@frontera-sdk/cli 1.53.6 → 1.53.8

package/src/local/local-dev-references.ts

@@ -735,29 +735,6 @@ export function pointMediaTypesAt(project: LocalProject, blueprint: ResolvedBlue
   }
 }
 
-/**
- * The properties each object type lets a governed Action write
- * (`backing.editable`), for the types those Actions act on. `blueprint apply`
- * leaves backings to `bind`, so `local dev` declares them itself
- * (`blueprint editable`) before an Action's write path is built.
- */
-export function editableSets(dir: string, subjects: ReadonlySet<string> | null): Map<string, string[]> {
-  const out = new Map<string, string[]>()
-  const at = join(dir, 'object-types')
-  if (!existsSync(at)) return out
-  for (const name of readdirSync(at)) {
-    if (!/\.ya?ml$/.test(name) || name.startsWith('.')) continue
-    try {
-      const doc = parseYaml(readFileSync(join(at, name), 'utf8')) as { apiName?: unknown; backing?: { editable?: unknown } } | null
-      const editable = doc?.backing?.editable
-      if (typeof doc?.apiName === 'string' && (!subjects || subjects.has(doc.apiName)) && Array.isArray(editable) && editable.length) out.set(doc.apiName, editable.map(String).sort((a, b) => (String(a) < String(b) ? -1 : String(a) > String(b) ? 1 : 0)))
-    } catch {
-      // A file that does not parse is refused by the apply itself.
-    }
-  }
-  return out
-}
-
 /**
  * A copy of a Blueprint folder without some governed Actions, under
  * `.frontera/local/resolved/blueprint-without`: applied with `--prune`, it

package/src/local/local-person-steps.ts

@@ -2,6 +2,9 @@ import { existsSync, mkdirSync, readFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 
 import { writeFileAtomic } from '../fs-atomic'
+import { getProfile } from '../profiles'
+import { localProject } from './local-project'
+import { readLink, targetOf, targetProfileName } from './local-sync-link'
 
 /**
  * Person-steps (Forge improvement plan T4, N4): a step only the person may
@@ -74,6 +77,10 @@ export interface PersonStep {
   key?: string
   check?: StepCheck
   lastCheckedAt?: string
+  /** The workspace a change request's step acts on (`targetOf`): stale once the folder links elsewhere. */
+  target?: string
+  /** The profile its command and check name (`targetProfileName`): stale when it is gone or no longer the folder's. */
+  profile?: string
 }
 
 interface StepsFile {
@@ -119,12 +126,35 @@ function filePath(root: string): string {
 export function readPersonSteps(root: string): PersonStep[] {
   const path = filePath(root)
   if (!existsSync(path)) return []
+  let steps: PersonStep[]
   try {
     const parsed = JSON.parse(readFileSync(path, 'utf8')) as Partial<StepsFile>
-    return Array.isArray(parsed.steps) ? parsed.steps.filter((s): s is PersonStep => !!s && typeof s.id === 'string' && (typeof s.command === 'string' || s.command === null)) : []
+    steps = Array.isArray(parsed.steps) ? parsed.steps.filter((s): s is PersonStep => !!s && typeof s.id === 'string' && (typeof s.command === 'string' || s.command === null)) : []
   } catch {
     return []
   }
+  const current = steps.some((s) => s.profile) ? currentTarget(root) : null
+  return current ? steps.map((s) => aimedAt(s, current)) : steps
+}
+
+/**
+ * A change request's step recorded for the folder's target under another
+ * profile, aimed at the folder's profile for it. The profile name follows the
+ * folder's path, so it changes when the folder is moved or renamed, while the
+ * steps file moves with the folder.
+ */
+function aimedAt(step: PersonStep, current: StepTarget): PersonStep {
+  const was = step.profile
+  if (!was || step.target !== current.target || was === current.profile) return step
+  const swap = (command: string) => command.split(' ')
+    .map((word, i, words) => (word === was && words[i - 1] === '--profile' ? current.profile : word === `--profile=${was}` ? `--profile=${current.profile}` : word))
+    .join(' ')
+  return {
+    ...step,
+    profile: current.profile,
+    ...(step.command ? { command: swap(step.command) } : {}),
+    ...(step.check ? { check: { ...step.check, command: swap(step.check.command) } } : {}),
+  }
 }
 
 function writeSteps(root: string, steps: PersonStep[]): void {
@@ -273,21 +303,73 @@ export function checkProblem(check: StepCheck, readOnly: readonly string[]): str
   return null
 }
 
+/** Where a folder's link points (`targetOf`), and the profile that reaches it (`targetProfileName`). */
+export interface StepTarget {
+  target: string
+  profile: string
+}
+
+/** The folder's current target, or null when it links to no workspace. */
+export function currentTarget(root: string): StepTarget | null {
+  const link = readLink(root)
+  return link ? { target: targetOf(link), profile: targetProfileName(localProject(root), link) } : null
+}
+
+/**
+ * Why a change request's step must not run, or null when it may: it was
+ * recorded for another target than the folder links to now, it names a profile
+ * that is not the folder's and no target to aim it again (a hand-written
+ * step), or its profile is gone. Each says how to go on: connect the folder,
+ * or dismiss the step. The request is applied already, so applying it again
+ * is refused; adding a profile by hand would aim the step at a profile
+ * nothing keeps in step with the link.
+ */
+export function staleProblem(step: PersonStep, current: StepTarget | null): string | null {
+  if (step.target && step.target !== current?.target) {
+    return `it was recorded for ${step.target}, and this folder now links to ${current?.target ?? 'no workspace'}: link this folder back to it with \`frontera local sync connect --relink\`, or dismiss this step`
+  }
+  if (!step.profile) return null
+  if (step.profile !== current?.profile) {
+    return `it names the profile ${step.profile}, which is not this folder's for its link, and it records no target to aim it at this folder's: dismiss this step`
+  }
+  if (!getProfile(step.profile)) {
+    return `its profile ${step.profile} is not on this computer: connect this folder again with \`frontera local sync connect\`, which records it, or dismiss this step`
+  }
+  return null
+}
+
+/** The command aimed at a profile: `--profile <profile>` added unless it names one already. */
+export function atProfile(command: string, profile: string | null): string {
+  return !profile || /(?:^|\s)--profile(?:\s|=|$)/.test(command) ? command : `${command} --profile ${profile}`
+}
+
 /**
  * Record what a request left for a person, as person-steps of its delivery
- * (the request's title). An item already listed (by its key) is updated, a
- * settled one stays settled, so applying a request again doesn't bring back
- * what was done.
+ * (the request's title). An item already listed (by its key) is updated. A
+ * settled one stays settled when the request is applied again to the same
+ * target, so that doesn't bring back what was done; applied to another
+ * target, it is pending again there. `at` is the request's target: its profile
+ * (`targetProfileName`), which each command and check names, since the folder
+ * is bound to its local runtime and the steps change the workspace the request
+ * was applied to, and the target itself, recorded on each step.
  */
-export function recordAfterApply(root: string, delivery: string, items: AfterApplyItem[], now = new Date()): PersonStep[] {
+export function recordAfterApply(root: string, delivery: string, items: AfterApplyItem[], at: { profile: string; target: string } | null = null, now = new Date()): PersonStep[] {
+  const profile = at?.profile ?? null
   const steps = readPersonSteps(root)
   const out: PersonStep[] = []
-  for (const item of items) {
+  for (const raw of items) {
+    const item = { ...raw, ...(raw.command ? { command: atProfile(raw.command, profile) } : {}), ...(raw.check ? { check: { ...raw.check, command: atProfile(raw.check.command, profile) } } : {}) }
     const credential = ((CREDENTIALS as readonly string[]).includes(item.credential) ? item.credential : 'person') as Credential
     const command = item.command && !commandProblem(item.command) ? item.command : null
     const existing = steps.find((s) => s.key === item.key && s.delivery === delivery)
     if (existing) {
-      Object.assign(existing, { command, why: item.why, changes: item.label, credential, ...(item.check ? { check: item.check } : {}) })
+      if (at && existing.target && existing.target !== at.target) {
+        existing.status = 'pending'
+        delete existing.doneAt
+        delete existing.doneBy
+        delete existing.lastCheckedAt
+      }
+      Object.assign(existing, { command, why: item.why, changes: item.label, credential, ...(item.check ? { check: item.check } : {}), ...(at ? { target: at.target, profile: at.profile } : {}) })
       out.push(existing)
       continue
     }
@@ -303,6 +385,7 @@ export function recordAfterApply(root: string, delivery: string, items: AfterApp
       source: 'change-request',
       key: item.key,
       ...(item.check ? { check: item.check } : {}),
+      ...(at ? { target: at.target, profile: at.profile } : {}),
     }
     steps.push(step)
     out.push(step)
@@ -332,12 +415,13 @@ export async function runStepChecks(
   now = new Date(),
 ): Promise<{ checked: number; done: PersonStep[]; problems: Array<{ id: string; problem: string }> }> {
   const steps = readPersonSteps(root)
+  const current = currentTarget(root)
   const done: PersonStep[] = []
   const problems: Array<{ id: string; problem: string }> = []
   let checked = 0
   for (const step of steps) {
     if (step.status !== 'pending' || !step.check) continue
-    const problem = checkProblem(step.check, readOnly)
+    const problem = staleProblem(step, current) ?? checkProblem(step.check, readOnly)
     if (problem) {
       problems.push({ id: step.id, problem })
       continue

package/src/local/local-sync-link.ts

@@ -1,11 +1,15 @@
 import { spawnSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
 import { existsSync, readFileSync, statSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
 
 import { parseDocument } from 'yaml'
 
+import { credentialStore } from '../credential-store'
+import { forgetDeviceSession } from '../device-login'
 import { writeFileAtomic } from '../fs-atomic'
 import { configDir } from '../paths'
+import { deleteProfile, fingerprint, getProfile, putProfile } from '../profiles'
 import { PROJECT_FILES, type LocalProject } from './local-project'
 
 /**
@@ -161,3 +165,75 @@ export function removeSyncKey(project: LocalProject, role: KeyRole): void {
   delete keys[account(project, role)]
   writeFileAtomic(keysFile(), `${JSON.stringify(keys, null, 2)}\n`, 0o600)
 }
+
+// ── The link's target as a CLI profile ──────────────────────────────────────
+
+/**
+ * The CLI profile that reaches the linked workspace's platform with the
+ * project's own keys, one per folder and target: its name comes from the
+ * project (its folder), the platform and the workspace. The organization is
+ * left out, since a workspace already fixes it, so adding the organization
+ * key keeps the name. The project folder is bound to its local runtime, so a step
+ * that must change the workspace (a change request's after-apply steps, the
+ * read that checks them) names this profile with `--profile`; the remote guard
+ * lets a command that names its target through.
+ */
+export function targetProfileName(project: LocalProject, link: SyncLink): string {
+  const target = [project.id, link.platform, link.workspace].join('\n')
+  return `sync-${createHash('sha256').update(target).digest('hex').slice(0, 16)}`
+}
+
+/** Where a recorded step acts, `<host>/<workspace>`: a step whose target is not the folder's link is stale. */
+export const targetOf = (link: SyncLink) => `${new URL(link.platform).host}/${link.workspace}`
+
+/** The fingerprints of the keys stored for the project now. */
+export function projectKeyFingerprints(project: LocalProject): string[] {
+  return (['organization', 'workspace'] as const).flatMap((role) => {
+    const key = getSyncKey(project, role)
+    return key ? [fingerprint(key)] : []
+  })
+}
+
+/**
+ * Record the target profile from the keys stored for the project: the
+ * organization key when there is one (every step a change request leaves is
+ * at organization grain), else the workspace key. Null when no key is stored.
+ * The profile is the project's when it holds one of the project's keys, now
+ * or before `connect` replaced them (`previous`), and then takes the current
+ * key; one holding another key is left alone. The key is stored as every
+ * profile's is, so a machine without a secure store refuses it unless its
+ * person chose the 0600 file.
+ */
+export async function registerTargetProfile(project: LocalProject, link: SyncLink, previous: readonly string[] = []): Promise<string | null> {
+  const organizationKey = getSyncKey(project, 'organization')
+  const key = organizationKey ?? getSyncKey(project, 'workspace')
+  if (!key) return null
+  const name = targetProfileName(project, link)
+  const existing = getProfile(name)
+  if (existing && ![...previous, ...projectKeyFingerprints(project)].includes(existing.fingerprint)) {
+    throw new Error(`the profile ${name} holds a key that isn't this project's, so it is left as it is; \`frontera auth remove ${name}\` frees the name`)
+  }
+  await credentialStore().set(name, key)
+  const now = new Date().toISOString()
+  putProfile(name, {
+    apiUrl: link.platform,
+    credentialKind: organizationKey ? 'organization' : 'workspace',
+    workspaceId: organizationKey ? null : link.workspace,
+    orgId: link.organization ?? null,
+    fingerprint: fingerprint(key),
+    createdAt: existing?.createdAt ?? now,
+    lastVerifiedAt: now,
+  })
+  return name
+}
+
+/** Remove this folder's target profile with its key and its browser sign-in, unless the profile holds a key that isn't the project's. */
+export async function removeTargetProfile(project: LocalProject, link: SyncLink): Promise<void> {
+  const name = targetProfileName(project, link)
+  const existing = getProfile(name)
+  if (existing && !projectKeyFingerprints(project).includes(existing.fingerprint)) return
+  if (existing) deleteProfile(name)
+  const store = credentialStore()
+  await store.delete(name)
+  await forgetDeviceSession(store, name, (url, init) => fetch(url, { ...init, signal: AbortSignal.timeout(5_000) }))
+}

package/src/local/local-sync-precheck.ts

@@ -64,7 +64,7 @@ export function fixFor(check: Check): string | null {
   const ref = check.ref
   if (check.code === 'stale_base' || check.code === 'exists' || check.code === 'gone') return `pull it first (\`frontera local sync pull ${ref}\`), then propose`
   if (check.code === 'unpublished_draft') return 'publish or discard its draft on the platform, then fetch and propose'
-  if (check.code === 'blueprint_backing') return 'leave it out: a dataset binding is set on the platform'
+  if (check.code === 'blueprint_backing') return 'make the type’s backing name a dataset the organization has, or add its datasets/<name>.json to this request, and map each field to one of its columns'
   if (check.code === 'blueprint_draft') return 'publish or discard the Blueprint’s draft on the platform, then propose'
   const model = /the model (\S+) is not in this workspace/.exec(check.message)
   if (model) return `choose the workspace model it goes as (\`frontera local sync map-model ${model[1]} <workspace model>\`)`

package/src/local/local-sync-push.ts

@@ -1055,6 +1055,13 @@ export function parseOutcome(raw: unknown): ApplyOutcome {
 const STEP_MARK: Record<StepStatus, string> = { done: '✓', failed: '✗', 'not-run': '·' }
 const BACK_WORD = { 'put-back': 'put back', failed: 'could not be put back', irreversible: 'cannot be withdrawn' } as const
 
+/** What failed: an item's title when the step is one item's, otherwise the step's own words ("Grant the workspace its new object types"). */
+export function failedName(outcome: ApplyOutcome, titles: Record<string, string> = {}): string {
+  const failed = outcome.failure
+  if (!failed) return 'a step'
+  return titles[failed.ref] ?? outcome.steps.find((s) => s.key === failed.key)?.label ?? failed.ref
+}
+
 /** Apply's steps, and after a failure what was put back, as `request apply` prints them. */
 export function describeOutcome(outcome: ApplyOutcome, titles: Record<string, string> = {}): string[] {
   const lines = outcome.steps.flatMap((s) => [
@@ -1063,9 +1070,8 @@ export function describeOutcome(outcome: ApplyOutcome, titles: Record<string, st
   ])
   if (outcome.ok) return [`Applied ${outcome.steps.length} step${outcome.steps.length === 1 ? '' : 's'}:`, ...lines]
   const failed = outcome.failure
-  const name = failed ? titles[failed.ref] ?? failed.ref : 'a step'
   return [
-    `Not applied: ${failed ? `${name} failed: ${failed.message}` : 'a step failed'}`,
+    `Not applied: ${failed ? `${failedName(outcome, titles)} failed: ${failed.message}` : 'a step failed'}`,
     ...lines,
     ...(outcome.compensation.length
       ? ['', 'What was put back:', ...outcome.compensation.map((c) => `  ${c.label}: ${BACK_WORD[c.status]}${c.error ? ` (${c.error})` : ''}`)]

package/src/main.ts

@@ -382,6 +382,7 @@ async function main(): Promise<number> {
         cwd,
         apiUrl: credential.apiUrl,
         token: credential.token,
+        ...('profile' in credential && credential.profile ? { profile: credential.profile } : {}),
         positional,
         flags,
         repeated,