apps.ts"]
 // CIL[DOC-MACRO purpose="Update an existing app"]
 // CIL[DOC-RESPONSIBILITY responsibility="Validate the caller, load the current record, check field-level permissions, and apply updates"]
 // CIL[DOC-CONTEXT module="functions" layer="edge" related_files=".framework/functions/_shared/audit.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts,.framework/functions/apps.ts"]
@@ -285,6 +302,7 @@ export const create = createHandler(async (ctx, body) => {
 // CIL[DOC-MICRO logic_summary="Finds the current record, validates update permissions, sets updated_at, persists changes, and emits an audit event" notable_decisions="Strips body id from updates; uses validateUpdatePermissions to enforce field-level access"]
 // CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
+// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:update:constant" type="constant" identity="update" parent="~/.framework/functions/apps.ts"]
 export const update = createHandler(async (ctx, body) => {
   const id = body?.id || ctx.query?.id
   const { id: _bodyId, ...updates } = body || {}
@@ -320,7 +338,7 @@ export const update = createHandler(async (ctx, body) => {
     throw new Error(fieldValidation.error)
   }
 
-  const { data, error: err } = await ctx.db
+  const { data, error: err } = await adminDb
     .from('apps')
     .update({
       ...updates,
@@ -336,14 +354,13 @@ export const update = createHandler(async (ctx, body) => {
 
   return data
 })
+// CIL[END stable_id="~/.framework/functions/apps.ts:update:constant"]
 // CIL[DOC-VECTOR type="context" content="purpose='Update an existing app'; No verified external callers; imports: .framework/functions/_shared/middleware.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/audit.ts"]
 // CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
 // CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
 // CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-// CIL[END stable_id="~/.framework/functions/apps.ts:update:constant"]
-// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:remove:constant" type="constant" identity="remove" parent="~/.framework/functions/apps.ts"]
 // CIL[DOC-MACRO purpose="Soft-delete an app"]
 // CIL[DOC-RESPONSIBILITY responsibility="Set is_active to false for an app after authentication and existence checks"]
 // CIL[DOC-CONTEXT module="functions" layer="edge" related_files=".framework/functions/_shared/audit.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts,.framework/functions/apps.ts"]
@@ -351,6 +368,7 @@ export const update = createHandler(async (ctx, body) => {
 // CIL[DOC-MICRO logic_summary="Loads the record, flips the is_active flag and updated_at, and emits an audit event" notable_decisions="Performs a soft delete rather than a hard delete"]
 // CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
+// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:remove:constant" type="constant" identity="remove" parent="~/.framework/functions/apps.ts"]
 export const remove = createHandler(async (ctx, body) => {
   const id = body?.id || ctx.query?.id
 
@@ -373,7 +391,19 @@ export const remove = createHandler(async (ctx, body) => {
     throw new Error('App not found')
   }
 
-  const { data, error: err } = await ctx.db
+  if (!permissions.isSystemAdmin(ctx)) {
+    const perms = await permissions.resolveFirstSurfacePermissions(
+      ctx.principal.id,
+      ctx.accountId!,
+      'app',
+      'delete'
+    )
+    if (!perms.canDelete) {
+      throw new Error('Insufficient permissions to delete apps')
+    }
+  }
+
+  const { data, error: err } = await adminDb
     .from('apps')
     .update({
       is_active: false,
@@ -389,14 +419,13 @@ export const remove = createHandler(async (ctx, body) => {
 
   return data
 })
+// CIL[END stable_id="~/.framework/functions/apps.ts:remove:constant"]
 // CIL[DOC-VECTOR type="context" content="purpose='Soft-delete an app'; No verified external callers; imports: .framework/functions/_shared/middleware.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/audit.ts"]
 // CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
 // CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
 // CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-// CIL[END stable_id="~/.framework/functions/apps.ts:remove:constant"]
-// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:checkAvailability:constant" type="constant" identity="checkAvailability" parent="~/.framework/functions/apps.ts"]
 // CIL[DOC-MACRO purpose="Check whether a slug is available for an account"]
 // CIL[DOC-RESPONSIBILITY responsibility="Return an availability boolean from the is_app_available RPC"]
 // CIL[DOC-CONTEXT module="functions" layer="edge" related_files=".framework/functions/_shared/audit.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts,.framework/functions/apps.ts"]
@@ -404,6 +433,7 @@ export const remove = createHandler(async (ctx, body) => {
 // CIL[DOC-MICRO logic_summary="Validates the slug and account, then calls the is_app_available RPC" notable_decisions="Uses an account-scoped stored procedure to determine availability"]
 // CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
+// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:checkAvailability:constant" type="constant" identity="checkAvailability" parent="~/.framework/functions/apps.ts"]
 export const checkAvailability = createHandler(async (ctx, body) => {
   const { slug } = ctx.query || {}
 
@@ -425,14 +455,13 @@ export const checkAvailability = createHandler(async (ctx, body) => {
 
   return { available: data }
 })
+// CIL[END stable_id="~/.framework/functions/apps.ts:checkAvailability:constant"]
 // CIL[DOC-VECTOR type="context" content="purpose='Check whether a slug is available for an account'; No verified external callers; imports: .framework/functions/_shared/middleware.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/audit.ts"]
 // CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
 // CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
 // CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-// CIL[END stable_id="~/.framework/functions/apps.ts:checkAvailability:constant"]
-// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:updateVersion:constant" type="constant" identity="updateVersion" parent="~/.framework/functions/apps.ts"]
 // CIL[DOC-MACRO purpose="Update an app version via a stored procedure"]
 // CIL[DOC-RESPONSIBILITY responsibility="Bump the version of an app and emit an audit log"]
 // CIL[DOC-CONTEXT module="functions" layer="edge" related_files=".framework/functions/_shared/audit.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts,.framework/functions/apps.ts"]
@@ -440,6 +469,7 @@ export const checkAvailability = createHandler(async (ctx, body) => {
 // CIL[DOC-MICRO logic_summary="Validates inputs, calls the update_app_version RPC, and emits an audit event" notable_decisions="RPC encapsulates version logic and any related triggers"]
 // CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
+// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:updateVersion:constant" type="constant" identity="updateVersion" parent="~/.framework/functions/apps.ts"]
 export const updateVersion = createHandler(async (ctx, body) => {
   const { id, version } = body
 
@@ -447,7 +477,11 @@ export const updateVersion = createHandler(async (ctx, body) => {
     throw new Error('App ID and version are required')
   }
 
-  const { data, error: err } = await ctx.db
+  if (!permissions.isSystemAdmin(ctx)) {
+    throw new Error('Insufficient permissions to update app version')
+  }
+
+  const { data, error: err } = await adminDb
     .rpc('update_app_version', {
       app_id: id,
       new_version: version
@@ -459,14 +493,13 @@ export const updateVersion = createHandler(async (ctx, body) => {
 
   return { success: true }
 })
+// CIL[END stable_id="~/.framework/functions/apps.ts:updateVersion:constant"]
 // CIL[DOC-VECTOR type="context" content="purpose='Update an app version via a stored procedure'; No verified external callers; imports: .framework/functions/_shared/middleware.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/audit.ts"]
 // CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
 // CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
 // CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-// CIL[END stable_id="~/.framework/functions/apps.ts:updateVersion:constant"]
-// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:handler:constant" type="constant" identity="handler" parent="~/.framework/functions/apps.ts"]
 // CIL[DOC-MACRO purpose="Dispatch incoming app requests to the correct handler by HTTP method and action"]
 // CIL[DOC-RESPONSIBILITY responsibility="Route GET/POST/PATCH/DELETE methods to the appropriate list, get, schema, create, update, remove, and version handlers"]
 // CIL[DOC-CONTEXT module="functions" layer="edge" related_files=".framework/functions/_shared/audit.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/middleware.ts,.framework/functions/_shared/permissions.ts,.framework/functions/_shared/principal.ts,.framework/functions/apps.ts"]
@@ -474,6 +507,7 @@ export const updateVersion = createHandler(async (ctx, body) => {
 // CIL[DOC-MICRO logic_summary="Switches on HTTP method and query params to dispatch to the appropriate app operation" notable_decisions="GET with id or slug maps to get; action schema/available handled; POST action version or create; PATCH update; DELETE remove"]
 // CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
+// CIL[BEGIN stable_id="~/.framework/functions/apps.ts:handler:constant" type="constant" identity="handler" parent="~/.framework/functions/apps.ts"]
 export const handler = createHandler(async (ctx, body) => {
   const method = ctx.query?.method || 'GET'
 
@@ -504,10 +538,10 @@ export const handler = createHandler(async (ctx, body) => {
       throw new Error(`Unsupported method: ${method}`)
   }
 })
+// CIL[END stable_id="~/.framework/functions/apps.ts:handler:constant"]
 // CIL[DOC-VECTOR type="context" content="purpose='Dispatch incoming app requests to the correct handler by HTTP method and action'; No verified external callers; imports: .framework/functions/_shared/middleware.ts,.framework/functions/_shared/db.ts,.framework/functions/_shared/audit.ts"]
 // CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
 // CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
 // CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-// CIL[END stable_id="~/.framework/functions/apps.ts:handler:constant"]

package/.framework/functions/cil-ingest.ts

@@ -168,9 +168,9 @@ interface ChunkProposal {
 // CIL[DOC-MICRO logic_summary="Holds the static LANGUAGE_MAP value" notable_decisions="Static value used across cil-ingest"]
 const LANGUAGE_MAP: Record<string, string> = {
   '.ts': 'typescript',
-  '.tsx': 'typescript',
+  '.tsx': 'typescriptreact',
   '.js': 'javascript',
-  '.jsx': 'javascript',
+  '.jsx': 'javascriptreact',
   '.sql': 'sql',
   '.py': 'python',
   '.go': 'go',
@@ -1606,9 +1606,9 @@ async function pass2Chunk(
   for (const fileItem of fileItems || []) {
     const relPath: string = fileItem.data?.file_path || fileItem.title
     const absPath = path.join(repoPath, relPath)
-    const language = fileItem.data?.language || 'unknown'
+    const language = detectLanguage(relPath)
 
-    if (!['typescript', 'javascript'].includes(language)) continue
+    if (!['typescript', 'typescriptreact', 'javascript', 'javascriptreact'].includes(language)) continue
 
     if (!forceReprocess && alreadyChunkedFileIds.has(fileItem.id)) continue
 
@@ -1628,13 +1628,23 @@ async function pass2Chunk(
 
       const rawContent = fs.readFileSync(absPath, 'utf-8')
       const rawLines = rawContent.split('\n')
-      // Blank (rather than remove) CIL marker/DOC lines when force-reprocessing:
+      // Blank (rather than remove) CIL BEGIN/END marker lines when force-reprocessing:
       // filtering them out shifts every line index, so stored line_start/line_end
       // land in stripped-file coordinates and validate_file reports false drift.
       // Blank lines are invisible to the AST proposer and collapse in
       // computeContentHash, keeping hashes identical to store_markers output.
+      // DOC tags are intentionally preserved — they are source-of-truth docs.
+      // markerResidue tracks blanked marker slots so the write pass can drop
+      // residue that ends up adjacent to a fresh marker (prevents +1 drift).
+      const markerResidue = new Set<number>()
       const lines = forceReprocess
-        ? rawLines.map((l: string) => (/^\/\/\s*CIL\[/.test(l.trim()) || /^\s*\/\*\s*CIL\[/.test(l.trim())) ? '' : l)
+        ? rawLines.map((l: string, i: number) => {
+            if (/^\/\/\s*CIL\[(?:BEGIN|END)\b/.test(l.trim()) || /^\s*\/\*\s*CIL\[(?:BEGIN|END)\b/.test(l.trim())) {
+              markerResidue.add(i)
+              return ''
+            }
+            return l
+          })
         : rawLines
       const content = lines.join('\n')
 
@@ -1832,7 +1842,7 @@ async function pass2Chunk(
             },
           })
           
-          approvedChunks.push({ name: proposal.name, stable_id: proposal.stable_id, line_start: proposal.line_start, line_end: proposal.line_end, marker_line_end: proposal.marker_line_end, chunk_type: proposal.chunk_type, is_proposal: true })
+          approvedChunks.push({ name: proposal.name, stable_id: proposal.stable_id, parent_stable_id: proposal.parent_stable_id || canonicalPath, line_start: proposal.line_start, line_end: proposal.line_end, marker_line_end: proposal.marker_line_end, chunk_type: proposal.chunk_type, is_proposal: true })
           chunksQueued++
         }
       }
@@ -1844,25 +1854,47 @@ async function pass2Chunk(
         let resultLines = [...lines]
 
 
-        const sorted = [...approvedChunks].sort((a, b) => b.line_start - a.line_start)
-
-        for (const chunk of sorted) {
-          const startLine = resultLines[chunk.line_start - 1]
+        // Compute every insertion index against the pre-insertion `lines`, then
+        // apply splices bottom-up. Indexing the mutating resultLines (the old
+        // approach) broke on nested chunks: declarations inside a component
+        // shifted its closing lines, so the parent's END marker landed mid-JSX.
+        const insertions: { idx: number; begin: boolean; text: string }[] = []
+        for (const chunk of approvedChunks) {
+          const startLine = lines[chunk.line_start - 1]
           
           if (startLine && ANY_MARKER_RE.test(startLine.trim())) continue
 
           const startMarker = chunk.is_proposal ? proposalStartMarker(chunk.name) : chunkStartMarker(chunk.stable_id, chunk.chunk_type, chunk.name, chunk.parent_stable_id)
           const endMarker   = chunk.is_proposal ? proposalEndMarker(chunk.name)   : chunkEndMarker(chunk.stable_id)
-          const startIdx = markerInsertIdx(resultLines, chunk.line_start)
+          const startIdx = markerInsertIdx(lines, chunk.line_start)
           
           const endIdx = chunk.chunk_type === 'module_header'
             ? chunk.marker_line_end
-            : markerEndInsertIdx(resultLines, chunk.line_start, chunk.marker_line_end)
+            : markerEndInsertIdx(lines, chunk.line_start, chunk.marker_line_end)
 
-          resultLines.splice(endIdx, 0, endMarker)
-          resultLines.splice(startIdx, 0, startMarker)
+          insertions.push({ idx: startIdx, begin: true, text: startMarker })
+          insertions.push({ idx: endIdx, begin: false, text: endMarker })
           markersWritten++
         }
+        insertions.sort((a, b) => b.idx - a.idx || (a.begin === b.begin ? 0 : a.begin ? -1 : 1))
+        for (const ins of insertions) {
+          resultLines.splice(ins.idx, 0, ins.text)
+          if (markerResidue.size) {
+            const shifted = new Set<number>()
+            for (const r of markerResidue) shifted.add(r >= ins.idx ? r + 1 : r)
+            markerResidue.clear()
+            shifted.forEach(r => markerResidue.add(r))
+          }
+        }
+        // Remove the blanked old-marker slots after fresh markers are in place.
+        // Fresh markers occupy equivalent positions, so this is a swap where
+        // markers did not move — and it prevents residue lines from ratcheting
+        // +1 line per pass wherever old and new positions disagree.
+        for (let i = resultLines.length - 1; i >= 0; i--) {
+          if (markerResidue.has(i) && (resultLines[i] || '').trim() === '') {
+            resultLines.splice(i, 1)
+          }
+        }
 
 
         fs.writeFileSync(absPath, resultLines.join('\n'), 'utf-8')
@@ -1873,6 +1905,7 @@ async function pass2Chunk(
         id: fileItem.id,
         data: {
           ...fileItem.data,
+          language,
           stored_hash: fileHash,
           file_hash: fileHash,
           content_hash: fileHash,

package/.framework/functions/debug-auth.ts

@@ -24,14 +24,14 @@
 
 
 import { createHandler } from './_shared/middleware'
+import { isSystemAdmin } from './_shared/principal'
+// CIL[END stable_id="~/.framework/functions/debug-auth.ts:module_header:module_header"]
 // CIL[DOC-VECTOR type="context" content="purpose='Netlify function for debugging authentication state and JWT token resolution'; No verified external callers; imports: .framework/functions/_shared/middleware.ts"]
 // CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
 // CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
 // CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-// CIL[END stable_id="~/.framework/functions/debug-auth.ts:module_header:module_header"]
-// CIL[BEGIN stable_id="~/.framework/functions/debug-auth.ts:debug:constant" type="constant" identity="debug" parent="~/.framework/functions/debug-auth.ts"]
 // CIL[DOC-MACRO purpose="Return a debug payload showing whether a principal and selected environment variables are present"]
 // CIL[DOC-RESPONSIBILITY responsibility="Builds a safe, read-only debug response from request context and process.env"]
 // CIL[DOC-CONTEXT module="framework/functions" layer="functions" related_files=".framework/functions/_shared/middleware.ts,.framework/functions/debug-auth.ts"]
@@ -39,6 +39,7 @@ import { createHandler } from './_shared/middleware'
 // CIL[DOC-MICRO logic_summary="Checks the request context for a principal and masks environment variable presence" notable_decisions="Only reports SET/NOT_SET for sensitive env values"]
 // CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
+// CIL[BEGIN stable_id="~/.framework/functions/debug-auth.ts:debug:constant" type="constant" identity="debug" parent="~/.framework/functions/debug-auth.ts"]
 const debug = createHandler(async (ctx, _body) => {
   const envObj = (globalThis as any).process?.env || {}
   return {
@@ -54,14 +55,13 @@ const debug = createHandler(async (ctx, _body) => {
     }
   }
 })
+// CIL[END stable_id="~/.framework/functions/debug-auth.ts:debug:constant"]
 // CIL[DOC-VECTOR type="context" content="purpose='Return a debug payload showing whether a principal and selected environment variables are present'; No verified external callers; imports: .framework/functions/_shared/middleware.ts"]
 // CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
 // CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
 // CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-// CIL[END stable_id="~/.framework/functions/debug-auth.ts:debug:constant"]
-// CIL[BEGIN stable_id="~/.framework/functions/debug-auth.ts:testJwt:constant" type="constant" identity="testJwt" parent="~/.framework/functions/debug-auth.ts"]
 // CIL[DOC-MACRO purpose="Validate and return the resolved JWT principal for a request"]
 // CIL[DOC-RESPONSIBILITY responsibility="Verifies a principal exists and returns its identity and account association"]
 // CIL[DOC-CONTEXT module="framework/functions" layer="functions" related_files=".framework/functions/_shared/middleware.ts,.framework/functions/debug-auth.ts"]
@@ -69,6 +69,7 @@ const debug = createHandler(async (ctx, _body) => {
 // CIL[DOC-MICRO logic_summary="Returns principal data or an error if authentication did not resolve" notable_decisions="Includes accountId from the request context"]
 // CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
+// CIL[BEGIN stable_id="~/.framework/functions/debug-auth.ts:testJwt:constant" type="constant" identity="testJwt" parent="~/.framework/functions/debug-auth.ts"]
 const testJwt = createHandler(async (ctx, _body) => {
   const envObj = (globalThis as any).process?.env || {}
   if (!ctx.principal) {
@@ -89,14 +90,13 @@ const testJwt = createHandler(async (ctx, _body) => {
     }
   }
 })
+// CIL[END stable_id="~/.framework/functions/debug-auth.ts:testJwt:constant"]
 // CIL[DOC-VECTOR type="context" content="purpose='Validate and return the resolved JWT principal for a request'; No verified external callers; imports: .framework/functions/_shared/middleware.ts"]
 // CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
 // CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
 // CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-// CIL[END stable_id="~/.framework/functions/debug-auth.ts:testJwt:constant"]
-// CIL[BEGIN stable_id="~/.framework/functions/debug-auth.ts:handler:function" type="function" identity="handler" parent="~/.framework/functions/debug-auth.ts"]
 // CIL[DOC-MACRO purpose="Route incoming requests to the debug or testJwt handler"]
 // CIL[DOC-RESPONSIBILITY responsibility="Dispatches by query method to the appropriate handler and returns the result"]
 // CIL[DOC-CONTEXT module="framework/functions" layer="functions" related_files=".framework/functions/_shared/middleware.ts,.framework/functions/debug-auth.ts"]
@@ -104,10 +104,16 @@ const testJwt = createHandler(async (ctx, _body) => {
 // CIL[DOC-MICRO logic_summary="Reads the method query parameter, switches to debug or testJwt, and awaits the handler" notable_decisions="Defaults unknown methods to debug"]
 // CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
 // CIL[DOC-STABILITY stability="stable"]
+// CIL[BEGIN stable_id="~/.framework/functions/debug-auth.ts:handler:function" type="function" identity="handler" parent="~/.framework/functions/debug-auth.ts"]
 export async function handler(event: any, context: any) {
   const method = event.queryStringParameters?.method || 'debug'
   
   const ctx = await createHandler(async (ctx, _body) => {
+    if (!isSystemAdmin(ctx.principal)) {
+      const e: any = new Error('system_admin required')
+      e.statusCode = 403
+      throw e
+    }
     switch (method) {
       case 'debug':
         return await debug(ctx, _body)
@@ -120,10 +126,10 @@ export async function handler(event: any, context: any) {
   
   return ctx
 }
+// CIL[END stable_id="~/.framework/functions/debug-auth.ts:handler:function"]
 // CIL[DOC-VECTOR type="context" content="purpose='Route incoming requests to the debug or testJwt handler'; No verified external callers; imports: .framework/functions/_shared/middleware.ts"]
 // CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
 // CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
 // CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
-// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-// CIL[END stable_id="~/.framework/functions/debug-auth.ts:handler:function"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]