Private/Get-GraphPermissionIndex.ps1

function Get-GraphPermissionIndex {
    <#
    .SYNOPSIS
        Loads and caches the permission -> record-id reverse index.
    .DESCRIPTION
        Reads data/graph-command-permissions.json once per session. This is the reverse
        index used by Get-GraphMapping -Permission so that a permission lookup does not
        require scanning the whole catalog.
    #>

    [CmdletBinding()]
    [OutputType([pscustomobject])]
    param(
        [switch]$Force
    )

    if (-not $Force -and $script:GraphPermissionCache) {
        return $script:GraphPermissionCache
    }

    $paths = Get-GraphCatalogPath
    if (-not $paths.PermissionsPath) {
        throw "GraphShell could not locate graph-command-permissions.json. Run scripts/sync-graph-command-index.ps1 or set `$env:GRAPHSHELL_CATALOG_PATH."
    }
    Write-Verbose "Loading GraphShell permission index from $($paths.PermissionsPath)"

    $raw = Get-Content -LiteralPath $paths.PermissionsPath -Raw
    $parsed = $raw | ConvertFrom-Json

    $byName = [System.Collections.Generic.Dictionary[string, object]]::new([System.StringComparer]::OrdinalIgnoreCase)
    foreach ($property in $parsed.permissions.PSObject.Properties) {
        $byName[$property.Name] = $property.Value
    }

    $script:GraphPermissionCache = [pscustomobject]@{
        Source = $parsed.source
        ByName = $byName
        Names  = [string[]]$byName.Keys
    }

    return $script:GraphPermissionCache
}