@varde-flyt/vfac 0.14.0 → 0.14.1

package/dist/vfac.mjs

@@ -18162,21 +18162,32 @@ async function runDoctor(parsed) {
   const mutating = access.projects.filter(
     (project) => project.permissions.some((permission) => !permission.endsWith(".read"))
   );
+  const organizationWide = access.tenantPermissions.includes("project.read");
+  const alsoOrganizationWide = access.tenantPermissions.length > 0 ? `Organization-wide it holds ${access.tenantPermissions.join(", ")}, which reaches no Project. ` : "";
+  const perProject = projects.length === 0 ? "" : `. Granted per Project: ${projects.join(", ")}` + (mutating.length > 0 ? ` \u2014 you can deploy in ${mutating.map((project) => project.projectId).join(", ")}` : " \u2014 read-only there");
   checks.push(
-    access.tenantWide ? {
+    organizationWide ? {
       name: "Access",
       ok: true,
-      detail: `the whole organization \u2014 ${access.tenantPermissions.join(", ")}`,
-      facts: { scope: "organization", grantedProjectIds: null }
+      detail: `the whole organization \u2014 ${access.tenantPermissions.join(", ")}${perProject}`,
+      facts: {
+        scope: "organization",
+        grantedProjectIds: projects.length > 0 ? projects.join(",") : null
+      }
     } : projects.length === 0 ? {
       // A FAILURE, NOT A NOTE. This credential authenticates and can do
       // nothing at all — and the check said so in words while `report`
       // computed the exit code from `ok` alone, so `doctor` printed
       // "nothing else will work" and exited 0. A pipeline reads the code,
       // not the sentence.
+      //
+      // STILL A FAILURE WITH KNOWLEDGE READ AND NO PROJECT. That gate is a
+      // legitimate one — it serves an MCP client — but every `vfac`
+      // command that reads a Project is refused under it, and a pipeline
+      // pointed at it has the wrong credential.
       name: "Access",
       ok: false,
-      detail: "none. This credential holds no Project and nothing organization-wide, so every command below it will be refused. Ask an organization administrator for access."
+      detail: access.tenantPermissions.length > 0 ? `no Project. ${alsoOrganizationWide}Every command below that reads a Project will be refused. A gate holding only that serves an MCP client, not vfac; ask an organization administrator for a Project role on the gate vfac uses.` : "none. This credential holds no Project and nothing organization-wide, so every command below it will be refused. Ask an organization administrator for access."
     } : {
       name: "Access",
       ok: true,
@@ -18205,7 +18216,7 @@ async function runDoctor(parsed) {
         // names are the difference.
         grantedProjectIds: projects.join(",")
       },
-      detail: `${projects.join(", ")} \u2014 and nothing organization-wide. ` + (mutating.length > 0 ? "You can deploy in those Projects, read their catalogue, and list them. " : "Read-only there: catalogue, manifests, resources and operations. An apply or a lifecycle command is refused, and that is what was granted rather than a fault. ") + "Anything ACROSS the organization \u2014 a Project you hold nothing in, or its members \u2014 is refused."
+      detail: `${projects.join(", ")}` + (access.tenantPermissions.length > 0 ? ". " : " \u2014 and nothing organization-wide. ") + alsoOrganizationWide + (mutating.length > 0 ? "You can deploy in those Projects, read their catalogue, and list them. " : "Read-only there: catalogue, manifests, resources and operations. An apply or a lifecycle command is refused, and that is what was granted rather than a fault. ") + "Anything ACROSS the organization \u2014 a Project you hold nothing in, or its members \u2014 is refused."
     }
   );
   checks.push({
@@ -19216,10 +19227,13 @@ async function runWhoami(parsed) {
   }
   const { principal, access } = result.data;
   const lines = [`${principal.name}  ${principal.id}  (${principal.type})`];
-  if (access.tenantWide) {
+  if (access.tenantPermissions.length > 0) {
     lines.push("", "Granted  across the whole organization");
     lines.push(`  ${access.tenantPermissions.join(", ")}`);
-  } else {
+  }
+  if (access.projects.length > 0 && access.tenantPermissions.length > 0) {
+    lines.push("", "Granted  in these Projects");
+  } else if (!access.tenantWide) {
     lines.push("", "Granted  in these Projects only \u2014 nothing organization-wide.");
     lines.push("         Listing these works. Reading ACROSS the organization does not.");
   }
@@ -19227,7 +19241,7 @@ async function runWhoami(parsed) {
     lines.push("", `  ${project.projectId}`);
     lines.push(`    ${project.permissions.join(", ")}`);
   }
-  if (!access.tenantWide && access.projects.length === 0) {
+  if (access.projects.length === 0 && !access.tenantPermissions.includes("project.read")) {
     lines.push("", "  No Projects. Ask an organization administrator for access.");
   }
   lines.push(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varde-flyt/vfac",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Deploy and manage Varde Flyt Products from a manifest.",
   "repository": {
     "type": "git",