@frontera-sdk/cli 1.52.39 → 1.52.41

package/src/local/local-apps.ts

@@ -1,7 +1,9 @@
-import { existsSync, readdirSync, readFileSync } from 'node:fs'
-import { join } from 'node:path'
+import { existsSync, lstatSync, readdirSync, readFileSync, statSync } from 'node:fs'
+import { basename, join, relative } from 'node:path'
 
 import type { RemoteItem } from './local-sync-plan'
+import { readDevSessionState } from './local-app-dev-session'
+import { isAlive } from './local-state'
 
 /**
  * Custom Apps: the workspace's code Apps (a Chat App is `chat-apps/`). A
@@ -11,9 +13,10 @@ import type { RemoteItem } from './local-sync-plan'
  * with its switch. `local dev` makes the App on the local runtime and binds
  * those Functions, so the App's calls to them are allowed here as there.
  *
- * Its code is its own project (a folder `frontera app pull` fills and
- * `frontera app deploy` ships), and is not brought: the App is saved here
- * without it, which its portability says (Adapted). Who may open it, its
+ * Its code is its own project: a pull brings the deployed version's source
+ * into `apps/<slug>/` (`local-app-code.ts`) unless `--no-app-code` or the
+ * folder is there, and `local dev` deploys it here on its own; its
+ * portability says so (Adapted). Who may open it, its
  * sign-in (audiences, roles, keys) and its addresses are the platform's:
  * people and deployment (sync v2 design §8). Never proposed back.
  */
@@ -45,7 +48,7 @@ export interface AppFile {
 export const appPath = (slug: string) => `apps/${slug}.json`
 
 /** Why an App is Adapted here, as the build and the Pull dialog say it. */
-export const APP_WITHOUT_CODE = 'Saved here with the Functions it may start, without its code: an App’s code is its own project, deployed to this runtime on its own'
+export const APP_WITHOUT_CODE = 'Saved here with the Functions it may start; its code is its own project in apps/<slug>/, which a pull brings unless --no-app-code, where `frontera app dev` runs it against this runtime and `frontera app deploy` deploys it here'
 
 const strings = (v: unknown): string[] | undefined => (Array.isArray(v) && v.every((x) => typeof x === 'string') && v.length ? (v as string[]) : undefined)
 
@@ -71,7 +74,7 @@ export function readApps(rows: AppRow[], wanted: (ref: string) => boolean): Remo
     if (!wanted(ref)) continue
     const doc = appDocument(row)
     const notes = [
-      row.version ? `Its code (version ${row.version}) is its own project and stays on the platform; this file is what the App is and the Functions it may start` : 'Never deployed in the workspace; this file is what the App is and the Functions it may start',
+      row.version ? `Its code (version ${row.version}) is its own project: a pull brings it into apps/${row.slug}/ unless --no-app-code or that folder is there; this file is what the App is and the Functions it may start` : 'Never deployed in the workspace; this file is what the App is and the Functions it may start',
       row.hosting === 'external' ? 'Hosted on its own domain: its sign-in, roles and keys stay on the platform' : 'Who may open it and its addresses stay on the platform',
     ]
     out.push({ ref, kind: 'app', name: row.slug, title: row.name, files: { [appPath(row.slug)]: `${JSON.stringify(doc, null, 2)}\n` }, unresolved: [], notes, requires: doc.functions.map((f) => f.function), id: row.id, ...(row.version ? { version: `v${row.version}` } : {}) })
@@ -151,6 +154,176 @@ export async function applyApp(root: string, slug: string, call: Call, provides:
     const gone = await call('DELETE', `/v1/functions/${encodeURIComponent(fn)}/app-bindings/${encodeURIComponent(slug)}`)
     if (gone.status >= 400 && gone.status !== 404) lines.push(`  warning: Function ${fn} could not be unbound from it (${errorOf(gone)})`)
   }
-  lines.unshift(`  saved App ${name}${named.size ? ` (may start ${[...named].sort().join(', ')})` : ''}`)
+  lines.unshift(`  saved App ${name}${named.size ? ` (may start ${[...named].sort((a, b) => (String(a) < String(b) ? -1 : String(a) > String(b) ? 1 : 0)).join(', ')})` : ''}`)
   return { ok: true, output: lines.join('\n') }
 }
+
+// ── A Custom App's code, in the project ─────────────────────────────────────
+
+/** Folders an App's code is never in: dependencies, build output, the project's state and its other kinds. */
+const NOT_APP_DIRS = new Set(['node_modules', '.git', '.frontera', '.next', 'dist', 'out', 'build', 'vendor', 'fixtures', 'datasets', 'blueprint', 'agents', 'workflows', 'functions', 'knowledge', 'skills', 'themes', 'mcp', 'chat-apps'])
+
+export function readPackage(dir: string): { scripts?: Record<string, string>; frontera?: unknown } | null {
+  try {
+    return JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')) as { scripts?: Record<string, string>; frontera?: unknown }
+  } catch {
+    return null
+  }
+}
+
+/** A folder that is a Custom App's code: its manifest (`frontera.config.json`, or `frontera` in package.json) beside a package.json. */
+function isAppFolder(dir: string): boolean {
+  if (!existsSync(join(dir, 'package.json'))) return false
+  if (existsSync(join(dir, 'frontera.config.json'))) return true
+  return !!readPackage(dir)?.frontera
+}
+
+/**
+ * Each Custom App's code folder, relative to the project: apps/<name>/ with a
+ * package.json, and any other folder an App was made in (`frontera app init
+ * <name>` at the project's root makes ./<name>/), found by its manifest. The
+ * project's own root is not one.
+ */
+export function customAppFolders(root: string): string[] {
+  const out: string[] = []
+  const walk = (dir: string, depth: number) => {
+    let names: string[]
+    try {
+      names = readdirSync(dir).sort()
+    } catch {
+      return
+    }
+    for (const name of names) {
+      if (name.startsWith('.') || NOT_APP_DIRS.has(name)) continue
+      const path = join(dir, name)
+      try {
+        if (!lstatSync(path).isDirectory()) continue
+      } catch {
+        continue
+      }
+      // apps/<name>/ with a package.json is an App's code, manifest or not, as it always was.
+      if (isAppFolder(path) || (dir === join(root, 'apps') && existsSync(join(path, 'package.json')))) {
+        out.push(relative(root, path))
+        continue
+      }
+      if (depth < 2) walk(path, depth + 1)
+    }
+  }
+  walk(root, 0)
+  return out
+}
+
+/**
+ * Where each Custom App's code is, as Studio says how to work on it: `folder`
+ * (its code folder, where `frontera app dev` runs it), `not-pulled` (the
+ * workspace deployed it, but its code isn't in the project: a pull brings
+ * it), or `none` (its file only describes it: it was never deployed, so no
+ * code exists, and `frontera app init` starts one). By the App's slug, for
+ * every apps/<slug>.json and every code folder.
+ */
+export type AppCodeState = { slug: string; code: 'folder'; dir: string } | { slug: string; code: 'not-pulled'; version: string } | { slug: string; code: 'none' }
+
+export function appCodeStates(root: string): AppCodeState[] {
+  const folders = new Map(customAppFolders(root).map((dir) => [basename(dir), dir] as const))
+  const described = existsSync(join(root, 'apps')) ? readdirSync(join(root, 'apps')).filter((f) => f.endsWith('.json')).map((f) => f.slice(0, -'.json'.length)) : []
+  const slugs = [...new Set([...described, ...folders.keys()])].sort()
+  return slugs.map((slug): AppCodeState => {
+    const dir = folders.get(slug)
+    if (dir) return { slug, code: 'folder', dir }
+    let version: unknown
+    try {
+      version = (JSON.parse(readFileSync(join(root, appPath(slug)), 'utf8')) as { version?: unknown }).version
+    } catch {
+      version = undefined
+    }
+    return typeof version === 'string' && version ? { slug, code: 'not-pulled', version } : { slug, code: 'none' }
+  })
+}
+
+/** What the project knows about one Custom App's code: its last deployment here and its dev server. */
+export interface CustomAppFolder {
+  /** Its folder's name: the row's name (`app/<name>`). */
+  name: string
+  /** Its folder, relative to the project. */
+  dir: string
+  /** The last `frontera app deploy` from this folder, when it made one: its id and when. */
+  deployment: { id: string; at: string | null } | null
+  /** The version its code was pulled at (a pull of the App, or `frontera app pull`), when it was: not a deployment here. */
+  pulled: { version: string; at: string | null } | null
+  /** Its code changed after that deployment. */
+  changedSinceDeploy: boolean
+  /** Its build is in the folder (`out/`, what `frontera app deploy` uploads), deployed or not. */
+  built: boolean
+  /** The dev server `frontera app dev` (or `app_dev`) runs for it, while it runs. */
+  devServer: string | null
+  /**
+   * A deployment from here that went with a database restore (`frontera local
+   * snapshot restore`, a `local check` rollback): the restored database does
+   * not have it, and the next `frontera local dev` deploys the App again.
+   */
+  away?: { deployment: string; restoredAt: string }
+  /** The running dev server could not mint the browser's session the last time it tried: its words. */
+  devSessionError?: string
+}
+
+function newestSource(dir: string): number {
+  let newest = 0
+  const walk = (at: string, depth: number) => {
+    let names: string[]
+    try {
+      names = readdirSync(at)
+    } catch {
+      return
+    }
+    for (const n of names) {
+      if (n.startsWith('.') || ['node_modules', 'out', 'dist', '.next', 'build'].includes(n)) continue
+      const path = join(at, n)
+      try {
+        const st = statSync(path)
+        if (st.isDirectory()) {
+          if (depth < 8) walk(path, depth + 1)
+        } else if (st.mtimeMs > newest && !/\.tsbuildinfo$/.test(n)) newest = st.mtimeMs
+      } catch {
+        // Gone while reading.
+      }
+    }
+  }
+  walk(dir, 0)
+  return newest
+}
+
+export function customAppFolder(root: string, dir: string): CustomAppFolder {
+  const name = basename(dir)
+  const statePath = join(root, dir, '.frontera', 'state.json')
+  let deployment: CustomAppFolder['deployment'] = null
+  let pulled: CustomAppFolder['pulled'] = null
+  let changedSinceDeploy = false
+  let away: CustomAppFolder['away']
+  try {
+    const state = JSON.parse(readFileSync(statePath, 'utf8')) as { parentVersion?: unknown; pulledVersion?: unknown; restoredAway?: { deployment?: unknown; restoredAt?: unknown } }
+    const at = statSync(statePath).mtimeMs
+    const r = state.restoredAway
+    if (r && typeof r.deployment === 'string' && typeof r.restoredAt === 'string') away = { deployment: r.deployment, restoredAt: r.restoredAt }
+    if (typeof state.parentVersion === 'string' && state.parentVersion) {
+      deployment = { id: state.parentVersion, at: new Date(at).toISOString() }
+      changedSinceDeploy = newestSource(join(root, dir)) > at + 1000
+    }
+    if (typeof state.pulledVersion === 'string' && state.pulledVersion) pulled = { version: state.pulledVersion, at: new Date(at).toISOString() }
+  } catch {
+    // Never deployed from here.
+  }
+  let devServer: string | null = null
+  let devSessionError: string | undefined
+  try {
+    const dev = JSON.parse(readFileSync(join(root, '.frontera', 'local', 'app-dev', `${name}.json`), 'utf8')) as { pid?: unknown; url?: unknown; startedAt?: unknown }
+    if (typeof dev.url === 'string' && typeof dev.pid === 'number' && isAlive(dev.pid)) {
+      devServer = dev.url
+      // This server's own last session mint, not one an earlier server recorded.
+      const session = readDevSessionState(join(root, '.frontera', 'local'), name)
+      if (session && !session.ok && (typeof dev.startedAt !== 'string' || session.at >= dev.startedAt)) devSessionError = session.error ?? 'its session request failed'
+    }
+  } catch {
+    // Not running.
+  }
+  return { name, dir, deployment, pulled, changedSinceDeploy, built: existsSync(join(root, dir, 'out')), devServer, ...(away ? { away } : {}), ...(devSessionError ? { devSessionError } : {}) }
+}

package/src/local/local-blueprint-errors.ts

@@ -0,0 +1,198 @@
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+
+import type { ActionBuild } from './local-actions'
+import { ACTIVE_CATALOG } from './local-blueprint-schemas'
+
+/**
+ * A Blueprint failure, said against the project's files.
+ *
+ * The runtime names a problem by where it sits in the draft definition it
+ * holds (`actions.1.concurrency.strategy`), which says nothing to whoever
+ * edits `blueprint/actions/resetLine.yaml`; and `blueprint apply` prints the
+ * same issue in its message and again in its hint. Here each indexed path
+ * becomes the file it came from and the field inside it, and a line that says
+ * what another already says is dropped.
+ */
+
+/** The draft definition's arrays, and the `blueprint/` folder each one's files live in. */
+const COLLECTIONS: Record<string, string> = {
+  actions: 'actions',
+  objects: 'object-types',
+  objectTypes: 'object-types',
+  relationships: 'link-types',
+  linkTypes: 'link-types',
+  metrics: 'metrics',
+  sharedProperties: 'shared-fields',
+  semanticTypes: 'semantic-types',
+}
+
+const COLLECTION = Object.keys(COLLECTIONS).join('|')
+
+/** `actions.1.x`, `actions[1].x`, `/actions/1/x`: a collection, an index, then the field path. */
+const INDEXED = new RegExp(`(?<![A-Za-z0-9_])/?(${COLLECTION})(?:\\.|\\[|/)(\\d+)\\]?((?:(?:\\.|/)[A-Za-z0-9_]+|\\[\\d+\\])*)`, 'g')
+
+/** The file a Blueprint artifact lives in, as the project holds it: `blueprint/actions/resetLine.yaml`. */
+export function blueprintFile(root: string, folder: string, apiName: string): string {
+  for (const ext of ['yaml', 'yml', 'json']) {
+    const rel = join('blueprint', folder, `${apiName}.${ext}`)
+    if (existsSync(join(root, rel))) return rel
+  }
+  return join('blueprint', folder, `${apiName}.yaml`)
+}
+
+/** `/concurrency/strategy` or `.inputs[0].valueType` → `concurrency.strategy`, `inputs.0.valueType`. */
+function fieldPath(rest: string): string {
+  return rest
+    .replace(/\[(\d+)\]/g, '.$1')
+    .split(/[./]/)
+    .filter(Boolean)
+    .join('.')
+}
+
+/**
+ * Every indexed path in the text, named by the file it came from: the
+ * definition is the runtime's draft (`GET /v1/blueprint/lifecycle`), whose
+ * arrays the indices count into. A path whose index the definition does not
+ * have is left as it is.
+ */
+export function nameIndexedPaths(text: string, definition: unknown, root: string): string {
+  const def = (definition && typeof definition === 'object' ? definition : {}) as Record<string, unknown>
+  return text.replace(INDEXED, (whole, collection: string, index: string, rest: string) => {
+    const list = def[collection]
+    const entry = Array.isArray(list) ? (list[Number(index)] as { apiName?: unknown } | undefined) : undefined
+    const apiName = typeof entry?.apiName === 'string' ? entry.apiName : null
+    if (!apiName) return whole
+    const field = fieldPath(rest)
+    const file = blueprintFile(root, COLLECTIONS[collection]!, apiName)
+    return field ? `${file} (${field})` : file
+  })
+}
+
+/** Whether the text names a definition array by index, so it is worth reading the draft to name it. */
+export function hasIndexedPaths(text: string): boolean {
+  INDEXED.lastIndex = 0
+  const found = INDEXED.test(text)
+  INDEXED.lastIndex = 0
+  return found
+}
+
+/** The words of a line, for telling two lines that say the same thing apart from two that do not. */
+function gist(line: string): string {
+  return line
+    .replace(/^\s*(error|hint|warning)(\s*\[[^\]]*\])?:\s*/i, '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, ' ')
+    .trim()
+}
+
+/**
+ * Lines with each thing said once: a line whose words another line already
+ * holds is dropped (the hint that repeats the message), and of two that
+ * overlap, the longer one stays where the first one was.
+ */
+export function dedupeLines(lines: string[]): string[] {
+  const kept: Array<{ line: string; gist: string }> = []
+  for (const line of lines) {
+    const g = gist(line)
+    if (!g) continue
+    if (kept.some((k) => k.gist.includes(g))) continue
+    const shorter = kept.findIndex((k) => g.includes(k.gist))
+    if (shorter >= 0) {
+      kept[shorter] = { line, gist: g }
+      // A third line the new one also covers.
+      for (let i = kept.length - 1; i > shorter; i--) if (g.includes(kept[i]!.gist)) kept.splice(i, 1)
+      continue
+    }
+    kept.push({ line, gist: g })
+  }
+  return kept.map((k) => k.line)
+}
+
+/**
+ * The governed Actions that did not deploy, as the failure `local dev` reports:
+ * one line per Action, naming its file, then each failed check under it.
+ * Empty when every Action that runs here deployed.
+ */
+export function actionFailureLines(actions: Record<string, ActionBuild>, root: string): string[] {
+  const out: string[] = []
+  for (const [name, a] of Object.entries(actions)) {
+    if (a.status !== 'failed') continue
+    out.push(`governed Action ${name} (${blueprintFile(root, 'actions', name)}) didn’t deploy: ${a.reason ?? 'no reason given'}`)
+    for (const f of a.findings ?? []) out.push(`  ✕ ${f}`)
+  }
+  return out
+}
+
+/** The service's refusal of an Action's source system by a name the draft lacks. */
+const UNKNOWN_SOURCE_SYSTEM = /authoritySourceSystem names a source system "([^"]*)", which is not on the draft/
+
+/**
+ * What to write instead when an Action names a source system the draft does
+ * not have: source systems have no file or command, so the one an Action that
+ * writes Blueprint records can name is `active-catalog`, which the service
+ * adds with the first object type. Null when the text is about something else.
+ */
+export function sourceSystemHint(text: string): string | null {
+  const m = UNKNOWN_SOURCE_SYSTEM.exec(text)
+  if (!m || m[1] === ACTIVE_CATALOG) {
+    return m ? `\`${ACTIVE_CATALOG}\` is added to the draft with its first object type: apply an object type before (or with) the Action.` : null
+  }
+  return `An Action that writes the Blueprint's own records names \`effect.authoritySourceSystem: ${ACTIVE_CATALOG}\`, or leaves the key out (source systems have no file or command of their own); "${m[1]}" is not one.`
+}
+
+/** `blueprint apply`'s line naming the step the runtime refused: `Stopped at: create object-type Receipt`. */
+const STOPPED_AT = /^\s*Stopped at: (create|update|delete) (semantic-type|shared-field|object-type|link-type|metric|action) ([A-Za-z][A-Za-z0-9_]*)\s*$/m
+
+/**
+ * The Blueprint artifact a failed `blueprint apply` stopped at, as
+ * `kind:apiName` (`object-type:Receipt`), with the runtime's reason: the
+ * line after the step's. Null when the output names no step (a failure
+ * before any write, or a CLI that does not say it), or when the draft moved
+ * under the apply (a conflict is not the file's fault).
+ */
+export function refusedArtifact(output: string): { key: string; reason: string } | null {
+  const m = STOPPED_AT.exec(output)
+  if (!m) return null
+  // Someone else changed the draft first (another apply, a person in Blueprint): the file is not
+  // what was refused, so nothing is left off for it.
+  if (/error \[(CONFLICT|DRAFT_CONFLICT|VALIDATION_STALE)\]/.test(output)) return null
+  const after = output.slice(m.index + m[0].length).split('\n').map((l) => l.trim()).filter(Boolean)
+  const at = after.findIndex((l) => !/^(hint|warning):/i.test(l) && !/^frontera\s/.test(l))
+  const reason = at >= 0 ? after[at]!.replace(/^error(\s*\[[^\]]*\])?:\s*/i, '') : 'the runtime refused it'
+  // The specifics travel in the error's hint (`blueprint apply` prints the service's details there:
+  // `businessOutcomes.0.expectedChanges.4.value — An optional input …`): said with the reason, so
+  // `local dev` and `status` never stop at "validation failed". A command to run is not a reason.
+  const specifics = at >= 0
+    ? after.slice(at + 1)
+      .map((l) => l.replace(/^hint:\s*/i, ''))
+      .filter((l) => l && !/^frontera\s/.test(l) && !/^`?frontera\s/.test(l) && !/^warning:/i.test(l) && !/^(Applied before failing|Nothing was applied)/.test(l))
+    : []
+  const said = dedupeLines([reason, ...specifics])
+  // A detail the reason already carries (a service that names the issue in its message too) is said once.
+  const gistOf = (l: string) => (l.includes(' — ') ? l.slice(l.lastIndexOf(' — ') + 3) : l).replace(/[.]$/, '').trim()
+  const head = said[0] ?? reason
+  const fresh = said.slice(1).filter((l) => !head.includes(gistOf(l)))
+  const joined = fresh.length ? `${head.replace(/[.:]\s*$/, '')}: ${fresh.map((l) => l.replace(/[.]$/, '')).join('; ')}` : head
+  return { key: `${m[2]}:${m[3]}`, reason: joined }
+}
+
+/** A `✕ <folder>/<name>.yaml: <why>` line `blueprint plan`/`apply` prints for a rule an Action or metric file breaks. */
+const RULE_LINE = /^\s*✕\s+(?:\S*\/)?(actions|metrics)\/([A-Za-z][A-Za-z0-9_]*)\.(?:ya?ml|json):\s*(.+?)\s*$/gm
+
+/**
+ * The Action and metric files `blueprint apply` refused before its first write
+ * (a broken rule: `actions/x.yaml: … optional with no default …`), each as
+ * `kind:apiName` with its reasons: `local dev` leaves each off and applies the
+ * rest, as it does for a step the runtime refused. Empty when the output is
+ * not such a refusal.
+ */
+export function refusedByRules(output: string): Array<{ key: string; reason: string }> {
+  if (!/error \[VALIDATION_ERROR\]/.test(output) || !/so nothing was (planned or )?applied/.test(output)) return []
+  const reasons = new Map<string, string[]>()
+  for (const m of output.matchAll(RULE_LINE)) {
+    const key = `${m[1] === 'actions' ? 'action' : 'metric'}:${m[2]}`
+    reasons.set(key, [...(reasons.get(key) ?? []), m[3]!])
+  }
+  return [...reasons].map(([key, why]) => ({ key, reason: why.join('; ') }))
+}

package/src/local/local-blueprint-outline.ts

@@ -199,12 +199,20 @@ const ACTION_LABEL: Record<ActionLocalStatus, string> = {
   'not-deployed': 'Not deployed yet',
 }
 
+/** What the runtime said when it refused an Action's file, without the build record's lead-in. */
+export function refusedReason(reason: string | undefined): string {
+  const words = (reason ?? 'the local runtime refused it').replace(/^the local runtime refused it: /, '')
+  return words.charAt(0).toUpperCase() + words.slice(1)
+}
+
 /**
  * How the local runtime holds one Action: what the last Blueprint build
  * recorded for the files as they are, or, before one, what it will do.
  */
 export function actionLocal(doc: Doc, built: BuildEntry['actions'] | null): OutlineAction['local'] {
   const recorded = built?.[doc.apiName as string]
+  // Refused by the runtime (its own file is wrong), not left off by design: a failure to fix, with the runtime's words.
+  if (recorded?.status === 'left-off' && recorded.refused) return { status: 'failed', label: 'Refused by the runtime', reason: refusedReason(recorded.reason) }
   if (recorded) return { status: recorded.status, label: ACTION_LABEL[recorded.status], reason: recorded.reason ?? null }
   const fit = actionFit(doc)
   return fit.runsLocally ? { status: 'not-deployed', label: ACTION_LABEL['not-deployed'], reason: null } : { status: 'switched-off', label: ACTION_LABEL['switched-off'], reason: fit.reason ?? null }
@@ -403,29 +411,34 @@ export interface BlueprintBuildState {
   applied: boolean
   /** The last Blueprint build failed for these files: its error. */
   failed?: string | null
+  /** Each object type as the last build left it, when it was for these files: a type the runtime refused says so. */
+  objects?: BuildEntry['objects'] | null
 }
 
 /**
  * The one thing worth saying about an object type on this runtime, most
  * important first: platform only > the Blueprint failed to build > not
- * applied yet > adapted (an Action that does not run here, a calculated field
- * off, every row read) > built. `state` (or `true`) says the runtime holds the
+ * applied yet > adapted (an Action switched off here, a calculated field
+ * off, every row read) > built. An Action that didn't deploy is its own
+ * row, not its type's. `state` (or `true`) says the runtime holds the
  * project's current Blueprint.
  */
-export function objectStatus(o: Pick<ObjectOutline, 'fields' | 'actions' | 'local'>, state: boolean | BlueprintBuildState): ObjectStatus {
+export function objectStatus(o: Pick<ObjectOutline, 'fields' | 'actions' | 'local'> & { apiName?: string }, state: boolean | BlueprintBuildState): ObjectStatus {
   const s: BlueprintBuildState = typeof state === 'boolean' ? { applied: state } : state
   if (o.local.leftOff) return { kind: 'platform-only', label: 'Platform only' }
   if (s.failed) return { kind: 'failed', label: 'Failed', reason: s.failed }
+  // The runtime refused this type alone: it is left off, and the rest of the Blueprint built.
+  const refused = o.apiName ? s.objects?.[o.apiName]?.refused : undefined
+  if (refused) return { kind: 'failed', label: 'Left off: the runtime refused it', reason: refused }
   if (!s.applied) return { kind: 'not-applied', label: 'Not applied yet' }
-  const idle = o.actions.filter((a) => a.local.status === 'switched-off' || a.local.status === 'failed')
+  // A governed Action that didn't deploy is a failure of its own (`action/<name>`, a row of the
+  // build), so the type it acts on is not counted as failed a second time.
+  const idle = o.actions.filter((a) => a.local.status === 'switched-off')
   if (idle.length) {
-    const failed = idle.filter((a) => a.local.status === 'failed')
-    const label = failed.length
-      ? failed.length === 1 ? 'An action didn’t deploy' : `${failed.length} actions didn’t deploy`
-      : idle.length === 1 ? '1 action switched off here' : `${idle.length} actions switched off here`
+    const label = idle.length === 1 ? '1 action switched off here' : `${idle.length} actions switched off here`
     return { kind: 'adapted', label, reason: idle.map((a) => `${a.displayName}: ${a.local.reason ?? a.local.label}`).join('; ') }
   }
-  if (o.local.mediaStub) return { kind: 'stubbed', label: 'Stubbed: no files here', reason: `Its files stay on the platform: an empty Media Set, ${o.local.mediaStub}, stands in for them here` }
+  if (o.local.mediaStub) return { kind: 'stubbed', label: 'Stubbed: placeholder files', reason: `Its files stay on the platform: a stand-in Media Set, ${o.local.mediaStub}, holds placeholder files for them here` }
   if (o.local.calculated.length) {
     const names = o.local.calculated.map((api) => o.fields.find((f) => f.apiName === api)?.displayName ?? api)
     return { kind: 'adapted', label: names.length === 1 ? `Adapted: ${inline(names[0]!)} off` : `Adapted: ${names.length} fields off` }
@@ -445,14 +458,20 @@ export function localOrganizationId(root: string): string | null {
 }
 
 /** The Blueprint's build for the files as they are: applied or not, failed or not, and its Actions. */
-export function blueprintBuild(root: string): BlueprintBuildState & { actions: BuildEntry['actions'] | null } {
+export function blueprintBuild(root: string): BlueprintBuildState & { actions: BuildEntry['actions'] | null; parts: BuildEntry['parts'] | null; refusedBefore: BuildEntry['actions'] | null } {
   const project = { root, id: '', stateDir: join(root, '.frontera', 'local') }
   const org = localOrganizationId(root)
   const entry = loadBuild(project, org).blueprint
   // The record speaks only for the files it was made from.
   const current = !!entry && entry.hash === contentHash(project, { kind: 'blueprint', key: 'blueprint' })
-  const failed = current && entry.status === 'failed' ? (entry.error ?? 'The Blueprint didn’t apply') : null
-  return { applied: blueprintApplyState(project, org) === 'applied', failed, actions: current && !failed ? (entry.actions ?? null) : null }
+  // Published, with a governed Action that didn't deploy: the types are on the runtime, and
+  // that Action's object type is what failed (`objectStatus`), not every type.
+  const published = current && entry.status === 'failed' && !!entry.actions && Object.values(entry.actions).some((a) => a.status === 'failed')
+  const failed = current && entry.status === 'failed' && !published ? (entry.error ?? 'The Blueprint didn’t apply') : null
+  // The Actions the last build couldn't deploy, kept when a Blueprint file changed since: a refusal stays a
+  // failure until an apply says otherwise, as any item's does (`buildView`), not "not applied" while unapplied.
+  const refusedBefore = entry && !current && entry.actions ? Object.fromEntries(Object.entries(entry.actions).filter(([, a]) => a.status === 'failed' || (a.status === 'left-off' && a.refused))) : null
+  return { applied: published || blueprintApplyState(project, org) === 'applied', failed, actions: current && !failed ? (entry.actions ?? null) : null, objects: current && !failed ? (entry.objects ?? null) : null, parts: current && !failed ? (entry.parts ?? null) : null, refusedBefore: refusedBefore && Object.keys(refusedBefore).length ? refusedBefore : null }
 }
 
 /** The outline of a project folder: its files, its local datasets and what names its Actions. */