@varde-flyt/vfac 0.3.0 → 0.3.1

package/dist/vfac.mjs

@@ -15954,6 +15954,9 @@ async function runDoctor(parsed) {
   }
   const access = who.data.access;
   const projects = access.projects.map((project) => project.projectId);
+  const mutating = access.projects.filter(
+    (project) => project.permissions.some((permission) => !permission.endsWith(".read"))
+  );
   checks.push(
     access.tenantWide ? {
       name: "Access",
@@ -15980,7 +15983,15 @@ async function runDoctor(parsed) {
       // members, other Tenants' resources. An agent read the warning,
       // ran the listing, watched it succeed, and learned to distrust the
       // line — which is the worst outcome for a diagnostic.
-      detail: `${projects.join(", ")} \u2014 and nothing organization-wide. You can deploy in those Projects, read their catalogue, and list them. Anything ACROSS the organization \u2014 a Project you hold nothing in, or its members \u2014 is refused.`
+      // AND WHAT IT MAY DO THERE, which this also got wrong. "You can
+      // deploy in those Projects" is false for a gate granted *Project
+      // Read* — `project.read` and `resource.read`, no writes at all —
+      // and `doctor` is the FIRST command an agent is told to run, so it
+      // was the first sentence an observing agent read. An agent that
+      // believes it can deploy and is then refused reports a platform
+      // defect, which is precisely the outcome the guide now tells it not
+      // to reach for. Scope and role are two questions; this answers both.
+      detail: `${projects.join(", ")} \u2014 and nothing organization-wide. ` + (mutating.length > 0 ? "You can deploy in those Projects, read their catalogue, and list them. " : "Read-only there: catalogue, manifests, resources and operations. An apply or a lifecycle command is refused, and that is what was granted rather than a fault. ") + "Anything ACROSS the organization \u2014 a Project you hold nothing in, or its members \u2014 is refused."
     }
   );
   checks.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varde-flyt/vfac",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Deploy and manage Varde Flyt Products from a manifest.",
   "repository": {
     "type": "git",