@minnovate/shadow-publisher 0.15.2 → 0.17.0

package/dist/claude/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "git-publisher",
   "displayName": "Git Publisher",
-  "version": "0.15.2",
+  "version": "0.17.0",
   "description": "Publish an app folder's Git history to the serverless Git publishing backend and keep it updated (\"publish my app\", \"update my app\", \"fetch the engineered version\").",
   "author": { "name": "git-publisher project" },
   "keywords": ["git", "publish", "deploy", "serverless"]

package/dist/claude/plugin/skills/publish-app/SKILL.md

@@ -179,7 +179,7 @@ following, for when the person asks not to wait.
   `recorded.excluded` is not empty, what was left out and why. Then read `progress` (null with
   `--no-wait`) and pass on its `hint`:
   - `kind: "settled"` with `ending` `"live"`: the app is live. `"not-deployed"`: published and
-    checked, and this organisation does not deploy automatically. `"failed"` with `findings`: it
+    checked, and this organization does not deploy automatically. `"failed"` with `findings`: it
     did not pass its checks, and `findings` says why — fix them as "When the checks find something"
     below says. `"failed"` without `findings`: it stopped at `failedAt`; the portal says why — do
     not guess the reason. A fault on our side can be tried again: to find out, run `publisher
@@ -206,12 +206,27 @@ following, for when the person asks not to wait.
     publish from a complete copy: `publisher checkout <new folder> --repo <id>`.
   - `LIMIT_EXCEEDED`, `PACK_INVALID`: quote the message; suggest removing very large files from the
     folder if the message mentions size.
+  - `REPOSITORY_MOVED`: see "When the app moved" below.
 - `"unknown"` / exit code 3: the publication was sent but its outcome is not known yet. Run
   `publisher status . --json`; it waits for and resolves interrupted publications without creating
   duplicates. Repeat once if it still says `finalizing`.
 - Exit code 4: run `publisher doctor --json` and follow `next.action` (normally `reauthenticate`:
   run `next.command`). Never ask the user for a token.
 
+### When the app moved
+
+`REPOSITORY_MOVED` means the app moved to another organization (the person's team adopted it).
+This folder can no longer publish; nothing was lost, and it can still be read. It comes as a
+`"rejected"` publication, or as `error.code` when the publish was refused before it started; both
+carry a `hint` and `details.movedTo` (in `publication.rejection.details` or `error.details`).
+Pass the `hint` on, then:
+
+1. Tell the person to sign in again and choose the organization the app moved to:
+   `publisher login`. Never ask them for a token.
+2. Find the app there: `publisher checkout <new folder> --repo <details.movedTo> --json` when
+   `details.movedTo` is set; otherwise `publisher list --json` and pick the app by its name.
+3. Make the change again in the new folder (copy over what this folder had that was not published),
+   and publish from there. Do not try to publish this folder again, and never use `--force`.
 
 ### When the checks find something
 
@@ -265,7 +280,7 @@ folder. Never `init` or `sync` an empty new folder in its place: that makes a se
 In a sandbox (Claude Cowork, Claude Code on the web) a `NETWORK` error, or `CONNECT tunnel failed,
 response 403`, usually means the sandbox's network does not allow the platform. Tell the person that
 their Claude settings must allow the platform's domain and its storage (`*.s3.<region>.amazonaws.com`)
-under Settings → Capabilities, or that their organisation's owner must, on a Team or Enterprise plan.
+under Settings → Capabilities, or that their organization's owner must, on a Team or Enterprise plan.
 Do not retry until they say it is done.
 
 ## 6. Interrupted earlier?

package/dist/claude/plugin/skills/sync-app/SKILL.md

@@ -20,10 +20,20 @@ publish it follows the app through received → checked → going live → live
 result. `merged` says whether anything
 published elsewhere was brought in (`"fast-forward"` or `"merge"`); mention it when it is not null.
 
+## When the app moved
+
+A sync that ends with `REPOSITORY_MOVED` — `publication.rejection.code`, or `error.code` when it
+was refused before anything was sent — means the app moved to another organization (the person's
+team adopted it). Pass on its `hint`, and do what the `publish-app` skill's "When the app moved"
+says: sign in again with `publisher login` and choose that organization, then
+`publisher checkout <new folder> --repo <details.movedTo>` (or find the app with
+`publisher list --json` when `details.movedTo` is `null`), and publish from the new folder. Do not
+sync this folder again.
+
 ## When it waits for an answer
 
 Sometimes the app's preparation asks one business question before it can go on (for example
-whether to use the organisation's data). `follow` then stops with `kind: "waiting"` and
+whether to use the organization's data). `follow` then stops with `kind: "waiting"` and
 `next.command`. Read the question:
 
 ```bash
@@ -39,7 +49,8 @@ publisher answer <question id>=<value> --json
 ```
 
 A value that is not an option is refused before anything is sent; `error.details.questions` lists
-the choices. Exit 4 means this sign-in may not answer (an owner or admin can); exit 3 means ask
+the choices. Exit 4 means this sign-in may not answer (an owner or admin can, or the app's creator for the
+first preparation after an adoption); exit 3 means ask
 again. Then `publisher follow . --publication <id> --until-change --timeout 100 --json` to see it go live, telling them each step as `publish-app` step 4 says.
 
 ## When it did not go live because of a fault on our side

package/dist/publisher.cjs

@@ -98,10 +98,10 @@ var ERROR_CODES = [
   "UNAUTHORIZED",
   "FORBIDDEN",
   "REF_FORBIDDEN",
-  // The credential names no organisation, so there is nothing to publish a repository FOR. Its own
-  // code rather than FORBIDDEN: a caller can act on it (sign in again, choosing an organisation),
+  // The credential names no organization, so there is nothing to publish a repository FOR. Its own
+  // code rather than FORBIDDEN: a caller can act on it (sign in again, choosing an organization),
   // and a test that could not tell it from "you may not" would prove nothing about the check.
-  "ORGANISATION_REQUIRED",
+  "ORGANIZATION_REQUIRED",
   // A repository is created only by the platform's application maker (the portal), for a person,
   // after it has made the application the repository will belong to. Its own code: a terminal that
   // meets it is an older client calling this route directly, and can say "upgrade" rather than
@@ -116,6 +116,13 @@ var ERROR_CODES = [
   "REPOSITORY_NOT_FOUND",
   "REPOSITORY_CONFLICT",
   "REPOSITORY_ARCHIVED",
+  // The repository moved to another organization (an adoption): it refuses every write and still
+  // admits reads. `details.movedTo` names the new repository only to a caller with a grant on it,
+  // and is null for everybody else. A client that does not know the code reads it as its 409.
+  "REPOSITORY_MOVED",
+  // A copy for an adoption names the organization it moves the application from, and the source
+  // repository is in another one. Its own code: the portal tells it from a moved repository.
+  "REPOSITORY_NOT_IN_ORGANIZATION",
   "ACCESS_CONFLICT",
   // publications (begin / finalize / status)
   "PUBLICATION_NOT_FOUND",
@@ -145,7 +152,7 @@ var ERROR_CODES = [
   "INTERNAL",
   // client-side only
   "NETWORK",
-  "CANCELLED",
+  "CANCELED",
   "OUTCOME_UNKNOWN",
   "LOCAL_STATE",
   "GIT"
@@ -159,12 +166,14 @@ var HTTP_STATUS_FOR_CODE = {
   UNAUTHORIZED: 401,
   FORBIDDEN: 403,
   REF_FORBIDDEN: 403,
-  ORGANISATION_REQUIRED: 403,
+  ORGANIZATION_REQUIRED: 403,
   APPLICATION_REQUIRED: 403,
   ADMIN_REQUIRED: 403,
   REPOSITORY_NOT_FOUND: 404,
   REPOSITORY_CONFLICT: 409,
   REPOSITORY_ARCHIVED: 409,
+  REPOSITORY_MOVED: 409,
+  REPOSITORY_NOT_IN_ORGANIZATION: 409,
   ACCESS_CONFLICT: 412,
   PUBLICATION_NOT_FOUND: 404,
   NOTHING_CHANGED: 409,
@@ -187,7 +196,7 @@ var HTTP_STATUS_FOR_CODE = {
   UNAVAILABLE: 503,
   INTERNAL: 500,
   NETWORK: 0,
-  CANCELLED: 0,
+  CANCELED: 0,
   OUTCOME_UNKNOWN: 0,
   LOCAL_STATE: 0,
   GIT: 0
@@ -2680,14 +2689,14 @@ var LimitsSchema = object({
   maxTemporaryBytes: _default(positiveInt(), 3 * 512 * 1024 * 1024),
   /** wall-clock bound for a single validation git command */
   gitTimeoutMs: _default(positiveInt(), 3e5),
-  // ---- per-organisation bounds ----
+  // ---- per-organization bounds ----
   /**
-   * ACTIVE repositories an organisation may hold when it sets no quota of its own in users
-   * (ADR-0014 A1); anyone may sign up and publish, so this bounds one account's organisation.
+   * ACTIVE repositories an organization may hold when it sets no quota of its own in users
+   * (ADR-0014 A1); anyone may sign up and publish, so this bounds one account's organization.
    * Named `maxRepositoriesPerPrincipal` before 0.9.0, when it counted a creator's repositories.
    * Defaulted so an older server reads as the default, not a failure.
    */
-  maxRepositoriesPerOrganisation: _default(positiveInt(), 25),
+  maxRepositoriesPerOrganization: _default(positiveInt(), 25),
   // ---- a publication of files (ADR-0030) ----
   /** the UTF-8 bytes of the files one file publication writes; the commit builder is invoked with them, and Lambda takes 6 MB */
   maxFilePublicationBytes: _default(positiveInt(), 4 * 1024 * 1024),
@@ -2712,7 +2721,7 @@ var DEFAULT_LIMITS = {
   maxProcessMemoryBytes: 2 * 1024 * 1024 * 1024,
   maxTemporaryBytes: 3 * 512 * 1024 * 1024,
   gitTimeoutMs: 3e5,
-  maxRepositoriesPerOrganisation: 25,
+  maxRepositoriesPerOrganization: 25,
   maxFilePublicationBytes: 4 * 1024 * 1024,
   maxFilePublicationPaths: 1e3,
   maxShownFileBytes: 512 * 1024
@@ -2791,7 +2800,14 @@ var IndexRecord = object({
    * stays exactly where it was, which is also the only thing the bucket policy permits
    * (`DenyDeleteOfImmutableKeys`). Records written before this field existed read back as null.
    */
-  archived: _default(nullable(IsoDate), null)
+  archived: _default(nullable(IsoDate), null),
+  /**
+   * The repository this one was copied into when its application moved to another organization (an
+   * adoption, ADR-0034), or null. Set once, by the same compare-and-swap as `archived`, after the copy
+   * holds every object. A moved repository refuses every publication and compaction with
+   * `REPOSITORY_MOVED`, and still admits every read. Records written before this field read as null.
+   */
+  movedTo: _default(nullable(RepoId), null)
 });
 var OwnerMarker = object({
   schemaVersion: SchemaVersion,
@@ -2799,7 +2815,7 @@ var OwnerMarker = object({
   repoId: RepoId,
   createdAt: IsoDate
 });
-var RepositoryOrganisation = object({
+var RepositoryOrganization = object({
   schemaVersion: SchemaVersion,
   repoId: RepoId,
   org: OrgId
@@ -2813,17 +2829,23 @@ var MetaRecord = object({
   createdBy: PrincipalId,
   creationId: CreationId,
   /**
-   * The organisation that published this repository, and what `repoId` is derived from: "that
-   * organisation publishes a repository" is the product's sentence.
+   * The organization that published this repository, and what `repoId` is derived from: "that
+   * organization publishes a repository" is the product's sentence.
    *
    * `null` is what a record written BEFORE repositories were org-scoped reads as, and every such
    * record is still readable, cloneable and publishable — `tests/compat/fixtures/schema-v1` is one,
    * and the promise that it stays readable is why this field is not required. What `null` must
    * never do is default: the worker refuses to ANNOUNCE a publication it cannot attribute
    * (`packages/worker/src/publish.ts`), because a consumer that guessed would create an
-   * application in an organisation nobody chose. Every repository created since carries one.
+   * application in an organization nobody chose. Every repository created since carries one.
    */
-  org: _default(nullable(OrgId), null)
+  org: _default(nullable(OrgId), null),
+  /**
+   * The repository this one is a copy of (ADR-0034), or null for a repository that was created
+   * empty. Create-only with the rest of the meta, so a replayed copy can prove it copies the same
+   * repository, and a creation can never reuse the id of a copy.
+   */
+  movedFrom: _default(nullable(RepoId), null)
 });
 var GrantPattern = string2().check(
   _minLength(1),
@@ -2995,6 +3017,12 @@ var CreateRepositoryRequest = object({
 });
 var RepositoryIdRequest = object({ creationId: CreationId });
 var RepositoryIdResponse = object({ repoId: RepoId });
+var CopyRepositoryRequest = object({
+  creationId: CreationId,
+  fromOrganization: OrgId,
+  grants: _default(array(Grant).check(_maxLength(200)), [])
+});
+var CopyRepositoryResponse = object({ repoId: RepoId, movedFrom: RepoId });
 var RepositoryInfo = object({
   repoId: RepoId,
   name: string2(),
@@ -3005,6 +3033,11 @@ var RepositoryInfo = object({
   createdAt: IsoDate,
   /** null unless the repository is archived; an admin must be able to SEE one to bring it back */
   archived: _default(nullable(IsoDate), null),
+  /**
+   * The repository this one moved to (ADR-0034), and only for a caller with a grant on THAT one:
+   * anybody else reads null. Optional so an older server reads as null.
+   */
+  movedTo: _default(nullable(RepoId), null),
   size: object({ baseBytes: int(), incrementalBytes: int(), packCount: int() }),
   lastTransaction: nullable(object({ id: string2(), kind: string2(), generation: Generation, committedAt: IsoDate })),
   /** whether a compaction has produced a base bundle yet; before one, a fetch installs the packs */
@@ -3135,7 +3168,7 @@ var BundleBootstrapResponse = object({
 // ../protocol/src/keys.ts
 var PENDING_KEY_RE = new RegExp(`^pending/(${REPO_ID_RE.source.slice(1, -1)})/(${PUBLICATION_ID_RE.source.slice(1, -1)})$`);
 var OWNER_KEY_RE = new RegExp(`^owners/(${PRINCIPAL_ID_RE.source.slice(1, -1)})/(${REPO_ID_RE.source.slice(1, -1)})$`);
-var REPOSITORY_ORGANISATION_KEY_RE = new RegExp(`^repository-organisations/(${REPO_ID_RE.source.slice(1, -1)})\\.json$`);
+var REPOSITORY_ORGANIZATION_KEY_RE = new RegExp(`^repository-organizations/(${REPO_ID_RE.source.slice(1, -1)})\\.json$`);
 
 // ../protocol/src/index.ts
 var MAX_WAIT_SECONDS = 5;
@@ -3451,8 +3484,8 @@ function feedStdin(child, input, onSourceError) {
 function killedError(reason, detail, args, timeoutMs, maxOut) {
   const what = `git ${args[0]}`;
   switch (reason) {
-    case "cancelled":
-      return new PublisherError("CANCELLED", `${what} cancelled`);
+    case "canceled":
+      return new PublisherError("CANCELED", `${what} canceled`);
     case "timeout":
       return new PublisherError("GIT", `${what} timed out after ${timeoutMs}ms`, { retryable: true });
     case "output-limit":
@@ -3489,7 +3522,7 @@ async function runGit(args, opts = {}) {
     terminate(child);
   };
   const timer = setTimeout(() => kill("timeout"), timeoutMs);
-  const onAbort = () => kill("cancelled");
+  const onAbort = () => kill("canceled");
   if (opts.signal) {
     if (opts.signal.aborted) {
       onAbort();
@@ -4024,7 +4057,7 @@ async function packObjectsToFile(repoDir, extraArgs, stdinLines, opts) {
       throw startFailure("git pack-objects", ended.error, repoDir);
     }
     if (opts.signal?.aborted) {
-      throw new PublisherError("CANCELLED", "pack creation cancelled");
+      throw new PublisherError("CANCELED", "pack creation canceled");
     }
     if (timedOut) {
       throw new PublisherError("GIT", `pack-objects timed out after ${timeoutMs}ms`, { retryable: true });
@@ -5152,7 +5185,7 @@ var PortalSession = class {
           continue;
         }
       }
-      return answer2;
+      return { ...answer2, merged: answer2.status === 403 ? mergedSay(answer2.body) : null };
     }
   }
 };
@@ -5177,6 +5210,15 @@ async function askPortal(fetchImpl, url2, token, body) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function mergedSay(body) {
+  const error2 = isRecord(body) ? body["error"] : void 0;
+  if (!isRecord(error2) || error2["code"] !== "organization-merged") {
+    return null;
+  }
+  const details = error2["details"];
+  const say = isRecord(details) ? details["say"] : void 0;
+  return typeof say === "string" && say !== "" ? say : null;
+}
 
 // ../client/src/portal-refusal.ts
 function portalRefusalCode(body) {
@@ -5216,7 +5258,7 @@ async function createApplication(input, opts) {
       throw new PublisherError("UNAUTHORIZED", 'the portal did not accept this credential; run "publisher login" again');
     }
     if (answer2.status === 403) {
-      throw new PublisherError("FORBIDDEN", `the portal refused to make an application here (${code || "forbidden"})`);
+      throw new PublisherError("FORBIDDEN", answer2.merged ?? `the portal refused to make an application here (${code || "forbidden"})`);
     }
     if (answer2.status === 409 && REFUSALS[code] !== void 0) {
       throw new PublisherError(REFUSALS[code], `the portal refused the repository (${code})`, { details: { portal: code } });
@@ -5291,7 +5333,7 @@ var Transport = class {
     const token = await this.opts.token();
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(new PublisherError("NETWORK", "request timed out", { retryable: true })), this.opts.timeoutMs ?? 6e4);
-    const onAbort = () => controller.abort(new PublisherError("CANCELLED", "cancelled"));
+    const onAbort = () => controller.abort(new PublisherError("CANCELED", "canceled"));
     ro.signal?.addEventListener("abort", onAbort, { once: true });
     if (ro.signal?.aborted) {
       onAbort();
@@ -5361,7 +5403,7 @@ function sleep(ms, signal) {
       "abort",
       () => {
         clearTimeout(t);
-        reject(new PublisherError("CANCELLED", "cancelled"));
+        reject(new PublisherError("CANCELED", "canceled"));
       },
       { once: true }
     );
@@ -5449,7 +5491,7 @@ async function followRun(input, opts) {
       return { kind: "unavailable", reason: "no-route" };
     }
     if (answer2.status === 403) {
-      return { kind: "forbidden" };
+      return { kind: "forbidden", say: answer2.merged };
     }
     if (answer2.status === 200) {
       const run2 = soleRun(answer2.body);
@@ -5540,7 +5582,7 @@ async function confirmPortal(portal, endpoint, fetchImpl = fetch) {
 
 // ../client/src/preparation.ts
 var PREPARATION = "preparation";
-var STATUSES = ["queued", "running", "needs-choice", "ready", "blocked", "cancelled"];
+var STATUSES = ["queued", "running", "needs-choice", "ready", "blocked", "canceled"];
 var MAX_FINDINGS = 10;
 var MAX_TEXT = 500;
 function readPreparation(input, opts) {
@@ -5559,7 +5601,7 @@ async function call(input, opts, body) {
     return { kind: "unauthorized" };
   }
   if (answer2.status === 403) {
-    return { kind: "forbidden" };
+    return { kind: "forbidden", say: answer2.merged };
   }
   if (answer2.status === 409) {
     return { kind: "moved-on" };
@@ -5664,7 +5706,7 @@ async function runCreatorTool(input, opts) {
     return { kind: "unauthorized" };
   }
   if (answer2.status === 403) {
-    return { kind: "forbidden" };
+    return { kind: "forbidden", say: answer2.merged };
   }
   if (answer2.status === 404) {
     return { kind: "unavailable", detail: "the portal does not serve this tool" };
@@ -5738,7 +5780,7 @@ async function onboardFolder(opts) {
   const walk = async (d) => {
     for (const e of await (0, import_promises6.readdir)(d, { withFileTypes: true })) {
       if (opts.signal?.aborted) {
-        throw new PublisherError("CANCELLED", "cancelled");
+        throw new PublisherError("CANCELED", "canceled");
       }
       const full = (0, import_node_path5.join)(d, e.name);
       const rel = (0, import_node_path5.relative)(dir, full).split(import_node_path5.sep).join("/");
@@ -5929,7 +5971,7 @@ async function uploadPack(fetchImpl, upload, packPath, size, opts) {
     });
   } catch (e) {
     if (opts.signal?.aborted) {
-      throw new PublisherError("CANCELLED", "upload cancelled");
+      throw new PublisherError("CANCELED", "upload canceled");
     }
     throw new PublisherError("NETWORK", `upload failed: ${e.message}`, { retryable: true, cause: e });
   }
@@ -7176,7 +7218,7 @@ function progressHint(r, portal, answerable = false) {
         case "live":
           return "Your app is live.";
         case "not-deployed":
-          return "Published and checked; this organisation does not deploy automatically.";
+          return "Published and checked; this organization does not deploy automatically.";
         case "failed":
           return inPortal(portal, `It stopped at "${r.failedAt ?? "a step"}".${r.reason === null ? "" : ` ${r.reason}`}`, r.reason === null ? "See why" : "See it");
         case "stopped":
@@ -7194,7 +7236,7 @@ function progressHint(r, portal, answerable = false) {
     case "unauthorized":
       return inPortal(portal, "Published, but the portal did not accept this sign-in (run publisher login).", "Follow it");
     case "forbidden":
-      return inPortal(portal, "Published, but the portal would not show this sign-in the run.", "Follow it");
+      return inPortal(portal, r.say === null ? "Published, but the portal would not show this sign-in the run." : `Published. ${r.say}`, "Follow it");
     case "malformed":
       return inPortal(portal, `Published, but the portal's answer about the run could not be read (${r.detail}).`, "Follow it");
   }
@@ -7743,6 +7785,23 @@ async function linkFolder(inv, p, endpoint, dir, attach) {
   };
 }
 
+// src/moved.ts
+var Moved = class {
+  /**
+   * The sentence for a refusal or a rejection with `code`, or null when it is not a move. `details`
+   * names the new repository only when the service showed it to this sign-in, and then the sentence
+   * gives the command that brings it into a new folder.
+   */
+  static hint(code, details) {
+    if (code !== "REPOSITORY_MOVED") {
+      return null;
+    }
+    const movedTo = details?.["movedTo"];
+    const next = typeof movedTo === "string" ? `then run publisher checkout <new folder> --repo ${movedTo}` : "then run publisher list to find it there";
+    return `This app moved to another organization. Sign in again with publisher login, choose that organization, ${next}.`;
+  }
+};
+
 // src/commands/publication.ts
 var publish2 = {
   git: true,
@@ -7763,6 +7822,7 @@ var publish2 = {
   }
 };
 function published(inv, o) {
+  const hint = o.rejection === null ? null : Moved.hint(o.rejection.code, o.rejection.details);
   inv.out({
     state: o.state,
     publicationId: o.publicationId,
@@ -7771,7 +7831,8 @@ function published(inv, o) {
     refs: o.refs,
     rejection: o.rejection,
     resumed: o.resumed,
-    ...o.next === null ? {} : { next: o.next }
+    ...o.next === null ? {} : { next: o.next },
+    ...hint === null ? {} : { hint }
   });
   return exitFor(o.state);
 }
@@ -7941,13 +8002,16 @@ function shown(portal, r) {
       return { kind: "view", portal, preparation, questions, hint: hintFor(r.view) };
     }
     case "no-application":
-      throw new PublisherError("NOT_FOUND", "this repository has no application in your organisation yet; publish it first");
+      throw new PublisherError("NOT_FOUND", "this repository has no application in your organization yet; publish it first");
     case "moved-on":
       throw new PublisherError("UNAVAILABLE", "the preparation moved on before the answer arrived; run publisher question again", { retryable: true });
     case "unauthorized":
       throw new PublisherError("UNAUTHORIZED", "the portal did not accept this sign-in; run publisher login");
     case "forbidden":
-      throw new PublisherError("FORBIDDEN", "the portal will not let this sign-in answer for this organisation (an owner or admin can)");
+      throw new PublisherError(
+        "FORBIDDEN",
+        r.say ?? "the portal will not let this sign-in answer for this organization (an owner or admin can, or the app's creator for the first preparation after an adoption)"
+      );
     case "unavailable":
       throw new PublisherError("UNAVAILABLE", `the portal could not be asked: ${r.detail}`, { retryable: true });
     case "malformed":
@@ -8030,7 +8094,7 @@ async function creatorTool(p, endpoint, tool, args, opts = {}) {
     case "unauthorized":
       throw new PublisherError("UNAUTHORIZED", "the portal did not accept this sign-in; run publisher login");
     case "forbidden":
-      throw new PublisherError("FORBIDDEN", "the portal will not let this sign-in do that in this organisation");
+      throw new PublisherError("FORBIDDEN", result.say ?? "the portal will not let this sign-in do that in this organization");
     case "unavailable":
       throw new PublisherError("UNAVAILABLE", `the portal could not be asked: ${result.detail}`, { retryable: true });
     case "malformed":
@@ -8118,7 +8182,7 @@ var share = {
   async run(inv) {
     const access2 = inv.cmd[1];
     if (access2 === void 0) {
-      throw new PublisherError("INVALID_REQUEST", "share takes organisation, invited or anyone-with-link");
+      throw new PublisherError("INVALID_REQUEST", "share takes organization, invited or anyone-with-link");
     }
     const { dir, app } = await folderApp(inv);
     return run(inv, dir, "share_app", { app, access: access2, add: listFlag(inv, "add"), remove: listFlag(inv, "remove") });
@@ -8205,7 +8269,7 @@ function outcome(r) {
       rejection: o.rejection,
       ...o.next === null ? {} : { next: o.next }
     },
-    hint: syncHint(r.state, r.reconciled.before.conflicts, r.marked)
+    hint: (o?.rejection ? Moved.hint(o.rejection.code, o.rejection.details) : null) ?? syncHint(r.state, r.reconciled.before.conflicts, r.marked)
   };
 }
 function syncHint(state, conflicts, marked) {
@@ -8294,11 +8358,13 @@ var EXIT_CODE = {
   NOT_FOUND: 1,
   METHOD_NOT_ALLOWED: 1,
   REF_FORBIDDEN: 1,
-  ORGANISATION_REQUIRED: 1,
+  ORGANIZATION_REQUIRED: 1,
   APPLICATION_REQUIRED: 1,
   REPOSITORY_NOT_FOUND: 1,
   REPOSITORY_CONFLICT: 1,
   REPOSITORY_ARCHIVED: 1,
+  REPOSITORY_MOVED: 1,
+  REPOSITORY_NOT_IN_ORGANIZATION: 1,
   ACCESS_CONFLICT: 1,
   PUBLICATION_NOT_FOUND: 1,
   NOTHING_CHANGED: 1,
@@ -8319,7 +8385,7 @@ var EXIT_CODE = {
   INVALID_TARGET: 1,
   EXPIRED: 1,
   INTERNAL: 1,
-  CANCELLED: 1,
+  CANCELED: 1,
   LOCAL_STATE: 1,
   GIT: 1
 };
@@ -8487,7 +8553,8 @@ Usage:
   publisher follow [dir] --publication <id>             follow an accepted publication's run where a sync left it
       [--timeout <seconds>] [--until-change]            --until-change (sync too): return at the next step, to tell it
   publisher question [dir] [--repo <id>]                the question the app's preparation waits on, if any,
-                                                        with each option's value (answering needs owner or admin)
+                                                        with each option's value (an owner or admin answers it, or
+                                                        the app's creator for the first one after an adoption)
   publisher answer <question>=<value>... [--repo <id>]  answer it from this folder; a value that is not one of
                                                         the question's options is refused before anything is sent
   publisher retry [dir] [--repo <id>]                   try the app's newest version again, when it did not go
@@ -8499,14 +8566,14 @@ Usage:
                                                         (the data and who can open the app stay as they are)
   publisher suggestions                                 what colleagues suggested for this folder's app, still open
   publisher suggestion done|decline <id> [--run <id>]   close one; sync --answers <id> closes it with that publication
-  publisher share organisation|invited|anyone-with-link [--add <emails>] [--remove <emails>]
+  publisher share organization|invited|anyone-with-link [--add <emails>] [--remove <emails>]
                                                         who can open this folder's app; new invitees get the link by mail
   publisher columns [<id>]                              the column names of connected data, for the code that reads it;
                                                         its first rows only to an owner or admin who allowed that
   publisher data add <sheet link> [--app <app>] [--name <name>]
                                                         connect a Google sheet anyone with the link can view, and
                                                         turn it on for that app (an app you made, or any as owner or admin)
-  publisher data remove <id> --app <app>                that app stops using that data; the organisation keeps it
+  publisher data remove <id> --app <app>                that app stops using that data; the organization keeps it
   publisher merge-check [dir] --ours <ref> --theirs <ref> [--apply]
   publisher info [dir]                                   repository state as seen by the server
   publisher doctor                                       environment check (node, git, credentials, association)
@@ -8600,9 +8667,11 @@ main(process.argv.slice(2)).then(
   (e) => {
     const json = process.argv.includes("--json");
     if (e instanceof PublisherError) {
-      const payload = { error: { code: e.code, message: e.message, retryable: e.retryable, details: e.details ?? null } };
+      const moved = Moved.hint(e.code, e.details);
+      const payload = { error: { code: e.code, message: e.message, retryable: e.retryable, details: e.details ?? null }, ...moved === null ? {} : { hint: moved } };
       const hint = e.code === "NETWORK" ? `
-  if this folder's service moved, "publisher doctor" says where to` : "";
+  if this folder's service moved, "publisher doctor" says where to` : moved === null ? "" : `
+  ${moved}`;
       process.stdout.write((json ? JSON.stringify(payload) : `error [${e.code}]: ${e.message}${hint}`) + "\n");
       process.exit(exitCodeFor(e.code));
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minnovate/shadow-publisher",
-  "version": "0.15.2",
+  "version": "0.17.0",
   "description": "publisher: publish an app's Git history to the serverless Git backend",
   "license": "Apache-2.0",
   "type": "module",