@frontera-sdk/cli 1.53.6 → 1.53.7

package/src/commands/blueprint/declarative.ts

@@ -23,15 +23,19 @@ import {
 } from '../../blueprint/compile'
 import { metricRuleProblems } from '../../blueprint/metric-rules'
 import { actionRuleProblems, type ActionRuleProblems, type InheritedConflict } from '../../blueprint/action-rules'
-import { pickCurrentRevision } from '../../blueprint/dataset-revision'
+import { datasetBindingCommand, pickCurrentRevision } from '../../blueprint/dataset-revision'
 import { nameCheckWords, orgNameCheck } from '../../blueprint/org-name-check'
 import {
   assertPrunesLeaveNoDanglingReference,
   diff,
+  driftOf,
+  editableChanges,
   isEmpty,
   satisfies,
+  type DatasetIndex,
   type ModelOperation,
   type Plan,
+  type RebindChange,
 } from '../../blueprint/diff'
 import {
   API_NAME_RULE,
@@ -135,6 +139,66 @@ async function datasetNamesByRevision(
   return names
 }
 
+/**
+ * What `plan` needs from the Datasets: the name each pinned revision belongs to, and the
+ * current revision of a Dataset a file names. The Dataset list names every current
+ * revision, so revisions are read only for a pin that is not current (it may have
+ * drifted) and for a Dataset a file names that its type does not read now (it may move).
+ * When every type reads its Dataset's current revision, nothing beyond the list is read.
+ * Undefined when this credential cannot read Datasets, so nothing is planned from a guess.
+ */
+async function readDatasetIndex(
+  client: BlueprintAuthoringApi,
+  files: AuthoredFile[],
+  live: DefinitionBundle,
+): Promise<DatasetIndex | undefined> {
+  const pinOf = (apiName: string) => (live.objects.find((object) => object.apiName === apiName)
+    ?.governance.sourceMappings[0] as { datasetRevisionId?: string } | undefined)?.datasetRevisionId
+  const named = files.flatMap((file) => {
+    const dataset = file.kind === 'object-type' ? (file.document.backing as { dataset?: unknown } | undefined)?.dataset : undefined
+    return typeof dataset === 'string' && dataset && live.objects.some((object) => object.apiName === file.apiName)
+      ? [{ dataset, pin: pinOf(file.apiName) }]
+      : []
+  })
+  const pins = new Set([...named.flatMap((entry) => entry.pin ?? []), ...driftOf(live).map((pin) => pin.datasetRevisionId)])
+  if (named.length === 0 && pins.size === 0) return undefined
+  const readable = await readableDatasets(client)
+  if (!readable) return undefined
+
+  const byName = new Map(readable.flatMap((dataset) => (dataset.id && dataset.name ? [[dataset.name, { ...dataset, id: dataset.id }] as const] : [])))
+  const index: DatasetIndex = { nameByRevisionId: new Map(), current: new Map() }
+  for (const [name, dataset] of byName) {
+    if (dataset.currentRevisionId) index.nameByRevisionId.set(dataset.currentRevisionId, name)
+  }
+  const read = new Set<string>()
+  const readRevisions = async (name: string, dataset: { id: string; currentRevisionId?: string }) => {
+    if (read.has(name)) return
+    read.add(name)
+    const revisions = await client.datasetRevisions(dataset.id)
+    for (const revision of revisions) {
+      if (revision.id) index.nameByRevisionId.set(revision.id, name)
+    }
+    const current = pickCurrentRevision(dataset, revisions)
+    if (!current?.id) return
+    index.current.set(name, {
+      id: current.id,
+      ...(current.schemaDigest ? { schemaDigest: current.schemaDigest } : {}),
+      ...(current.columns ? { columns: current.columns.flatMap((column) => (column.name ? [column.name] : [])) } : {}),
+    })
+  }
+  for (const { dataset, pin } of named) {
+    const target = byName.get(dataset)
+    if (target && (!pin || target.currentRevisionId !== pin)) await readRevisions(dataset, target)
+  }
+  for (const pin of pins) {
+    for (const [name, dataset] of byName) {
+      if (index.nameByRevisionId.has(pin)) break
+      await readRevisions(name, dataset)
+    }
+  }
+  return index
+}
+
 async function resolveRevision(
   client: BlueprintAuthoringApi,
   name: string,
@@ -308,34 +372,18 @@ async function computePlan(ctx: CommandContext): Promise<{
     })
   }
   const { definition, revision } = await client.draft()
-  const plan = withheldPrunes(diff(files, definition, revision), directory)
+  const datasets = await readDatasetIndex(client, files, definition)
+  const plan = withheldPrunes(diff(files, definition, revision, datasets), directory)
 
-  // Per DISTINCT dataset, which is what the design promised and what the previous
-  // loop did not do: it called `datasetRevisions` once per BOUND TYPE, after
-  // `datasetNamesByRevision` had already read every dataset's revisions. A hundred
-  // types on one dataset cost a hundred redundant round trips.
+  // A type moving to another Dataset is no longer held to the old one's contract.
+  const rebound = new Set(plan.rebind.map((change) => change.objectApiName))
   const drift: Array<{ objectApiName: string; datasetName: string; currentDigest: string }> = []
-  if (plan.drift.length > 0) {
-    // One pass over the datasets, not two: the revisions are read once and both the
-    // revision→name map and the current-revision map are built from the same reads.
-    const names = new Map<string, string>()
-    const currentByDataset = new Map<string, { id: string; schemaDigest?: string }>()
-    for (const dataset of await readableDatasets(client) ?? []) {
-      if (!dataset.id || !dataset.name) continue
-      const revisions = await client.datasetRevisions(dataset.id)
-      for (const revision of revisions) {
-        if (revision.id) names.set(revision.id, dataset.name)
-      }
-      const current = pickCurrentRevision(dataset, revisions)
-      if (current?.id) currentByDataset.set(dataset.name, { id: current.id, schemaDigest: current.schemaDigest })
-    }
-    for (const pin of plan.drift) {
-      const datasetName = names.get(pin.datasetRevisionId)
-      if (!datasetName) continue
-      const current = currentByDataset.get(datasetName)
-      if (!current?.schemaDigest || current.schemaDigest === pin.pinnedDigest) continue
-      drift.push({ objectApiName: pin.objectApiName, datasetName, currentDigest: current.schemaDigest })
-    }
+  for (const pin of plan.drift) {
+    const datasetName = datasets?.nameByRevisionId.get(pin.datasetRevisionId)
+    if (!datasetName || rebound.has(pin.objectApiName)) continue
+    const current = datasets?.current.get(datasetName)
+    if (!current?.schemaDigest || current.schemaDigest === pin.pinnedDigest) continue
+    drift.push({ objectApiName: pin.objectApiName, datasetName, currentDigest: current.schemaDigest })
   }
   const inherits = inheritance(ctx)
   const actionProblems = actionRuleProblems(files, inherits.conflict)
@@ -1341,8 +1389,8 @@ export const blueprintApply: Command = {
 
     // Drift is REPORTED, and blocks only the artifacts it is about. It used to throw
     // before the plan was even shown, so a colleague's type reading a moved dataset
-    // refused an unrelated creation and hid what the run would have done. A rebind is
-    // `bind`'s act either way — the plan says so on the line.
+    // refused an unrelated creation and hid what the run would have done. Re-binding to
+    // the same Dataset's new revision is `bind`'s act; the plan says so on the line.
     const driftingNames = new Set(drift.map((entry) => entry.objectApiName))
     const blocked = plan.operations.filter((operation) =>
       operation.kind === 'object-type' && driftingNames.has(operation.apiName))
@@ -1354,6 +1402,16 @@ export const blueprintApply: Command = {
       )
     }
 
+    // A rebind that cannot be sent stops the run before any write, with what to run instead.
+    const refused = plan.rebind.filter((change): change is Extract<RebindChange, { refused: string }> => 'refused' in change)
+    if (refused.length > 0) {
+      throw new CliError(
+        refused.map((change) => `${change.objectApiName} cannot move to Dataset "${change.to}": ${change.refused}.`).join('\n')
+        + '\nNothing was applied.',
+        { code: 'CONFLICT', hint: refused.map((change) => change.next).join('\n') },
+      )
+    }
+
     // BOTH orderings resolved before the confirmation, not inside the write loop.
     // Each refuses a mutual `compensationAction` pair, and a refusal that arrives
     // after the creates have committed leaves the draft half-applied — which is what
@@ -1367,9 +1425,10 @@ export const blueprintApply: Command = {
     const ordered = orderForApply(plan.operations)
     const orderedPrunes = prune ? orderForPrune(plan.prunes, liveCompensations(definition)) : []
 
+    const changeCount = plan.operations.length + plan.editable.length + plan.rebind.length
     if (ctx.flags.yes !== true) {
       throw new CliError(
-        `This would apply ${plan.operations.length} change${plan.operations.length === 1 ? '' : 's'}.\n`
+        `This would apply ${changeCount} change${changeCount === 1 ? '' : 's'}.\n`
         + `${renderPlan(plan, { prune })}\n\nRe-run with --yes to apply.`,
         { code: 'USAGE', hint: 'frontera blueprint apply --yes' },
       )
@@ -1398,6 +1457,23 @@ export const blueprintApply: Command = {
           }),
         ),
       }
+      // First, so a property this run adds can read a column only the new Dataset publishes.
+      // The file naming the Dataset is the decision `--accept-contract-change` stands for in `bind`.
+      for (const change of plan.rebind) {
+        if ('refused' in change) continue
+        current = `update object-type ${change.objectApiName} dataset: ${change.from ?? '(none)'} → ${change.to}`
+        try {
+          revision = (await client.draftCommand(datasetBindingCommand(change.objectId, change.datasetRevisionId, change.columnMappings, true), revision)).revision
+        } catch (err) {
+          if (!(err instanceof CliError)) throw err
+          throw new CliError(`backing.dataset (${change.to}) was refused: ${err.message}`, {
+            code: err.code,
+            hint: `frontera blueprint bind ${change.objectApiName} --dataset ${change.to} --plan ./map.json`,
+            cause: err,
+          })
+        }
+        applied.push(current)
+      }
       for (const operation of ordered) {
         const file = byKey.get(`${operation.kind}:${operation.apiName}`)!
         current = `${operation.operation} ${operation.kind} ${operation.apiName}`
@@ -1411,6 +1487,24 @@ export const blueprintApply: Command = {
           applied.push(current)
         }
       }
+      // Last, against the draft as these writes left it: a type created above has its
+      // id, and a property added above can be named.
+      if (plan.editable.length) {
+        const after = await client.draft()
+        revision = after.revision
+        for (const change of editableChanges(files, after.definition)) {
+          current = `update object-type ${change.objectApiName}`
+          const objectId = after.definition.objects.find((object) => object.apiName === change.objectApiName)?.id
+          if (!objectId) throw new CliError(`No object type "${change.objectApiName}" on the draft to declare editable fields on.`, { code: 'NOT_FOUND', hint: 'frontera blueprint plan — re-plan against the current draft, then re-apply.' })
+          try {
+            revision = (await client.draftCommand({ kind: 'set_editable_properties', objectId, editableProperties: change.to }, revision)).revision
+          } catch (err) {
+            if (!(err instanceof CliError)) throw err
+            throw new CliError(`backing.editable (${change.to.join(', ') || 'none'}) was refused: ${err.message}`, { code: err.code, ...(err.hint ? { hint: err.hint } : {}), cause: err })
+          }
+          applied.push(`${current} editable: ${change.to.join(', ') || '(none)'}`)
+        }
+      }
       current = null
     } catch (err) {
       // What landed is as important as what failed: the draft is shared, and a

package/src/commands/blueprint/editable.ts

@@ -5,11 +5,9 @@ import type { Command, CommandContext } from '../types'
 /**
  * Declare which properties a governed Action may write.
  *
- * The `set_editable_properties` draft command has existed since the edit
- * overlay landed, and until now nothing called it: `apply` excludes backings
- * from its diff (`bind` owns them) and `bind` sends only the column mapping.
- * So the one declaration standing between a published ontology and an Action
- * that can change it was reachable by raw HTTP alone.
+ * The `set_editable_properties` draft command, for one object type at a time.
+ * `apply` sends the same command for every file whose `backing.editable`
+ * differs from the draft; this verb reads or changes the set without a file.
  *
  * It is its own verb rather than a flag on `bind` because narrowing the set is
  * a governed act with its own consequence — an edit already stored against a

package/src/commands/local/dev.ts

@@ -29,7 +29,7 @@ import {
   type SyncProfiles,
   type SyncTarget,
 } from '../../local/local-dev-sync'
-import { applyBindings, applyKnowledge, applyPlugin, blueprintWithout, editableSets, embeddingsDiffer, localDirectory, mediaCatalogDatasetReason, pointMediaTypesAt, promoteWorkflow, resolveBlueprint, resolveTarget, type ObjectBuild, type ResolvedBlueprint } from '../../local/local-dev-references'
+import { applyBindings, applyKnowledge, applyPlugin, blueprintWithout, embeddingsDiffer, localDirectory, mediaCatalogDatasetReason, pointMediaTypesAt, promoteWorkflow, resolveBlueprint, resolveTarget, type ObjectBuild, type ResolvedBlueprint } from '../../local/local-dev-references'
 import { applyObjectSets, namesObjectSet, objectSetCalls } from '../../local/local-object-sets'
 import { applyTheme, themeCalls } from '../../local/local-themes'
 import { ensureMediaSets, mediaUpload } from '../../local/local-media-sets'
@@ -421,8 +421,6 @@ async function apply(project: LocalProject, target: SyncTarget, opts: ApplyOptio
     if (named) result = { ...result, output: `${result.output}\n${named}`.trim() }
   }
   let authoredAgain: string[] = []
-  // Object types whose editable fields were declared for their Actions below.
-  const editableDone = new Set<string>()
   if (actionCalls && blueprint) {
     const names = blueprint.actions.map((a) => a.apiName)
     // A decision pins the Action's contract, its object type's fields included, and a first
@@ -431,14 +429,6 @@ async function apply(project: LocalProject, target: SyncTarget, opts: ApplyOptio
       const again = await runCli(project, command, opts.auth)
       if (!again.ok) return again
     }
-    // What each Action may write (`backing.editable`): `blueprint apply` leaves backings to `bind`.
-    const appliedDir = blueprint.dir ? join(project.root, blueprint.dir) : join(project.root, 'blueprint')
-    const subjects = new Set(blueprint.actions.flatMap((a) => (a.fit.subject ? [a.fit.subject] : [])))
-    for (const [type, props] of editableSets(appliedDir, subjects)) {
-      editableDone.add(type)
-      const set = await runCli(project, ['blueprint', 'editable', type, '--set', props.join(','), '--profile', profiles.organization], opts.auth)
-      if (!set.ok && !/no change|already|unchanged/i.test(set.output)) notes = [notes, `  warning: ${type}'s editable fields (${props.join(', ')}) could not be declared: ${oneLine(applyErrorText(set.output))}`].filter(Boolean).join('\n')
-    }
     // An Action whose contract moved after its decision here blocks the publish, and a decision
     // cannot follow a new contract. On this runtime it is authored again under a new id: out of
     // the draft (`--prune` over a copy without it), then back from the files.
@@ -462,16 +452,6 @@ async function apply(project: LocalProject, target: SyncTarget, opts: ApplyOptio
     const refused = await prepareActions(actionCalls, names, new Set(authoredAgain))
     if (refused.size) return { ok: false, output: `error [BLUEPRINT_ACTIONS]: governed Action ${[...refused].map(([name, why]) => `${name}: ${why}`).join('; ')}` }
   }
-  // Every other type's `backing.editable` too, before the publish: an editable type's rows carry
-  // their record version, which an Action on it (one to come, or an App's) submits.
-  if (blueprint && opts.publish) {
-    const appliedDir = blueprint.dir ? join(project.root, blueprint.dir) : join(project.root, 'blueprint')
-    for (const [type, props] of editableSets(appliedDir, null)) {
-      if (editableDone.has(type)) continue
-      const set = await runCli(project, ['blueprint', 'editable', type, '--set', props.join(','), '--profile', profiles.organization], opts.auth)
-      if (!set.ok && !/no change|already|unchanged/i.test(set.output)) result = { ...result, output: `${result.output}\n  warning: ${type}'s editable fields (${props.join(', ')}) could not be declared: ${oneLine(applyErrorText(set.output))}` }
-    }
-  }
   const objectTypes = target.kind === 'blueprint' ? blueprintObjectTypes(blueprintRoot) : []
   // The workspace's grants beyond read (`blueprint/workspace-grants.yaml`); a file that is wrong fails the Blueprint, said by line.
   const workspaceGrants = target.kind === 'blueprint' ? readWorkspaceGrants(project.root) : null

package/src/commands/local/steps.ts

@@ -1,6 +1,6 @@
 import { UsageError } from '../../errors'
 import { FRONTERA_READ_ONLY_COMMANDS } from '../../forge/permission-rules'
-import { addPersonStep, clearSettledSteps, CREDENTIAL_WORDS, CREDENTIALS, deliveryGroups, readPersonSteps, runStepChecks, settlePersonStep, type PersonStep } from '../../local/local-person-steps'
+import { addPersonStep, clearSettledSteps, CREDENTIAL_WORDS, CREDENTIALS, currentTarget, deliveryGroups, readPersonSteps, runStepChecks, settlePersonStep, staleProblem, type PersonStep, type StepTarget } from '../../local/local-person-steps'
 import { runSelf } from '../../mcp/mcp-cli'
 import { localProject } from '../../local/local-project'
 import { flagBool, flagString, type Command } from '../types'
@@ -15,11 +15,15 @@ import { flagBool, flagString, type Command } from '../types'
 
 const ACTIONS = ['list', 'add', 'done', 'dismiss', 'reopen', 'check', 'clear'] as const
 
-function stepLines(steps: PersonStep[]): string[] {
-  return steps.flatMap((s, n) => [
-    `  ${n + 1}. ${s.command ?? `${s.changes} (in the product)`}${s.check ? ' · checks itself' : ''}`,
-    `     ${s.why} Changes: ${s.changes} Needs ${CREDENTIAL_WORDS[s.credential] ?? s.credential}. (${s.id})`,
-  ])
+function stepLines(steps: PersonStep[], current: StepTarget | null): string[] {
+  return steps.flatMap((s, n) => {
+    const stale = staleProblem(s, current)
+    return [
+      `  ${n + 1}. ${s.command ?? `${s.changes} (in the product)`}${s.check ? ' · checks itself' : ''}`,
+      `     ${s.why} Changes: ${s.changes} Needs ${CREDENTIAL_WORDS[s.credential] ?? s.credential}. (${s.id})`,
+      ...(stale ? [`     ! Don't run it: ${stale}.`] : []),
+    ]
+  })
 }
 
 export const localSteps: Command = {
@@ -97,7 +101,7 @@ export const localSteps: Command = {
     const groups = deliveryGroups(steps)
     const settled = steps.filter((s) => s.status !== 'pending')
     const lines = groups.length
-      ? groups.flatMap((g) => [g.delivery ? `${g.delivery}:` : 'Other steps:', ...stepLines(g.steps), ''])
+      ? groups.flatMap((g) => [g.delivery ? `${g.delivery}:` : 'Other steps:', ...stepLines(g.steps, currentTarget(project.root)), ''])
       : ['No steps wait on the person.', '']
     if (flagBool(ctx, 'all') && settled.length) lines.push('Settled:', ...settled.map((s) => `  ${s.status === 'done' ? '✓' : '–'} ${s.command ?? s.changes} (${s.id})`))
     return { data: { pending: groups, ...(flagBool(ctx, 'all') ? { settled } : {}) }, text: lines.join('\n').trimEnd() }

package/src/commands/local/sync-request.ts

@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 
+import { signInStep } from '../../device-login'
 import { CliError, UsageError } from '../../errors'
 import { documentPath, readFolders, readPulledDocuments, recordPulledDocuments, sha256Of, type PulledDocument } from '../../local/local-knowledge-documents'
 import { assetFilename } from '../skill/bundle-commands'
@@ -12,7 +13,7 @@ import { mcpServersNotCarried } from '../../local/local-mcp-servers'
 import { localProject, type LocalProject } from '../../local/local-project'
 import { HISTORY_KINDS, projectAtRevision } from '../../local/local-sync-base'
 import { normalizeOrigin, unwrap } from '../../local/local-sync-client'
-import { getSyncKey, readLink, setModelMapping, type SyncLink } from '../../local/local-sync-link'
+import { getSyncKey, readLink, registerTargetProfile, setModelMapping, targetOf, type SyncLink } from '../../local/local-sync-link'
 import { itemTitle } from '../../local/local-sync-names'
 import { checkBody, markMissingModels, markRefused, needsAPerson, planOf, type ApplyStep, type WorkspaceModel } from '../../local/local-sync-precheck'
 import { afterApplyOf, recordAfterApply } from '../../local/local-person-steps'
@@ -28,6 +29,7 @@ import {
   checksOf,
   currentRequest,
   describeOutcome,
+  failedName,
   functionEntryOf,
   isOpen,
   itemLine,
@@ -470,7 +472,9 @@ function previewText(link: SyncLink, items: PushItem[], kept: { title: string }
   const not = items.filter((i) => !i.proposable)
   const name = link.workspaceName ?? link.workspace
   const lines = [
-    ok.length ? `Would propose ${plural(ok.length, 'item')} to ${name}${kept ? `, updating “${kept.title}”` : ''}:` : `Nothing to propose to ${name}.`,
+    ok.length
+      ? `Would propose ${plural(ok.length, 'item')} to ${name}${kept ? `, updating “${kept.title}”` : ''}:`
+      : not.length ? `Nothing to propose to ${name}: ${plural(not.length, 'change')} here cannot go yet, each for the reason below.` : `Nothing to propose to ${name}.`,
     // Each item's notes under it.
     ...ok.flatMap((i) => [`  [x] ${pushItemLine(i)}`, ...(usedBy.has(i.ref) ? [`      ! Still used by ${usedBy.get(i.ref)!.join(', ')}: applying would be refused`] : []), ...i.notes.map((n) => `      · ${n}`)]),
   ]
@@ -627,6 +631,15 @@ export async function syncPush(ctx: CommandContext): Promise<{ data: unknown; te
   const going = chosen.filter((i) => i.proposable && !leftSamples.includes(i))
   const releaseAsks = parseReleases(flagString(ctx, 'release'))
   if (!going.length && !releaseAsks.length) {
+    // Changes the checks refused are changes still: say why each can't go, not that nothing changed.
+    const held = chosen.filter((i) => !i.proposable && !i.sample)
+    if (held.length) {
+      throw new CliError(`nothing to propose: ${plural(held.length, 'change')} here cannot go yet\n${held.flatMap((i) => [`  ${KIND_WORD[i.kind]} ${i.title}: ${i.reason}`, ...(i.fix ? [`      Fix: ${i.fix}`] : [])]).join('\n')}`, {
+        code: 'SYNC_PUSH_BLOCKED',
+        hint: `fix ${held.length === 1 ? 'it' : 'them'} as said, then check with \`frontera local sync push --preview\``,
+        details: { blocked: held.map((i) => ({ ref: i.ref, code: i.blocked, message: i.reason, ...(i.fix ? { fix: i.fix } : {}) })) },
+      })
+    }
     throw new CliError(`nothing to propose: nothing ${mcp ? 'a change request carries ' : ''}changed here since the last pull`, {
       code: 'SYNC_NOTHING_TO_PUSH',
       hint: `${mcp ? `${mcp.line} For anything else, ` : ''}change an item in the project first; \`frontera local sync status\` shows where it stands`,
@@ -971,7 +984,7 @@ async function apply(ctx: CommandContext) {
     throw new CliError(describeOutcome(outcome, allTitles).join('\n'), {
       code: 'SYNC_APPLY_FAILED',
       hint: /migration instruction/i.test(outcome.failure?.message ?? '') ? 'say what to do with existing records: apply again with `--migration "<instructions>"`' : 'once what failed is fixed, apply again (`frontera local sync request apply`); a fix in the project’s files is pushed first (`frontera local sync push`)',
-      details: { outcome, failed: outcome.failure ? { ref: outcome.failure.ref, title: allTitles[outcome.failure.ref] ?? outcome.failure.ref, message: outcome.failure.message } : null },
+      details: { outcome, failed: outcome.failure ? { ref: outcome.failure.ref, title: failedName(outcome, allTitles), message: outcome.failure.message } : null },
     })
   }
   // The workspace now has the applied versions: fetch, and move each applied item's base to them.
@@ -994,7 +1007,13 @@ async function apply(ctx: CommandContext) {
   // The Agents applied: their cases' last local runs become the baseline the next request's evals compare with.
   recordApplied(project, answer.items.filter((i) => i.kind === 'agent' && !i.deleted).map((i) => i.name))
   // What the request left for a person: kept as the delivery's person-steps, which Forge shows as Pending in workspace (N6).
-  const pending = recordAfterApply(project.root, answer.request.title, afterApplyOf(answer.outcome))
+  const after = afterApplyOf(answer.outcome)
+  // The steps change the workspace the request went to, so they name it: the folder is bound to its local runtime.
+  const { target, targetError } = after.length
+    ? await registerTargetProfile(project, link).then((name) => ({ target: name, targetError: null }), (err: Error) => ({ target: null, targetError: err.message }))
+    : { target: null, targetError: null }
+  const pending = recordAfterApply(project.root, answer.request.title, after, target ? { profile: target, target: targetOf(link) } : null)
+  const signIn = target && pending.length ? await signInStep({ profile: target, apiUrl: link.platform, named: true }) : null
   return {
     data: { applied: true, outcome, request: { id: answer.request.id, title: answer.request.title, state: answer.request.state }, fetched, pendingInWorkspace: pending },
     text: [
@@ -1003,7 +1022,11 @@ async function apply(ctx: CommandContext) {
       '',
       fetched.error ? `Could not fetch afterwards: ${fetched.error}. Run \`frontera local sync fetch\`.` : `Fetched: ${plural(fetched.adopted.length, 'item')} now match${fetched.adopted.length === 1 ? 'es' : ''} the workspace.`,
       ...(pending.length
-        ? ['', `Pending in workspace (${pending.length}), for a person:`, ...pending.map((p) => `  - ${p.changes}${p.command ? `: \`${p.command}\`` : ''}${p.check ? ' (checks itself)' : ''}`), 'Forge lists them on the project’s home; `frontera local steps` here.']
+        ? ['', `Pending in workspace (${pending.length}), for a person:`, ...pending.map((p) => `  - ${p.changes}${p.command ? `: \`${p.command}\`` : ''}${p.check ? ' (checks itself)' : ''}`),
+          target
+            ? `They run against ${new URL(link.platform).host} with \`--profile ${target}\` (this project's keys), not the local runtime${signIn ? `; a step a signed-in person takes needs \`${signIn}\` first` : ''}.`
+            : `They name no target: the CLI could not record a profile for ${new URL(link.platform).host}${targetError ? ` (${targetError})` : ''}. Add \`--profile <a profile for that platform>\` when you run them.`,
+          'Forge lists them on the project’s home; `frontera local steps` here.']
         : []),
     ].join('\n'),
   }

package/src/commands/local/sync.ts

@@ -11,7 +11,7 @@ import { lessonsToPropose, pullLessons, type LessonsPulled } from '../../local/l
 import { analyticsNeeded, connectionsNeeded, documentationNeeded, standInPath, writePlatformOnly, writeStandIns } from '../../local/local-stand-ins'
 import { localProject, type LocalProject } from '../../local/local-project'
 import { normalizeOrigin, syncClient, type SyncClient } from '../../local/local-sync-client'
-import { getSyncKey, projectFile, readLink, removeSyncKey, setSyncKey, writeLink, type SyncLink } from '../../local/local-sync-link'
+import { getSyncKey, projectFile, projectKeyFingerprints, readLink, registerTargetProfile, removeSyncKey, removeTargetProfile, setSyncKey, targetProfileName, writeLink, type SyncLink } from '../../local/local-sync-link'
 import { describeRepair, repairBases, type BaseRepair } from '../../local/local-sync-base'
 import { conflictsId, mergeItemFiles, type Choice, type Conflict, type Side } from '../../local/local-sync-merge'
 import {
@@ -434,11 +434,13 @@ const connect = async (ctx: CommandContext) => {
   }
   const blueprintFlag = flagString(ctx, 'blueprint')
   if (blueprintFlag && blueprintFlag !== 'workspace' && blueprintFlag !== 'organization') throw new UsageError('--blueprint is workspace or organization', '`--blueprint organization` reads the whole model and needs an organization key')
+  // The stored organization key belongs to the previous link's platform and organization: kept only while both stay.
+  const keepsOrganizationKey = !keys.organization && previous?.platform === platform && previous.organization === me.orgId
   const link: SyncLink = {
     platform,
     workspace: me.workspaceId!,
     workspaceName: identity?.workspace.name ?? previous?.workspaceName,
-    organization: keys.organization ? me.orgId! : previous?.organization,
+    organization: keys.organization ? me.orgId! : keepsOrganizationKey ? previous!.organization : undefined,
     organizationName: identity?.organization.name ?? previous?.organizationName,
     blueprint: (blueprintFlag as SyncLink['blueprint'] | undefined) ?? (previous?.blueprint === 'organization' && keys.organization ? 'organization' : 'workspace'),
     // The models mapped for this workspace stay; another workspace has its own catalog.
@@ -446,14 +448,26 @@ const connect = async (ctx: CommandContext) => {
   }
   // A folder that is not a project yet gets the project file the link lives in.
   if (!existsSync(projectFile(project.root))) writeFileSync(projectFile(project.root), `# A Frontera project. \`frontera local dev\` applies agents/, workflows/, functions/ and blueprint/.\nname: ${basename(project.root)}\n`)
+  // The previous target's profile goes with the keys it was made from.
+  if (previous && targetProfileName(project, previous) !== targetProfileName(project, link)) await removeTargetProfile(project, previous)
+  // Read before the keys are replaced, so a profile holding the key a rotation replaces is still the project's.
+  const previousKeys = projectKeyFingerprints(project)
   setSyncKey(project, 'workspace', keys.workspace)
   if (keys.organization) setSyncKey(project, 'organization', keys.organization)
+  else if (!keepsOrganizationKey) removeSyncKey(project, 'organization')
   writeLink(project.root, link)
+  // The workspace as a CLI profile: a change request's steps for a person name it (`--profile`).
+  const { profile, profileError } = await registerTargetProfile(project, link, previousKeys).then(
+    (name) => ({ profile: name, profileError: null }),
+    (err: Error) => ({ profile: null, profileError: err.message }),
+  )
   return {
-    data: { link, keys: { workspace: true, organization: !!(keys.organization || getSyncKey(project, 'organization')) } },
+    data: { link, keys: { workspace: true, organization: !!(keys.organization || getSyncKey(project, 'organization')) }, profile },
     text: [
       `Linked to ${link.workspaceName ?? link.workspace}${link.organizationName ? ` (${link.organizationName})` : ''} on ${new URL(platform).host}.`,
       'Keys are in your keychain; the link is in frontera.yaml.',
+      ...(profile ? [`A change request's steps for a person reach this platform with \`--profile ${profile}\`, not the local runtime.`] : []),
+      ...(profileError ? [`No CLI profile was recorded for this platform (${profileError}); a change request's steps for a person name none until one is.`] : []),
       'See what you can pull: `frontera local sync pull --preview`.',
     ].join('\n'),
   }
@@ -947,6 +961,8 @@ const resolve = async (ctx: CommandContext) => {
 const disconnect = async (ctx: CommandContext) => {
   const project = localProject(ctx.cwd)
   const link = readLink(project.root)
+  // First, while the keys that show the profile is the project's are still stored.
+  if (link) await removeTargetProfile(project, link)
   removeSyncKey(project, 'workspace')
   removeSyncKey(project, 'organization')
   const forget = flagBool(ctx, 'forget-link')

package/src/commands/types.ts

@@ -106,6 +106,8 @@ export interface CommandContext {
   cwd: string
   apiUrl: string
   token: string
+  /** The profile the credential came from, when it came from one. */
+  profile?: string
   positional: string[]
   flags: Record<string, string | boolean>
   /** Every value of a string flag given more than once (`flags` holds the last). */

package/src/device-login.ts

@@ -1,4 +1,4 @@
-import type { CredentialStore } from './credential-store'
+import { credentialStore, type CredentialStore } from './credential-store'
 import { CliError } from './errors'
 
 /**
@@ -128,6 +128,24 @@ export async function readDeviceSession(store: CredentialStore, profile: string,
   }
 }
 
+/** How long a stored session must still last for a printed sign-in step to be left out: the steps after it take a few minutes. */
+const SIGN_IN_STEP_MARGIN_MS = 5 * 60_000
+
+/**
+ * The sign-in step a list of next steps starts with: `frontera auth login --browser`, with
+ * `--profile` when the steps name one. Null when that profile already holds a browser
+ * session for this platform that lasts past the next few minutes, so a person who signed
+ * in is not asked again at every printed step.
+ */
+export async function signInStep(
+  at: { profile?: string; apiUrl: string; named?: boolean },
+  store: CredentialStore = credentialStore(),
+  now = Date.now(),
+): Promise<string | null> {
+  if (at.profile && (await readDeviceSession(store, at.profile, at.apiUrl, now + SIGN_IN_STEP_MARGIN_MS))) return null
+  return `frontera auth login --browser${at.named && at.profile ? ` --profile ${at.profile}` : ''}`
+}
+
 /** Revoke the session on the platform (best effort) and forget it here. */
 export async function forgetDeviceSession(store: CredentialStore, profile: string, fetchFn: Fetch = fetch): Promise<boolean> {
   const raw = await store.get(sessionSlot(profile)).catch(() => null)

package/src/exit.ts

@@ -74,6 +74,8 @@ const USAGE_CODES = new Set([
   // An Action that isn't there to submit, or a submit without the key it needs.
   'ACTION_NOT_FOUND',
   'ACTION_IDEMPOTENCY_KEY_REQUIRED',
+  // `blueprint publish` without the --instruction its changes need: fixed in the command.
+  'MIGRATION_INSTRUCTION_REQUIRED',
 ])
 /**
  * Someone changed it first: re-read, then decide or submit again. Each of
@@ -115,6 +117,9 @@ const CONFLICT_CODES = new Set([
   'AUTOMATION_PUBLISH_UNCERTAIN',
   // The dataset's rows are written somewhere else now.
   'DATASET_AUTHORITY_MOVED',
+  // A release the draft's state refuses (an Action without a deployment decision, a
+  // missing column): the same publish is refused until that is cleared.
+  'RELEASE_BLOCKED',
 ])
 /**
  * Refusals the service sends under another code with a `reason` that is a

package/src/local/local-actions.ts

@@ -21,8 +21,8 @@ import type { LocalCredentials } from './local-state'
  *   after the publish    an Action that writes only the Blueprint's records gets its write
  *                        path (an ontology edit derived from the Action), built and validated
  *                        by the organization key, then reviewed and activated by the owner's
- *                        session (the service refuses a reviewer who built it); the owner role
- *                        may then invoke it
+ *                        session (an ontology edit, so its builder may review it); the owner
+ *                        role may then invoke it
  *
  * An Action whose effect would reach another system (a transition, a command)
  * keeps its switched-off decision: it is published, workflows that name it
@@ -170,8 +170,9 @@ export async function unpublishedActions(call: Call, apiNames: string[]): Promis
  * Actions whose contract moved after their decision was taken here (an edit
  * to the Action, or to a field of its object type), which blocks the publish:
  * a decision cannot follow a new contract. The draft's validation names them.
- * On the platform the cure is authoring the Action again under a new id; on
- * the local runtime `local dev` does that itself (see `dev.ts`).
+ * On the platform a person retires the old deployment (`action retire`), then
+ * publishes and deploys again; on the local runtime `local dev` authors the
+ * Action again under a new id itself (see `dev.ts`).
  */
 export async function staleActions(call: Call, apiNames: string[]): Promise<{ stale: string[]; consumed: string[] }> {
   const validated = await call('org', 'POST', '/v1/blueprint/lifecycle/validate', {})
@@ -295,7 +296,7 @@ async function deployOne(call: Call, published: Deployable, attachment?: LocalAc
     if (findings.length) return { reason: `its write path did not validate (${findings.length} failed check${findings.length === 1 ? '' : 's'})`, findings }
     return `its write path did not validate: ${validation.status >= 300 ? message(validation) : failedChecks(report)}`
   }
-  // A different principal from the key that built it: the service insists.
+  // Review and activation take a person's session; the key only builds.
   const reviewed = await call('session', 'POST', `${ADMIN}/binding-revisions/${bindingRevisionId}/review`, { validationReportId: report.id, expectedStateGeneration: 2 })
   if (reviewed.status >= 300) return `its review was refused: ${message(reviewed)}`
   const revision = data<{ stateId?: string; stateGeneration?: number; actionDefinitionId?: string }>(await call('session', 'GET', `${ADMIN}/binding-revisions/${bindingRevisionId}`))

package/src/local/local-blueprint-schemas.ts

@@ -113,7 +113,7 @@ const OBJECT_TYPE: JsonSchema = {
       type: 'object',
       description: 'Where the records come from: the dataset by NAME (its revision is resolved when applied), and one column per property. There is no name-match fallback.',
       properties: {
-        dataset: text('The dataset’s apiName (datasets/<apiName>.json).'),
+        dataset: text('The dataset’s apiName (datasets/<apiName>.json). Naming another dataset moves the type to it on `frontera blueprint apply` and in a change request’s Apply; each property keeps its column. A change request creates a new type bound to it, in the same release.'),
         mapping: {
           type: 'object',
           description: 'property apiName → its column, or { column, field } for a field inside a column.',
@@ -124,7 +124,7 @@ const OBJECT_TYPE: JsonSchema = {
             ],
           },
         },
-        editable: { type: 'array', items: { type: 'string' }, description: 'The properties a governed Action may write.' },
+        editable: { type: 'array', items: { type: 'string' }, description: 'The properties a governed Action may write. `frontera blueprint apply` and a change request’s Apply declare this list, for a type they create too; leave the key out to keep what the draft holds, or write [] for none.' },
       },
       required: ['dataset', 'mapping'],
     },

package/src/local/local-dev-references.ts

@@ -735,29 +735,6 @@ export function pointMediaTypesAt(project: LocalProject, blueprint: ResolvedBlue
   }
 }
 
-/**
- * The properties each object type lets a governed Action write
- * (`backing.editable`), for the types those Actions act on. `blueprint apply`
- * leaves backings to `bind`, so `local dev` declares them itself
- * (`blueprint editable`) before an Action's write path is built.
- */
-export function editableSets(dir: string, subjects: ReadonlySet<string> | null): Map<string, string[]> {
-  const out = new Map<string, string[]>()
-  const at = join(dir, 'object-types')
-  if (!existsSync(at)) return out
-  for (const name of readdirSync(at)) {
-    if (!/\.ya?ml$/.test(name) || name.startsWith('.')) continue
-    try {
-      const doc = parseYaml(readFileSync(join(at, name), 'utf8')) as { apiName?: unknown; backing?: { editable?: unknown } } | null
-      const editable = doc?.backing?.editable
-      if (typeof doc?.apiName === 'string' && (!subjects || subjects.has(doc.apiName)) && Array.isArray(editable) && editable.length) out.set(doc.apiName, editable.map(String).sort((a, b) => (String(a) < String(b) ? -1 : String(a) > String(b) ? 1 : 0)))
-    } catch {
-      // A file that does not parse is refused by the apply itself.
-    }
-  }
-  return out
-}
-
 /**
  * A copy of a Blueprint folder without some governed Actions, under
  * `.frontera/local/resolved/blueprint-without`: applied with `--prune`, it