@cellajs/cli 0.6.5 → 0.6.6

package/dist/drive.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/tools/drive.ts","../src/utils/app-facts.ts","../src/utils/env.ts"],"sourcesContent":["import { spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport process from 'node:process';\nimport type { Browser, BrowserContext, BrowserContextOptions, Page } from 'playwright';\nimport { importFromWorkspace } from '../utils/app-facts';\n\nexport type { Browser, BrowserContext, BrowserContextOptions, Page } from 'playwright';\n\nexport type Playwright = typeof import('playwright');\n\n/** A signed-in user of the app: where it answers and the cookie that signs a browser or a request in. */\nexport interface Session {\n  email: string;\n  frontendUrl: string;\n  /** The API, a path under the frontend's origin. */\n  backendUrl: string;\n  /** The app's slug, read off the cookie name; the persisted UI store's key starts with it. */\n  slug: string;\n  /** In the shape `context.addCookies` takes. */\n  cookie: { name: string; value: string; url: string; httpOnly: true; sameSite: 'Strict' };\n  /** `name=value`, for a request's cookie header. */\n  header: string;\n}\n\nexport interface MintOptions {\n  /** The app's root; default the current directory. */\n  forkPath?: string;\n  /** The environment the mint script runs in: a testbed's names its database. Default this process's. */\n  env?: NodeJS.ProcessEnv;\n  /** Session lifetime; default 2. */\n  hours?: number;\n}\n\n/** Playwright as the app's frontend installed it, so the CLI ships none. */\nexport function loadPlaywright(forkPath = process.cwd()): Promise<Playwright> {\n  return importFromWorkspace<Playwright>(forkPath, 'frontend', 'playwright');\n}\n\n/**\n * Checks that Playwright has its Chromium, before anything slow starts.\n * @throws with the install command when it has none\n */\nexport async function requireChromium(forkPath = process.cwd()): Promise<void> {\n  const { chromium } = await loadPlaywright(forkPath);\n  if (!existsSync(chromium.executablePath())) {\n    throw new Error('Playwright has no Chromium yet: run `pnpm --filter frontend exec playwright install chromium`');\n  }\n}\n\n/**\n * Signs `email` in through the backend's `session:mint` script, which refuses outside development and test. The script\n * prints `<cookie name>=<signed value>` and a curl line with the API URL, both from the config of the environment it runs\n * in, so a testbed's shifted ports and a linked worktree's are written down nowhere.\n * @throws when the script prints no session, as for an email with no user\n */\nexport function mintSession(email: string, { forkPath = process.cwd(), env, hours = 2 }: MintOptions = {}): Session {\n  const minted = spawnSync('pnpm', ['--silent', '--filter', 'backend', 'session:mint', email, String(hours)], {\n    cwd: forkPath,\n    env,\n    encoding: 'utf8',\n  });\n  const cookie = /^((?:__Host-)?([\\w-]+)-session-v\\d+)=(\\S+)$/m.exec(minted.stdout);\n  const api = /^curl (\\S+)\\/me /m.exec(minted.stdout);\n  if (!cookie || !api) throw new Error(`could not mint a session for ${email}:\\n${minted.stdout}\\n${minted.stderr}`);\n  const frontendUrl = new URL(api[1]).origin;\n  return {\n    email,\n    frontendUrl,\n    backendUrl: api[1],\n    slug: cookie[2],\n    cookie: { name: cookie[1], value: cookie[3], url: frontendUrl, httpOnly: true, sameSite: 'Strict' },\n    header: `${cookie[1]}=${cookie[3]}`,\n  };\n}\n\n/**\n * Signs a minted session out, so a finished run leaves no live session in the user's sessions list. A JSON content type\n * passes the CSRF check without an Origin header; a stack that is already down leaves the session to expire.\n */\nexport async function signOut(session: Session | null | undefined): Promise<void> {\n  if (!session) return;\n  const headers = { cookie: session.header, 'content-type': 'application/json' };\n  await fetch(`${session.backendUrl}/auth/sign-out`, { method: 'POST', headers }).catch(() => {});\n}\n\nexport interface ContextOptions extends BrowserContextOptions {\n  /** Signs the context in. */\n  session?: Session;\n  /**\n   * Fields written into the app's persisted UI store (`<slug>-ui`) before any page script runs, so the first paint is\n   * already in the mode they set. Merged into what the store holds: a list joins the stored one, any other value wins.\n   */\n  uiStore?: { slug: string; state: Record<string, unknown> };\n}\n\n/** A browser context, signed in and with its UI store seeded when asked. */\nexport async function newContext(\n  browser: Browser,\n  { session, uiStore, ...options }: ContextOptions = {},\n): Promise<BrowserContext> {\n  const context = await browser.newContext(options);\n  // tsx and esbuild's keepNames wrap named functions in an `__name` helper that a page script does not have\n  await context.addInitScript({ content: 'window.__name = (fn) => fn;' });\n  if (session) await context.addCookies([session.cookie]);\n  if (uiStore) {\n    await context.addInitScript(\n      ([key, fields]) => {\n        const stored = JSON.parse(localStorage.getItem(key) ?? '{}');\n        const state = { ...stored.state };\n        for (const [name, value] of Object.entries(fields)) {\n          const before = state[name];\n          state[name] = Array.isArray(value) && Array.isArray(before) ? [...new Set([...before, ...value])] : value;\n        }\n        // A fresh entry needs the store's own version, or zustand drops it as written by an older build\n        localStorage.setItem(key, JSON.stringify({ version: 1, ...stored, state }));\n      },\n      [`${uiStore.slug}-ui`, uiStore.state] as const,\n    );\n  }\n  return context;\n}\n\n/**\n * Resolves once the page has stopped adding or changing content for `quiet` ms, or after `cap` ms. Lazy sections, query\n * results and opening overlays all show up as DOM changes; the network never goes idle in development.\n */\nexport async function settle(page: Page, { quiet = 400, cap = 3000 } = {}): Promise<void> {\n  const waited = page.evaluate(\n    ([quietMs, capMs]) =>\n      new Promise<void>((resolve) => {\n        const done = () => {\n          observer.disconnect();\n          clearTimeout(timer);\n          clearTimeout(limit);\n          resolve();\n        };\n        let timer = setTimeout(done, quietMs);\n        const limit = setTimeout(done, capMs);\n        const observer = new MutationObserver(() => {\n          clearTimeout(timer);\n          timer = setTimeout(done, quietMs);\n        });\n        observer.observe(document, { subtree: true, childList: true, characterData: true });\n      }),\n    [quiet, cap] as const,\n  );\n  // A navigation during the wait tears down the page's script context\n  await waited.catch(() => page.waitForTimeout(quiet));\n}\n\n/**\n * Opens `url` in a new page and settles once the route has rendered its content.\n * @throws when the route redirects: a check or a shot would judge another page under this one's name\n */\nexport async function openPage(context: BrowserContext, url: string, { timeout = 30_000 } = {}): Promise<Page> {\n  const page = await context.newPage();\n  await page.goto(url, { waitUntil: 'domcontentloaded', timeout });\n  await page.locator('main, [role=\"main\"], #accessibility-content, form, h1, footer').first().waitFor({ timeout });\n  await settle(page);\n  const landed = new URL(page.url()).pathname;\n  const asked = new URL(url).pathname;\n  if (landed !== asked) throw new Error(`${asked} redirected to ${landed}`);\n  return page;\n}\n","import { execFileSync, spawnSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { createRequire } from 'node:module';\nimport { dirname, join, resolve } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport { z } from 'zod';\nimport { setEnv } from './env';\n\nconst appConfigSchema = z.object({\n  frontendUrl: z.string(),\n  backendUrl: z.string(),\n  devPortOffset: z.number(),\n  services: z.record(\n    z.string(),\n    z.object({ enabled: z.boolean(), port: z.number(), internalPort: z.number().optional() }),\n  ),\n});\n\n/** The part of the app's development config the develop commands read. */\nexport type AppFacts = z.infer<typeof appConfigSchema>;\n\n/** The app's local database helpers (`shared/src/local-database.ts`), as the develop commands call them. */\nexport interface LocalDatabases {\n  port: (database: string) => number;\n  url: (database: string, role: 'postgres' | 'runtime_role' | 'admin_role') => string;\n  /** The env `backend/compose.yaml` reads: the project name and each database's host port. */\n  composeEnv: () => Record<string, string>;\n}\n\n/** Node strips the types of a file outside node_modules, so the app's own TS loads without a build or tsx. */\nexport async function importFromApp(forkPath: string, file: string): Promise<Record<string, unknown>> {\n  const path = join(forkPath, file);\n  if (!existsSync(path)) throw new Error(`not an app built from cella: ${path} is missing`);\n  // The app's config reads the mode once, at its first import, and the dev port offset applies in development mode only\n  setEnv('NODE_ENV', 'development');\n  return import(pathToFileURL(path).href);\n}\n\n/**\n * The app's config in development mode, from its own `shared` package. In a linked worktree the import claims that\n * worktree's port slot, as `pnpm dev` would.\n */\nexport async function loadAppFacts(forkPath: string): Promise<AppFacts> {\n  const parsed = appConfigSchema.safeParse((await importFromApp(forkPath, 'shared/index.ts')).appConfig);\n  if (!parsed.success)\n    throw new Error(`shared/index.ts exports no appConfig this CLI can read: ${parsed.error.message}`);\n  return parsed.data;\n}\n\n/** The app's local database helpers. */\nexport async function loadLocalDatabases(forkPath: string): Promise<LocalDatabases> {\n  const module = await importFromApp(forkPath, 'shared/src/local-database.ts');\n  const { localDatabasePort, localDatabaseUrl, composeEnv } = module;\n  if (\n    typeof localDatabasePort !== 'function' ||\n    typeof localDatabaseUrl !== 'function' ||\n    typeof composeEnv !== 'function'\n  ) {\n    throw new Error('shared/src/local-database.ts lacks localDatabasePort, localDatabaseUrl or composeEnv');\n  }\n  return {\n    port: (database) => localDatabasePort(database),\n    url: (database, role) => localDatabaseUrl(database, role),\n    composeEnv: () => composeEnv(),\n  };\n}\n\n/**\n * A package as the app's `workspace` installed it, so a tool drives the app's own Playwright, TypeScript or Tailwind and\n * the CLI ships none. The package's ESM entry when it has one, else its CommonJS exports.\n * @throws when the workspace does not have the package installed\n */\nexport async function importFromWorkspace<T>(forkPath: string, workspace: string, name: string): Promise<T> {\n  const require = createRequire(join(forkPath, workspace, 'package.json'));\n  let manifestPath: string | undefined;\n  try {\n    manifestPath = require.resolve(`${name}/package.json`);\n  } catch {\n    // A package whose exports leave out package.json resolves by its main entry below\n  }\n  const root = manifestPath ? JSON.parse(readFileSync(manifestPath, 'utf8')).exports?.['.'] : undefined;\n  const esm = typeof root?.import === 'string' ? root.import : root?.import?.default;\n  if (manifestPath && typeof esm === 'string') return import(pathToFileURL(join(dirname(manifestPath), esm)).href);\n  try {\n    return require(name);\n  } catch {\n    throw new Error(`${name} is not installed in ${workspace}: run \\`pnpm --filter ${workspace} add -D ${name}\\``);\n  }\n}\n\n/**\n * A Docker image as a tool runs it, pinned by digest (`name[:tag]@sha256:…`) so every run scans with the same code.\n * Pulls it on first use; the pull shows Docker's own progress.\n * @throws when the reference has no digest, Docker does not answer, or the pull fails\n */\nexport function resolveImage(reference: string): string {\n  if (!/@sha256:[0-9a-f]{64}$/.test(reference)) throw new Error(`${reference} is not pinned by digest`);\n  if (spawnSync('docker', ['info'], { stdio: 'ignore' }).status !== 0) {\n    throw new Error('Docker does not answer: start Docker (or OrbStack) first');\n  }\n  if (spawnSync('docker', ['image', 'inspect', reference], { stdio: 'ignore' }).status === 0) return reference;\n  if (spawnSync('docker', ['pull', reference], { stdio: ['ignore', 'inherit', 'inherit'] }).status !== 0) {\n    throw new Error(`could not pull ${reference}`);\n  }\n  return reference;\n}\n\n/**\n * Where a tool keeps its results and state: `<git dir>/cella-<tool>/` of this checkout, or of the git directory every\n * worktree shares. Inside the git directory nothing shows in `git status`.\n */\nexport function toolDir(forkPath: string, tool: string, scope: 'checkout' | 'repository' = 'checkout'): string {\n  const flag = scope === 'checkout' ? '--absolute-git-dir' : '--git-common-dir';\n  const gitDir = execFileSync('git', ['rev-parse', flag], { cwd: forkPath, encoding: 'utf8' }).trim();\n  return join(resolve(forkPath, gitDir), `cella-${tool}`);\n}\n","import process from 'node:process';\n\n/**\n * Centralized environment access for CLI/runtime integration points.\n */\nexport function getEnv(name: string): string | undefined {\n  // biome-ignore lint/style/noProcessEnv: This module centralizes intentional CLI environment access.\n  return process.env[name];\n}\n\n/** Whether the variable is set at all, even to an empty string. */\nexport function hasEnv(name: string): boolean {\n  // biome-ignore lint/style/noProcessEnv: This module centralizes intentional CLI environment access.\n  return name in process.env;\n}\n\n/** A mutable copy of the full environment, for passing to child processes. */\nexport function getEnvSnapshot(): NodeJS.ProcessEnv {\n  // biome-ignore lint/style/noProcessEnv: This module centralizes intentional CLI environment access.\n  return { ...process.env };\n}\n\n/** Set a variable for this process and the children it spawns from here on. */\nexport function setEnv(name: string, value: string): void {\n  // biome-ignore lint/style/noProcessEnv: This module centralizes intentional CLI environment access.\n  process.env[name] = value;\n}\n"],"mappings":";AAAA,SAAS,aAAAA,kBAAiB;AAC1B,SAAS,cAAAC,mBAAkB;AAC3B,OAAOC,cAAa;;;ACFpB,SAAS,cAAc,iBAAiB;AACxC,SAAS,YAAY,oBAAoB;AACzC,SAAS,qBAAqB;AAC9B,SAAS,SAAS,MAAM,eAAe;AACvC,SAAS,qBAAqB;AAC9B,SAAS,SAAS;;;ACLlB,OAAO,aAAa;;;ADQpB,IAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,aAAa,EAAE,OAAO;AAAA,EACtB,YAAY,EAAE,OAAO;AAAA,EACrB,eAAe,EAAE,OAAO;AAAA,EACxB,UAAU,EAAE;AAAA,IACV,EAAE,OAAO;AAAA,IACT,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,GAAG,MAAM,EAAE,OAAO,GAAG,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAAA,EAC1F;AACF,CAAC;AAwDD,eAAsB,oBAAuB,UAAkB,WAAmB,MAA0B;AAC1G,QAAMC,WAAU,cAAc,KAAK,UAAU,WAAW,cAAc,CAAC;AACvE,MAAI;AACJ,MAAI;AACF,mBAAeA,SAAQ,QAAQ,GAAG,IAAI,eAAe;AAAA,EACvD,QAAQ;AAAA,EAER;AACA,QAAM,OAAO,eAAe,KAAK,MAAM,aAAa,cAAc,MAAM,CAAC,EAAE,UAAU,GAAG,IAAI;AAC5F,QAAM,MAAM,OAAO,MAAM,WAAW,WAAW,KAAK,SAAS,MAAM,QAAQ;AAC3E,MAAI,gBAAgB,OAAO,QAAQ,SAAU,QAAO,OAAO,cAAc,KAAK,QAAQ,YAAY,GAAG,GAAG,CAAC,EAAE;AAC3G,MAAI;AACF,WAAOA,SAAQ,IAAI;AAAA,EACrB,QAAQ;AACN,UAAM,IAAI,MAAM,GAAG,IAAI,wBAAwB,SAAS,yBAAyB,SAAS,WAAW,IAAI,IAAI;AAAA,EAC/G;AACF;;;ADtDO,SAAS,eAAe,WAAWC,SAAQ,IAAI,GAAwB;AAC5E,SAAO,oBAAgC,UAAU,YAAY,YAAY;AAC3E;AAMA,eAAsB,gBAAgB,WAAWA,SAAQ,IAAI,GAAkB;AAC7E,QAAM,EAAE,SAAS,IAAI,MAAM,eAAe,QAAQ;AAClD,MAAI,CAACC,YAAW,SAAS,eAAe,CAAC,GAAG;AAC1C,UAAM,IAAI,MAAM,+FAA+F;AAAA,EACjH;AACF;AAQO,SAAS,YAAY,OAAe,EAAE,WAAWD,SAAQ,IAAI,GAAG,KAAK,QAAQ,EAAE,IAAiB,CAAC,GAAY;AAClH,QAAM,SAASE,WAAU,QAAQ,CAAC,YAAY,YAAY,WAAW,gBAAgB,OAAO,OAAO,KAAK,CAAC,GAAG;AAAA,IAC1G,KAAK;AAAA,IACL;AAAA,IACA,UAAU;AAAA,EACZ,CAAC;AACD,QAAM,SAAS,+CAA+C,KAAK,OAAO,MAAM;AAChF,QAAM,MAAM,oBAAoB,KAAK,OAAO,MAAM;AAClD,MAAI,CAAC,UAAU,CAAC,IAAK,OAAM,IAAI,MAAM,gCAAgC,KAAK;AAAA,EAAM,OAAO,MAAM;AAAA,EAAK,OAAO,MAAM,EAAE;AACjH,QAAM,cAAc,IAAI,IAAI,IAAI,CAAC,CAAC,EAAE;AACpC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,YAAY,IAAI,CAAC;AAAA,IACjB,MAAM,OAAO,CAAC;AAAA,IACd,QAAQ,EAAE,MAAM,OAAO,CAAC,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,aAAa,UAAU,MAAM,UAAU,SAAS;AAAA,IAClG,QAAQ,GAAG,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC;AAAA,EACnC;AACF;AAMA,eAAsB,QAAQ,SAAoD;AAChF,MAAI,CAAC,QAAS;AACd,QAAM,UAAU,EAAE,QAAQ,QAAQ,QAAQ,gBAAgB,mBAAmB;AAC7E,QAAM,MAAM,GAAG,QAAQ,UAAU,kBAAkB,EAAE,QAAQ,QAAQ,QAAQ,CAAC,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AAChG;AAaA,eAAsB,WACpB,SACA,EAAE,SAAS,SAAS,GAAG,QAAQ,IAAoB,CAAC,GAC3B;AACzB,QAAM,UAAU,MAAM,QAAQ,WAAW,OAAO;AAEhD,QAAM,QAAQ,cAAc,EAAE,SAAS,8BAA8B,CAAC;AACtE,MAAI,QAAS,OAAM,QAAQ,WAAW,CAAC,QAAQ,MAAM,CAAC;AACtD,MAAI,SAAS;AACX,UAAM,QAAQ;AAAA,MACZ,CAAC,CAAC,KAAK,MAAM,MAAM;AACjB,cAAM,SAAS,KAAK,MAAM,aAAa,QAAQ,GAAG,KAAK,IAAI;AAC3D,cAAM,QAAQ,EAAE,GAAG,OAAO,MAAM;AAChC,mBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClD,gBAAM,SAAS,MAAM,IAAI;AACzB,gBAAM,IAAI,IAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,QAAQ,MAAM,IAAI,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC,IAAI;AAAA,QACtG;AAEA,qBAAa,QAAQ,KAAK,KAAK,UAAU,EAAE,SAAS,GAAG,GAAG,QAAQ,MAAM,CAAC,CAAC;AAAA,MAC5E;AAAA,MACA,CAAC,GAAG,QAAQ,IAAI,OAAO,QAAQ,KAAK;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AACT;AAMA,eAAsB,OAAO,MAAY,EAAE,QAAQ,KAAK,MAAM,IAAK,IAAI,CAAC,GAAkB;AACxF,QAAM,SAAS,KAAK;AAAA,IAClB,CAAC,CAAC,SAAS,KAAK,MACd,IAAI,QAAc,CAACC,aAAY;AAC7B,YAAM,OAAO,MAAM;AACjB,iBAAS,WAAW;AACpB,qBAAa,KAAK;AAClB,qBAAa,KAAK;AAClB,QAAAA,SAAQ;AAAA,MACV;AACA,UAAI,QAAQ,WAAW,MAAM,OAAO;AACpC,YAAM,QAAQ,WAAW,MAAM,KAAK;AACpC,YAAM,WAAW,IAAI,iBAAiB,MAAM;AAC1C,qBAAa,KAAK;AAClB,gBAAQ,WAAW,MAAM,OAAO;AAAA,MAClC,CAAC;AACD,eAAS,QAAQ,UAAU,EAAE,SAAS,MAAM,WAAW,MAAM,eAAe,KAAK,CAAC;AAAA,IACpF,CAAC;AAAA,IACH,CAAC,OAAO,GAAG;AAAA,EACb;AAEA,QAAM,OAAO,MAAM,MAAM,KAAK,eAAe,KAAK,CAAC;AACrD;AAMA,eAAsB,SAAS,SAAyB,KAAa,EAAE,UAAU,IAAO,IAAI,CAAC,GAAkB;AAC7G,QAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,QAAM,KAAK,KAAK,KAAK,EAAE,WAAW,oBAAoB,QAAQ,CAAC;AAC/D,QAAM,KAAK,QAAQ,+DAA+D,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;AAC/G,QAAM,OAAO,IAAI;AACjB,QAAM,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE;AACnC,QAAM,QAAQ,IAAI,IAAI,GAAG,EAAE;AAC3B,MAAI,WAAW,MAAO,OAAM,IAAI,MAAM,GAAG,KAAK,kBAAkB,MAAM,EAAE;AACxE,SAAO;AACT;","names":["spawnSync","existsSync","process","require","process","existsSync","spawnSync","resolve"]}
+{"version":3,"sources":["../src/tools/drive.ts","../src/utils/app-facts.ts","../src/utils/env.ts"],"sourcesContent":["import { spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport process from 'node:process';\nimport type { Browser, BrowserContext, BrowserContextOptions, Page } from 'playwright';\nimport { importFromWorkspace } from '../utils/app-facts';\n\nexport type { Browser, BrowserContext, BrowserContextOptions, Page } from 'playwright';\n\nexport type Playwright = typeof import('playwright');\n\n/** A signed-in user of the app: where it answers and the cookie that signs a browser or a request in. */\nexport interface Session {\n  email: string;\n  frontendUrl: string;\n  /** The API, a path under the frontend's origin. */\n  backendUrl: string;\n  /** The app's slug, read off the cookie name; the persisted UI store's key starts with it. */\n  slug: string;\n  /** In the shape `context.addCookies` takes. */\n  cookie: { name: string; value: string; url: string; httpOnly: true; sameSite: 'Strict' };\n  /** `name=value`, for a request's cookie header. */\n  header: string;\n}\n\nexport interface MintOptions {\n  /** The app's root; default the current directory. */\n  forkPath?: string;\n  /** The environment the mint script runs in: a testbed's names its database. Default this process's. */\n  env?: NodeJS.ProcessEnv;\n  /** Session lifetime; default 2. */\n  hours?: number;\n}\n\n/** Playwright as the app's frontend installed it, so the CLI ships none. */\nexport function loadPlaywright(forkPath = process.cwd()): Promise<Playwright> {\n  return importFromWorkspace<Playwright>(forkPath, 'frontend', 'playwright');\n}\n\n/**\n * Checks that Playwright has its Chromium, before anything slow starts.\n * @throws with the install command when it has none\n */\nexport async function requireChromium(forkPath = process.cwd()): Promise<void> {\n  const { chromium } = await loadPlaywright(forkPath);\n  if (!existsSync(chromium.executablePath())) {\n    throw new Error('Playwright has no Chromium yet: run `pnpm --filter frontend exec playwright install chromium`');\n  }\n}\n\n/**\n * Signs `email` in through the backend's `session:mint` script, which refuses outside development and test. The script\n * prints `<cookie name>=<signed value>` and a curl line with the API URL, both from the config of the environment it runs\n * in, so a testbed's shifted ports and a linked worktree's are written down nowhere.\n * @throws when the script prints no session, as for an email with no user\n */\nexport function mintSession(email: string, { forkPath = process.cwd(), env, hours = 2 }: MintOptions = {}): Session {\n  const minted = spawnSync('pnpm', ['--silent', '--filter', 'backend', 'session:mint', email, String(hours)], {\n    cwd: forkPath,\n    env,\n    encoding: 'utf8',\n  });\n  const cookie = /^((?:__Host-)?([\\w-]+)-session-v\\d+)=(\\S+)$/m.exec(minted.stdout);\n  const api = /^curl (\\S+)\\/me /m.exec(minted.stdout);\n  if (!cookie || !api) throw new Error(`could not mint a session for ${email}:\\n${minted.stdout}\\n${minted.stderr}`);\n  const frontendUrl = new URL(api[1]).origin;\n  return {\n    email,\n    frontendUrl,\n    backendUrl: api[1],\n    slug: cookie[2],\n    cookie: { name: cookie[1], value: cookie[3], url: frontendUrl, httpOnly: true, sameSite: 'Strict' },\n    header: `${cookie[1]}=${cookie[3]}`,\n  };\n}\n\n/**\n * Signs a minted session out, so a finished run leaves no live session in the user's sessions list. A JSON content type\n * passes the CSRF check without an Origin header; a stack that is already down leaves the session to expire.\n */\nexport async function signOut(session: Session | null | undefined): Promise<void> {\n  if (!session) return;\n  const headers = { cookie: session.header, 'content-type': 'application/json' };\n  await fetch(`${session.backendUrl}/auth/sign-out`, { method: 'POST', headers }).catch(() => {});\n}\n\nexport interface ContextOptions extends BrowserContextOptions {\n  /** Signs the context in. */\n  session?: Session;\n  /**\n   * Fields written into the app's persisted UI store (`<slug>-ui`) before any page script runs, so the first paint is\n   * already in the mode they set. Merged into what the store holds: a list joins the stored one, any other value wins.\n   */\n  uiStore?: { slug: string; state: Record<string, unknown> };\n}\n\n/** A browser context, signed in and with its UI store seeded when asked. */\nexport async function newContext(\n  browser: Browser,\n  { session, uiStore, ...options }: ContextOptions = {},\n): Promise<BrowserContext> {\n  const context = await browser.newContext(options);\n  // tsx and esbuild's keepNames wrap named functions in an `__name` helper that a page script does not have\n  await context.addInitScript({ content: 'window.__name = (fn) => fn;' });\n  if (session) await context.addCookies([session.cookie]);\n  if (uiStore) {\n    await context.addInitScript(\n      ([key, fields]) => {\n        const stored = JSON.parse(localStorage.getItem(key) ?? '{}');\n        const state = { ...stored.state };\n        for (const [name, value] of Object.entries(fields)) {\n          const before = state[name];\n          state[name] = Array.isArray(value) && Array.isArray(before) ? [...new Set([...before, ...value])] : value;\n        }\n        // A fresh entry needs the store's own version, or zustand drops it as written by an older build\n        localStorage.setItem(key, JSON.stringify({ version: 1, ...stored, state }));\n      },\n      [`${uiStore.slug}-ui`, uiStore.state] as const,\n    );\n  }\n  return context;\n}\n\n/**\n * Resolves once the page has stopped adding or changing content for `quiet` ms, or after `cap` ms. Lazy sections, query\n * results and opening overlays all show up as DOM changes; the network never goes idle in development.\n */\nexport async function settle(page: Page, { quiet = 400, cap = 3000 } = {}): Promise<void> {\n  const waited = page.evaluate(\n    ([quietMs, capMs]) =>\n      new Promise<void>((resolve) => {\n        const done = () => {\n          observer.disconnect();\n          clearTimeout(timer);\n          clearTimeout(limit);\n          resolve();\n        };\n        let timer = setTimeout(done, quietMs);\n        const limit = setTimeout(done, capMs);\n        const observer = new MutationObserver(() => {\n          clearTimeout(timer);\n          timer = setTimeout(done, quietMs);\n        });\n        observer.observe(document, { subtree: true, childList: true, characterData: true });\n      }),\n    [quiet, cap] as const,\n  );\n  // A navigation during the wait tears down the page's script context\n  await waited.catch(() => page.waitForTimeout(quiet));\n}\n\n/**\n * Opens `url` in a new page and settles once the route has rendered its content.\n * @throws when the route redirects: a check or a shot would judge another page under this one's name\n */\nexport async function openPage(context: BrowserContext, url: string, { timeout = 30_000 } = {}): Promise<Page> {\n  const page = await context.newPage();\n  await page.goto(url, { waitUntil: 'domcontentloaded', timeout });\n  await page.locator('main, [role=\"main\"], #accessibility-content, form, h1, footer').first().waitFor({ timeout });\n  await settle(page);\n  const landed = new URL(page.url()).pathname;\n  const asked = new URL(url).pathname;\n  if (landed !== asked) throw new Error(`${asked} redirected to ${landed}`);\n  return page;\n}\n","import { execFileSync, spawnSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { createRequire } from 'node:module';\nimport { dirname, join, resolve } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport { z } from 'zod';\nimport { setEnv } from './env';\n\nconst appConfigSchema = z.object({\n  frontendUrl: z.string(),\n  backendUrl: z.string(),\n  devPortOffset: z.number(),\n  services: z.record(\n    z.string(),\n    z.object({ enabled: z.boolean(), port: z.number(), internalPort: z.number().optional() }),\n  ),\n});\n\n/** The part of the app's development config the develop commands read. */\nexport type AppFacts = z.infer<typeof appConfigSchema>;\n\n/** The app's local database helpers (`shared/src/local-database.ts`), as the develop commands call them. */\nexport interface LocalDatabases {\n  port: (database: string) => number;\n  url: (database: string, role: 'postgres' | 'runtime_role' | 'admin_role') => string;\n  /** The env `backend/compose.yaml` reads: the project name and each database's host port. */\n  composeEnv: () => Record<string, string>;\n}\n\n/** Node strips the types of a file outside node_modules, so the app's own TS loads without a build or tsx. */\nexport async function importFromApp(forkPath: string, file: string): Promise<Record<string, unknown>> {\n  const path = join(forkPath, file);\n  if (!existsSync(path)) throw new Error(`not an app built from cella: ${path} is missing`);\n  // The app's config reads the mode once, at its first import, and the dev port offset applies in development mode only\n  setEnv('NODE_ENV', 'development');\n  return import(pathToFileURL(path).href);\n}\n\n/** An app path a template alignment moved: `current`, or `legacy` in an app that has only the old one. */\nexport const movedPath = (forkPath: string, current: string, legacy: string): string =>\n  !existsSync(join(forkPath, current)) && existsSync(join(forkPath, legacy)) ? legacy : current;\n\n/**\n * The app's config in development mode, from its own `shared` package. In a linked worktree the import claims that\n * worktree's port slot, as `pnpm dev` would.\n */\nexport async function loadAppFacts(forkPath: string): Promise<AppFacts> {\n  const parsed = appConfigSchema.safeParse((await importFromApp(forkPath, 'shared/index.ts')).appConfig);\n  if (!parsed.success)\n    throw new Error(`shared/index.ts exports no appConfig this CLI can read: ${parsed.error.message}`);\n  return parsed.data;\n}\n\n/** The app's local database helpers. */\nexport async function loadLocalDatabases(forkPath: string): Promise<LocalDatabases> {\n  const module = await importFromApp(forkPath, 'shared/src/local-database.ts');\n  const { localDatabasePort, localDatabaseUrl, composeEnv } = module;\n  if (\n    typeof localDatabasePort !== 'function' ||\n    typeof localDatabaseUrl !== 'function' ||\n    typeof composeEnv !== 'function'\n  ) {\n    throw new Error('shared/src/local-database.ts lacks localDatabasePort, localDatabaseUrl or composeEnv');\n  }\n  return {\n    port: (database) => localDatabasePort(database),\n    url: (database, role) => localDatabaseUrl(database, role),\n    composeEnv: () => composeEnv(),\n  };\n}\n\n/**\n * A package as the app's `workspace` installed it, so a tool drives the app's own Playwright, TypeScript or Tailwind and\n * the CLI ships none. The package's ESM entry when it has one, else its CommonJS exports.\n * @throws when the workspace does not have the package installed\n */\nexport async function importFromWorkspace<T>(forkPath: string, workspace: string, name: string): Promise<T> {\n  const require = createRequire(join(forkPath, workspace, 'package.json'));\n  let manifestPath: string | undefined;\n  try {\n    manifestPath = require.resolve(`${name}/package.json`);\n  } catch {\n    // A package whose exports leave out package.json resolves by its main entry below\n  }\n  const root = manifestPath ? JSON.parse(readFileSync(manifestPath, 'utf8')).exports?.['.'] : undefined;\n  const esm = typeof root?.import === 'string' ? root.import : root?.import?.default;\n  if (manifestPath && typeof esm === 'string') return import(pathToFileURL(join(dirname(manifestPath), esm)).href);\n  try {\n    return require(name);\n  } catch {\n    throw new Error(`${name} is not installed in ${workspace}: run \\`pnpm --filter ${workspace} add -D ${name}\\``);\n  }\n}\n\n/**\n * A Docker image as a tool runs it, pinned by digest (`name[:tag]@sha256:…`) so every run scans with the same code.\n * Pulls it on first use; the pull shows Docker's own progress.\n * @throws when the reference has no digest, Docker does not answer, or the pull fails\n */\nexport function resolveImage(reference: string): string {\n  if (!/@sha256:[0-9a-f]{64}$/.test(reference)) throw new Error(`${reference} is not pinned by digest`);\n  if (spawnSync('docker', ['info'], { stdio: 'ignore' }).status !== 0) {\n    throw new Error('Docker does not answer: start Docker (or OrbStack) first');\n  }\n  if (spawnSync('docker', ['image', 'inspect', reference], { stdio: 'ignore' }).status === 0) return reference;\n  if (spawnSync('docker', ['pull', reference], { stdio: ['ignore', 'inherit', 'inherit'] }).status !== 0) {\n    throw new Error(`could not pull ${reference}`);\n  }\n  return reference;\n}\n\n/**\n * Where a tool keeps its results and state: `<git dir>/cella-<tool>/` of this checkout, or of the git directory every\n * worktree shares. Inside the git directory nothing shows in `git status`.\n */\nexport function toolDir(forkPath: string, tool: string, scope: 'checkout' | 'repository' = 'checkout'): string {\n  const flag = scope === 'checkout' ? '--absolute-git-dir' : '--git-common-dir';\n  const gitDir = execFileSync('git', ['rev-parse', flag], { cwd: forkPath, encoding: 'utf8' }).trim();\n  return join(resolve(forkPath, gitDir), `cella-${tool}`);\n}\n","import process from 'node:process';\n\n/**\n * Centralized environment access for CLI/runtime integration points.\n */\nexport function getEnv(name: string): string | undefined {\n  // biome-ignore lint/style/noProcessEnv: This module centralizes intentional CLI environment access.\n  return process.env[name];\n}\n\n/** Whether the variable is set at all, even to an empty string. */\nexport function hasEnv(name: string): boolean {\n  // biome-ignore lint/style/noProcessEnv: This module centralizes intentional CLI environment access.\n  return name in process.env;\n}\n\n/** A mutable copy of the full environment, for passing to child processes. */\nexport function getEnvSnapshot(): NodeJS.ProcessEnv {\n  // biome-ignore lint/style/noProcessEnv: This module centralizes intentional CLI environment access.\n  return { ...process.env };\n}\n\n/** Set a variable for this process and the children it spawns from here on. */\nexport function setEnv(name: string, value: string): void {\n  // biome-ignore lint/style/noProcessEnv: This module centralizes intentional CLI environment access.\n  process.env[name] = value;\n}\n"],"mappings":";AAAA,SAAS,aAAAA,kBAAiB;AAC1B,SAAS,cAAAC,mBAAkB;AAC3B,OAAOC,cAAa;;;ACFpB,SAAS,cAAc,iBAAiB;AACxC,SAAS,YAAY,oBAAoB;AACzC,SAAS,qBAAqB;AAC9B,SAAS,SAAS,MAAM,eAAe;AACvC,SAAS,qBAAqB;AAC9B,SAAS,SAAS;;;ACLlB,OAAO,aAAa;;;ADQpB,IAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,aAAa,EAAE,OAAO;AAAA,EACtB,YAAY,EAAE,OAAO;AAAA,EACrB,eAAe,EAAE,OAAO;AAAA,EACxB,UAAU,EAAE;AAAA,IACV,EAAE,OAAO;AAAA,IACT,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,GAAG,MAAM,EAAE,OAAO,GAAG,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAAA,EAC1F;AACF,CAAC;AA4DD,eAAsB,oBAAuB,UAAkB,WAAmB,MAA0B;AAC1G,QAAMC,WAAU,cAAc,KAAK,UAAU,WAAW,cAAc,CAAC;AACvE,MAAI;AACJ,MAAI;AACF,mBAAeA,SAAQ,QAAQ,GAAG,IAAI,eAAe;AAAA,EACvD,QAAQ;AAAA,EAER;AACA,QAAM,OAAO,eAAe,KAAK,MAAM,aAAa,cAAc,MAAM,CAAC,EAAE,UAAU,GAAG,IAAI;AAC5F,QAAM,MAAM,OAAO,MAAM,WAAW,WAAW,KAAK,SAAS,MAAM,QAAQ;AAC3E,MAAI,gBAAgB,OAAO,QAAQ,SAAU,QAAO,OAAO,cAAc,KAAK,QAAQ,YAAY,GAAG,GAAG,CAAC,EAAE;AAC3G,MAAI;AACF,WAAOA,SAAQ,IAAI;AAAA,EACrB,QAAQ;AACN,UAAM,IAAI,MAAM,GAAG,IAAI,wBAAwB,SAAS,yBAAyB,SAAS,WAAW,IAAI,IAAI;AAAA,EAC/G;AACF;;;AD1DO,SAAS,eAAe,WAAWC,SAAQ,IAAI,GAAwB;AAC5E,SAAO,oBAAgC,UAAU,YAAY,YAAY;AAC3E;AAMA,eAAsB,gBAAgB,WAAWA,SAAQ,IAAI,GAAkB;AAC7E,QAAM,EAAE,SAAS,IAAI,MAAM,eAAe,QAAQ;AAClD,MAAI,CAACC,YAAW,SAAS,eAAe,CAAC,GAAG;AAC1C,UAAM,IAAI,MAAM,+FAA+F;AAAA,EACjH;AACF;AAQO,SAAS,YAAY,OAAe,EAAE,WAAWD,SAAQ,IAAI,GAAG,KAAK,QAAQ,EAAE,IAAiB,CAAC,GAAY;AAClH,QAAM,SAASE,WAAU,QAAQ,CAAC,YAAY,YAAY,WAAW,gBAAgB,OAAO,OAAO,KAAK,CAAC,GAAG;AAAA,IAC1G,KAAK;AAAA,IACL;AAAA,IACA,UAAU;AAAA,EACZ,CAAC;AACD,QAAM,SAAS,+CAA+C,KAAK,OAAO,MAAM;AAChF,QAAM,MAAM,oBAAoB,KAAK,OAAO,MAAM;AAClD,MAAI,CAAC,UAAU,CAAC,IAAK,OAAM,IAAI,MAAM,gCAAgC,KAAK;AAAA,EAAM,OAAO,MAAM;AAAA,EAAK,OAAO,MAAM,EAAE;AACjH,QAAM,cAAc,IAAI,IAAI,IAAI,CAAC,CAAC,EAAE;AACpC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,YAAY,IAAI,CAAC;AAAA,IACjB,MAAM,OAAO,CAAC;AAAA,IACd,QAAQ,EAAE,MAAM,OAAO,CAAC,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,aAAa,UAAU,MAAM,UAAU,SAAS;AAAA,IAClG,QAAQ,GAAG,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC;AAAA,EACnC;AACF;AAMA,eAAsB,QAAQ,SAAoD;AAChF,MAAI,CAAC,QAAS;AACd,QAAM,UAAU,EAAE,QAAQ,QAAQ,QAAQ,gBAAgB,mBAAmB;AAC7E,QAAM,MAAM,GAAG,QAAQ,UAAU,kBAAkB,EAAE,QAAQ,QAAQ,QAAQ,CAAC,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AAChG;AAaA,eAAsB,WACpB,SACA,EAAE,SAAS,SAAS,GAAG,QAAQ,IAAoB,CAAC,GAC3B;AACzB,QAAM,UAAU,MAAM,QAAQ,WAAW,OAAO;AAEhD,QAAM,QAAQ,cAAc,EAAE,SAAS,8BAA8B,CAAC;AACtE,MAAI,QAAS,OAAM,QAAQ,WAAW,CAAC,QAAQ,MAAM,CAAC;AACtD,MAAI,SAAS;AACX,UAAM,QAAQ;AAAA,MACZ,CAAC,CAAC,KAAK,MAAM,MAAM;AACjB,cAAM,SAAS,KAAK,MAAM,aAAa,QAAQ,GAAG,KAAK,IAAI;AAC3D,cAAM,QAAQ,EAAE,GAAG,OAAO,MAAM;AAChC,mBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClD,gBAAM,SAAS,MAAM,IAAI;AACzB,gBAAM,IAAI,IAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,QAAQ,MAAM,IAAI,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC,IAAI;AAAA,QACtG;AAEA,qBAAa,QAAQ,KAAK,KAAK,UAAU,EAAE,SAAS,GAAG,GAAG,QAAQ,MAAM,CAAC,CAAC;AAAA,MAC5E;AAAA,MACA,CAAC,GAAG,QAAQ,IAAI,OAAO,QAAQ,KAAK;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AACT;AAMA,eAAsB,OAAO,MAAY,EAAE,QAAQ,KAAK,MAAM,IAAK,IAAI,CAAC,GAAkB;AACxF,QAAM,SAAS,KAAK;AAAA,IAClB,CAAC,CAAC,SAAS,KAAK,MACd,IAAI,QAAc,CAACC,aAAY;AAC7B,YAAM,OAAO,MAAM;AACjB,iBAAS,WAAW;AACpB,qBAAa,KAAK;AAClB,qBAAa,KAAK;AAClB,QAAAA,SAAQ;AAAA,MACV;AACA,UAAI,QAAQ,WAAW,MAAM,OAAO;AACpC,YAAM,QAAQ,WAAW,MAAM,KAAK;AACpC,YAAM,WAAW,IAAI,iBAAiB,MAAM;AAC1C,qBAAa,KAAK;AAClB,gBAAQ,WAAW,MAAM,OAAO;AAAA,MAClC,CAAC;AACD,eAAS,QAAQ,UAAU,EAAE,SAAS,MAAM,WAAW,MAAM,eAAe,KAAK,CAAC;AAAA,IACpF,CAAC;AAAA,IACH,CAAC,OAAO,GAAG;AAAA,EACb;AAEA,QAAM,OAAO,MAAM,MAAM,KAAK,eAAe,KAAK,CAAC;AACrD;AAMA,eAAsB,SAAS,SAAyB,KAAa,EAAE,UAAU,IAAO,IAAI,CAAC,GAAkB;AAC7G,QAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,QAAM,KAAK,KAAK,KAAK,EAAE,WAAW,oBAAoB,QAAQ,CAAC;AAC/D,QAAM,KAAK,QAAQ,+DAA+D,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;AAC/G,QAAM,OAAO,IAAI;AACjB,QAAM,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE;AACnC,QAAM,QAAQ,IAAI,IAAI,GAAG,EAAE;AAC3B,MAAI,WAAW,MAAO,OAAM,IAAI,MAAM,GAAG,KAAK,kBAAkB,MAAM,EAAE;AACxE,SAAO;AACT;","names":["spawnSync","existsSync","process","require","process","existsSync","spawnSync","resolve"]}

package/dist/index.js

@@ -49,6 +49,7 @@ async function importFromApp(forkPath, file) {
   setEnv("NODE_ENV", "development");
   return import(pathToFileURL(path).href);
 }
+var movedPath = (forkPath, current, legacy) => !existsSync(join(forkPath, current)) && existsSync(join(forkPath, legacy)) ? legacy : current;
 async function loadAppFacts(forkPath) {
   const parsed2 = appConfigSchema.safeParse((await importFromApp(forkPath, "shared/index.ts")).appConfig);
   if (!parsed2.success)
@@ -233,7 +234,7 @@ import process6 from "process";
 // package.json
 var package_default = {
   name: "@cellajs/cli",
-  version: "0.6.5",
+  version: "0.6.6",
   private: false,
   license: "MIT",
   description: "CLI for managing your monorepo and upgrading it with upstream Cella.",
@@ -761,6 +762,15 @@ async function gitMv(cwd, oldPath, newPath) {
   await mkdir2(newDir, { recursive: true });
   await git(["mv", "-f", oldPath, newPath], cwd);
 }
+async function moveFromRef(cwd, ref, from, to) {
+  const [mode, , blob] = (await git(["ls-tree", ref, "--", from], cwd)).split(/\s+/);
+  if (!blob) throw new Error(`${ref} holds no ${from}`);
+  await gitRm(cwd, [to], { cached: true });
+  await git(["update-index", "--add", "--cacheinfo", `${mode},${blob},${to}`], cwd);
+  await mkdir2(dirname3(join3(cwd, to)), { recursive: true });
+  await git(["checkout-index", "-f", "--", to], cwd);
+  await removeFileFully(cwd, from);
+}
 async function fileExistsInWorktree(cwd, filePath) {
   return existsSync3(join3(cwd, filePath));
 }
@@ -1373,11 +1383,12 @@ var STARTUP_TIMEOUT_MS = 5 * 6e4;
 var STOP_TIMEOUT_MS = 1e4;
 var DATABASE = "testbed";
 var DATABASE_SERVICE = "db_testbed";
-var showcasePath = (forkPath) => join4(forkPath, "json/showcase.json");
+var showcaseFile = (forkPath) => movedPath(forkPath, "backend/scripts/seeds/showcase.json", "json/showcase.json");
+var showcasePath = (forkPath) => join4(forkPath, showcaseFile(forkPath));
 var hasShowcase = (forkPath) => existsSync4(showcasePath(forkPath));
 function showcaseAdmin(forkPath) {
   const { admin } = JSON.parse(readFileSync2(showcasePath(forkPath), "utf8"));
-  if (typeof admin?.email !== "string") throw new Error("json/showcase.json names no admin email");
+  if (typeof admin?.email !== "string") throw new Error(`${showcaseFile(forkPath)} names no admin email`);
   return admin.email;
 }
 var shiftPort = (url) => {
@@ -1666,7 +1677,7 @@ async function withTestbed(forkPath, use, { fresh = false, destructive = false,
 }
 async function runTestbed(forkPath, options) {
   if (options.job === "stop") return stopTestbed(await resolveTestbed(forkPath));
-  if (options.showcase && !hasShowcase(forkPath)) throw new Error("this app keeps no json/showcase.json");
+  if (options.showcase && !hasShowcase(forkPath)) throw new Error(`this app keeps no ${showcaseFile(forkPath)}`);
   const data = options.showcase ? "showcase" : "seed";
   if (options.command.length > 0) {
     return withTestbed(forkPath, (testbed2) => runCommand(forkPath, testbed2.env, options.command), { ...options, data });
@@ -1701,7 +1712,7 @@ var testbedCommand = {
   ],
   options: [
     ["--fresh", "start from an empty database: migrate and seed it again"],
-    ["--showcase", "hold the showcase of json/showcase.json, which the screenshots shoot, for a review loop"]
+    ["--showcase", "hold the showcase seed, which the screenshots shoot, for a review loop"]
   ],
   passthrough: [
     "command",
@@ -1716,8 +1727,8 @@ var testbedCommand = {
 };
 
 // src/tools/a11y/audit.ts
-import { mkdirSync as mkdirSync3, statSync, writeFileSync as writeFileSync4 } from "fs";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync3, statSync, writeFileSync as writeFileSync5 } from "fs";
+import { join as join10 } from "path";
 
 // src/tools/a11y/axe-scan.ts
 import axe from "axe-core";
@@ -2387,8 +2398,97 @@ function recordDecisions(forkPath, decisions) {
 }
 
 // src/tools/a11y/probes/page-structure.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
+import { join as join8 } from "path";
+
+// src/tools/i18n/locales.ts
+import { existsSync as existsSync7, readdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { join as join7 } from "path";
+var localesDir = (forkPath) => movedPath(forkPath, "shared/locales", "locales");
+var MANIFEST = "namespaces.json";
+var SOURCE_LANGUAGE = "en";
+var entryPattern = /^(\s+)("(?:[^"\\]|\\.)*")\s*:\s*("(?:[^"\\]|\\.)*"),?\s*$/;
+function parseLocaleFile(path, text2) {
+  if (text2.trim() === "{}") return { path, indent: "  ", entries: [] };
+  const lines = text2.replace(/\n$/, "").split("\n");
+  if (lines[0] !== "{" || lines.at(-1) !== "}") return "not one JSON object with one entry per line";
+  const entries = [];
+  let indent = "  ";
+  for (const line of lines.slice(1, -1)) {
+    const match = entryPattern.exec(line);
+    if (!match) return `cannot read the line ${JSON.stringify(line.trim())}`;
+    indent = match[1];
+    entries.push({ key: JSON.parse(match[2]), value: JSON.parse(match[3]), raw: [match[2], match[3]] });
+  }
+  return { path, indent, entries };
+}
+function serializeLocaleFile(file) {
+  if (file.entries.length === 0) return "{}\n";
+  return `{
+${file.entries.map(({ raw }) => `${file.indent}${raw[0]}: ${raw[1]}`).join(",\n")}
+}
+`;
+}
+function writeLocaleFile(forkPath, file) {
+  writeFileSync3(join7(forkPath, file.path), serializeLocaleFile(file));
+}
+var textsOf = (file) => Object.fromEntries((file?.entries ?? []).map(({ key, value }) => [key, value]));
+var readJsonObject = (path) => {
+  const parsed2 = JSON.parse(readFileSync4(path, "utf8"));
+  if (!parsed2 || typeof parsed2 !== "object" || Array.isArray(parsed2)) throw new Error(`${path} is not a JSON object`);
+  return Object.fromEntries(Object.entries(parsed2));
+};
+function readLocales(forkPath) {
+  const localesPath = localesDir(forkPath);
+  const dir = join7(forkPath, localesPath);
+  if (!existsSync7(join7(dir, SOURCE_LANGUAGE))) throw new Error(`no ${localesPath}/${SOURCE_LANGUAGE}/ in ${forkPath}`);
+  const languages = readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => entry.name).sort((a, b) => a === SOURCE_LANGUAGE ? -1 : b === SOURCE_LANGUAGE ? 1 : a.localeCompare(b));
+  const files2 = /* @__PURE__ */ new Map();
+  for (const language2 of languages) {
+    for (const name of readdirSync(join7(dir, language2)).filter((name2) => name2.endsWith(".json"))) {
+      const path = `${localesPath}/${language2}/${name}`;
+      const parsed2 = parseLocaleFile(path, readFileSync4(join7(forkPath, path), "utf8"));
+      if (typeof parsed2 === "string") throw new Error(`${path}: ${parsed2}; pnpm lint:fix writes one entry per line`);
+      files2.set(`${language2}/${name.slice(0, -".json".length)}`, parsed2);
+    }
+  }
+  const manifestPath = join7(dir, MANIFEST);
+  if (!existsSync7(manifestPath)) throw new Error(`no ${localesPath}/${MANIFEST}: upgrade the app from cella first`);
+  const merged = readJsonObject(manifestPath);
+  const namespaces = /* @__PURE__ */ new Map();
+  for (const [namespace, sources] of Object.entries(merged)) {
+    if (!Array.isArray(sources) || !sources.every((source) => typeof source === "string")) {
+      throw new Error(`${localesPath}/${MANIFEST}: ${namespace} must list file names`);
+    }
+    namespaces.set(namespace, sources);
+  }
+  const mergedFiles = new Set([...namespaces.values()].flat());
+  const ownFiles = [...new Set([...files2.keys()].map((key) => key.split("/")[1]))].filter(
+    (file) => !mergedFiles.has(file)
+  );
+  for (const file of ownFiles.sort()) namespaces.set(file, [file]);
+  return { dir: localesPath, languages, namespaces, files: files2 };
+}
+function namespaceTexts(locales, language2, namespace) {
+  const sources = locales.namespaces.get(namespace) ?? [];
+  return Object.assign({}, ...sources.map((file) => textsOf(locales.files.get(`${language2}/${file}`))));
+}
+var lineOf = (file, key) => file.entries.findIndex((entry) => entry.key === key) + 2;
+var pluralSuffix = /_(ordinal_)?(zero|one|two|few|many|other)$/;
+function pluralForm(key) {
+  const match = pluralSuffix.exec(key);
+  if (!match) return void 0;
+  return { base: key.slice(0, match.index), category: match[2], ordinal: !!match[1] };
+}
+var withPluralForms = (key) => [
+  key,
+  ...["zero", "one", "two", "few", "many", "other"].flatMap((category) => [
+    `${key}_${category}`,
+    `${key}_ordinal_${category}`
+  ])
+];
+
+// src/tools/a11y/probes/page-structure.ts
 var titles = { criteria: ["2.4.2"], check: "probe:titles", what: "A distinct, descriptive page title" };
 var language = {
   criteria: ["3.1.1"],
@@ -2422,7 +2522,7 @@ var pageStructure = async (page, state, { app }) => {
 var languageSwitch = async (page, state, { app, forkPath }) => {
   if (state.open) return [];
   const names = JSON.parse(
-    readFileSync4(join7(forkPath, "locales", app.defaultLanguage, "common.json"), "utf8")
+    readFileSync5(join8(forkPath, localesDir(forkPath), app.defaultLanguage, "common.json"), "utf8")
   );
   const findings2 = [];
   for (const other of app.languages.filter((lng) => lng !== app.defaultLanguage)) {
@@ -2756,15 +2856,15 @@ var inputs = async (page, state) => {
 };
 
 // src/tools/a11y/review-packet.ts
-import { mkdirSync as mkdirSync2, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join8 } from "path";
-var packetDir = (run, stateId) => join8(run.resultsDir, "review", stateId);
+import { mkdirSync as mkdirSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { join as join9 } from "path";
+var packetDir = (run, stateId) => join9(run.resultsDir, "review", stateId);
 function writePacketFile(run, stateId, name, content) {
   mkdirSync2(packetDir(run, stateId), { recursive: true });
-  writeFileSync3(join8(packetDir(run, stateId), name), content);
+  writeFileSync4(join9(packetDir(run, stateId), name), content);
 }
 function removePacketFile(run, stateId, name) {
-  rmSync2(join8(packetDir(run, stateId), name), { force: true });
+  rmSync2(join9(packetDir(run, stateId), name), { force: true });
 }
 function pageFacts() {
   const text2 = (el) => (el?.textContent ?? "").trim().replace(/\s+/g, " ");
@@ -3225,7 +3325,7 @@ async function runAudit(run, scope, testbed, options) {
   const startedAt = Date.now();
   const email = options.email ?? testbed.env.ADMIN_EMAIL;
   if (!email) throw new Error("no audit user: pass --email, or set ADMIN_EMAIL in backend/.env");
-  const builtAt = statSync(join9(run.forkPath, "frontend/dist/index.html"), { throwIfNoEntry: false })?.mtime;
+  const builtAt = statSync(join10(run.forkPath, "frontend/dist/index.html"), { throwIfNoEntry: false })?.mtime;
   printStep("auditing", `${testbed.frontendUrl}, frontend build of ${builtAt?.toLocaleString() ?? "unknown date"}`);
   const states = options.states.length > 0 ? scope.states.filter((state) => options.states.includes(state.id)) : scope.states;
   const session = await startAudit(run.forkPath, scope, { email, env: testbed.env });
@@ -3265,12 +3365,12 @@ async function runAudit(run, scope, testbed, options) {
   mkdirSync3(run.resultsDir, { recursive: true });
   const axe2 = summarizeAxe(scans);
   for (const [id, items] of axe2.evidence) for (const item of items) evidence.add([id], item);
-  writeFileSync4(join9(run.resultsDir, "axe.json"), `${JSON.stringify({ ...axe2.report, errors }, null, 2)}
+  writeFileSync5(join10(run.resultsDir, "axe.json"), `${JSON.stringify({ ...axe2.report, errors }, null, 2)}
 `);
   evidence.addFindings(acrossStates(findings2));
   runCodeChecks(evidence, run, scope.sources);
   const skipped2 = Object.keys(errors).length;
-  const target = options.states.length > 0 || skipped2 ? join9(run.resultsDir, "ledger-partial.json") : join9(run.forkPath, ledgerFile);
+  const target = options.states.length > 0 || skipped2 ? join10(run.resultsDir, "ledger-partial.json") : join10(run.forkPath, ledgerFile);
   const ledger = writeLedger(
     run.forkPath,
     evidence.byCriterion,
@@ -3294,10 +3394,10 @@ async function runAudit(run, scope, testbed, options) {
 }
 
 // src/tools/a11y/decide.ts
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 import { resolve as resolve4 } from "path";
 function runDecide(forkPath, { file, decision }) {
-  const input2 = file ? JSON.parse(readFileSync5(resolve4(file), "utf8")) : [decision];
+  const input2 = file ? JSON.parse(readFileSync6(resolve4(file), "utf8")) : [decision];
   if (!Array.isArray(input2)) throw new Error(`${file} holds no list of decisions`);
   const decisions = input2.map(parseDecision);
   const ledger = recordDecisions(forkPath, decisions);
@@ -3311,8 +3411,8 @@ function runDecide(forkPath, { file, decision }) {
 
 // src/tools/a11y/report.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { copyFileSync, mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname4, join as join10 } from "path";
+import { copyFileSync, mkdirSync as mkdirSync4, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname4, join as join11 } from "path";
 var statusLabel = {
   supports: "Supports",
   "partially-supports": "Partially Supports",
@@ -3431,7 +3531,7 @@ Not evaluated.
 
 This report describes the product as tested on the report date. Accessibility can change as the product changes.
 `;
-  const tracked = spawnSync5("git", ["ls-files", "frontend/src", "backend/src", "locales"], {
+  const tracked = spawnSync5("git", ["ls-files", "frontend/src", "backend/src", "shared/locales", "locales"], {
     cwd: forkPath,
     encoding: "utf8"
   }).stdout.split("\n");
@@ -3458,7 +3558,7 @@ NVDA and Firefox on Windows, keyboard only, in light and dark mode.
 
 ## Confirm: decided by an agent (${byAgent.length})
 
-The agent judged these from the review packets in \`${join10(resultsDir, "review")}/\`. Check its evidence, then record your own
+The agent judged these from the review packets in \`${join11(resultsDir, "review")}/\`. Check its evidence, then record your own
 decision; a wrong Supports here ends up in the published report.
 
 ${byAgent.map((r) => {
@@ -3502,11 +3602,11 @@ ${failing.map((r) => {
   }).join("\n")}
 `;
   mkdirSync4(resultsDir, { recursive: true });
-  writeFileSync5(join10(resultsDir, "vpat-draft.md"), vpat);
-  writeFileSync5(join10(resultsDir, "manual-pass.md"), checklist);
+  writeFileSync6(join11(resultsDir, "vpat-draft.md"), vpat);
+  writeFileSync6(join11(resultsDir, "manual-pass.md"), checklist);
   const html = toHtml(vpat, `${app.name} Accessibility Conformance Report`);
-  const pdfPath = join10(resultsDir, "conformance-report.pdf");
-  writeFileSync5(join10(resultsDir, "conformance-report.html"), html);
+  const pdfPath = join11(resultsDir, "conformance-report.pdf");
+  writeFileSync6(join11(resultsDir, "conformance-report.html"), html);
   const { chromium } = await loadPlaywright(forkPath);
   const browser = await chromium.launch();
   try {
@@ -3526,12 +3626,12 @@ ${failing.map((r) => {
     if (unconfirmed && !draft) {
       const ids = [...open, ...byAgent].map((r) => r.id).join(", ");
       throw new Error(
-        `not published: ${open.length} criteria are open and ${byAgent.length} are decided by an agent only (${ids}). See ${join10(resultsDir, "manual-pass.md")}, or add --draft to publish it as a draft`
+        `not published: ${open.length} criteria are open and ${byAgent.length} are decided by an agent only (${ids}). See ${join11(resultsDir, "manual-pass.md")}, or add --draft to publish it as a draft`
       );
     }
     const publicPath = "frontend/public/static/common/accessibility-conformance-report.pdf";
-    mkdirSync4(dirname4(join10(forkPath, publicPath)), { recursive: true });
-    copyFileSync(pdfPath, join10(forkPath, publicPath));
+    mkdirSync4(dirname4(join11(forkPath, publicPath)), { recursive: true });
+    copyFileSync(pdfPath, join11(forkPath, publicPath));
     const count3 = (status) => ledger.criteria.filter((r) => r.status === status).length;
     const review = {
       standard: ledger.standard,
@@ -3638,8 +3738,8 @@ var a11yCommand = {
 };
 
 // src/tools/bench/command.ts
-import { existsSync as existsSync7, readdirSync } from "fs";
-import { basename, join as join11 } from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync2 } from "fs";
+import { basename, join as join12 } from "path";
 
 // src/tools/bench/request.ts
 var BENCH_REQUEST_ENV = "CELLA_BENCH";
@@ -3648,11 +3748,11 @@ var BENCH_REQUEST_ENV = "CELLA_BENCH";
 var BENCH_DIR = "backend/bench";
 var ENTRY_COMMAND = ["pnpm", "exec", "tsx", "--no-experimental-webstorage", "bench/run.ts"];
 async function runBench(forkPath, options) {
-  if (!existsSync7(join11(forkPath, BENCH_DIR, "run.ts"))) {
+  if (!existsSync8(join12(forkPath, BENCH_DIR, "run.ts"))) {
     throw new Error(`${BENCH_DIR}/run.ts is missing: upgrade the app from cella first`);
   }
-  const scenariosDir = join11(forkPath, BENCH_DIR, "scenarios");
-  const names = readdirSync(scenariosDir).filter((file) => file.endsWith(".ts")).map((file) => basename(file, ".ts")).sort();
+  const scenariosDir = join12(forkPath, BENCH_DIR, "scenarios");
+  const names = readdirSync2(scenariosDir).filter((file) => file.endsWith(".ts")).map((file) => basename(file, ".ts")).sort();
   if (options.scenario && !names.includes(options.scenario)) {
     throw new Error(`unknown scenario '${options.scenario}'. expected one of: ${names.join(", ")}`);
   }
@@ -3664,7 +3764,7 @@ async function runBench(forkPath, options) {
     scenariosDir,
     dataDir: toolDir(forkPath, "bench", "repository")
   };
-  const run = (env) => runCommand(join11(forkPath, "backend"), { ...env, [BENCH_REQUEST_ENV]: JSON.stringify(request) }, ENTRY_COMMAND);
+  const run = (env) => runCommand(join12(forkPath, "backend"), { ...env, [BENCH_REQUEST_ENV]: JSON.stringify(request) }, ENTRY_COMMAND);
   return options.isolated ? withTestbed(forkPath, (testbed) => run(testbed.env)) : run(getEnvSnapshot());
 }
 var benchCommand = {
@@ -3703,98 +3803,12 @@ import { spawnSync as spawnSync6 } from "child_process";
 import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "fs";
 import { join as join14 } from "path";
 
-// src/tools/i18n/locales.ts
-import { existsSync as existsSync8, readdirSync as readdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
-import { join as join12 } from "path";
-var LOCALES_DIR = "locales";
-var MANIFEST = "namespaces.json";
-var SOURCE_LANGUAGE = "en";
-var entryPattern = /^(\s+)("(?:[^"\\]|\\.)*")\s*:\s*("(?:[^"\\]|\\.)*"),?\s*$/;
-function parseLocaleFile(path, text2) {
-  if (text2.trim() === "{}") return { path, indent: "  ", entries: [] };
-  const lines = text2.replace(/\n$/, "").split("\n");
-  if (lines[0] !== "{" || lines.at(-1) !== "}") return "not one JSON object with one entry per line";
-  const entries = [];
-  let indent = "  ";
-  for (const line of lines.slice(1, -1)) {
-    const match = entryPattern.exec(line);
-    if (!match) return `cannot read the line ${JSON.stringify(line.trim())}`;
-    indent = match[1];
-    entries.push({ key: JSON.parse(match[2]), value: JSON.parse(match[3]), raw: [match[2], match[3]] });
-  }
-  return { path, indent, entries };
-}
-function serializeLocaleFile(file) {
-  if (file.entries.length === 0) return "{}\n";
-  return `{
-${file.entries.map(({ raw }) => `${file.indent}${raw[0]}: ${raw[1]}`).join(",\n")}
-}
-`;
-}
-function writeLocaleFile(forkPath, file) {
-  writeFileSync6(join12(forkPath, file.path), serializeLocaleFile(file));
-}
-var textsOf = (file) => Object.fromEntries((file?.entries ?? []).map(({ key, value }) => [key, value]));
-var readJsonObject = (path) => {
-  const parsed2 = JSON.parse(readFileSync6(path, "utf8"));
-  if (!parsed2 || typeof parsed2 !== "object" || Array.isArray(parsed2)) throw new Error(`${path} is not a JSON object`);
-  return Object.fromEntries(Object.entries(parsed2));
-};
-function readLocales(forkPath) {
-  const dir = join12(forkPath, LOCALES_DIR);
-  if (!existsSync8(join12(dir, SOURCE_LANGUAGE))) throw new Error(`no ${LOCALES_DIR}/${SOURCE_LANGUAGE}/ in ${forkPath}`);
-  const languages = readdirSync2(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => entry.name).sort((a, b) => a === SOURCE_LANGUAGE ? -1 : b === SOURCE_LANGUAGE ? 1 : a.localeCompare(b));
-  const files2 = /* @__PURE__ */ new Map();
-  for (const language2 of languages) {
-    for (const name of readdirSync2(join12(dir, language2)).filter((name2) => name2.endsWith(".json"))) {
-      const path = `${LOCALES_DIR}/${language2}/${name}`;
-      const parsed2 = parseLocaleFile(path, readFileSync6(join12(forkPath, path), "utf8"));
-      if (typeof parsed2 === "string") throw new Error(`${path}: ${parsed2}; pnpm lint:fix writes one entry per line`);
-      files2.set(`${language2}/${name.slice(0, -".json".length)}`, parsed2);
-    }
-  }
-  const manifestPath = join12(dir, MANIFEST);
-  if (!existsSync8(manifestPath)) throw new Error(`no ${LOCALES_DIR}/${MANIFEST}: upgrade the app from cella first`);
-  const merged = readJsonObject(manifestPath);
-  const namespaces = /* @__PURE__ */ new Map();
-  for (const [namespace, sources] of Object.entries(merged)) {
-    if (!Array.isArray(sources) || !sources.every((source) => typeof source === "string")) {
-      throw new Error(`${LOCALES_DIR}/${MANIFEST}: ${namespace} must list file names`);
-    }
-    namespaces.set(namespace, sources);
-  }
-  const mergedFiles = new Set([...namespaces.values()].flat());
-  const ownFiles = [...new Set([...files2.keys()].map((key) => key.split("/")[1]))].filter(
-    (file) => !mergedFiles.has(file)
-  );
-  for (const file of ownFiles.sort()) namespaces.set(file, [file]);
-  return { languages, namespaces, files: files2 };
-}
-function namespaceTexts(locales, language2, namespace) {
-  const sources = locales.namespaces.get(namespace) ?? [];
-  return Object.assign({}, ...sources.map((file) => textsOf(locales.files.get(`${language2}/${file}`))));
-}
-var lineOf = (file, key) => file.entries.findIndex((entry) => entry.key === key) + 2;
-var pluralSuffix = /_(ordinal_)?(zero|one|two|few|many|other)$/;
-function pluralForm(key) {
-  const match = pluralSuffix.exec(key);
-  if (!match) return void 0;
-  return { base: key.slice(0, match.index), category: match[2], ordinal: !!match[1] };
-}
-var withPluralForms = (key) => [
-  key,
-  ...["zero", "one", "two", "few", "many", "other"].flatMap((category) => [
-    `${key}_${category}`,
-    `${key}_ordinal_${category}`
-  ])
-];
-
 // src/tools/i18n/scan.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import { readFileSync as readFileSync7, statSync as statSync2 } from "fs";
 import { dirname as dirname5, join as join13 } from "path";
 var codeFile = /\.(?:[cm]?[jt]sx?)$/;
-var skipped = (path) => path.endsWith(".d.ts") || path.startsWith("locales/") || path.startsWith("cella/alignments/") || path.split("/").some((segment) => segment === "node_modules" || segment === "gen" || segment.includes(".gen."));
+var skipped = (path) => path.endsWith(".d.ts") || path.startsWith("locales/") || path.startsWith("shared/locales/") || path.startsWith("cella/alignments/") || path.split("/").some((segment) => segment === "node_modules" || segment === "gen" || segment.includes(".gen."));
 var MAX_FILE_BYTES = 1e6;
 var MAX_COMBINATIONS = 500;
 var escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -4211,10 +4225,10 @@ function printList(title, items) {
   console.info(`    ${colors_default.dim(`${items.slice(0, LIST_MAX).join(", ")}${more}`)}`);
 }
 var describe = ({ key, missing, extra }) => [key, ...missing.map((name) => `-${name}`), ...extra.map((name) => `+${name}`)].join(" ");
-function printStatus(report) {
+function printStatus(report, dir) {
   const label = ({ name, files: files2 }) => files2.length > 1 || files2[0] !== name ? `${name} (${files2.join(" + ")})` : name;
   console.info(
-    `${colors_default.bold(`${LOCALES_DIR}/`)} ${colors_default.dim(`${report.languages.join(", ")} \xB7 namespaces ${report.namespaces.map(label).join(", ")}`)}`
+    `${colors_default.bold(`${dir}/`)} ${colors_default.dim(`${report.languages.join(", ")} \xB7 namespaces ${report.namespaces.map(label).join(", ")}`)}`
   );
   console.info();
   console.info(colors_default.dim(row2(columns.map(([title]) => title))));
@@ -4286,9 +4300,10 @@ function printStatus(report) {
   console.info(`  ${colors_default.dim("missing and same-as-English keys: --json lists them \xB7 cella i18n unused")}`);
 }
 function runStatus(forkPath, json) {
-  const report = buildStatus(readLocales(forkPath));
+  const locales = readLocales(forkPath);
+  const report = buildStatus(locales);
   if (json) writeStdout(JSON.stringify(report, null, 2));
-  else printStatus(report);
+  else printStatus(report, locales.dir);
   return defectCount(report) === 0 ? 0 : 1;
 }
 
@@ -5779,7 +5794,9 @@ var alignmentExempt = [
   "json/",
   "locales/",
   "sdk/gen",
-  "shared/config"
+  "shared/config",
+  "shared/json/",
+  "shared/locales/"
 ];
 function ownedPaths(configSource) {
   const lists = [...configSource.matchAll(/\b(?:ignored|pinned): \[([\s\S]*?)\n {4}\]/g)].map((match) => match[1]);
@@ -7615,8 +7632,9 @@ async function analyzeRefs(repoPath, localRef, incomingRef, mergeBaseRef, predic
       const forkModifiedOld = forkOldHash !== baseOldHash;
       const oldPathPinned = predicates.isPinned(oldPath);
       let upstreamChanged2;
-      if (fileIsPinned || oldPathPinned || predicates.isIgnored(oldPath)) {
+      if (fileIsPinned || fileIsIgnored || oldPathPinned || predicates.isIgnored(oldPath)) {
         status = "pinned";
+        if (oldPathInFork) renamedFrom = oldPath;
         if (forkModifiedOld && upstreamHash !== baseOldHash) {
           upstreamChanged2 = true;
           renamedProtected.add(filePath);
@@ -7772,9 +7790,11 @@ async function applyDirectMerge(forkPath, upstreamRef, mergeBaseRef, config, onP
   );
   const batchRestorePaths = [];
   const batchRemovePaths = [];
+  const movedProtected = [];
   for (const file of analyzedFiles) {
     if (file.status === "identical" || file.status === "ahead") continue;
-    if (file.isIgnored || file.isPinned && !file.renamedFrom) {
+    if (file.status === "pinned" && file.renamedFrom) movedProtected.push({ from: file.renamedFrom, to: file.path });
+    else if (file.isIgnored || file.isPinned) {
       (file.existsInFork ? batchRestorePaths : batchRemovePaths).push(file.path);
     }
   }
@@ -7791,6 +7811,10 @@ async function applyDirectMerge(forkPath, upstreamRef, mergeBaseRef, config, onP
       await removeFileFromWorktree(forkPath, filePath);
     }
   }
+  for (const { from, to } of movedProtected) {
+    onProgress?.(`\u2192 ${from} \u2192 ${to}: keeping your copy (moved in upstream)`);
+    await moveFromRef(forkPath, "HEAD", from, to);
+  }
   for (const file of analyzedFiles) {
     const { path: filePath, status, existsInFork } = file;
     if (status === "identical" || status === "ahead" || isProtectedFile(file)) continue;