@frontera-sdk/cli 1.53.7 → 1.53.9

package/src/local/local-sync-plan.ts

@@ -5,7 +5,7 @@ import { dirname, join, relative, resolve, sep } from 'node:path'
 import { parse as parseYaml } from 'yaml'
 
 import type { Portability } from './local-portability'
-import { conflictsId, deepEqual, mergeItemFiles, type Choice, type Side } from './local-sync-merge'
+import { conflictsId, deepEqual, mergeItemFiles, sameContent, type Choice, type Side } from './local-sync-merge'
 import { itemTitle } from './local-sync-names'
 import { toNames, type Directory, type Unresolved } from './local-sync-refs'
 import { comparableText, isPluginFile, withLocalSecrets } from './local-secrets'
@@ -358,6 +358,32 @@ export function baseFiles(entry: LockEntry | undefined, read: ((path: string) =>
   return out
 }
 
+/** Whether two sets of an item's files say the same, file by file: a missing file only matches a missing one. */
+function sameFiles(a: Record<string, string | null>, b: Record<string, string | null>): boolean {
+  return [...new Set([...Object.keys(a), ...Object.keys(b)])].every((path) => {
+    const x = a[path] ?? null
+    const y = b[path] ?? null
+    return x === y || (x !== null && y !== null && sameContent(path, x, y))
+  })
+}
+
+/** Every base file is here, as the last pull wrote it: without one, a deletion on one side reads as an addition on the other. */
+const wholeBase = (base: Record<string, string | null>) => Object.keys(base).length > 0 && Object.values(base).every((v) => v !== null)
+
+/**
+ * The status again, from what the files say rather than their exact text,
+ * when every base file is here to compare with: a side whose files
+ * differ from the base only in key order or formatting (the platform writes
+ * a document's keys its own way from one read to the next) has not moved.
+ */
+function settledStatus(found: ItemStatus, base: Record<string, string | null>, local: Record<string, string | null>, remote: Record<string, string | null>): ItemStatus {
+  if (found !== 'conflict' && found !== 'edited' && found !== 'changed') return found
+  if (!wholeBase(base)) return found
+  const localMoved = !sameFiles(base, local)
+  const remoteMoved = !sameFiles(base, remote)
+  return remoteMoved ? (localMoved ? 'conflict' : 'changed') : localMoved ? 'edited' : 'same'
+}
+
 /** The working files at these paths, null where absent. */
 export function localFiles(root: string, paths: string[]): Record<string, string | null> {
   return Object.fromEntries(paths.map((p) => [p, readLocal(root, p)]))
@@ -414,18 +440,30 @@ export function computePlan(root: string, remote: RemoteItem[], lock: SyncLock |
     // An Agent's file that neither the base nor the workspace has but the folder does (its first tools, in a new
     // `bindings.json`) is a change here too, as push reads it: otherwise status says nothing while push proposes it.
     const added = item.kind === 'agent' ? AGENT_FILES.map((f) => `agents/${item.name}/${f}`).filter((p) => !paths.includes(p) && existsSync(join(root, p))) : []
-    const matches = files.every((f) => f.local === f.remote) && !added.length
+    // Saying the same as the workspace is up to date, whatever order the platform wrote the keys in.
+    const matches = files.every((f) => f.local === f.remote || (f.local !== null && f.remote !== null && sameContent(f.path, f.local, f.remote))) && !added.length
     // The files as they stand over the base's paths, plus any path only the workspace has that is
     // already in the folder: a file the pull would overwrite counts as a change here.
     const basePaths = entry ? [...Object.keys(entry.files), ...files.filter((f) => !(f.path in entry.files) && f.local !== null).map((f) => f.path), ...added] : Object.keys(item.files)
-    const found = statusFor(entry?.remote ?? null, localHash(root, basePaths, opts.base, item.files), itemHash(item.files), matches) ?? 'same'
+    const hashed = statusFor(entry?.remote ?? null, localHash(root, basePaths, opts.base, item.files), itemHash(item.files), matches) ?? 'same'
+    const base = baseFiles(entry, opts.base)
+    let found = entry && !entry.conflict && !added.length ? settledStatus(hashed, base, Object.fromEntries(files.map((f) => [f.path, f.local])), Object.fromEntries(files.map((f) => [f.path, f.remote]))) : hashed
     // Pulled with conflicts and not resolved: it stays so until `resolve`, whatever the files say.
-    const status: ItemStatus = entry?.conflict && found !== 'same' ? 'unresolved' : found
     let merge: PlanItem['merge']
-    if (status === 'conflict' || status === 'unresolved') {
+    if (found === 'conflict' || (entry?.conflict && found !== 'same')) {
       const local = localFiles(root, paths)
-      merge = { conflicts: mergeItemFiles(baseFiles(entry, opts.base), local, item.files).conflicts }
+      const result = mergeItemFiles(base, local, item.files)
+      merge = { conflicts: result.conflicts }
+      // A clean merge that leaves every file as it is here: what the workspace changed is already in the files
+      // (proposed from here, or a set only reordered there). Nothing comes in; the change is this side's alone.
+      // Only against the whole base: without it the merge keeps what the workspace deleted, and the item stays a
+      // conflict, so the base is looked for again and a push waits for the pull.
+      if (found === 'conflict' && entry && !entry.conflict && wholeBase(base) && !result.conflicts && result.files.every((f) => f.merged === (local[f.path] ?? null))) {
+        found = 'edited'
+        merge = undefined
+      }
     }
+    const status: ItemStatus = entry?.conflict && found !== 'same' ? 'unresolved' : found
     const namesOnly = status === 'changed' && opts.directory ? differsOnlyInNames(localFiles(root, paths), item.files, opts.directory) : false
     plan.push({
       ref: item.ref,

package/src/local/local-sync-precheck.ts

@@ -65,7 +65,8 @@ export function fixFor(check: Check): string | null {
   if (check.code === 'stale_base' || check.code === 'exists' || check.code === 'gone') return `pull it first (\`frontera local sync pull ${ref}\`), then propose`
   if (check.code === 'unpublished_draft') return 'publish or discard its draft on the platform, then fetch and propose'
   if (check.code === 'blueprint_backing') return 'make the type’s backing name a dataset the organization has, or add its datasets/<name>.json to this request, and map each field to one of its columns'
-  if (check.code === 'blueprint_draft') return 'publish or discard the Blueprint’s draft on the platform, then propose'
+  if (check.code === 'blueprint_draft') return 'publish the organization’s Blueprint on the platform first, then propose'
+  if (check.code === 'blueprint_draft_conflict') return 'publish or discard that change in the Blueprint on the platform, or leave this item out (`frontera local sync push <kind/name>…` proposes only the items it names), then propose'
   const model = /the model (\S+) is not in this workspace/.exec(check.message)
   if (model) return `choose the workspace model it goes as (\`frontera local sync map-model ${model[1]} <workspace model>\`)`
   if (check.code === 'unresolved') return 'propose what it names too, or create that in the workspace first'

package/src/local/local-sync-push.ts

@@ -17,7 +17,7 @@ import { importedFiles } from './local-function-shared'
 import { isIgnoredName } from './local-dev-sync'
 import { comparableText, withoutSecrets } from './local-secrets'
 import { projectModels } from './local-sync-models'
-import { deepEqual } from './local-sync-merge'
+import { deepEqual, sameContent } from './local-sync-merge'
 import { portableNotes, sameDocumentText, toLocal, toWorkspace } from './local-sync-portable'
 import { itemTitle } from './local-sync-names'
 import { isScaffoldSample } from './local-scaffold'
@@ -443,12 +443,18 @@ export function pushCandidates(input: CandidateInput): PushItem[] {
     // A Plugin whose only difference is this computer's secrets (a header set here) is the same, as status reads it.
     const pluginSame = kind === 'plugin' && !!theirs && Object.keys(files).length > 0 && Object.keys(files).every((p) => theirs.files[p] !== undefined && comparableText(p, readLocal(root, p) ?? '', theirs.files[p]!) === theirs.files[p])
     const textSame = !entry || itemHash(files) === entry.remote || !theirs || itemHash(theirs.files) !== entry.remote || pluginSame
-    if (status === 'same' && textSame && !extra) continue
+    // Up to date as status reads it: the files say what the workspace's say, keys in another order or not.
+    const saysSame = status === 'same' && !!theirs && Object.keys(files).length === Object.keys(theirs.files).length && Object.entries(files).every(([path, text]) => theirs.files[path] !== undefined && sameContent(path, text, theirs.files[path]!))
+    if (status === 'same' && (textSame || saysSame) && !extra) continue
     if (status === 'same' && Object.keys(files).length === 0) continue
     const isNew = !entry && !theirs
-    const baseFiles: Record<string, string> = !isNew && theirs && entry && itemHash(theirs.files) === entry.remote ? theirs.files : {}
+    // The workspace has not moved since the last pull (the plan reads what its files say, key order aside), or what it
+    // changed is already in the files here: its version now is the base.
+    const unmoved = !!theirs && !!entry && (itemHash(theirs.files) === entry.remote || p?.status === 'edited')
+    const baseFiles: Record<string, string> = !isNew && unmoved ? theirs!.files : {}
     const diffPaths = [...new Set([...Object.keys(baseFiles), ...Object.keys(files)])].sort((a, b) => (String(a) < String(b) ? -1 : String(a) > String(b) ? 1 : 0))
-    const diff: PushFile[] = diffPaths.map((path) => ({ path, base: baseFiles[path] ?? null, local: files[path] ?? null })).filter((f) => f.base !== f.local)
+    // A file that says the same as the base, keys in another order, is no change to show.
+    const diff: PushFile[] = diffPaths.map((path) => ({ path, base: baseFiles[path] ?? null, local: files[path] ?? null })).filter((f) => f.base !== f.local && !(f.base !== null && f.local !== null && sameContent(f.path, f.base, f.local)))
     const item: PushItem = {
       ref,
       kind,
@@ -513,7 +519,7 @@ export function pushCandidates(input: CandidateInput): PushItem[] {
     } else if (item.proposable && !isNew) {
       // The base is what the workspace holds now (the plan says only this side moved): its current
       // revision, which for a Blueprint file is the Blueprint's.
-      item.baseRevision = (kind === 'blueprint' || kind === 'evaluation' ? snapshot?.groups[kind] : undefined) ?? (theirs && entry && itemHash(theirs.files) === entry.remote ? theirs.revision : undefined) ?? entry?.revision ?? null
+      item.baseRevision = (kind === 'blueprint' || kind === 'evaluation' ? snapshot?.groups[kind] : undefined) ?? (unmoved ? theirs!.revision : undefined) ?? entry?.revision ?? null
     } else if (item.proposable && kind === 'blueprint') {
       item.baseRevision = snapshot?.groups.blueprint ?? null
     }
@@ -805,12 +811,10 @@ export function sameDocument(path: string, a: string, b: string): boolean {
     if (/^agents\/[^/]+\/evals\/[^/]+\.ya?ml$/.test(path)) return deepEqual(evaluationCases(a), evaluationCases(b))
     // A knowledge base's quality checks are a set: the platform lists them in its own order.
     if (path.endsWith(`/${QUALITY_CHECKS_FILE}`)) return deepEqual(checkSet(a), checkSet(b))
-    if (/\.json$/i.test(path)) return deepEqual(JSON.parse(a), JSON.parse(b))
-    if (/\.ya?ml$/i.test(path)) return deepEqual(parseYaml(a), parseYaml(b))
   } catch {
     return false
   }
-  return false
+  return sameContent(path, a, b)
 }
 
 /** Quality checks as a set: by question, each one's lists in order of their words. */
@@ -1017,7 +1021,8 @@ export interface ApplyOutcome {
   ok: boolean
   steps: ApplyStep[]
   failure?: { key: string; ref: string; itemIds: string[]; message: string }
-  compensation: Array<{ label: string; type: string; status: 'put-back' | 'failed' | 'irreversible'; error?: string }>
+  /** `note`: what a put-back left other than as it was. */
+  compensation: Array<{ label: string; type: string; status: 'put-back' | 'failed' | 'irreversible'; error?: string; note?: string }>
 }
 
 /** Apply's outcome as the service sent it, read defensively: a field it lacks reads as empty. */
@@ -1042,7 +1047,13 @@ export function parseOutcome(raw: unknown): ApplyOutcome {
     if (!c || typeof c !== 'object') return []
     const r = c as Record<string, unknown>
     const status = r.status === 'failed' || r.status === 'irreversible' ? r.status : 'put-back'
-    return [{ label: String(r.label ?? ''), type: String(r.type ?? ''), status: status as 'put-back' | 'failed' | 'irreversible', ...(typeof r.error === 'string' ? { error: r.error } : {}) }]
+    return [{
+      label: String(r.label ?? ''),
+      type: String(r.type ?? ''),
+      status: status as 'put-back' | 'failed' | 'irreversible',
+      ...(typeof r.error === 'string' ? { error: r.error } : {}),
+      ...(typeof r.note === 'string' ? { note: r.note } : {}),
+    }]
   })
   return {
     ok: o.ok === true,
@@ -1074,7 +1085,7 @@ export function describeOutcome(outcome: ApplyOutcome, titles: Record<string, st
     `Not applied: ${failed ? `${failedName(outcome, titles)} failed: ${failed.message}` : 'a step failed'}`,
     ...lines,
     ...(outcome.compensation.length
-      ? ['', 'What was put back:', ...outcome.compensation.map((c) => `  ${c.label}: ${BACK_WORD[c.status]}${c.error ? ` (${c.error})` : ''}`)]
+      ? ['', 'What was put back:', ...outcome.compensation.map((c) => `  ${c.label}: ${BACK_WORD[c.status]}${c.error ? ` (${c.error})` : ''}${c.note ? `. ${c.note}` : ''}`)]
       : ['', 'Nothing had changed yet, so nothing needed putting back.']),
   ]
 }

package/src/local/local-sync-remote.ts

@@ -42,9 +42,11 @@ import { governedActionIds, invert, itemRef, referencesIn, refName as refNameOf,
 export interface SyncSource {
   /** The workspace key's client. */
   workspace: SyncClient
-  /** The organization key's client, when one was given. */
+  /** The organization's reader, when there is one: the person signed in, or the organization key. */
   organization?: SyncClient
   workspaceId: string
+  /** The person signed in, when they read nothing at organization grain (no Blueprint Steward) and no key reads for them. */
+  notSteward?: string
 }
 
 /** Envelopes come single (`{data}`) or double (`{data:{data}}`); lists are what is inside. */
@@ -1268,7 +1270,8 @@ export function sliceDraft(draft: Bundle, granted: ReadonlySet<string>): Bundle
   const ids = new Set(objects.map((o) => o.id))
   const actions = (def.actions ?? []).filter((a) => {
     const changes = (Array.isArray(a.businessOutcomes) ? a.businessOutcomes : []).flatMap((o: Record<string, any>) => (Array.isArray(o?.expectedChanges) ? o.expectedChanges : [])) as Array<Record<string, any>>
-    return [a.subject?.objectTypeId, ...changes.map((c) => c?.objectTypeId)].filter((v): v is string => typeof v === 'string').every((id) => ids.has(id))
+    const records = (Array.isArray(a.records) ? a.records : []) as Array<Record<string, any>>
+    return [a.subject?.objectTypeId, ...records.map((r) => r?.objectTypeId), ...changes.map((c) => c?.objectTypeId)].filter((v): v is string => typeof v === 'string').every((id) => ids.has(id))
   })
   return {
     ...def,
@@ -1312,7 +1315,7 @@ async function readBlueprint(
       notes.push('This platform cannot cut the Blueprint to the workspace yet; the organization key read the whole model')
       return readBlueprint(source, 'organization', warnings, notes, sets, opts)
     } else {
-      warnings.push('Blueprint: this platform cannot export a workspace’s Blueprint yet; connect an organization key to pull it')
+      warnings.push('Blueprint: this platform cannot export a workspace’s Blueprint yet; sign in for the project’s workspace to pull it')
       return []
     }
     if (opts.draft && !source.organization) notes.push('Reading the Blueprint’s unpublished draft takes an organization key; its published release was read')
@@ -1384,7 +1387,8 @@ async function withActions(org: SyncClient, sliced: Bundle, warnings: string[],
   const outside: string[] = []
   for (const action of published) {
     const changes = (Array.isArray(action.businessOutcomes) ? action.businessOutcomes : []).flatMap((o: Record<string, any>) => (Array.isArray(o?.expectedChanges) ? o.expectedChanges : [])) as Array<Record<string, any>>
-    const touched = [action.subject?.objectTypeId, ...changes.map((c) => c?.objectTypeId)].filter((v): v is string => typeof v === 'string')
+    const records = (Array.isArray(action.records) ? action.records : []) as Array<Record<string, any>>
+    const touched = [action.subject?.objectTypeId, ...records.map((r) => r?.objectTypeId), ...changes.map((c) => c?.objectTypeId)].filter((v): v is string => typeof v === 'string')
     if (touched.every((id) => ids.has(id))) kept.push(action)
     else outside.push(String(action.apiName))
   }
@@ -1742,9 +1746,10 @@ export async function readWorkspace(source: SyncSource, opts: ReadOptions = {}):
     it.notes.push(`Hard-codes the workspace’s object type ids, which the local runtime doesn’t share: ${hits.map((h) => `${h.file}:${h.line} (${h.objectType})`).join(', ')}. \`local dev\` deploys it here with this runtime’s ids in their place and leaves the files as they are; take the id from the query result (\`subjectOf\`, or \`result.objectTypeId\`) so the code holds on any runtime`)
   }
   if (!source.organization && items.some((i) => i.unresolved.length)) {
-    notes.push(directory.model?.size
-      ? 'Governed Actions are named only with an organization key (they are organization-wide); an Action step shows as an id until you connect one'
-      : 'Models and governed Actions are named only with an organization key (both are organization-wide); an LLM step’s model or an Action step shows as an id until you connect one')
+    const [what, shown] = directory.model?.size ? ['Governed Actions are', 'an Action step'] : ['Models and governed Actions are', 'an LLM step’s model or an Action step']
+    notes.push(source.notSteward
+      ? `${what} named only for a Blueprint Steward signed in for the project’s workspace (organization-wide); ${source.notSteward}, signed in here, is not one, so ${shown} shows as an id`
+      : `${what} named only while you’re signed in for the project’s workspace (organization-wide); ${shown} shows as an id until you sign in`)
   }
   return { items, warnings, notes, directory, models: lists.models ?? [] }
 }
@@ -1817,7 +1822,7 @@ export function noteActions(items: RemoteItem[], directory?: Directory): void {
       continue
     }
     const what = many ? `${missing.length} governed Actions` : `governed Action${missing.length === 1 ? '' : 's'} ${list}`
-    it.notes.push(`${subject.charAt(0).toUpperCase()}${subject.slice(1)} runs ${what}: add an organization key to bring ${missing.length === 1 ? 'it' : 'them'} with the Blueprint${many ? `: ${list}` : ''}`)
+    it.notes.push(`${subject.charAt(0).toUpperCase()}${subject.slice(1)} runs ${what}: sign in for the project’s workspace to bring ${missing.length === 1 ? 'it' : 'them'} with the Blueprint${many ? `: ${list}` : ''}`)
   }
 }
 

package/src/local/local-synthetic-data.ts

@@ -112,7 +112,7 @@ interface ActionFile {
   apiName: string
   subject?: { objectType?: string }
   inputs?: Array<{ apiName?: string; valueType?: { kind?: string; enum?: unknown[] } }>
-  businessOutcomes?: Array<{ expectedChanges?: Array<{ kind?: string; property?: string; value?: { kind?: string; field?: string; value?: unknown } }> }>
+  businessOutcomes?: Array<{ expectedChanges?: Array<{ kind?: string; objectType?: string; property?: string; value?: { kind?: string; field?: string; value?: unknown } }> }>
 }
 
 /**
@@ -612,7 +612,7 @@ export function actionEnums(actions: ActionFile[]): Map<string, string[]> {
     for (const outcome of a.businessOutcomes ?? []) {
       for (const change of outcome.expectedChanges ?? []) {
         if (change.kind !== 'property_set' || !change.property) continue
-        const key = `${type}.${change.property}`
+        const key = `${change.objectType ?? type}.${change.property}`
         const values = change.value?.kind === 'input' && change.value.field ? asStrings(inputs.get(change.value.field)?.valueType?.enum) : change.value?.kind === 'literal' && change.value.value !== undefined ? [String(change.value.value)] : null
         if (values) out.set(key, [...new Set([...(out.get(key) ?? []), ...values])])
       }

package/src/main.ts

@@ -245,8 +245,13 @@ async function main(): Promise<number> {
           { cwd, ...(piped ? { env: { ...process.env, FRONTERA_TOKEN: piped } } : {}) },
         )
     // A command that acts as a person takes the browser sign-in (`auth login --browser`) over the
-    // profile's key, which it would refuse; nothing else does. A raw FRONTERA_TOKEN still wins.
-    if (command.meta.authLane === 'session' && credential.token.startsWith('sk-') && !process.env.FRONTERA_TOKEN?.trim() && 'profile' in credential && credential.profile) {
+    // profile's key, which it would refuse; so does an organization command over a workspace key
+    // (a project's target profile with no organization key), which it would refuse too. Nothing
+    // else does. A raw FRONTERA_TOKEN still wins.
+    const keyRefused = command.meta.authLane === 'session'
+      ? credential.token.startsWith('sk-')
+      : credential.token.startsWith('sk-ws-') && commandScope(command.meta) === 'organization' && command.meta.noun !== 'auth' && command.meta.noun !== 'kit'
+    if (keyRefused && !process.env.FRONTERA_TOKEN?.trim() && 'profile' in credential && credential.profile) {
       const signedIn = await readDeviceSession(credentialStore(), credential.profile, credential.apiUrl)
       if (signedIn) {
         credential = { ...credential, token: signedIn.token }