@carthooks/arcubase-cli 0.1.12 → 0.1.13

package/bundle/arcubase-admin.mjs

@@ -6660,8 +6660,9 @@ function renderCommandHelp(scope, moduleName, commandName, env = process.env) {
       '  - update policy: {"update":["options"],"options":{"policy":{"key":"custom","actions":["view","add","edit"],"all_fields_read":true,"all_fields_write":true,"fields":[{"key":":1002","read":false,"write":false,"report":false}]},"list_options":{}}}'
     ] : [],
     ...scope === "admin" && command.commandPath[0] === "access-rule" && command.commandPath[1] === "create" ? [
-      "body-json example:",
-      '  - {"name":"Sales read write","enabled":true,"type":"form","options":{"user_scope":[{"type":"user","id":2188889901}],"policy":{"key":"custom","actions":["view","add","edit"],"all_fields_read":false,"all_fields_write":false,"fields":[{"key":":1001","read":true,"write":true,"report":false},{"key":":1002","read":false,"write":false,"report":false}]},"list_options":{}}}',
+      "body-json examples:",
+      `  - full access: ${JSON.stringify(buildFullAccessRuleBody())}`,
+      `  - hide field: ${JSON.stringify(buildHiddenFieldAccessRuleBody())}`,
       "success requires:",
       "  - result.enabled must be true",
       '  - options.user_scope[].type is "user" for tenant users',
@@ -7040,6 +7041,26 @@ function isAccessRuleUpdateCommand(scope, command) {
   return scope === "admin" && command.commandPath[0] === "access-rule" && command.commandPath[1] === "update";
 }
 function buildAccessRuleShapeHint(userId = 2188889901) {
+  return buildHiddenFieldAccessRuleBody(userId);
+}
+function buildFullAccessRuleBody(userId = 2188889977) {
+  return {
+    name: "Admin full access",
+    enabled: true,
+    type: "form",
+    options: {
+      user_scope: [{ type: "user", id: userId }],
+      policy: {
+        key: "custom",
+        actions: ["view", "add", "edit", "delete"],
+        all_fields_read: true,
+        all_fields_write: true
+      },
+      list_options: {}
+    }
+  };
+}
+function buildHiddenFieldAccessRuleBody(userId = 2188889901) {
   return {
     name: "Sales read write",
     enabled: true,
@@ -7057,6 +7078,12 @@ function buildAccessRuleShapeHint(userId = 2188889901) {
     }
   };
 }
+function buildAccessRuleCreateToolCall(body) {
+  return {
+    command: "access-rule create",
+    args: ["--app-id", "<app_id>", "--table-id", "<table_id>", "--body-json", JSON.stringify(body)]
+  };
+}
 function buildAssignUsersValidationDetails(scope, command, requestType, path, message, env = process.env) {
   return {
     operation: `${scope}.${command.module}.${command.functionName}`,
@@ -7194,7 +7221,15 @@ function buildBodyGuidance(requestType) {
     };
   }
   if (requestType === "AppIngressCreateReqVO" || requestType === "AppIngressUpdateReqVO") {
+    const retryToolCalls = [
+      buildAccessRuleCreateToolCall(buildFullAccessRuleBody()),
+      buildAccessRuleCreateToolCall(buildHiddenFieldAccessRuleBody())
+    ];
     return {
+      retryToolCalls,
+      suggestions: [
+        "next arcubase-admin-cli input: retryToolCalls[0] for full access or retryToolCalls[1] for hidden-field access"
+      ],
       shapeHint: buildAccessRuleShapeHint(),
       commonMistakes: [
         "use options.policy, not top-level permissions",
@@ -7647,6 +7682,60 @@ function unwrapData(value) {
   }
   return current;
 }
+function numericFieldKeys(fields) {
+  if (!isRecord2(fields)) return [];
+  return Object.keys(fields).filter((key) => /^\d+$/.test(key)).sort((left, right) => Number(left) - Number(right));
+}
+function permitFieldId(permit) {
+  if (!isRecord2(permit) || typeof permit.key !== "string") return void 0;
+  const match = /^:(\d+)$/.exec(permit.key);
+  return match?.[1];
+}
+function rowFieldPermits(value) {
+  const data = unwrapData(value);
+  const fieldPermits = isRecord2(data) && isRecord2(data.fieldPermits) ? data.fieldPermits : void 0;
+  return fieldPermits && Array.isArray(fieldPermits.fields) ? fieldPermits.fields.filter((item) => isRecord2(item)) : [];
+}
+function buildRowValueEvidence(command, responseBody) {
+  if (command.scope !== "user" || command.commandPath[0] !== "row") return void 0;
+  const action = command.commandPath[1];
+  const data = unwrapData(responseBody);
+  const rules = [
+    "current row values come only from row query fields or row get record.fields",
+    "table schema fields[].value and default_value_mode are schema defaults, not returned row values",
+    "a field id absent from returned row fields has no row-value evidence",
+    "read visibility status is fieldPermits read:false; FIELD_PERMISSION_REQUIRED is only a write preflight error"
+  ];
+  if (action === "get") {
+    const record = isRecord2(data) && isRecord2(data.record) ? data.record : void 0;
+    const returnedFieldIds = numericFieldKeys(record?.fields);
+    const permits = rowFieldPermits(responseBody);
+    const permitFieldIds = permits.map(permitFieldId).filter((id) => Boolean(id));
+    const deniedReadFieldIds = permits.filter((permit) => permit.read === false).map(permitFieldId).filter((id) => Boolean(id)).sort((left, right) => Number(left) - Number(right));
+    const notReturnedFieldIds = permitFieldIds.filter((id) => !returnedFieldIds.includes(id)).sort((left, right) => Number(left) - Number(right));
+    return {
+      source: "row get record.fields",
+      returnedFieldIds,
+      notReturnedFieldIds,
+      deniedReadFieldIds,
+      absentFieldMeaning: "not returned to current user; no row-value evidence",
+      rules
+    };
+  }
+  if (action === "query") {
+    const items = isRecord2(data) && Array.isArray(data.items) ? data.items : [];
+    return {
+      source: "row query items[].fields",
+      rows: items.filter((item) => isRecord2(item)).map((item) => ({
+        rowId: item.id,
+        returnedFieldIds: numericFieldKeys(item.fields)
+      })),
+      absentFieldMeaning: "not returned to current user; no row-value evidence",
+      rules
+    };
+  }
+  return void 0;
+}
 function requiredRowAction(command, flags) {
   if (command.commandPath[0] !== "row") return void 0;
   switch (command.commandPath[1]) {
@@ -7954,7 +8043,7 @@ async function executeCLI(scope, argv, env, fetchImpl = fetch) {
     if (error instanceof CLIError && error.code === "INVALID_BODY_JSON" && command.requestType) {
       throw new CLIError(
         "INVALID_BODY_JSON",
-        `body json is invalid for ${scope}.${command.commandPath.join(" ")}; fix JSON syntax, then use the canonical ${command.requestType} shape from docs/types`,
+        `body json is invalid for ${scope}.${command.commandPath.join(" ")}; retry with retryToolCalls[0] or retryToolCalls[1] when present`,
         2,
         buildBodyValidationDetails(scope, command, command.requestType, [{ path: "body", message: "invalid JSON syntax" }], runtimeEnv)
       );
@@ -8091,11 +8180,13 @@ async function executeCLI(scope, argv, env, fetchImpl = fetch) {
       } : {}
     });
   }
+  const rowValueEvidence = buildRowValueEvidence(command, parsedResponse);
   return {
     kind: "result",
     commandPath: command.commandPath,
     status: response.status,
-    data: parsedResponse
+    data: parsedResponse,
+    ...rowValueEvidence ? { rowValueEvidence } : {}
   };
 }
 

package/bundle/arcubase.mjs

@@ -6660,8 +6660,9 @@ function renderCommandHelp(scope, moduleName, commandName, env = process.env) {
       '  - update policy: {"update":["options"],"options":{"policy":{"key":"custom","actions":["view","add","edit"],"all_fields_read":true,"all_fields_write":true,"fields":[{"key":":1002","read":false,"write":false,"report":false}]},"list_options":{}}}'
     ] : [],
     ...scope === "admin" && command.commandPath[0] === "access-rule" && command.commandPath[1] === "create" ? [
-      "body-json example:",
-      '  - {"name":"Sales read write","enabled":true,"type":"form","options":{"user_scope":[{"type":"user","id":2188889901}],"policy":{"key":"custom","actions":["view","add","edit"],"all_fields_read":false,"all_fields_write":false,"fields":[{"key":":1001","read":true,"write":true,"report":false},{"key":":1002","read":false,"write":false,"report":false}]},"list_options":{}}}',
+      "body-json examples:",
+      `  - full access: ${JSON.stringify(buildFullAccessRuleBody())}`,
+      `  - hide field: ${JSON.stringify(buildHiddenFieldAccessRuleBody())}`,
       "success requires:",
       "  - result.enabled must be true",
       '  - options.user_scope[].type is "user" for tenant users',
@@ -7040,6 +7041,26 @@ function isAccessRuleUpdateCommand(scope, command) {
   return scope === "admin" && command.commandPath[0] === "access-rule" && command.commandPath[1] === "update";
 }
 function buildAccessRuleShapeHint(userId = 2188889901) {
+  return buildHiddenFieldAccessRuleBody(userId);
+}
+function buildFullAccessRuleBody(userId = 2188889977) {
+  return {
+    name: "Admin full access",
+    enabled: true,
+    type: "form",
+    options: {
+      user_scope: [{ type: "user", id: userId }],
+      policy: {
+        key: "custom",
+        actions: ["view", "add", "edit", "delete"],
+        all_fields_read: true,
+        all_fields_write: true
+      },
+      list_options: {}
+    }
+  };
+}
+function buildHiddenFieldAccessRuleBody(userId = 2188889901) {
   return {
     name: "Sales read write",
     enabled: true,
@@ -7057,6 +7078,12 @@ function buildAccessRuleShapeHint(userId = 2188889901) {
     }
   };
 }
+function buildAccessRuleCreateToolCall(body) {
+  return {
+    command: "access-rule create",
+    args: ["--app-id", "<app_id>", "--table-id", "<table_id>", "--body-json", JSON.stringify(body)]
+  };
+}
 function buildAssignUsersValidationDetails(scope, command, requestType, path, message, env = process.env) {
   return {
     operation: `${scope}.${command.module}.${command.functionName}`,
@@ -7194,7 +7221,15 @@ function buildBodyGuidance(requestType) {
     };
   }
   if (requestType === "AppIngressCreateReqVO" || requestType === "AppIngressUpdateReqVO") {
+    const retryToolCalls = [
+      buildAccessRuleCreateToolCall(buildFullAccessRuleBody()),
+      buildAccessRuleCreateToolCall(buildHiddenFieldAccessRuleBody())
+    ];
     return {
+      retryToolCalls,
+      suggestions: [
+        "next arcubase-admin-cli input: retryToolCalls[0] for full access or retryToolCalls[1] for hidden-field access"
+      ],
       shapeHint: buildAccessRuleShapeHint(),
       commonMistakes: [
         "use options.policy, not top-level permissions",
@@ -7647,6 +7682,60 @@ function unwrapData(value) {
   }
   return current;
 }
+function numericFieldKeys(fields) {
+  if (!isRecord2(fields)) return [];
+  return Object.keys(fields).filter((key) => /^\d+$/.test(key)).sort((left, right) => Number(left) - Number(right));
+}
+function permitFieldId(permit) {
+  if (!isRecord2(permit) || typeof permit.key !== "string") return void 0;
+  const match = /^:(\d+)$/.exec(permit.key);
+  return match?.[1];
+}
+function rowFieldPermits(value) {
+  const data = unwrapData(value);
+  const fieldPermits = isRecord2(data) && isRecord2(data.fieldPermits) ? data.fieldPermits : void 0;
+  return fieldPermits && Array.isArray(fieldPermits.fields) ? fieldPermits.fields.filter((item) => isRecord2(item)) : [];
+}
+function buildRowValueEvidence(command, responseBody) {
+  if (command.scope !== "user" || command.commandPath[0] !== "row") return void 0;
+  const action = command.commandPath[1];
+  const data = unwrapData(responseBody);
+  const rules = [
+    "current row values come only from row query fields or row get record.fields",
+    "table schema fields[].value and default_value_mode are schema defaults, not returned row values",
+    "a field id absent from returned row fields has no row-value evidence",
+    "read visibility status is fieldPermits read:false; FIELD_PERMISSION_REQUIRED is only a write preflight error"
+  ];
+  if (action === "get") {
+    const record = isRecord2(data) && isRecord2(data.record) ? data.record : void 0;
+    const returnedFieldIds = numericFieldKeys(record?.fields);
+    const permits = rowFieldPermits(responseBody);
+    const permitFieldIds = permits.map(permitFieldId).filter((id) => Boolean(id));
+    const deniedReadFieldIds = permits.filter((permit) => permit.read === false).map(permitFieldId).filter((id) => Boolean(id)).sort((left, right) => Number(left) - Number(right));
+    const notReturnedFieldIds = permitFieldIds.filter((id) => !returnedFieldIds.includes(id)).sort((left, right) => Number(left) - Number(right));
+    return {
+      source: "row get record.fields",
+      returnedFieldIds,
+      notReturnedFieldIds,
+      deniedReadFieldIds,
+      absentFieldMeaning: "not returned to current user; no row-value evidence",
+      rules
+    };
+  }
+  if (action === "query") {
+    const items = isRecord2(data) && Array.isArray(data.items) ? data.items : [];
+    return {
+      source: "row query items[].fields",
+      rows: items.filter((item) => isRecord2(item)).map((item) => ({
+        rowId: item.id,
+        returnedFieldIds: numericFieldKeys(item.fields)
+      })),
+      absentFieldMeaning: "not returned to current user; no row-value evidence",
+      rules
+    };
+  }
+  return void 0;
+}
 function requiredRowAction(command, flags) {
   if (command.commandPath[0] !== "row") return void 0;
   switch (command.commandPath[1]) {
@@ -7954,7 +8043,7 @@ async function executeCLI(scope, argv, env, fetchImpl = fetch) {
     if (error instanceof CLIError && error.code === "INVALID_BODY_JSON" && command.requestType) {
       throw new CLIError(
         "INVALID_BODY_JSON",
-        `body json is invalid for ${scope}.${command.commandPath.join(" ")}; fix JSON syntax, then use the canonical ${command.requestType} shape from docs/types`,
+        `body json is invalid for ${scope}.${command.commandPath.join(" ")}; retry with retryToolCalls[0] or retryToolCalls[1] when present`,
         2,
         buildBodyValidationDetails(scope, command, command.requestType, [{ path: "body", message: "invalid JSON syntax" }], runtimeEnv)
       );
@@ -8091,11 +8180,13 @@ async function executeCLI(scope, argv, env, fetchImpl = fetch) {
       } : {}
     });
   }
+  const rowValueEvidence = buildRowValueEvidence(command, parsedResponse);
   return {
     kind: "result",
     commandPath: command.commandPath,
     status: response.status,
-    data: parsedResponse
+    data: parsedResponse,
+    ...rowValueEvidence ? { rowValueEvidence } : {}
   };
 }
 

package/dist/runtime/errors.d.ts

@@ -26,6 +26,7 @@ export type CLIErrorDetails = {
     responseBody?: string;
     traceId?: string;
     upstreamError?: unknown;
+    retryToolCalls?: unknown[];
     suggestions?: string[];
 };
 export declare class CLIError extends Error {

package/dist/runtime/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/runtime/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAA;IAC7B,OAAO,CAAC,EAAE,aAAa,EAAE,CAAA;IACzB,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAA;IACvB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CACvB,CAAA;AAED,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAA;gBAEtB,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAI,EAAE,OAAO,CAAC,EAAE,eAAe;IAQlF,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CASlC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/runtime/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAA;IAC7B,OAAO,CAAC,EAAE,aAAa,EAAE,CAAA;IACzB,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAA;IACvB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,cAAc,CAAC,EAAE,OAAO,EAAE,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CACvB,CAAA;AAED,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAA;gBAEtB,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAI,EAAE,OAAO,CAAC,EAAE,eAAe;IAQlF,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CASlC"}

package/dist/runtime/execute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/runtime/execute.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,UAAU,CAAA;AAG1D,OAAO,EAAwE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAK/H,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,YAAY,CAAA;IACnB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CAC9B,CAAA;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAc1D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAE,QAAsB,GAAG,MAAM,CAoB7G;AAOD,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAMlD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,GAAE,QAAsB,GAAG,MAAM,CAkFpI;AAu5CD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,uBAAuB,CActH;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,SAAS,GAAE,OAAO,KAAa,GAAG,OAAO,CAAC,GAAG,CAAC,CAiMrI"}
+{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/runtime/execute.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,UAAU,CAAA;AAG1D,OAAO,EAAwE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAK/H,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,YAAY,CAAA;IACnB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CAC9B,CAAA;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAc1D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAE,QAAsB,GAAG,MAAM,CAoB7G;AAOD,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAMlD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,GAAE,QAAsB,GAAG,MAAM,CAmFpI;AA8/CD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,uBAAuB,CActH;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,SAAS,GAAE,OAAO,KAAa,GAAG,OAAO,CAAC,GAAG,CAAC,CAmMrI"}

package/dist/runtime/execute.js

@@ -104,8 +104,9 @@ export function renderCommandHelp(scope, moduleName, commandName, env = process.
             : []),
         ...(scope === 'admin' && command.commandPath[0] === 'access-rule' && command.commandPath[1] === 'create'
             ? [
-                'body-json example:',
-                '  - {"name":"Sales read write","enabled":true,"type":"form","options":{"user_scope":[{"type":"user","id":2188889901}],"policy":{"key":"custom","actions":["view","add","edit"],"all_fields_read":false,"all_fields_write":false,"fields":[{"key":":1001","read":true,"write":true,"report":false},{"key":":1002","read":false,"write":false,"report":false}]},"list_options":{}}}',
+                'body-json examples:',
+                `  - full access: ${JSON.stringify(buildFullAccessRuleBody())}`,
+                `  - hide field: ${JSON.stringify(buildHiddenFieldAccessRuleBody())}`,
                 'success requires:',
                 '  - result.enabled must be true',
                 '  - options.user_scope[].type is "user" for tenant users',
@@ -510,6 +511,26 @@ function isAccessRuleUpdateCommand(scope, command) {
     return scope === 'admin' && command.commandPath[0] === 'access-rule' && command.commandPath[1] === 'update';
 }
 function buildAccessRuleShapeHint(userId = 2188889901) {
+    return buildHiddenFieldAccessRuleBody(userId);
+}
+function buildFullAccessRuleBody(userId = 2188889977) {
+    return {
+        name: 'Admin full access',
+        enabled: true,
+        type: 'form',
+        options: {
+            user_scope: [{ type: 'user', id: userId }],
+            policy: {
+                key: 'custom',
+                actions: ['view', 'add', 'edit', 'delete'],
+                all_fields_read: true,
+                all_fields_write: true,
+            },
+            list_options: {},
+        },
+    };
+}
+function buildHiddenFieldAccessRuleBody(userId = 2188889901) {
     return {
         name: 'Sales read write',
         enabled: true,
@@ -527,6 +548,12 @@ function buildAccessRuleShapeHint(userId = 2188889901) {
         },
     };
 }
+function buildAccessRuleCreateToolCall(body) {
+    return {
+        command: 'access-rule create',
+        args: ['--app-id', '<app_id>', '--table-id', '<table_id>', '--body-json', JSON.stringify(body)],
+    };
+}
 function buildAssignUsersValidationDetails(scope, command, requestType, path, message, env = process.env) {
     return {
         operation: `${scope}.${command.module}.${command.functionName}`,
@@ -664,7 +691,15 @@ function buildBodyGuidance(requestType) {
         };
     }
     if (requestType === 'AppIngressCreateReqVO' || requestType === 'AppIngressUpdateReqVO') {
+        const retryToolCalls = [
+            buildAccessRuleCreateToolCall(buildFullAccessRuleBody()),
+            buildAccessRuleCreateToolCall(buildHiddenFieldAccessRuleBody()),
+        ];
         return {
+            retryToolCalls,
+            suggestions: [
+                'next arcubase-admin-cli input: retryToolCalls[0] for full access or retryToolCalls[1] for hidden-field access',
+            ],
             shapeHint: buildAccessRuleShapeHint(),
             commonMistakes: [
                 'use options.policy, not top-level permissions',
@@ -938,6 +973,71 @@ function unwrapData(value) {
     }
     return current;
 }
+function numericFieldKeys(fields) {
+    if (!isRecord(fields))
+        return [];
+    return Object.keys(fields).filter((key) => /^\d+$/.test(key)).sort((left, right) => Number(left) - Number(right));
+}
+function permitFieldId(permit) {
+    if (!isRecord(permit) || typeof permit.key !== 'string')
+        return undefined;
+    const match = /^:(\d+)$/.exec(permit.key);
+    return match?.[1];
+}
+function rowFieldPermits(value) {
+    const data = unwrapData(value);
+    const fieldPermits = isRecord(data) && isRecord(data.fieldPermits) ? data.fieldPermits : undefined;
+    return fieldPermits && Array.isArray(fieldPermits.fields)
+        ? fieldPermits.fields.filter((item) => isRecord(item))
+        : [];
+}
+function buildRowValueEvidence(command, responseBody) {
+    if (command.scope !== 'user' || command.commandPath[0] !== 'row')
+        return undefined;
+    const action = command.commandPath[1];
+    const data = unwrapData(responseBody);
+    const rules = [
+        'current row values come only from row query fields or row get record.fields',
+        'table schema fields[].value and default_value_mode are schema defaults, not returned row values',
+        'a field id absent from returned row fields has no row-value evidence',
+        'read visibility status is fieldPermits read:false; FIELD_PERMISSION_REQUIRED is only a write preflight error',
+    ];
+    if (action === 'get') {
+        const record = isRecord(data) && isRecord(data.record) ? data.record : undefined;
+        const returnedFieldIds = numericFieldKeys(record?.fields);
+        const permits = rowFieldPermits(responseBody);
+        const permitFieldIds = permits.map(permitFieldId).filter((id) => Boolean(id));
+        const deniedReadFieldIds = permits
+            .filter((permit) => permit.read === false)
+            .map(permitFieldId)
+            .filter((id) => Boolean(id))
+            .sort((left, right) => Number(left) - Number(right));
+        const notReturnedFieldIds = permitFieldIds
+            .filter((id) => !returnedFieldIds.includes(id))
+            .sort((left, right) => Number(left) - Number(right));
+        return {
+            source: 'row get record.fields',
+            returnedFieldIds,
+            notReturnedFieldIds,
+            deniedReadFieldIds,
+            absentFieldMeaning: 'not returned to current user; no row-value evidence',
+            rules,
+        };
+    }
+    if (action === 'query') {
+        const items = isRecord(data) && Array.isArray(data.items) ? data.items : [];
+        return {
+            source: 'row query items[].fields',
+            rows: items.filter((item) => isRecord(item)).map((item) => ({
+                rowId: item.id,
+                returnedFieldIds: numericFieldKeys(item.fields),
+            })),
+            absentFieldMeaning: 'not returned to current user; no row-value evidence',
+            rules,
+        };
+    }
+    return undefined;
+}
 function requiredRowAction(command, flags) {
     if (command.commandPath[0] !== 'row')
         return undefined;
@@ -1272,7 +1372,7 @@ export async function executeCLI(scope, argv, env, fetchImpl = fetch) {
     }
     catch (error) {
         if (error instanceof CLIError && error.code === 'INVALID_BODY_JSON' && command.requestType) {
-            throw new CLIError('INVALID_BODY_JSON', `body json is invalid for ${scope}.${command.commandPath.join(' ')}; fix JSON syntax, then use the canonical ${command.requestType} shape from docs/types`, 2, buildBodyValidationDetails(scope, command, command.requestType, [{ path: 'body', message: 'invalid JSON syntax' }], runtimeEnv));
+            throw new CLIError('INVALID_BODY_JSON', `body json is invalid for ${scope}.${command.commandPath.join(' ')}; retry with retryToolCalls[0] or retryToolCalls[1] when present`, 2, buildBodyValidationDetails(scope, command, command.requestType, [{ path: 'body', message: 'invalid JSON syntax' }], runtimeEnv));
         }
         throw error;
     }
@@ -1381,10 +1481,12 @@ export async function executeCLI(scope, argv, env, fetchImpl = fetch) {
                 : {}),
         });
     }
+    const rowValueEvidence = buildRowValueEvidence(command, parsedResponse);
     return {
         kind: 'result',
         commandPath: command.commandPath,
         status: response.status,
         data: parsedResponse,
+        ...(rowValueEvidence ? { rowValueEvidence } : {}),
     };
 }

package/dist/tests/execute_validation.test.js

@@ -250,6 +250,37 @@ test('body json parse errors include command docs and type hints', async () => {
         return true;
     });
 });
+test('access-rule invalid json returns copyable create retry examples', async () => {
+    await assert.rejects(async () => {
+        await executeCLI('admin', ['access-rule', 'create', '--app-id', 'app_1', '--table-id', 'table_1', '--body-json', '{"name":"Admin full access","enabled":true,"type":"form","options":{"user_scope":[{"type":"user","id":2188889977}],"policy":{"key":"custom","actions":["view","add","edit","delete"],"all_fields_read":true,"all_fields_write":true},"list_options":{}}'], env, async () => new Response('{}', { status: 200 }));
+    }, (error) => {
+        assert.ok(error instanceof CLIError);
+        assert.equal(error.code, 'INVALID_BODY_JSON');
+        assert.equal(error.details?.requestType, 'AppIngressCreateReqVO');
+        assert.match(error.message, /retryToolCalls/);
+        const toolCall = (error.details?.retryToolCalls ?? [])[0];
+        assert.ok(toolCall);
+        assert.equal(toolCall.command, 'access-rule create');
+        assert.deepEqual(toolCall.args.slice(0, 5), ['--app-id', '<app_id>', '--table-id', '<table_id>', '--body-json']);
+        const body = JSON.parse(toolCall.args[5]);
+        assert.deepEqual(body, {
+            name: 'Admin full access',
+            enabled: true,
+            type: 'form',
+            options: {
+                user_scope: [{ type: 'user', id: 2188889977 }],
+                policy: {
+                    key: 'custom',
+                    actions: ['view', 'add', 'edit', 'delete'],
+                    all_fields_read: true,
+                    all_fields_write: true,
+                },
+                list_options: {},
+            },
+        });
+        return true;
+    });
+});
 test('access-rule list executes against external root path', async () => {
     const out = await executeCLI('admin', ['access-rule', 'list', '--app-id', 'app_1', '--table-id', 'table_1'], env, async (url, init) => new Response(JSON.stringify({ url, method: init?.method }), { status: 200 }));
     assert.equal(out.kind, 'result');
@@ -396,6 +427,37 @@ test('row get resolves internal policy_id as query parameter', async () => {
     assert.equal(out.kind, 'result');
     assert.equal(calls[0], 'https://arcubase.example.com/api/entity/2188900691/2188900694/row/4000000046?policy_id=policy_hash_1');
 });
+test('row get returns machine-readable row value evidence', async () => {
+    const out = await executeCLI('user', ['row', 'get', '--app-id', '2188900691', '--table-id', '2188900694', '--row-id', '4000000046'], env, withRowPolicyResolver('2188900694', ['view'], async () => new Response(JSON.stringify({
+        data: {
+            record: {
+                id: 4000000046,
+                fields: { 1001: '复测投票' },
+            },
+            fieldPermits: {
+                all_fields_read: false,
+                fields: [
+                    { key: ':1001', read: true, write: true, report: false },
+                    { key: ':1002', read: false, write: false, report: false },
+                    { key: ':1003', read: true, write: true, report: false },
+                ],
+            },
+        },
+    }), { status: 200 })));
+    assert.deepEqual(out.rowValueEvidence, {
+        source: 'row get record.fields',
+        returnedFieldIds: ['1001'],
+        notReturnedFieldIds: ['1002', '1003'],
+        deniedReadFieldIds: ['1002'],
+        absentFieldMeaning: 'not returned to current user; no row-value evidence',
+        rules: [
+            'current row values come only from row query fields or row get record.fields',
+            'table schema fields[].value and default_value_mode are schema defaults, not returned row values',
+            'a field id absent from returned row fields has no row-value evidence',
+            'read visibility status is fieldPermits read:false; FIELD_PERMISSION_REQUIRED is only a write preflight error',
+        ],
+    });
+});
 test('row command rejects user-provided policy_id', async () => {
     const bodyFile = tempJSONFile({ fields: { 1001: '今天吃什么' }, policy_id: 'manual_policy' });
     await assert.rejects(async () => {

package/dist/tests/help.test.js

@@ -81,6 +81,8 @@ test('admin access-rule help gives update whitelist and assign-users body-json e
     assert.equal(create.kind, 'help');
     assert.match(create.text, /Access rule/);
     assert.match(create.text, /access-rule\.md/);
+    assert.match(create.text, /full access/);
+    assert.match(create.text, /"actions":\["view","add","edit","delete"\]/);
     assert.match(create.text, /"user_scope":\[\{"type":"user","id":2188889901\}\]/);
     assert.doesNotMatch(create.text, /"user_scope":\[\{"type":"member"/);
     const update = await executeCLI('admin', ['access-rule', 'update', '--help'], env, async () => new Response('{}'));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carthooks/arcubase-cli",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "Arcubase runtime CLI for admin and user command execution",
   "type": "module",
   "main": "./dist/index.js",

package/sdk-dist/docs/runtime-reference/access-rule.md

@@ -20,6 +20,14 @@ Use the numeric `tenantUserId` / `TenantUser.ID`.
 Do not use hash ids such as `arcubaseTenantUserId`.
 Use `user_scope[].type:"user"` for a tenant user. Do not use FieldVO field type `member` in access rules.
 
+## Body Input
+
+```bash
+--body-json '<json-string>' | --body-file access-rule.json
+```
+
+Prefer `--body-json` for short payloads. `--body-file` is available for large or fragile JSON payloads.
+
 ## Create Read/Write Rule With Hidden Field
 
 ```bash
@@ -29,6 +37,17 @@ arcubase-admin access-rule create \
   --body-json '{"name":"Sales read write","enabled":true,"type":"form","options":{"user_scope":[{"type":"user","id":2188889901}],"policy":{"key":"custom","actions":["view","add","edit"],"all_fields_read":false,"all_fields_write":false,"fields":[{"key":":1001","read":true,"write":true,"report":false},{"key":":1002","read":false,"write":false,"report":false},{"key":":1003","read":true,"write":true,"report":false}]},"list_options":{}}}'
 ```
 
+## Create Admin Full Access Rule
+
+Use this for the operator's own admin entry before creating seed rows.
+
+```bash
+arcubase-admin access-rule create \
+  --app-id 2188893436 \
+  --table-id 2188893443 \
+  --body-json '{"name":"Admin full access","enabled":true,"type":"form","options":{"user_scope":[{"type":"user","id":2188889977}],"policy":{"key":"custom","actions":["view","add","edit","delete"],"all_fields_read":true,"all_fields_write":true},"list_options":{}}}'
+```
+
 Rules:
 
 - read permission = `actions:["view"]`

package/sdk-dist/docs/runtime-reference/row-crud.md

@@ -83,6 +83,12 @@ Typical row shape:
 }
 ```
 
+Returned values:
+
+- current row values are only in `fields`
+- fields absent from `fields` are not returned to the current user and have no row-value evidence
+- table schema `fields[].value` and `default_value_mode` describe schema defaults, not current row values
+
 ## Read one row
 
 Command:
@@ -96,6 +102,13 @@ arcubase row get \
 
 Use this when you already know the row id and want the full record payload.
 
+Returned values:
+
+- current row values are in `record.fields`
+- fields absent from `record.fields` are not returned to the current user and have no row-value evidence
+- use `fieldPermits` only to explain access, not as current row values
+- read visibility status is `fieldPermits read:false`; `FIELD_PERMISSION_REQUIRED` is a write preflight error from row create/update
+
 ## Update a row
 
 Command:

package/src/runtime/errors.ts

@@ -29,6 +29,7 @@ export type CLIErrorDetails = {
   responseBody?: string
   traceId?: string
   upstreamError?: unknown
+  retryToolCalls?: unknown[]
   suggestions?: string[]
 }
 

package/src/runtime/execute.ts

@@ -121,8 +121,9 @@ export function renderCommandHelp(scope: CommandScope, moduleName: string, comma
       : []),
     ...(scope === 'admin' && command.commandPath[0] === 'access-rule' && command.commandPath[1] === 'create'
       ? [
-          'body-json example:',
-          '  - {"name":"Sales read write","enabled":true,"type":"form","options":{"user_scope":[{"type":"user","id":2188889901}],"policy":{"key":"custom","actions":["view","add","edit"],"all_fields_read":false,"all_fields_write":false,"fields":[{"key":":1001","read":true,"write":true,"report":false},{"key":":1002","read":false,"write":false,"report":false}]},"list_options":{}}}',
+          'body-json examples:',
+          `  - full access: ${JSON.stringify(buildFullAccessRuleBody())}`,
+          `  - hide field: ${JSON.stringify(buildHiddenFieldAccessRuleBody())}`,
           'success requires:',
           '  - result.enabled must be true',
           '  - options.user_scope[].type is "user" for tenant users',
@@ -567,6 +568,28 @@ function isAccessRuleUpdateCommand(scope: CommandScope, command: NonNullable<Ret
 }
 
 function buildAccessRuleShapeHint(userId = 2188889901) {
+  return buildHiddenFieldAccessRuleBody(userId)
+}
+
+function buildFullAccessRuleBody(userId = 2188889977) {
+  return {
+    name: 'Admin full access',
+    enabled: true,
+    type: 'form',
+    options: {
+      user_scope: [{ type: 'user', id: userId }],
+      policy: {
+        key: 'custom',
+        actions: ['view', 'add', 'edit', 'delete'],
+        all_fields_read: true,
+        all_fields_write: true,
+      },
+      list_options: {},
+    },
+  }
+}
+
+function buildHiddenFieldAccessRuleBody(userId = 2188889901) {
   return {
     name: 'Sales read write',
     enabled: true,
@@ -585,6 +608,13 @@ function buildAccessRuleShapeHint(userId = 2188889901) {
   }
 }
 
+function buildAccessRuleCreateToolCall(body: unknown) {
+  return {
+    command: 'access-rule create',
+    args: ['--app-id', '<app_id>', '--table-id', '<table_id>', '--body-json', JSON.stringify(body)],
+  }
+}
+
 function buildAssignUsersValidationDetails(
   scope: CommandScope,
   command: NonNullable<ReturnType<typeof findCommand>>,
@@ -618,7 +648,7 @@ function buildAssignUsersValidationDetails(
   }
 }
 
-function buildBodyGuidance(requestType: string): Pick<CLIErrorDetails, 'shapeHint' | 'commonMistakes' | 'suggestions'> {
+function buildBodyGuidance(requestType: string): Pick<CLIErrorDetails, 'retryToolCalls' | 'shapeHint' | 'commonMistakes' | 'suggestions'> {
   if (requestType === 'EntitySaveReqVO' || requestType === 'AppCreateEntityReqVO') {
     return {
       shapeHint: {
@@ -730,7 +760,15 @@ function buildBodyGuidance(requestType: string): Pick<CLIErrorDetails, 'shapeHin
     }
   }
   if (requestType === 'AppIngressCreateReqVO' || requestType === 'AppIngressUpdateReqVO') {
+    const retryToolCalls = [
+      buildAccessRuleCreateToolCall(buildFullAccessRuleBody()),
+      buildAccessRuleCreateToolCall(buildHiddenFieldAccessRuleBody()),
+    ]
     return {
+      retryToolCalls,
+      suggestions: [
+        'next arcubase-admin-cli input: retryToolCalls[0] for full access or retryToolCalls[1] for hidden-field access',
+      ],
       shapeHint: buildAccessRuleShapeHint(),
       commonMistakes: [
         'use options.policy, not top-level permissions',
@@ -1233,6 +1271,72 @@ function unwrapData(value: unknown): unknown {
   return current
 }
 
+function numericFieldKeys(fields: unknown): string[] {
+  if (!isRecord(fields)) return []
+  return Object.keys(fields).filter((key) => /^\d+$/.test(key)).sort((left, right) => Number(left) - Number(right))
+}
+
+function permitFieldId(permit: unknown): string | undefined {
+  if (!isRecord(permit) || typeof permit.key !== 'string') return undefined
+  const match = /^:(\d+)$/.exec(permit.key)
+  return match?.[1]
+}
+
+function rowFieldPermits(value: unknown): Array<Record<string, unknown>> {
+  const data = unwrapData(value)
+  const fieldPermits = isRecord(data) && isRecord(data.fieldPermits) ? data.fieldPermits : undefined
+  return fieldPermits && Array.isArray(fieldPermits.fields)
+    ? fieldPermits.fields.filter((item): item is Record<string, unknown> => isRecord(item))
+    : []
+}
+
+function buildRowValueEvidence(command: NonNullable<ReturnType<typeof findCommand>>, responseBody: unknown): Record<string, unknown> | undefined {
+  if (command.scope !== 'user' || command.commandPath[0] !== 'row') return undefined
+  const action = command.commandPath[1]
+  const data = unwrapData(responseBody)
+  const rules = [
+    'current row values come only from row query fields or row get record.fields',
+    'table schema fields[].value and default_value_mode are schema defaults, not returned row values',
+    'a field id absent from returned row fields has no row-value evidence',
+    'read visibility status is fieldPermits read:false; FIELD_PERMISSION_REQUIRED is only a write preflight error',
+  ]
+  if (action === 'get') {
+    const record = isRecord(data) && isRecord(data.record) ? data.record : undefined
+    const returnedFieldIds = numericFieldKeys(record?.fields)
+    const permits = rowFieldPermits(responseBody)
+    const permitFieldIds = permits.map(permitFieldId).filter((id): id is string => Boolean(id))
+    const deniedReadFieldIds = permits
+      .filter((permit) => permit.read === false)
+      .map(permitFieldId)
+      .filter((id): id is string => Boolean(id))
+      .sort((left, right) => Number(left) - Number(right))
+    const notReturnedFieldIds = permitFieldIds
+      .filter((id) => !returnedFieldIds.includes(id))
+      .sort((left, right) => Number(left) - Number(right))
+    return {
+      source: 'row get record.fields',
+      returnedFieldIds,
+      notReturnedFieldIds,
+      deniedReadFieldIds,
+      absentFieldMeaning: 'not returned to current user; no row-value evidence',
+      rules,
+    }
+  }
+  if (action === 'query') {
+    const items = isRecord(data) && Array.isArray(data.items) ? data.items : []
+    return {
+      source: 'row query items[].fields',
+      rows: items.filter((item): item is Record<string, unknown> => isRecord(item)).map((item) => ({
+        rowId: item.id,
+        returnedFieldIds: numericFieldKeys(item.fields),
+      })),
+      absentFieldMeaning: 'not returned to current user; no row-value evidence',
+      rules,
+    }
+  }
+  return undefined
+}
+
 function requiredRowAction(command: NonNullable<ReturnType<typeof findCommand>>, flags: Record<string, string | boolean>): string | undefined {
   if (command.commandPath[0] !== 'row') return undefined
   switch (command.commandPath[1]) {
@@ -1632,7 +1736,7 @@ export async function executeCLI(scope: CommandScope, argv: string[], env?: Runt
     if (error instanceof CLIError && error.code === 'INVALID_BODY_JSON' && command.requestType) {
       throw new CLIError(
         'INVALID_BODY_JSON',
-        `body json is invalid for ${scope}.${command.commandPath.join(' ')}; fix JSON syntax, then use the canonical ${command.requestType} shape from docs/types`,
+        `body json is invalid for ${scope}.${command.commandPath.join(' ')}; retry with retryToolCalls[0] or retryToolCalls[1] when present`,
         2,
         buildBodyValidationDetails(scope, command, command.requestType, [{ path: 'body', message: 'invalid JSON syntax' }], runtimeEnv),
       )
@@ -1782,10 +1886,12 @@ export async function executeCLI(scope: CommandScope, argv: string[], env?: Runt
         : {}),
     })
   }
+  const rowValueEvidence = buildRowValueEvidence(command, parsedResponse)
   return {
     kind: 'result',
     commandPath: command.commandPath,
     status: response.status,
     data: parsedResponse,
+    ...(rowValueEvidence ? { rowValueEvidence } : {}),
   }
 }

package/src/tests/execute_validation.test.ts

@@ -281,6 +281,38 @@ test('body json parse errors include command docs and type hints', async () => {
   })
 })
 
+test('access-rule invalid json returns copyable create retry examples', async () => {
+  await assert.rejects(async () => {
+    await executeCLI('admin', ['access-rule', 'create', '--app-id', 'app_1', '--table-id', 'table_1', '--body-json', '{"name":"Admin full access","enabled":true,"type":"form","options":{"user_scope":[{"type":"user","id":2188889977}],"policy":{"key":"custom","actions":["view","add","edit","delete"],"all_fields_read":true,"all_fields_write":true},"list_options":{}}'], env as any, async () => new Response('{}', { status: 200 }))
+  }, (error: unknown) => {
+    assert.ok(error instanceof CLIError)
+    assert.equal(error.code, 'INVALID_BODY_JSON')
+    assert.equal(error.details?.requestType, 'AppIngressCreateReqVO')
+    assert.match(error.message, /retryToolCalls/)
+    const toolCall = (error.details?.retryToolCalls ?? [])[0] as any
+    assert.ok(toolCall)
+    assert.equal(toolCall.command, 'access-rule create')
+    assert.deepEqual(toolCall.args.slice(0, 5), ['--app-id', '<app_id>', '--table-id', '<table_id>', '--body-json'])
+    const body = JSON.parse(toolCall.args[5])
+    assert.deepEqual(body, {
+      name: 'Admin full access',
+      enabled: true,
+      type: 'form',
+      options: {
+        user_scope: [{ type: 'user', id: 2188889977 }],
+        policy: {
+          key: 'custom',
+          actions: ['view', 'add', 'edit', 'delete'],
+          all_fields_read: true,
+          all_fields_write: true,
+        },
+        list_options: {},
+      },
+    })
+    return true
+  })
+})
+
 test('access-rule list executes against external root path', async () => {
   const out = await executeCLI(
     'admin',
@@ -477,6 +509,43 @@ test('row get resolves internal policy_id as query parameter', async () => {
   assert.equal(calls[0], 'https://arcubase.example.com/api/entity/2188900691/2188900694/row/4000000046?policy_id=policy_hash_1')
 })
 
+test('row get returns machine-readable row value evidence', async () => {
+  const out = await executeCLI(
+    'user',
+    ['row', 'get', '--app-id', '2188900691', '--table-id', '2188900694', '--row-id', '4000000046'],
+    env as any,
+    withRowPolicyResolver('2188900694', ['view'], async () => new Response(JSON.stringify({
+      data: {
+        record: {
+          id: 4000000046,
+          fields: { 1001: '复测投票' },
+        },
+        fieldPermits: {
+          all_fields_read: false,
+          fields: [
+            { key: ':1001', read: true, write: true, report: false },
+            { key: ':1002', read: false, write: false, report: false },
+            { key: ':1003', read: true, write: true, report: false },
+          ],
+        },
+      },
+    }), { status: 200 })),
+  )
+  assert.deepEqual(out.rowValueEvidence, {
+    source: 'row get record.fields',
+    returnedFieldIds: ['1001'],
+    notReturnedFieldIds: ['1002', '1003'],
+    deniedReadFieldIds: ['1002'],
+    absentFieldMeaning: 'not returned to current user; no row-value evidence',
+    rules: [
+      'current row values come only from row query fields or row get record.fields',
+      'table schema fields[].value and default_value_mode are schema defaults, not returned row values',
+      'a field id absent from returned row fields has no row-value evidence',
+      'read visibility status is fieldPermits read:false; FIELD_PERMISSION_REQUIRED is only a write preflight error',
+    ],
+  })
+})
+
 test('row command rejects user-provided policy_id', async () => {
   const bodyFile = tempJSONFile({ fields: { 1001: '今天吃什么' }, policy_id: 'manual_policy' })
   await assert.rejects(async () => {

package/src/tests/help.test.ts

@@ -90,6 +90,8 @@ test('admin access-rule help gives update whitelist and assign-users body-json e
   assert.equal(create.kind, 'help')
   assert.match(create.text, /Access rule/)
   assert.match(create.text, /access-rule\.md/)
+  assert.match(create.text, /full access/)
+  assert.match(create.text, /"actions":\["view","add","edit","delete"\]/)
   assert.match(create.text, /"user_scope":\[\{"type":"user","id":2188889901\}\]/)
   assert.doesNotMatch(create.text, /"user_scope":\[\{"type":"member"/)