@minnovate/shadow-publisher 0.15.2 → 0.16.0

package/dist/claude/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "git-publisher",
   "displayName": "Git Publisher",
-  "version": "0.15.2",
+  "version": "0.16.0",
   "description": "Publish an app folder's Git history to the serverless Git publishing backend and keep it updated (\"publish my app\", \"update my app\", \"fetch the engineered version\").",
   "author": { "name": "git-publisher project" },
   "keywords": ["git", "publish", "deploy", "serverless"]

package/dist/claude/plugin/skills/publish-app/SKILL.md

@@ -206,12 +206,27 @@ following, for when the person asks not to wait.
     publish from a complete copy: `publisher checkout <new folder> --repo <id>`.
   - `LIMIT_EXCEEDED`, `PACK_INVALID`: quote the message; suggest removing very large files from the
     folder if the message mentions size.
+  - `REPOSITORY_MOVED`: see "When the app moved" below.
 - `"unknown"` / exit code 3: the publication was sent but its outcome is not known yet. Run
   `publisher status . --json`; it waits for and resolves interrupted publications without creating
   duplicates. Repeat once if it still says `finalizing`.
 - Exit code 4: run `publisher doctor --json` and follow `next.action` (normally `reauthenticate`:
   run `next.command`). Never ask the user for a token.
 
+### When the app moved
+
+`REPOSITORY_MOVED` means the app moved to another organisation (the person's team adopted it).
+This folder can no longer publish; nothing was lost, and it can still be read. It comes as a
+`"rejected"` publication, or as `error.code` when the publish was refused before it started; both
+carry a `hint` and `details.movedTo` (in `publication.rejection.details` or `error.details`).
+Pass the `hint` on, then:
+
+1. Tell the person to sign in again and choose the organisation the app moved to:
+   `publisher login`. Never ask them for a token.
+2. Find the app there: `publisher checkout <new folder> --repo <details.movedTo> --json` when
+   `details.movedTo` is set; otherwise `publisher list --json` and pick the app by its name.
+3. Make the change again in the new folder (copy over what this folder had that was not published),
+   and publish from there. Do not try to publish this folder again, and never use `--force`.
 
 ### When the checks find something
 

package/dist/claude/plugin/skills/sync-app/SKILL.md

@@ -20,6 +20,16 @@ publish it follows the app through received → checked → going live → live
 result. `merged` says whether anything
 published elsewhere was brought in (`"fast-forward"` or `"merge"`); mention it when it is not null.
 
+## When the app moved
+
+A sync that ends with `REPOSITORY_MOVED` — `publication.rejection.code`, or `error.code` when it
+was refused before anything was sent — means the app moved to another organisation (the person's
+team adopted it). Pass on its `hint`, and do what the `publish-app` skill's "When the app moved"
+says: sign in again with `publisher login` and choose that organisation, then
+`publisher checkout <new folder> --repo <details.movedTo>` (or find the app with
+`publisher list --json` when `details.movedTo` is `null`), and publish from the new folder. Do not
+sync this folder again.
+
 ## When it waits for an answer
 
 Sometimes the app's preparation asks one business question before it can go on (for example
@@ -39,7 +49,8 @@ publisher answer <question id>=<value> --json
 ```
 
 A value that is not an option is refused before anything is sent; `error.details.questions` lists
-the choices. Exit 4 means this sign-in may not answer (an owner or admin can); exit 3 means ask
+the choices. Exit 4 means this sign-in may not answer (an owner or admin can, or the app's creator for the
+first preparation after an adoption); exit 3 means ask
 again. Then `publisher follow . --publication <id> --until-change --timeout 100 --json` to see it go live, telling them each step as `publish-app` step 4 says.
 
 ## When it did not go live because of a fault on our side

package/dist/publisher.cjs

@@ -116,6 +116,13 @@ var ERROR_CODES = [
   "REPOSITORY_NOT_FOUND",
   "REPOSITORY_CONFLICT",
   "REPOSITORY_ARCHIVED",
+  // The repository moved to another organisation (an adoption): it refuses every write and still
+  // admits reads. `details.movedTo` names the new repository only to a caller with a grant on it,
+  // and is null for everybody else. A client that does not know the code reads it as its 409.
+  "REPOSITORY_MOVED",
+  // A copy for an adoption names the organisation it moves the application from, and the source
+  // repository is in another one. Its own code: the portal tells it from a moved repository.
+  "REPOSITORY_NOT_IN_ORGANISATION",
   "ACCESS_CONFLICT",
   // publications (begin / finalize / status)
   "PUBLICATION_NOT_FOUND",
@@ -165,6 +172,8 @@ var HTTP_STATUS_FOR_CODE = {
   REPOSITORY_NOT_FOUND: 404,
   REPOSITORY_CONFLICT: 409,
   REPOSITORY_ARCHIVED: 409,
+  REPOSITORY_MOVED: 409,
+  REPOSITORY_NOT_IN_ORGANISATION: 409,
   ACCESS_CONFLICT: 412,
   PUBLICATION_NOT_FOUND: 404,
   NOTHING_CHANGED: 409,
@@ -2791,7 +2800,14 @@ var IndexRecord = object({
    * stays exactly where it was, which is also the only thing the bucket policy permits
    * (`DenyDeleteOfImmutableKeys`). Records written before this field existed read back as null.
    */
-  archived: _default(nullable(IsoDate), null)
+  archived: _default(nullable(IsoDate), null),
+  /**
+   * The repository this one was copied into when its application moved to another organisation (an
+   * adoption, ADR-0034), or null. Set once, by the same compare-and-swap as `archived`, after the copy
+   * holds every object. A moved repository refuses every publication and compaction with
+   * `REPOSITORY_MOVED`, and still admits every read. Records written before this field read as null.
+   */
+  movedTo: _default(nullable(RepoId), null)
 });
 var OwnerMarker = object({
   schemaVersion: SchemaVersion,
@@ -2823,7 +2839,13 @@ var MetaRecord = object({
    * (`packages/worker/src/publish.ts`), because a consumer that guessed would create an
    * application in an organisation nobody chose. Every repository created since carries one.
    */
-  org: _default(nullable(OrgId), null)
+  org: _default(nullable(OrgId), null),
+  /**
+   * The repository this one is a copy of (ADR-0034), or null for a repository that was created
+   * empty. Create-only with the rest of the meta, so a replayed copy can prove it copies the same
+   * repository, and a creation can never reuse the id of a copy.
+   */
+  movedFrom: _default(nullable(RepoId), null)
 });
 var GrantPattern = string2().check(
   _minLength(1),
@@ -2995,6 +3017,12 @@ var CreateRepositoryRequest = object({
 });
 var RepositoryIdRequest = object({ creationId: CreationId });
 var RepositoryIdResponse = object({ repoId: RepoId });
+var CopyRepositoryRequest = object({
+  creationId: CreationId,
+  fromOrganisation: OrgId,
+  grants: _default(array(Grant).check(_maxLength(200)), [])
+});
+var CopyRepositoryResponse = object({ repoId: RepoId, movedFrom: RepoId });
 var RepositoryInfo = object({
   repoId: RepoId,
   name: string2(),
@@ -3005,6 +3033,11 @@ var RepositoryInfo = object({
   createdAt: IsoDate,
   /** null unless the repository is archived; an admin must be able to SEE one to bring it back */
   archived: _default(nullable(IsoDate), null),
+  /**
+   * The repository this one moved to (ADR-0034), and only for a caller with a grant on THAT one:
+   * anybody else reads null. Optional so an older server reads as null.
+   */
+  movedTo: _default(nullable(RepoId), null),
   size: object({ baseBytes: int(), incrementalBytes: int(), packCount: int() }),
   lastTransaction: nullable(object({ id: string2(), kind: string2(), generation: Generation, committedAt: IsoDate })),
   /** whether a compaction has produced a base bundle yet; before one, a fetch installs the packs */
@@ -5152,7 +5185,7 @@ var PortalSession = class {
           continue;
         }
       }
-      return answer2;
+      return { ...answer2, merged: answer2.status === 403 ? mergedSay(answer2.body) : null };
     }
   }
 };
@@ -5177,6 +5210,15 @@ async function askPortal(fetchImpl, url2, token, body) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function mergedSay(body) {
+  const error2 = isRecord(body) ? body["error"] : void 0;
+  if (!isRecord(error2) || error2["code"] !== "organisation-merged") {
+    return null;
+  }
+  const details = error2["details"];
+  const say = isRecord(details) ? details["say"] : void 0;
+  return typeof say === "string" && say !== "" ? say : null;
+}
 
 // ../client/src/portal-refusal.ts
 function portalRefusalCode(body) {
@@ -5216,7 +5258,7 @@ async function createApplication(input, opts) {
       throw new PublisherError("UNAUTHORIZED", 'the portal did not accept this credential; run "publisher login" again');
     }
     if (answer2.status === 403) {
-      throw new PublisherError("FORBIDDEN", `the portal refused to make an application here (${code || "forbidden"})`);
+      throw new PublisherError("FORBIDDEN", answer2.merged ?? `the portal refused to make an application here (${code || "forbidden"})`);
     }
     if (answer2.status === 409 && REFUSALS[code] !== void 0) {
       throw new PublisherError(REFUSALS[code], `the portal refused the repository (${code})`, { details: { portal: code } });
@@ -5449,7 +5491,7 @@ async function followRun(input, opts) {
       return { kind: "unavailable", reason: "no-route" };
     }
     if (answer2.status === 403) {
-      return { kind: "forbidden" };
+      return { kind: "forbidden", say: answer2.merged };
     }
     if (answer2.status === 200) {
       const run2 = soleRun(answer2.body);
@@ -5559,7 +5601,7 @@ async function call(input, opts, body) {
     return { kind: "unauthorized" };
   }
   if (answer2.status === 403) {
-    return { kind: "forbidden" };
+    return { kind: "forbidden", say: answer2.merged };
   }
   if (answer2.status === 409) {
     return { kind: "moved-on" };
@@ -5664,7 +5706,7 @@ async function runCreatorTool(input, opts) {
     return { kind: "unauthorized" };
   }
   if (answer2.status === 403) {
-    return { kind: "forbidden" };
+    return { kind: "forbidden", say: answer2.merged };
   }
   if (answer2.status === 404) {
     return { kind: "unavailable", detail: "the portal does not serve this tool" };
@@ -7194,7 +7236,7 @@ function progressHint(r, portal, answerable = false) {
     case "unauthorized":
       return inPortal(portal, "Published, but the portal did not accept this sign-in (run publisher login).", "Follow it");
     case "forbidden":
-      return inPortal(portal, "Published, but the portal would not show this sign-in the run.", "Follow it");
+      return inPortal(portal, r.say === null ? "Published, but the portal would not show this sign-in the run." : `Published. ${r.say}`, "Follow it");
     case "malformed":
       return inPortal(portal, `Published, but the portal's answer about the run could not be read (${r.detail}).`, "Follow it");
   }
@@ -7743,6 +7785,23 @@ async function linkFolder(inv, p, endpoint, dir, attach) {
   };
 }
 
+// src/moved.ts
+var Moved = class {
+  /**
+   * The sentence for a refusal or a rejection with `code`, or null when it is not a move. `details`
+   * names the new repository only when the service showed it to this sign-in, and then the sentence
+   * gives the command that brings it into a new folder.
+   */
+  static hint(code, details) {
+    if (code !== "REPOSITORY_MOVED") {
+      return null;
+    }
+    const movedTo = details?.["movedTo"];
+    const next = typeof movedTo === "string" ? `then run publisher checkout <new folder> --repo ${movedTo}` : "then run publisher list to find it there";
+    return `This app moved to another organisation. Sign in again with publisher login, choose that organisation, ${next}.`;
+  }
+};
+
 // src/commands/publication.ts
 var publish2 = {
   git: true,
@@ -7763,6 +7822,7 @@ var publish2 = {
   }
 };
 function published(inv, o) {
+  const hint = o.rejection === null ? null : Moved.hint(o.rejection.code, o.rejection.details);
   inv.out({
     state: o.state,
     publicationId: o.publicationId,
@@ -7771,7 +7831,8 @@ function published(inv, o) {
     refs: o.refs,
     rejection: o.rejection,
     resumed: o.resumed,
-    ...o.next === null ? {} : { next: o.next }
+    ...o.next === null ? {} : { next: o.next },
+    ...hint === null ? {} : { hint }
   });
   return exitFor(o.state);
 }
@@ -7947,7 +8008,10 @@ function shown(portal, r) {
     case "unauthorized":
       throw new PublisherError("UNAUTHORIZED", "the portal did not accept this sign-in; run publisher login");
     case "forbidden":
-      throw new PublisherError("FORBIDDEN", "the portal will not let this sign-in answer for this organisation (an owner or admin can)");
+      throw new PublisherError(
+        "FORBIDDEN",
+        r.say ?? "the portal will not let this sign-in answer for this organisation (an owner or admin can, or the app's creator for the first preparation after an adoption)"
+      );
     case "unavailable":
       throw new PublisherError("UNAVAILABLE", `the portal could not be asked: ${r.detail}`, { retryable: true });
     case "malformed":
@@ -8030,7 +8094,7 @@ async function creatorTool(p, endpoint, tool, args, opts = {}) {
     case "unauthorized":
       throw new PublisherError("UNAUTHORIZED", "the portal did not accept this sign-in; run publisher login");
     case "forbidden":
-      throw new PublisherError("FORBIDDEN", "the portal will not let this sign-in do that in this organisation");
+      throw new PublisherError("FORBIDDEN", result.say ?? "the portal will not let this sign-in do that in this organisation");
     case "unavailable":
       throw new PublisherError("UNAVAILABLE", `the portal could not be asked: ${result.detail}`, { retryable: true });
     case "malformed":
@@ -8205,7 +8269,7 @@ function outcome(r) {
       rejection: o.rejection,
       ...o.next === null ? {} : { next: o.next }
     },
-    hint: syncHint(r.state, r.reconciled.before.conflicts, r.marked)
+    hint: (o?.rejection ? Moved.hint(o.rejection.code, o.rejection.details) : null) ?? syncHint(r.state, r.reconciled.before.conflicts, r.marked)
   };
 }
 function syncHint(state, conflicts, marked) {
@@ -8299,6 +8363,8 @@ var EXIT_CODE = {
   REPOSITORY_NOT_FOUND: 1,
   REPOSITORY_CONFLICT: 1,
   REPOSITORY_ARCHIVED: 1,
+  REPOSITORY_MOVED: 1,
+  REPOSITORY_NOT_IN_ORGANISATION: 1,
   ACCESS_CONFLICT: 1,
   PUBLICATION_NOT_FOUND: 1,
   NOTHING_CHANGED: 1,
@@ -8487,7 +8553,8 @@ Usage:
   publisher follow [dir] --publication <id>             follow an accepted publication's run where a sync left it
       [--timeout <seconds>] [--until-change]            --until-change (sync too): return at the next step, to tell it
   publisher question [dir] [--repo <id>]                the question the app's preparation waits on, if any,
-                                                        with each option's value (answering needs owner or admin)
+                                                        with each option's value (an owner or admin answers it, or
+                                                        the app's creator for the first one after an adoption)
   publisher answer <question>=<value>... [--repo <id>]  answer it from this folder; a value that is not one of
                                                         the question's options is refused before anything is sent
   publisher retry [dir] [--repo <id>]                   try the app's newest version again, when it did not go
@@ -8600,9 +8667,11 @@ main(process.argv.slice(2)).then(
   (e) => {
     const json = process.argv.includes("--json");
     if (e instanceof PublisherError) {
-      const payload = { error: { code: e.code, message: e.message, retryable: e.retryable, details: e.details ?? null } };
+      const moved = Moved.hint(e.code, e.details);
+      const payload = { error: { code: e.code, message: e.message, retryable: e.retryable, details: e.details ?? null }, ...moved === null ? {} : { hint: moved } };
       const hint = e.code === "NETWORK" ? `
-  if this folder's service moved, "publisher doctor" says where to` : "";
+  if this folder's service moved, "publisher doctor" says where to` : moved === null ? "" : `
+  ${moved}`;
       process.stdout.write((json ? JSON.stringify(payload) : `error [${e.code}]: ${e.message}${hint}`) + "\n");
       process.exit(exitCodeFor(e.code));
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minnovate/shadow-publisher",
-  "version": "0.15.2",
+  "version": "0.16.0",
   "description": "publisher: publish an app's Git history to the serverless Git backend",
   "license": "Apache-2.0",
   "type": "module",