@datarails-ai/dr-cli 1.6.83 → 1.6.84

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.83",
+  version: "1.6.84",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -38,7 +38,7 @@ var package_default = {
     postinstall: "node scripts/postinstall.mjs"
   },
   dependencies: {
-    "@datarails-ai/dr-appspace-cli": "0.10.6",
+    "@datarails-ai/dr-appspace-cli": "0.10.9",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     commander: "^12.1.0",
@@ -67,7 +67,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-09-30T16:59:09.762Z";
+var BUILD_TIME = "2026-10-01T05:04:40.480Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -4412,6 +4412,16 @@ async function setupCall(serverFlag, accountFlag, options = {}) {
 
 // src/scopes/matcher.ts
 var SCOPE_RE = /^(\*|[a-z][a-z0-9-]*):(\*|read|write|destructive)$/;
+var ACTION_RANK = new Map(
+  ["read", "write", "destructive"].map((action, rank) => [action, rank])
+);
+function actionSatisfies(granted, wanted) {
+  if (granted === "*" || granted === wanted) return true;
+  const g = ACTION_RANK.get(granted);
+  const w = ACTION_RANK.get(wanted);
+  if (g === void 0 || w === void 0) return false;
+  return g > w;
+}
 var WHITESPACE = "\\t\\n\\v\\f\\r \\x1c-\\x1f\\x85\\xa0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000\\ufeff";
 var TRIM_RE = new RegExp(`^[${WHITESPACE}]+|[${WHITESPACE}]+$`, "g");
 var SPLIT_RE = new RegExp(`[${WHITESPACE}]+`);
@@ -4442,7 +4452,7 @@ function isAllowed(scopes, resource, action) {
   if (entries.length === 0) return true;
   const res = trimShared(resource).toLowerCase();
   const act = trimShared(action).toLowerCase();
-  return entries.some(([r, a]) => (r === "*" || r === res) && (a === "*" || a === act));
+  return entries.some(([r, a]) => (r === "*" || r === res) && actionSatisfies(a, act));
 }
 function isEntryAllowed(scopes, entry) {
   return entry.requires.every((r) => isAllowed(scopes, r.resource, r.action));

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.83",
+  "cliVersion": "1.6.84",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {
@@ -4257,6 +4257,14 @@
         }
       ]
     },
+    "app-space tables": {
+      "requires": [
+        {
+          "resource": "app-space",
+          "action": "read"
+        }
+      ]
+    },
     "app-space scaffold": {
       "requires": []
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.83",
+  "version": "1.6.84",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {
@@ -17,7 +17,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@datarails-ai/dr-appspace-cli": "0.10.6",
+    "@datarails-ai/dr-appspace-cli": "0.10.9",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     "commander": "^12.1.0",