@datarails-ai/dr-appspace-cli 0.10.13 → 0.10.14

package/dist/cli.js

@@ -13,7 +13,7 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-appspace-cli",
-  version: "0.10.13",
+  version: "0.10.14",
   description: "Datarails App Space CLI \u2014 build, try, push and publish App Space apps",
   type: "module",
   engines: {
@@ -57,7 +57,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-01T08:37:09.841Z";
+var BUILD_TIME = "2026-10-01T09:25:02.651Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -14566,6 +14566,92 @@ function originOf(row) {
 function sourcesOf(contract) {
   return isPlainObject7(contract?.data?.sources) ? contract.data.sources : {};
 }
+var FINANCEOS_SCOPES = {
+  commands: {
+    "status:read": ["status", "whoami"],
+    "tables:read": ["list_tables", "get_table"],
+    "semantic:read": ["list_semantic_tables", "get_semantic_table", "metric_series"],
+    "metrics:read": ["list_metrics", "get_metric", "metric_series"],
+    "filebox:read": ["list_filebox"],
+    "users:read": ["list_users"],
+    "pipeline:read": ["data_readiness"],
+    "raw:read": ["get_raw_table", "get_raw_table_data", "get_aliased_table_data"]
+  },
+  namespaces: {
+    "status:read": ["status"],
+    "tables:read": ["tables"],
+    "semantic:read": ["semantic_tables"],
+    "metrics:read": ["metrics", "data_models"],
+    "filebox:read": ["filebox"]
+  },
+  gated: {
+    get_raw_table: "raw:read",
+    get_raw_table_data: "raw:read",
+    get_aliased_table_data: "raw:read"
+  }
+};
+function scopesGranting(kind, name) {
+  return Object.keys(FINANCEOS_SCOPES[kind]).filter((scope) => FINANCEOS_SCOPES[kind][scope].includes(name)).sort();
+}
+function financeosNeeds(row, origin) {
+  const needs = [];
+  const need = (reads, anyOf, catalog = false) => {
+    if (anyOf.length > 0 && !needs.some((one) => one.reads === reads && one.catalog === catalog)) needs.push({ reads, anyOf, catalog });
+  };
+  if (origin === "call") {
+    const parts = typeof row.from.call === "string" ? row.from.call.split(".") : [];
+    if (parts.length === 1) need(parts[0], scopesGranting("commands", parts[0]));
+    if (parts.length === 2) {
+      need(parts[0], scopesGranting("namespaces", parts[0]));
+      const gated = FINANCEOS_SCOPES.gated[parts[1]];
+      if (gated) need(`${parts[0]}.${parts[1]}`, [gated]);
+    }
+    return needs;
+  }
+  const read = isPlainObject7(row.from.financeos) ? row.from.financeos : {};
+  const filterable = Array.isArray(row.filterable) && row.filterable.length > 0;
+  if (read.metric_id !== void 0 && read.metric_id !== null) {
+    if (read.drill_rows) need("data_models", scopesGranting("namespaces", "data_models"));
+    else need("metric_series", scopesGranting("commands", "metric_series"));
+    if (filterable) need("data_models", scopesGranting("namespaces", "data_models"), true);
+    return needs;
+  }
+  const address = read.address === "id" || read.address === "alias" ? read.address : read.table_alias ? "alias" : read.table_id !== void 0 && read.table_id !== null ? "id" : null;
+  if (address === null) return needs;
+  const raw = read.rows === "raw" || row.shape === "ohlc";
+  if (address === "id") need("get_raw_table", scopesGranting("commands", "get_raw_table"));
+  if (raw) {
+    const page = address === "id" ? "get_raw_table_data" : "get_aliased_table_data";
+    need(page, scopesGranting("commands", page));
+  } else {
+    need("data_models", scopesGranting("namespaces", "data_models"));
+  }
+  if (filterable) need("data_models", scopesGranting("namespaces", "data_models"), true);
+  return needs;
+}
+function financeosScopeProblems(name, row, origin, declared) {
+  const missing = /* @__PURE__ */ new Map();
+  for (const { reads, anyOf, catalog } of financeosNeeds(row, origin)) {
+    if (anyOf.some((scope2) => declared.includes(scope2))) continue;
+    const scope = anyOf.includes("metrics:read") ? "metrics:read" : anyOf[0];
+    const entry = missing.get(scope) ?? { scope, anyOf, reads: [], catalog: true };
+    if (!entry.reads.includes(reads)) entry.reads.push(reads);
+    entry.catalog = entry.catalog && catalog;
+    missing.set(scope, entry);
+  }
+  return [...missing.values()].map(
+    ({ scope, anyOf, reads, catalog }) => catalog ? {
+      code: "financeos_scope_catalog",
+      pointer: `/data/sources/${escapePointer3(name)}/filterable`,
+      message: `source "${name}" offers filterable values, which the filter bar reads from ${reads.join(" and ")} with financeos scope ${anyOf.join(" or ")}; the source loads without it, but its filter bar offers no values until you add ${JSON.stringify(scope)} to app.capabilities.financeos`,
+      advisory: true
+    } : {
+      code: "financeos_scope",
+      pointer: "/app/capabilities/financeos",
+      message: `source "${name}" reads ${reads.join(" and ")}, which needs financeos scope ${anyOf.join(" or ")}; add ${JSON.stringify(scope)} to app.capabilities.financeos`
+    }
+  );
+}
 function servedSources(elements, sources) {
   const out = /* @__PURE__ */ new Set();
   for (const element of Object.values(elements)) {
@@ -14606,6 +14692,8 @@ function sourceProblems(sources, app, handlers, extra) {
         pointer: "/app/capabilities/financeos",
         message: `source "${name}" reads FinanceOS, and this app grants no financeos capability; grant at least one read scope (e.g. metrics:read, plus raw:read to read a table by id)`
       });
+    } else if (origin === "financeos" || origin === "call") {
+      problems.push(...financeosScopeProblems(name, row, origin, financeos));
     }
     if (origin === "depends") {
       for (const [index, dep] of row.from.entries()) {
@@ -15124,7 +15212,8 @@ function compileApp(contract, { kit = null, runtime = RUNTIME, extra = {} } = {}
   const handlers = isPlainObject7(contract.data?.app?.handlers) ? contract.data.app.handlers : {};
   const names = Object.keys(handlers).sort(natural3);
   const stated2 = sourcesOf(contract);
-  problems.push(...sourceProblems(stated2, app, handlers, extra));
+  const sourceFindings = sourceProblems(stated2, app, handlers, extra);
+  problems.push(...sourceFindings.filter((one) => !one.advisory));
   problems.push(...compareProblems(stated2, model));
   problems.push(...paramProblems(contract, stated2));
   problems.push(...themeProblems(app));
@@ -15208,7 +15297,7 @@ function compileApp(contract, { kit = null, runtime = RUNTIME, extra = {} } = {}
   problems.push(...numberPinProblems(declared, { "dr-app-runtime": runtime, "dr-app-widgets": appWidgets, "dr-components": appComponents, "dr-components-controls": appControls }));
   problems.push(...whenPinProblems(declared, { "dr-components": appComponents }));
   const widgetFindings = tree.problems.length === 0 ? widgetProblems(declared, tree, handlers, contract?.data?.sources, appWidgets) : [];
-  const warnings = widgetFindings.filter((one) => one.advisory).map(({ advisory: _advisory, ...one }) => one);
+  const warnings = [...sourceFindings, ...widgetFindings].filter((one) => one.advisory).map(({ advisory: _advisory, ...one }) => one);
   problems.push(...widgetFindings.filter((one) => !one.advisory));
   if (tree.problems.length === 0) problems.push(...partProblems(declared, tree, handlers, sources, contract?.pages, model));
   if (problems.length > 0) return { files: {}, problems, contract, warnings };
@@ -24469,6 +24558,8 @@ var REFUSALS = /* @__PURE__ */ new Set([
   "source_unknown",
   "source_name_taken",
   "source_needs_financeos",
+  // a source the declared financeos scopes do not reach (conversation 34b3d658)
+  "financeos_scope",
   "transform_missing",
   // a dashboard dataset row's own transform (transforms.mjs)
   "transform_row",
@@ -24535,6 +24626,9 @@ var PARAM_REFUSALS = {
   param_kind_value: "a param's default, min/max/step, values or max_selected is one its kind cannot hold",
   param_conflict: "one param name declared twice with different rules (the server keeps the first)"
 };
+var SOURCE_REFUSALS = {
+  financeos_scope: "a FinanceOS source reads a surface app.capabilities.financeos does not grant (a table aggregate or a metric needs metrics:read; a by-id table or raw rows need raw:read; a call needs the scope its command is under) \u2014 add the scope the message names. `filterable` values without metrics:read are only a warning (financeos_scope_catalog): the source loads, its filter bar offers nothing"
+};
 var KPI_REFUSALS = {
   source_compare_field: "a source's compare names a field its rows do not carry (where that is knowable: a FinanceOS aggregate's dimensions, measures and period column; an app table's columns), or is set on a source not shaped kpi \u2014 declare the measure beside the figure, or name one it carries"
 };
@@ -25588,6 +25682,8 @@ function registerCompileCommand(parent) {
           "",
           "An app's own header is refused with:",
           ...Object.entries(APP_REFUSALS).map(([code, what]) => `  ${code.padEnd(22)}${what}`),
+          "A FinanceOS source the declared scopes do not reach is refused with:",
+          ...Object.entries(SOURCE_REFUSALS).map(([code, what]) => `  ${code.padEnd(22)}${what}`),
           "A KPI source (shape kpi: its period comes from the rows; compare sets the figure against another measure of the same row) is refused with:",
           ...Object.entries(KPI_REFUSALS).map(([code, what]) => `  ${code.padEnd(22)}${what}`),
           "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-appspace-cli",
-  "version": "0.10.13",
+  "version": "0.10.14",
   "description": "Datarails App Space CLI — build, try, push and publish App Space apps",
   "type": "module",
   "engines": {